Function at 0x427310
Capabilities:
Accept command line arguments
Create directory
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x47a42c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push str.GlobalFC_B60363C3_6441_4097_A852_FC3D6F13D4F1
push 0
push 1
push 0
mov dword [ebp - 0x248], esi
call fcn.00414380
push str.6.0.9.0277
push str.WinMain
push str._ws____my_version_is__hs
mov dword [0x47bc6c], eax
call fcn.00420880
add esp, 0x1c
call fcn.00416480
mov eax, dword [ebp + 8]
mov dword [0x47c094], eax
lea eax, [ebp - 0x22c]
push eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
mov ebx, eax
cmp dword [ebp - 0x22c], edi
jle 0x427801
lea ecx, [edi + 0x2f]
mov eax, dword [ebx + edi*4]
cmp word [eax], 0x2d
jne 0x4273c3
mov word [eax], cx
push str._log
push dword [ebx + edi*4]
lea esi, [edi + 1]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x427412
cmp esi, dword [ebp - 0x22c]
jge 0x427412
mov edx, dword [ebx + edi*4 + 4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4273f0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, 0x479b24
call fcn.0040cfe0
mov edi, esi
jmp 0x4277e9
push str._schid
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x42744f
cmp esi, dword [ebp - 0x22c]
jge 0x42744f
mov edi, esi
push dword [ebx + edi*4]
call fcn.0043a803
add esp, 4
mov dword [0x47bc54], eax
mov dword [0x47bc5c], 1
jmp 0x4277e9
push str._deviceid
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x42748c
cmp esi, dword [ebp - 0x22c]
jge 0x42748c
mov edi, esi
push dword [ebx + edi*4]
call fcn.0043a803
add esp, 4
mov dword [0x47bc50], eax
mov dword [0x47bc5c], 1
jmp 0x4277e9
push str._emsserver
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x4274dc
cmp esi, dword [ebp - 0x22c]
jge 0x4274dc
mov edi, esi
mov edx, dword [ebx + edi*4]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4274b2
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x479b0c
call fcn.0040cfe0
mov dword [0x47bc5c], 1
jmp 0x4277e9
push str._winsrvc
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x4274ff
mov dword [ebp - 0x244], 1
jmp 0x4277e9
push str._schinst
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x427522
mov dword [ebp - 0x240], 1
jmp 0x4277e9
push 0x462b58
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
je 0x4277df
push str._schforcerebootdlg
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
je 0x4277df
push 0x462ba8
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
je 0x42757a
push str._rebootwhenneeded
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x427599
cmp esi, dword [ebp - 0x22c]
jge 0x427599
mov edi, esi
push dword [ebx + edi*4]
call fcn.0043a803
add esp, 4
mov dword [0x479aec], eax
jmp 0x4277e9
push 0x462bf0
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
je 0x4275c1
push str._autoreboot0users
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x4275e0
cmp esi, dword [ebp - 0x22c]
jge 0x4275e0
push dword [ebx + esi*4]
mov edi, esi
call fcn.0043a803
add esp, 4
mov dword [0x479af0], eax
jmp 0x4277e9
push 0x462c38
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
je 0x427608
push str._rebootpromptusers
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x427627
cmp esi, dword [ebp - 0x22c]
jge 0x427627
push dword [ebx + esi*4]
mov edi, esi
call fcn.0043a803
add esp, 4
mov dword [0x47bc68], eax
jmp 0x4277e9
push str._schstart
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x4277bf
mov dword [0x47bc64], 1
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
cmp esi, dword [ebp - 0x22c]
jge 0x427694
mov eax, dword [ebx + edi*4 + 4]
movzx eax, word [eax]
push eax
call fcn.0043b5f3
add esp, 4
test eax, eax
je 0x427694
push dword [ebx + edi*4 + 4]
lea ecx, [ebp - 0x228]
call fcn.0040efe0
mov edi, esi
mov ecx, str._ws____received_sch_start_time___ws
jmp 0x4276a9
push str.20:00
lea ecx, [ebp - 0x228]
call fcn.0040efe0
mov ecx, str._ws____no_sch_start_time_is_specified__use_default_one___ws
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
push str.WinMain
push ecx
call fcn.00420880
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0
push ecx
lea eax, [ebp - 0x228]
mov dword [ebp - 0x234], 0
cmovae eax, dword [ebp - 0x228]
push str._d:_d
push eax
call fcn.00427ee0
add esp, 0x1c
cmp eax, 2
jne 0x42779c
cmp dword [ebp - 0x23c], 0x17
ja 0x42779c
cmp dword [ebp - 0x234], 0x3b
ja 0x42779c
push 0
call fcn.0043b694
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push eax
