Function at 0x435cbb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x2c
mov eax, 0x4860db
call fcn.00462276
mov ebx, ecx
and dword [ebp - 4], 0
push 0x49606c
lea ecx, [ebp + 8]
call fcn.0040335d
mov esi, 0x48bc70
test eax, eax
jne 0x435dd4
mov edi, 0x4b5b68
push 0x496064
mov ecx, edi
call fcn.0040335d
test eax, eax
je 0x435d10
push 0x496068
mov ecx, edi
call fcn.0040335d
test eax, eax
jne 0x436061
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
mov byte [ebp - 4], 1
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
mov byte [ebp - 4], 2
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..NET_2.0
mov byte [ebp - 4], 3
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x48c3dc
mov byte [ebp - 4], 4
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 5
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push esi
mov byte [ebp - 4], 6
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.dotnet
mov byte [ebp - 4], 7
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 8
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 9
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
mov byte [ebp - 4], 0xa
push str.http:__download.microsoft.com_download_5_6_7_567758a3_759e_473e_bf8f_52154438565a_dotnetfx.exe
jmp 0x436051
push 0x496068
lea ecx, [ebp + 8]
call fcn.0040335d
test eax, eax
jne 0x436061
push 0x496064
mov ecx, 0x4b5b68
call fcn.0040335d
test eax, eax
jne 0x435f85
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0xb
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0xc
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1
mov byte [ebp - 4], 0xd
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
mov edi, 0x48c3dc
push edi
mov byte [ebp - 4], 0xe
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0xf
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x10
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet
mov byte [ebp - 4], 0x11
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str._q:a__c:_install__l__q_
mov byte [ebp - 4], 0x12
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.dotnetfx.exe
mov byte [ebp - 4], 0x13
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_a_a_c_aac39226_8825_44ce_90e3_bf8203e74006_dotnetfx.exe
mov byte [ebp - 4], 0x14
call fcn.00404253
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00434a26
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x15
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x16
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x17
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push edi
mov byte [ebp - 4], 0x18
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x19
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x1a
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x1b
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x496c54
mov byte [ebp - 4], 0x1c
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x1d
call fcn.00404253
mov byte [ebp - 4], 0x1e
jmp 0x436046
call fcn.0042ebe5
test al, al
je 0x436061
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push esi
mov byte [ebp - 4], 0x1f
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push esi
mov byte [ebp - 4], 0x20
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str..NET_1.1_SP1
mov byte [ebp - 4], 0x21
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x48c3dc
mov byte [ebp - 4], 0x22
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
mov byte [ebp - 4], 0x23
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
mov byte [ebp - 4], 0x24
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.dotnet_sp1
mov byte [ebp - 4], 0x25
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x496c54
mov byte [ebp - 4], 0x26
call fcn.00404253
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.NDP1.1sp1_KB867460_X86.exe
mov byte [ebp - 4], 0x27
call fcn.00404253
mov byte [ebp - 4], 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.http:__download.microsoft.com_download_8_b_4_8b4addd8_e957_4dea_bdb8_c4e00af5b94b_NDP1.1sp1_KB867460_X86.exe
call fcn.00404253
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.00434a26
push esi
lea ecx, [ebp + 8]
call fcn.0040335d
test eax, eax
je 0x43608c
push dword [ebp + 8]
mov esi, 0x4b5b68
mov ecx, esi
call fcn.0040335d
test eax, eax
je 0x43608c
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.004039d8
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401264
call fcn.0046234e
ret 4