Function at 0x44258d
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d1160
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x5164b0]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
push edi
mov eax, dword [0x5164b0]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
push ecx
push ecx
lea ecx, [esp + 0x24]
call fcn.00405f76
lea eax, [esp + 0x17]
xor ebx, ebx
push eax
push eax
push str.IsFengXingDllRun_V4
mov esi, str.FengXing
mov dword [esp + 0x25c], ebx
push esi
mov byte [esp + 0x27], bl
call fcn.0044cc7a
mov ecx, eax
call fcn.0044ce68
cmp byte [esp + 0x17], bl
jne 0x44260e
inc ebx
jmp 0x442bd7
lea eax, [esp + 0x17c]
push eax
call fcn.004a6040
pop ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push eax
mov edi, str.FXRLastTime
push edi
push esi
call fcn.0044cc7a
mov ecx, eax
call fcn.0044cce4
push ebx
push 0x15180
push dword [esp + 0x188]
push dword [esp + 0x188]
call fcn.004b9390
mov ecx, eax
mov eax, dword [esp + 0x18]
inc eax
cmp ecx, eax
jl 0x442bc0
push ecx
push edi
push esi
push ecx
call fcn.0044cc7a
pop ecx
mov ecx, eax
call fcn.0044d0a4
lea eax, [esp + 0x18]
mov dword [esp + 0x17c], ebx
push eax
push eax
push str.FXRunCnt
push esi
mov dword [esp + 0x28], 1
call fcn.0044cc7a
mov ecx, eax
call fcn.0044cce4
lea eax, [esp + 0x17c]
push eax
push eax
push 0x4ee54c
push esi
call fcn.0044cc7a
mov ecx, eax
call fcn.0044cce4
mov esi, dword [esp + 0x17c]
cmp esi, dword [esp + 0x18]
jl 0x4426cf
cmp dword [esp + 0x18], 0xffffffff
je 0x4426cf
push 2
jmp 0x442bd6
lea ecx, [esp + 0x228]
call fcn.00464c70
mov byte [esp + 0x250], 1
lea eax, [esp + 0x228]
cmp dword [esp + 0x23c], 0x10
cmovae eax, dword [esp + 0x228]
push eax
call fcn.004a6654
mov edi, eax
pop ecx
test edi, edi
jg 0x442727
push 3
pop ebx
push 0
push 1
lea ecx, [esp + 0x230]
mov byte [esp + 0x258], 0
call fcn.004044e5
jmp 0x442bd7
lea eax, [esp + 0x17c]
mov dword [esp + 0x17c], 0x1e
push eax
push eax
push str.RunProbability_V4
push str.FengXing
call fcn.0044cc7a
mov ecx, eax
call fcn.0044cce4
mov eax, edi
push 0x64
cdq
pop ecx
idiv ecx
cmp edx, dword [esp + 0x17c]
jl 0x442766
push 4
jmp 0x442709
push str.http:__down.koowo.com_mbox_data_plugin_20160219_20160219_FunKuwo_c8880_s.zip
lea ecx, [esp + 0x1cc]
call fcn.004041e5
mov dword [esp + 0x20c], 0xf
mov dword [esp + 0x208], ebx
mov byte [esp + 0x1f8], bl
push 0x10
pop edi
mov byte [esp + 0x250], 3
lea eax, [esp + 0x1f8]
cmp dword [esp + 0x1dc], edi
lea ecx, [esp + 0x1c8]
push 3
cmovae ecx, dword [esp + 0x1cc]
mov edx, 0x4e870e
push eax
call fcn.0044f793
pop ecx
pop ecx
test eax, eax
jne 0x44281d
cmp dword [esp + 0x1dc], edi
lea eax, [esp + 0x1c8]
cmovae eax, dword [esp + 0x1c8]
push eax
push 0x4ee330
call fcn.0044fe3d
push eax
call fcn.0044fe7b
add esp, 0xc
xor edi, edi
push 6
pop ebx
push edi
