Function at 0x433d1d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2c
mov eax, 0x483b83
call fcn.004602d6
mov ebx, ecx
and dword [ebp - 4], 0
push 0x492864
lea ecx, [ebp + 8]
call fcn.004033a8
mov esi, 0x488c50
test eax, eax
jne 0x433e36
mov edi, 0x4b1b58
push 0x49285c
mov ecx, edi
call fcn.004033a8
test eax, eax
je 0x433d72
push 0x492860
mov ecx, edi
call fcn.004033a8
test eax, eax
jne 0x4340c3
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
mov byte [ebp - 4], 1
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
mov byte [ebp - 4], 2
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..NET_2.0
mov byte [ebp - 4], 3
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4893bc
mov byte [ebp - 4], 4
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 5
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push esi
mov byte [ebp - 4], 6
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.dotnet
mov byte [ebp - 4], 7
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 8
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 9
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
mov byte [ebp - 4], 0xa
push str.http:__download.microsoft.com_download_5_6_7_567758a3_759e_473e_bf8f_52154438565a_dotnetfx.exe
jmp 0x4340b3
push 0x492860
lea ecx, [ebp + 8]
call fcn.004033a8
test eax, eax
jne 0x4340c3
push 0x49285c
mov ecx, 0x4b1b58
call fcn.004033a8
test eax, eax
jne 0x433fe7
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0xb
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0xc
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1
mov byte [ebp - 4], 0xd
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edi, 0x4893bc
push edi
mov byte [ebp - 4], 0xe
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0xf
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x10
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet
mov byte [ebp - 4], 0x11
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 0x12
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 0x13
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_a_a_c_aac39226_8825_44ce_90e3_bf8203e74006_dotnetfx.exe
mov byte [ebp - 4], 0x14
call fcn.00404279
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00433b34
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x15
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x16
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x17
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x19
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x1a
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x1b
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4933a4
mov byte [ebp - 4], 0x1c
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x1d
call fcn.00404279
mov byte [ebp - 4], 0x1e
jmp 0x4340a8
call fcn.0042d6a4
test al, al
je 0x4340c3
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x1f
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x20
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x21
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x4893bc
mov byte [ebp - 4], 0x22
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x23
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x24
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x25
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4933a4
mov byte [ebp - 4], 0x26
call fcn.00404279
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x27
call fcn.00404279
mov byte [ebp - 4], 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_8_b_4_8b4addd8_e957_4dea_bdb8_c4e00af5b94b_NDP1.1sp1_KB867460_X86.exe
call fcn.00404279
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00433b34
push esi
lea ecx, [ebp + 8]
call fcn.004033a8
test eax, eax
je 0x4340ee
push dword [ebp + 8]
mov esi, 0x4b1b58
mov ecx, esi
call fcn.004033a8
test eax, eax
je 0x4340ee
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004039fe
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401240
call fcn.004603ae
ret 4