Function at 0x41a560
Capabilities:
Get common file path
Hash data with md5
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x450d2c
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x4642d8]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push esi
push edi
mov eax, dword [0x4642d8]
xor eax, esp
push eax
lea eax, [esp + 0x328]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x219]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x220], bl
call fcn.00435a70
add esp, 0xc
lea edx, [esp + 0x214]
push edx
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, 0xf
lea eax, [esp + 0x214]
mov dword [esp + 0x110], esi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41a600
sub eax, edi
push eax
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x100]
call fcn.00402320
push 8
push str._alipay_
lea ecx, [esp + 0x100]
mov dword [esp + 0x338], ebx
call fcn.00402eb0
push 0xe
push str.config_tcl2.db
lea ecx, [esp + 0x100]
call fcn.00402eb0
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
lea ecx, [esp + 0xa4]
push ecx
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x350], 1
mov dword [esp + 0x4c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x120]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402140
call fcn.00429ac0
cmp al, bl
jne 0x41a6ee
mov edi, 0x10
cmp dword [esp + 0xbc], edi
jb 0x41a6b9
mov eax, dword [esp + 0xa8]
push eax
call fcn.0043206e
add esp, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x110], edi
jb 0x41a6e7
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.0043206e
add esp, 4
xor eax, eax
jmp 0x41adfe
cmp dword [esp + 0xbc], 0x10
mov eax, dword [esp + 0xa8]
mov byte [esp + 0x17c], bl
mov dword [esp + 0x128], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x114], 0x67452301
mov dword [esp + 0x118], 0xefcdab89
mov dword [esp + 0x11c], 0x98badcfe
mov dword [esp + 0x120], 0x10325476
jae 0x41a747
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 0xbc]
lea ecx, [esp + 0x118]
call fcn.00411520
lea edi, [esp + 0xc0]
lea eax, [esp + 0x114]
call fcn.00411e90
mov edi, dword [esp + 0x18]
mov eax, edi
lea edx, [esp + 0xc0]
mov byte [esp + 0x330], 2
call fcn.004169a0
test al, al
je 0x41a807
mov edi, 0x10
cmp dword [esp + 0xd8], edi
jb 0x41a7aa
mov edx, dword [esp + 0xc4]
push edx
call fcn.0043206e
add esp, 4
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0xbc], edi
jb 0x41a7d8
mov eax, dword [esp + 0xa8]
push eax
call fcn.0043206e
add esp, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x110], edi
jb 0x41adf9
mov ecx, dword [esp + 0xfc]
push ecx
jmp 0x41adf1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xc8]
push edx
mov ecx, edi
call fcn.00402140
lea ecx, [esp + 0x184]
call fcn.004304f8
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x334], 3
call fcn.0042e52d
push 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x190]
mov byte [esp + 0x33c], 4
call fcn.0043131a
lea ecx, [esp + 0x1c]
test al, al
jne 0x41a8b3
mov byte [esp + 0x330], 3
call fcn.0042e630
lea ecx, [esp + 0x184]
call fcn.0041ae30
mov edi, 0x10
cmp dword [esp + 0xd8], edi
jb 0x41a899
mov edx, dword [esp + 0xc4]
push edx
call fcn.0043206e
add esp, 4
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
jmp 0x41a6a0
push str.bsblacklist
call fcn.0042f0a7
mov ecx, eax
call fcn.0042d327
test al, al
je 0x41aa72
push str.bsblacklist
lea ecx, [esp + 0x20]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042d9a0
xor esi, esi
mov dword [esp + 0x2c], eax
cmp eax, ebx
jbe 0x41aa72
push 0x457e20
push esi
push str.bsblacklist
lea ecx, [esp + 0x28]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee8b
mov ecx, eax
call fcn.0042f0a7
mov ecx, eax
call fcn.0042d31d
test al, al
je 0x41aa67
lea edx, [esp + 0xdc]
push edx
push 0x457e20
push esi
push str.bsblacklist
lea ecx, [esp + 0x2c]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee8b
mov ecx, eax
call fcn.0042f0a7
mov ecx, eax
call fcn.0042dc9f
mov byte [esp + 0x330], 5
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x41a971
lea ecx, [esp + 0xe0]
lea eax, [esp + 0x14]
push eax
call fcn.00401d70
lea edi, [esp + 0x14]
mov byte [esp + 0x330], 6
call fcn.0041c1c0
mov ebx, edi
call fcn.00401ff0
mov edi, eax
call fcn.00402080
mov ecx, dword [esp + 0x14]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41a9a3
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0xe4]
call fcn.00402320
lea ecx, [esp + 0xdc]
push ecx
lea ecx, [esp + 0x98]
call fcn.0042d7fb
lea edx, [esp + 0x94]
push edx
push 0x457e20
push esi
push str.bsblacklist
lea ecx, [esp + 0x2c]
mov byte [esp + 0x340], 7
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee8b