push 1
lea ecx, [esp + 0x200]
call fcn.004044e5
push edi
push 1
lea ecx, [esp + 0x1d0]
call fcn.004044e5
jmp 0x44270a
push 5
pop edx
lea ecx, [esp + 0x210]
call fcn.0045def5
push str.KwTemp_
mov edx, eax
mov byte [esp + 0x254], 4
lea ecx, [esp + 0x1e4]
call fcn.0040360e
pop ecx
push ebx
push 1
lea ecx, [esp + 0x218]
mov byte [esp + 0x258], 6
call fcn.004044e5
cmp dword [esp + 0x1f4], edi
lea eax, [esp + 0x1e0]
lea ecx, [esp + 0x1b0]
cmovae eax, dword [esp + 0x1e0]
push eax
call fcn.004041e5
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x250], 7
call fcn.0045f119
push ebx
push 1
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x258], 6
call fcn.004044e5
push 0x4e870e
lea ecx, [esp + 0x180]
call fcn.004041e5
push 8
pop ebx
mov byte [esp + 0x250], bl
lea eax, [esp + 0x1e0]
cmp dword [esp + 0x1f4], edi
lea ecx, [esp + 0x1b0]
cmovae eax, dword [esp + 0x1e0]
push eax
call fcn.004041e5
lea edx, [esp + 0x17c]
mov byte [esp + 0x250], 9
lea ecx, [esp + 0x1b0]
call fcn.0045f310
xor edi, edi
lea ecx, [esp + 0x1b0]
push edi
push 1
call fcn.004044e5
push edi
push 1
lea ecx, [esp + 0x184]
call fcn.004044e5
xor eax, eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
push ecx
lea eax, [esp + 0x180]
mov byte [esp + 0x254], 0xa
push eax
lea edx, [esp + 0x1e8]
lea ecx, [esp + 0x200]
call fcn.00455cc7
pop ecx
pop ecx
test al, al
je 0x442b82
mov eax, dword [esp + 0x17c]
cmp eax, dword [esp + 0x180]
je 0x442b82
push edi
lea ecx, [esp + 0x180]
call fcn.0040341a
push eax
lea edx, [esp + 0x1e4]
lea ecx, [esp + 0x19c]
call fcn.00443f1c
pop ecx
mov byte [esp + 0x250], 0xb
lea eax, [esp + 0x198]
cmp dword [esp + 0x1ac], 0x10
cmovae eax, dword [esp + 0x198]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x442b53
cmp dword [esp + 0x1ac], 0x10
lea eax, [esp + 0x198]
push str..exe
cmovae eax, dword [esp + 0x19c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x442b53
cmp dword [esp + 0x1ac], 0x10
lea eax, [esp + 0x198]
cmovae eax, dword [esp + 0x198]
xor ebx, ebx
push ebx
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esp + 0x1ac], 0x10
mov edi, eax
lea eax, [esp + 0x198]
cmovae eax, dword [esp + 0x198]
push edi
push eax
push str.Fx_ExcuteRet__s__ret:_d
push ecx
call fcn.0044fe3d
pop ecx
push eax
call fcn.0044fe7b
add esp, 0x10
mov dword [esp + 0x1c4], 0xf
mov dword [esp + 0x1c0], ebx
mov byte [esp + 0x1b0], bl
mov byte [esp + 0x250], 0xc
lea eax, [esp + 0x210]
push esi
test esi, esi
jle 0x442a87
push str.http:__webstat.kuwo.cn_logtjsj_commsj_commjstj_sjazb_FX_DLL_old_CLICK.jpg_rnum_d
jmp 0x442a8c
push str.http:__webstat.kuwo.cn_logtjsj_commsj_commjstj_sjazb_FX_DLL_CLICK.jpg_rnum_d
push eax
call fcn.004647ea
add esp, 0xc
lea ecx, [esp + 0x1b0]
push eax
call fcn.004033c5
push ebx
push 1
lea ecx, [esp + 0x218]
call fcn.004044e5
