Function at 0x4387c2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2c
mov eax, 0x488fcd
call fcn.00464d37
mov ebx, ecx
and dword [ebp - 4], 0
push 0x4998ec
lea ecx, [ebp + 8]
call fcn.00403366
mov esi, 0x48ed6c
test eax, eax
jne 0x4388db
mov edi, 0x4b9f4c
push 0x4998e4
mov ecx, edi
call fcn.00403366
test eax, eax
je 0x438817
push 0x4998e8
mov ecx, edi
call fcn.00403366
test eax, eax
jne 0x438b68
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
mov byte [ebp - 4], 1
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
mov byte [ebp - 4], 2
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..NET_2.0
mov byte [ebp - 4], 3
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.true
mov byte [ebp - 4], 4
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 5
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push esi
mov byte [ebp - 4], 6
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.dotnet
mov byte [ebp - 4], 7
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 8
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 9
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
mov byte [ebp - 4], 0xa
push str.http:__download.microsoft.com_download_5_6_7_567758a3_759e_473e_bf8f_52154438565a_dotnetfx.exe
jmp 0x438b58
push 0x4998e8
lea ecx, [ebp + 8]
call fcn.00403366
test eax, eax
jne 0x438b68
push 0x4998e4
mov ecx, 0x4b9f4c
call fcn.00403366
test eax, eax
jne 0x438a8c
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0xb
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0xc
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1
mov byte [ebp - 4], 0xd
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edi, str.true
push edi
mov byte [ebp - 4], 0xe
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0xf
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x10
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet
mov byte [ebp - 4], 0x11
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 0x12
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 0x13
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_a_a_c_aac39226_8825_44ce_90e3_bf8203e74006_dotnetfx.exe
mov byte [ebp - 4], 0x14
call fcn.00404237
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00438480
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x15
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x16
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x17
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x19
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x1a
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x1b
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x49a5c4
mov byte [ebp - 4], 0x1c
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x1d
call fcn.00404237
mov byte [ebp - 4], 0x1e
jmp 0x438b4d
call fcn.00431083
test al, al
je 0x438b68
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x1f
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x20
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x21
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.true
mov byte [ebp - 4], 0x22
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x23
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x24
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x25
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x49a5c4
mov byte [ebp - 4], 0x26
call fcn.00404237
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x27
call fcn.00404237
mov byte [ebp - 4], 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_8_b_4_8b4addd8_e957_4dea_bdb8_c4e00af5b94b_NDP1.1sp1_KB867460_X86.exe
call fcn.00404237
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00438480
push esi
lea ecx, [ebp + 8]
call fcn.00403366
test eax, eax
je 0x438b93
push dword [ebp + 8]
mov esi, 0x4b9f4c
mov ecx, esi
call fcn.00403366
test eax, eax
je 0x438b93
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00403ae1
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401000
call fcn.00464e0f
ret 4