mov ecx, eax
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee2b
lea ecx, [esp + 0x94]
mov byte [esp + 0x330], 6
call fcn.0042e630
mov byte [esp + 0x330], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41aa43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x330], 4
cmp dword [esp + 0xf4], 0x10
jb 0x41aa65
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.0043206e
add esp, 4
xor ebx, ebx
inc esi
cmp esi, dword [esp + 0x2c]
jb 0x41a8ef
lea edx, [esp + 0x34]
push edx
call fcn.0041c4f0
push 0x457e24
lea ecx, [esp + 0x20]
mov byte [esp + 0x334], 8
call fcn.0042f0a7
mov ecx, eax
call fcn.0042d327
test al, al
je 0x41ac95
push 0x457e24
lea ecx, [esp + 0x20]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042d9a0
xor esi, esi
mov dword [esp + 0x2c], eax
cmp eax, ebx
jbe 0x41ac95
push esi
push 0x457e24
lea ecx, [esp + 0x24]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee8b
mov ecx, eax
call fcn.0042d31d
test al, al
je 0x41ac8a
lea eax, [esp + 0xdc]
push eax
push esi
push 0x457e24
lea ecx, [esp + 0x28]
call fcn.0042f0a7
mov ecx, eax
call fcn.0042ee8b
mov ecx, eax
call fcn.0042dc9f
mov byte [esp + 0x330], 9
cmp dword [esp + 0xf4], 0x10
mov ecx, dword [esp + 0xe0]
jae 0x41ab2e
lea ecx, [esp + 0xe0]
lea edx, [esp + 0x14]
push edx
call fcn.00401d70
lea edi, [esp + 0x14]
mov byte [esp + 0x330], 0xa
call fcn.0041c1c0
mov ebx, edi
call fcn.00401ff0
mov edi, eax
call fcn.00402080
mov ecx, dword [esp + 0x14]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41ab60
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0xe4]
call fcn.00402320
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xe4]
mov edi, 0xf
push eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.00402140
mov dword [esp + 0x90], 1
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x7c]
mov byte [esp + 0x338], 0xb
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x78], edi
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
call fcn.00402140
mov edx, dword [esp + 0x90]
mov dword [esp + 0x70], edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ebx, [esp + 0x9c]
mov byte [esp + 0x338], 0xc
call fcn.0041c280
mov ebx, 0x10
cmp dword [esp + 0x6c], ebx
jb 0x41ac1b
mov edx, dword [esp + 0x58]
push edx
call fcn.0043206e
add esp, 4
xor eax, eax
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], eax
mov byte [esp + 0x58], al
cmp dword [esp + 0x8c], ebx
jb 0x41ac3f
mov eax, dword [esp + 0x78]
push eax
call fcn.0043206e
add esp, 4
mov byte [esp + 0x330], 9
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ac67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x330], 8
cmp dword [esp + 0xf4], ebx
jb 0x41ac88
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.0043206e
add esp, 4
xor ebx, ebx
inc esi
cmp esi, dword [esp + 0x2c]
jb 0x41aac4
mov edi, dword [esp + 0x18]
lea esi, [edi + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x50], ebx
je 0x41ad27
mov edx, dword [edi + 0x60]
mov eax, dword [edx + 4]
add edi, 0x48
push eax
mov ecx, edi
call fcn.0041c6c0
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov eax, dword [edi + 0x18]
lea ecx, [esp + 0x34]
mov dword [eax + 8], eax
cmp edi, ecx
je 0x41acfe
mov eax, dword [edi + 0x18]
mov ecx, dword [edi]
mov edx, dword [eax]
push eax
push ecx
push edx
push ecx
lea edx, [esp + 0x3c]
push edx
mov eax, edi
call fcn.0041c570
lea ebx, [esp + 0x34]
mov eax, edi
call fcn.0041c650
xor ebx, ebx
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x38]
call fcn.0041c6c0
mov eax, dword [esp + 0x4c]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x50], ebx
mov dword [eax], eax
mov eax, dword [esp + 0x4c]
mov dword [eax + 8], eax
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
add ecx, 0x38
call fcn.0042ee2b
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea esi, [esp + 0x34]
mov byte [esp + 0x330], 0xd
call fcn.0041c960
mov eax, dword [esp + 0x34]
push eax
call fcn.0043206e
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x330], 3
call fcn.0042e630
lea ecx, [esp + 0x184]
call fcn.0041ae30
mov esi, 0x10
cmp dword [esp + 0xd8], esi
jb 0x41ad98
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.0043206e
add esp, 4
mov edi, 0xf
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0xbc], esi
jb 0x41adcb
mov edx, dword [esp + 0xa8]
push edx
call fcn.0043206e
add esp, 4
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x110], esi
jb 0x41adf9
mov eax, dword [esp + 0xfc]
push eax
call fcn.0043206e
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x328]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.00432079
mov esp, ebp
pop ebp
ret 4