cmp dword [esp + 0x1c4], 0x10
lea ecx, [esp + 0x1b0]
push ebx
cmovae ecx, dword [esp + 0x1b4]
push ebx
call fcn.0044e7e1
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x258], 0xb
call fcn.004044e5
push esi
push ecx
cmp edi, 0x20
mov edx, str.Suc:
push edi
push ecx
setg al
movzx eax, al
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.0040686d
pop ecx
mov ecx, eax
call fcn.00442d43
mov edx, str.ExcuRet:
mov ecx, eax
call fcn.0040686d
pop ecx
mov ecx, eax
call fcn.00442e23
mov edx, str.run:
mov ecx, eax
call fcn.0040686d
pop ecx
mov ecx, eax
call fcn.00442e23
lea eax, [esi + 1]
push eax
push 0x4ee54c
push str.FengXing
push ecx
call fcn.0044cc7a
pop ecx
mov ecx, eax
call fcn.0044d0a4
xor edi, edi
push edi
push 1
lea ecx, [esp + 0x1a0]
call fcn.004044e5
lea ecx, [esp + 0x17c]
call fcn.00403e2c
push edi
push 1
lea ecx, [esp + 0x1e8]
call fcn.004044e5
jmp 0x4427fa
cmp dword [esp + 0x1dc], 0x10
lea eax, [esp + 0x1c8]
cmovae eax, dword [esp + 0x1c8]
push eax
push 0x4ee34c
call fcn.0044fe3d
push eax
call fcn.0044fe7b
add esp, 0xc
lea ecx, [esp + 0x17c]
push 7
pop ebx
call fcn.00403e2c
xor edi, edi
jmp 0x442b6e
push str.today_fx_already_work
push ecx
call fcn.0044fe3d
pop ecx
push eax
call fcn.0044fe7b
pop ecx
pop ecx
push 5
pop ebx
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0x20]
call fcn.00406022
mov byte [esp + 0x250], 0xd
cmp dword [eax + 0x14], 0x10
jb 0x442bf8
mov eax, dword [eax]
push eax
push ebx
push str._ExcuteFengXingExe__ret:_d_s
push ecx
call fcn.0044fe3d
pop ecx
push eax
call fcn.0044fe7b
add esp, 0x10
mov byte [esp + 0x250], 0
lea ecx, [esp + 0x210]
push 0
push 1
call fcn.004044e5
push ecx
push ecx
lea ecx, [esp + 0xd4]
call fcn.00405f76
lea eax, [esp + 0x210]
mov byte [esp + 0x250], 0xe
push eax
lea ecx, [esp + 0x20]
call fcn.00406022
mov esi, eax
push ebx
push ecx
mov edx, str.T:FXEXERET:
mov byte [esp + 0x258], 0xf
lea ecx, [esp + 0xe4]
call fcn.0040686d
pop ecx
mov ecx, eax
call fcn.00442e23
mov edx, esi
mov ecx, eax
call fcn.00443f79
xor edi, edi
mov byte [esp + 0x250], 0xe
push edi
push 1
lea ecx, [esp + 0x218]
call fcn.004044e5
push str.DataRepairDES
lea ecx, [esp + 0x1fc]
call fcn.004041e5
lea eax, [esp + 0x210]
mov byte [esp + 0x250], 0x10
push eax
lea ecx, [esp + 0xd0]
call fcn.00406022
mov esi, eax
mov byte [esp + 0x250], 0x11
call fcn.0044fe3d
push 1
push esi
lea ecx, [esp + 0x200]
push ecx
mov ecx, 0x4e870e
push ecx
push ecx
mov ecx, eax
call fcn.004503e5
push edi
push 1
lea ecx, [esp + 0x218]
call fcn.004044e5
push edi
push 1
lea ecx, [esp + 0x200]
call fcn.004044e5
lea ecx, [esp + 0xcc]
call fcn.00405f5c
lea ecx, [esp + 0x1c]
call fcn.00405f5c
mov eax, ebx
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x230]
xor ecx, esp
call fcn.004a5088
mov esp, ebp
pop ebp
ret