Function at 0x4011b9
Capabilities:
Create process on windows
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
push 4
lea eax, [esp + 0x2c]
push eax
push ecx
xor ebx, ebx
push 0x4031a4
mov dword [esp + 0x38], ebx
call fcn.00401112
xor edi, edi
add esp, 0x10
inc edi
test al, al
je 0x4011fc
cmp dword [esp + 0x28], edi
jne 0x4011fc
sub esp, 0x10
call section..text
add esp, 0x10
test al, al
jne 0x40121f
push 0x14
push str.Get_Article_Pro
push str.This_application_requires_.NET_Framework_v4___r_n_r_nDo_you_want_to_install_this_.NET_Framework_version_now_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 6
je 0x4014ea
dec eax
je 0x4014fb
push 2
push ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x2c]
push eax
push 0x403464
push 0x403454
call dword [sym.imp.mscoree.dll_CLRCreateInstance]
mov esi, eax
test esi, esi
jns 0x40125e
mov ecx, 0x40327c
push dword [ebp + 8]
mov edx, esi
call fcn.00401512
pop ecx
mov eax, esi
jmp 0x4014fe
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
push edx
push 0x403444
mov dword [esp + 0x24], ebx
mov ecx, dword [eax]
push 0x403290
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jns 0x401288
mov ecx, str.MetaHost__GetRuntime
jmp 0x40124c
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x34]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x28]
test eax, eax
js 0x4014e0
cmp dword [esp + 0x34], ebx
je 0x4014e0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0x403434
mov dword [esp + 0x28], ebx
mov ecx, dword [eax]
push 0x403424
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x4012df
mov ecx, str.RuntimeInfo__GetInterface
push dword [ebp + 8]
mov edx, eax
call fcn.00401512
pop ecx
jmp 0x4014fb
mov eax, dword [esp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x4012f4
mov ecx, str.RuntimeHost__Start
jmp 0x4012cf
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x34]
test eax, eax
jns 0x401323
push dword [ebp + 8]
mov edx, eax
mov ecx, str.RuntimeHost__GetDefaultDomain
call fcn.00401512
pop ecx
or ebx, 0xffffffff
jmp 0x4014ce
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], ebx
test eax, eax
je 0x401507
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
mov ecx, dword [eax]
push 0x403414
push eax
call dword [ecx]
test eax, eax
jns 0x401362
push dword [ebp + 8]
mov edx, eax
mov ecx, str.AppDomainThunk__QueryInterface
call fcn.00401512
pop ecx
or ebx, 0xffffffff
jmp 0x4014c0
lea eax, [esp + 0x38]
push eax
push edi
mov esi, 0x1a000
push 0x11
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov edi, eax
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jns 0x40139e
mov ecx, str.SafeArrayAccessData
jmp 0x4013f8
push esi
push 0x404060
push dword [esp + 0x38]
call sub.MSVCR110.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jns 0x4013c2
mov ecx, str.SafeArrayUnaccessData
jmp 0x4013f8
mov esi, dword [esp + 0x18]
test esi, esi
je 0x401507
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4013dc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xb4]
test eax, eax
jns 0x40140b
mov ecx, str.DefaultAppDomain__Load_3
push dword [ebp + 8]
mov edx, eax
call fcn.00401512
pop ecx
or ebx, 0xffffffff
jmp 0x4014b2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
test eax, eax
je 0x401507
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
jns 0x401435
mov ecx, str.Assembly__get_EntryPoint
jmp 0x40148e
xor eax, eax
lea edi, [esp + 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
xor eax, eax
push ebx
inc eax
push 0xc
mov word [esp + 0x4c], ax
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov ecx, dword [esp + 0x14]
mov edx, eax
test ecx, ecx
je 0x401507
mov eax, dword [ecx]
lea esi, [esp + 0x50]
push esi
push edx
sub esp, 0x10
mov edi, esp
lea esi, [esp + 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
call dword [eax + 0x94]
test eax, eax
jns 0x40149e
mov ecx, str.MethodInfo__Invoke_3
push dword [ebp + 8]
mov edx, eax
call fcn.00401512
pop ecx
or ebx, 0xffffffff
jmp 0x4014a4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4014b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4014c0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4014ce
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4014dc
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, ebx
jmp 0x4014fe
mov ecx, str.RuntimeInfo__IsLoadable
jmp 0x4012cf
push 0xa
push ebx
push ebx
push str.https:__www.microsoft.com_en_us_download_details.aspx_id17718
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004003
call fcn.00401760
int3