The [firewall and IPS] products are converging, but generally an IPS is better at deep packet inspection and a firewall is better at pretty much everything else (they've been around a long time and are more mature).

Specifically to the ASA, an ASA without the AIP-SSM (the IPS module) has deep packet inspection capabilities, but doesn't have thousands of built-in signatures, with new ones added as new vulnerabilities surface. It doesn't by default protect you from most application layer attacks.

For example, here's how you can configure the ASA to defend against the "Microsoft Snapshot Viewer ActiveX Control Arbitrary File Upload Vulnerability".

http://tools.cisco.com/security/center/viewAlert.x?alertId=16224

Unless you manually do this, you won't have protection. If you have the IPS module, a signature update was released the same day and you're automatically protected:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=6968&signatureSubId=0&softwareVersion=6.0&releaseVersion=S343