call fcn.0043cc66
mov ecx, dword [ebp - 0x23c]
push eax
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x234]
mov dword [eax + 4], ecx
mov dword [eax], 0
call fcn.0043d42f
add esp, 0xc
mov dword [ebp - 0x230], eax
test eax, eax
jne 0x42777c
push dword [ebx + edi*4 + 4]
push str.WinMain
push str._ws____failed_to_convert_time_received_from_args___ws
jmp 0x4277aa
cmp eax, dword [ebp - 0x238]
jg 0x4277b2
add eax, 0x15180
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x230], eax
call fcn.0040c360
jmp 0x4277e9
push dword [ebx + edi*4 + 4]
push str.WinMain
push str._ws____invalid_schedule_time_received_from_args___ws
call fcn.00420880
add esp, 0xc
lea ecx, [ebp - 0x228]
call fcn.0040c360
jmp 0x4277e9
push str._uninstallfamily
push dword [ebx + edi*4]
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x4277e9
mov dword [0x47bc58], 1
jmp 0x4277e9
mov dword [0x47bc68], 1
inc edi
mov ecx, 0x2f
cmp edi, dword [ebp - 0x22c]
jl 0x4273b7
mov esi, dword [ebp - 0x248]
cmp dword [0x47bc5c], 0
je 0x4278d0
push dword [0x47bc54]
call fcn.004170f0
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042b800
add esp, 0x10
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427850
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, 0x479b24
call fcn.0040cfe0
push 0x18
push str.FortiEMSInstaller_logs_
mov ecx, 0x479b24
call fcn.00413c10
cmp dword [0x479b38], 8
mov eax, 0x479b24
cmovae eax, dword [0x479b24]
push eax
call fcn.0043b2c1
add esp, 4
mov ecx, 0x479b24
push 0x11
push str.fctinstalllog.log
call fcn.00413c10
cmp dword [0x479b38], 8
mov eax, 0x479b24
cmovae eax, dword [0x479b24]
push eax
push str.Log_path_is__s
call fcn.00420880
add esp, 8
push esi
push str.WinMain
push str._ws____cmdline_hs
call fcn.00420880
add esp, 0xc
cmp dword [0x479b34], 0
je 0x427951
cmp dword [0x479b38], 8
mov eax, 0x479b24
push 0
cmovae eax, dword [0x479b24]
push 0x80
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x427951
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xa00000
jbe 0x427951
cmp dword [0x479b38], 8
mov eax, 0x479b24
cmovae eax, dword [0x479b24]
push eax
call fcn.0043b3eb
add esp, 4
push 0x104
push 0x47bc70
push 6
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [0x47bc70], si
jne 0x427a2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckInstallerGUIDRegistry
push str._ws____failed_to_load_GUID_from_string_res__err_d
call fcn.00420880
add esp, 0xc
cmp dword [0x47bc5c], 0
je 0x427bbd
cmp word [0x47bc70], 0
jne 0x427bbd
push str.WinMain
push str._ws____Warning:_no_installer_UID_is_detected_in_this_exe_file
call fcn.00420880
add esp, 8
cmp dword [0x47bc58], 0
jne 0x427bbd
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0
push eax
call fcn.0041d310
add esp, 4
test eax, eax
je 0x427bbd
cmp dword [ebp - 0x238], 0
je 0x427bbd
push str.WinMain
push str._ws____Another_instance_of_FCT_has_been_installed__nothing_will_be_changed.
call fcn.00420880
push 1
push 0
push 0
push 0x140
call fcn.00422af0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret 0x10
push 0x462358
push 0x47bc70
call fcn.0043affb
add esp, 8
test eax, eax
jne 0x427a67
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckInstallerGUIDRegistry
push str._ws____my_GUID_is_the_default_value_from_offical_installer
call fcn.00420880
add esp, 0xc
xor eax, eax
mov word [0x47bc70], ax
jmp 0x42798c
push str.softwareFortinetFortiClientFA_ESNAC
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00413810
mov edi, eax
add esp, 8
test edi, edi
jne 0x427a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckInstallerGUIDRegistry
push str._ws____failed_to_open_ESNAC_registry_key__err_d
jmp 0x427984
push 0
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], esi
push eax
push str.installation_uid
push edi
call fcn.00413d90
mov eax, dword [ebp - 0x234]
add esp, 0x10
test eax, eax
je 0x427b0d
push 0xffffffffffffffff
push eax
push 0x105
push 0x47be80
call fcn.0043d175
push dword [ebp - 0x234]
call fcn.004136e0
push 0x47be80
push 0x47bc70
push str.CheckInstallerGUIDRegistry
push str._ws____szInstallerGUID_ThisExe_s__szInstallerGUID_Installed_s
call fcn.00420880
push 0x47bc70
push 0x47be80
call fcn.0043affb
add esp, 0x2c
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x427b26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CheckInstallerGUIDRegistry
push str._ws____failed_to_read_registry_value__err_d
call fcn.00420880
add esp, 0xc
push edi
