Function at 0x472fc3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4203
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
mov eax, dword [0x524330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x208], ecx
and dword [ebp - 4], 0
push 0x4ff1f4
lea ecx, [ebp + 8]
call fcn.00403419
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x473174
push 0x4ff1f8
mov ecx, 0x5260b4
call fcn.00403419
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
jne 0x47304c
push 0x4ff1fc
mov ecx, 0x5260b4
call fcn.00403419
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x47316f
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x4fefbf
call fcn.00403241
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x4fefc9
call fcn.00403241
mov dword [ebp - 0x210], eax
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4fefca
call fcn.00403241
mov dword [ebp - 0x214], eax
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..NET_2.0
call fcn.00403241
mov dword [ebp - 0x218], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4ff20c
call fcn.00403241
mov dword [ebp - 0x21c], eax
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x4fefcb
call fcn.00403241
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 6
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x4fefd1
call fcn.00403241
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x4ff214
call fcn.00403241
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 8
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x4ff21c
call fcn.00403241
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 9
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0x4ff234
call fcn.00403241
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.http:__download.microsoft.com_download_5_6_7_567758a3_759e_473e_bf8f_52154438565a_dotnetfx.exe
call fcn.00403241
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x208]
call fcn.00476dbc
jmp 0x47355b
push 0x4ff2a8
lea ecx, [ebp + 8]
call fcn.00403419
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x47355b
push 0x4ff2ac
mov ecx, 0x5260b4
call fcn.00403419
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x473407
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0x4fefd2
call fcn.00403241
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push 0x4fefd3
call fcn.00403241
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4fefe1
call fcn.00403241
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x48], esp
push str..NET_1.1
call fcn.00403241
mov dword [ebp - 0x240], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x4ff2bc
call fcn.00403241
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push 0x4fefe2
call fcn.00403241
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push 0x4fefe3
call fcn.00403241
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.dotnet
call fcn.00403241
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str._q:a__c:_install__l__q_
call fcn.00403241
mov dword [ebp - 0x254], eax
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.dotnetfx.exe
call fcn.00403241
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push str.http:__download.microsoft.com_download_a_a_c_aac39226_8825_44ce_90e3_bf8203e74006_dotnetfx.exe
call fcn.00403241
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x208]
call fcn.00476dbc
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x4fefeb
call fcn.00403241
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
push 0x4feff5
call fcn.00403241
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x70], esp
push 0x4feff6
call fcn.00403241
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x74], esp
push 0x4ff358
call fcn.00403241
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x78], esp
push 0x4ff368
call fcn.00403241
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x7c], esp
push 0x4feff7
call fcn.00403241
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x80], esp
push 0x4ff002
call fcn.00403241
mov dword [ebp - 0x274], eax
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0x84], esp
push 0x4ff370
call fcn.00403241
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, esp
mov dword [ebp - 0x88], esp
push 0x4ff37c
call fcn.00403241
mov dword [ebp - 0x27c], eax
mov byte [ebp - 4], 0x1d
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push 0x4ff380
call fcn.00403241
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 0x1e
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push 0x4ff3a0
call fcn.00403241
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x208]
call fcn.00476dbc
jmp 0x47355b
call fcn.0046d769
movzx eax, al
test eax, eax
je 0x47355b
push ecx
mov ecx, esp
mov dword [ebp - 0x94], esp
push 0x4ff003
call fcn.00403241
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, esp
mov dword [ebp - 0x98], esp
push 0x4ff013
call fcn.00403241
mov dword [ebp - 0x288], eax
mov byte [ebp - 4], 0x20
push ecx
mov ecx, esp
mov dword [ebp - 0x9c], esp
push 0x4ff01a
call fcn.00403241
mov dword [ebp - 0x28c], eax
mov byte [ebp - 4], 0x21
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], esp
push str..NET_1.1_SP1
call fcn.00403241
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 0x22
push ecx
mov ecx, esp
mov dword [ebp - 0xa4], esp
push 0x4ff420
call fcn.00403241
mov dword [ebp - 0x294], eax
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 0x4ff01b
call fcn.00403241
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 0x24
push ecx
mov ecx, esp
mov dword [ebp - 0xac], esp
push 0x4ff01e
call fcn.00403241
mov dword [ebp - 0x29c], eax
mov byte [ebp - 4], 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0xb0], esp
push str.dotnet_sp1
call fcn.00403241
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0xb4], esp
push 0x4ff434
call fcn.00403241
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 4], 0x27
push ecx
mov ecx, esp
mov dword [ebp - 0xb8], esp
push str.NDP1.1sp1_KB867460_X86.exe
call fcn.00403241
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 4], 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0xbc], esp
push str.http:__download.microsoft.com_download_8_b_4_8b4addd8_e957_4dea_bdb8_c4e00af5b94b_NDP1.1sp1_KB867460_X86.exe
call fcn.00403241
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x208]
call fcn.00476dbc
push 0x4ff01f
lea ecx, [ebp + 8]
call fcn.00403419
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x4735a9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x200], eax
push dword [ebp - 0x200]
mov ecx, 0x5260b4
call fcn.00403419
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x4735a9
lea eax, [ebp + 8]
push eax
mov ecx, 0x5260b4
call fcn.00448f0e
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
call fcn.0040110c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret 4