call fcn.00413610
add esp, 4
test esi, esi
je 0x42798c
cmp dword [0x47bc58], 0
jne 0x42798c
push str.WinMain
push str._ws____this_installer_has_same_GUID_with_installed_one__dont_do_anything
call fcn.00420880
push 1
push 0
push 0
push 0x140
call fcn.00422af0
add esp, 0x18
cmp dword [0x47bc5c], 0
je 0x427e85
push 0
call fcn.004172a0
push str.FortiClientInstallerService
call fcn.004174d0
add esp, 8
test eax, eax
je 0x427e85
push 0xffffffffffffffff
push str.FortiClientInstallerService
call fcn.00417f10
push str.FortiClientInstallerService
call fcn.004176d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret 0x10
push str.E608B543_C77D_4302_9D0D_613D9D92A2AA
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
test ax, ax
je 0x427be6
push str.WinMain
push str._ws____REBOOT_ATOM_is_detected__set_the_system_wide_registry_flag__so_it_can_be_detected_in_local_system
call fcn.00420880
push 2
call fcn.00412e30
add esp, 0xc
cmp dword [0x47bc5c], 0
je 0x427cc2
cmp dword [0x47bc64], 0
je 0x427c8c
push 0
call fcn.0041d310
add esp, 4
test eax, eax
jne 0x427c8c
push str.WinMain
push str._ws____this_is_a_scheduled_deployment__but_no_existing_FCT_was_detected_on_target_machine
call fcn.00420880
add esp, 8
mov esi, 1
cmp dword [ebp - 0x240], 0
je 0x427c42
push str.WinMain
push str._ws____bSchFreshInst_is_TRUE__force_the_schedule__even_on_a_fresh_installation
xor esi, esi
call fcn.00420880
add esp, 8
call fcn.00412dc0
cmp eax, 2
je 0x427c7a
cmp eax, 3
je 0x427c7a
test esi, esi
je 0x427c8c
push str.WinMain
push str._ws____skip_the_schedule
call fcn.00420880
mov dword [0x47bc64], 0
mov dword [ebp - 0x230], 0
jmp 0x427c89
push str.WinMain
push str._ws____reboot_request_is_detected__previous_setup_was_not_finished__continue_the_setup_at_scheduled_time
call fcn.00420880
add esp, 8
cmp dword [0x47bc5c], 0
je 0x427cc2
call fcn.00416c40
test eax, eax
je 0x427cc2
push str.WinMain
push str._ws____rebooted_flag_was_set
call fcn.00420880
push 1
push 0
push 0
push 0x12c
call fcn.00422af0
add esp, 0x18
jmp 0x427cd4
push str.WinMain
push str._ws____rebooted_flag_was_not_set
call fcn.00420880
add esp, 8
cmp dword [ebp - 0x244], 0
je 0x427d09
push str.WinMain
push str._ws____run_in_windows_service_mode
call fcn.00420880
add esp, 8
call fcn.00417750
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x47bc5c], 0
je 0x427e9a
push str.WinMain
push str._ws____deployed_by_EMS__create_service_now
call fcn.00420880
add esp, 8
cmp dword [ebp - 0x230], 0
je 0x427e05
call fcn.00416bc0
mov dword [0x47c08c], eax
test al, 5
jne 0x427df5
push dword [ebp - 0x230]
call fcn.004171d0
call fcn.00416b40
push 0x20a
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042b800
lea eax, [ebp - 0x230]
push eax
call fcn.0043cc66
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0043ca3b
lea eax, [ebp - 0x210]
push eax
push str.WinMain
push str._ws____setup_is_scheduled_to__s__sent_this_time_to_EMS
call fcn.00420880
cmp dword [0x47c2e0], 0
mov ecx, 0x168
push 1
push dword [ebp - 0x230]
mov eax, 0x15e
cmovne eax, ecx
push 0
push eax
call fcn.00422af0
mov esi, eax
add esp, 0x40
test esi, esi
jns 0x427df0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.WinMain
push str._ws____SendFailureReport___failed__ret_d__err_d
call fcn.00420880
add esp, 0x10
mov eax, dword [0x47c08c]
test al, 1
jne 0x427e17
push 0
call fcn.004172a0
add esp, 4
jmp 0x427e17
push str.WinMain
push str._ws____no_schedule_time_received_from_args
call fcn.00420880
add esp, 8
push str.FortiClientInstallerService
call fcn.004174d0
add esp, 4
test eax, eax
je 0x427e41
push 0xffffffffffffffff
push str.FortiClientInstallerService
call fcn.00417f10
push str.FortiClientInstallerService
call fcn.004176d0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push str.FortiClientInstallerService
call fcn.00417360
push 0
push str.FortiClientInstallerService
call fcn.00417e10
mov esi, eax
add esp, 0x18
test esi, esi
jns 0x427e85
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.WinMain
push str._ws____failed_to_start_installer_schedule_service__ret_d__err_d
call fcn.00420880
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a27
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.0041daf0
mov ecx, dword [0x47bc6c]
add esp, 4
mov esi, eax
test ecx, ecx
je 0x427ec8
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0x47bc6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a27
mov esp, ebp
pop ebp
ret 0x10