Function at 0x4ada80
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f9d98
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6b000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004dacb0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x900]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CDuiTimer::constructor_void_]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x950]
mov dword [edi], vtable.CMainFrame.1.0
mov dword [edi + 0x10], vtable.CMainFrame.6.0
mov dword [edi + 0x24], vtable.CMainFrame.2.0
mov dword [edi + 0x28], vtable.CMainFrame.4.0
mov dword [edi + 0x2c], vtable.CMainFrame.5.0
mov dword [edi + 0x30], vtable.CMainFrame.3.0
mov dword [edi + 0x900], 0x6538a0
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov byte [ebp - 4], 5
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov byte [ebp - 4], 6
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov byte [ebp - 4], 7
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov byte [ebp - 4], 8
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov byte [ebp - 4], 9
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov byte [ebp - 4], 0xa
call fcn.004a9e30
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x9bc]
call fcn.004d3d40
mov byte [ebp - 4], 0xc
lea esi, [edi + 0x9dc]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a5c20
mov dword [esi], eax
mov byte [ebp - 4], 0xf
lea esi, [edi + 0x9e4]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a5b60
mov dword [esi], eax
mov byte [ebp - 4], 0x12
mov dword [edi + 0x9ec], 0
mov dword [edi + 0x9f0], 0
mov dword [edi + 0x9f4], 0
mov byte [ebp - 4], 0x13
mov dword [edi + 0x9f8], 0
mov dword [edi + 0x9fc], 0
mov dword [edi + 0xa00], 0
mov byte [ebp - 4], 0x14
lea eax, [edi + 0xa04]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 0x16
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov byte [ebp - 4], 0x18
lea eax, [edi + 0xa28]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 0x1a
lea esi, [edi + 0xa38]
mov dword [ebp - 0x14], esi
lea ebx, [esi + 0x58]
mov dword [edi + 0xa34], 0
mov dword [esi + 4], vtable.IUDFScanCallback.0
mov dword [esi], vtable.CScanControl.1.0
mov dword [esi + 4], vtable.CScanControl.0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov word [esi + 0x40], 1
mov dword [esi + 0x44], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [ebp - 0x18], ebx
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ae284
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x1c
lea ebx, [esi + 0x5c]
mov dword [ebp - 0x18], ebx
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ae28e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x1e
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov byte [ebp - 4], 0x1f
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 0x20
lea eax, [edi + 0xab0]
mov dword [ebp - 0x18], eax
lea esi, [eax + 0x24]
mov dword [eax], vtable.CProgressTaskBar.0
mov dword [ebp - 0x14], esi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ae298
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x23
lea esi, [edi + 0xad8]
mov dword [ebp - 0x18], esi
mov dword [esi], vtable.CPartitionScanControl.0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 0x24
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 0x25
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 0x26
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 0x27
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 0x28
lea ebx, [esi + 0x9c]
mov dword [esi + 0x48], 0x200
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], 1
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 1
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 1
mov dword [esi + 0x84], 1
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 1
mov dword [ebp - 0x14], ebx
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ae2a2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0x2a
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov byte [ebp - 4], 0x2b
lea esi, [edi + 0xb84]
mov dword [edi + 0xb80], edi
mov dword [ebp - 0x18], esi
call fcn.0040bf10
mov ecx, eax
test ecx, ecx
je 0x4ae2ac
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x2d
lea ecx, [edi + 0xbe0]
mov dword [edi + 0xb88], 0
mov dword [edi + 0xb8c], 0
mov dword [edi + 0xb90], 1
mov dword [edi + 0xb94], 0
mov dword [edi + 0xb98], 0
mov dword [edi + 0xb9c], 0
mov dword [edi + 0xba0], 0
mov dword [edi + 0xba4], 0
mov dword [edi + 0xba8], 0
mov dword [edi + 0xbac], 1
mov dword [edi + 0xbb0], 0
mov dword [edi + 0xbb4], 0
mov dword [edi + 0xbb8], 0x200
mov dword [edi + 0xbc0], 0x200
mov dword [edi + 0xbc4], 0
mov dword [edi + 0xbc8], 0x80000000
mov dword [edi + 0xbcc], 2
mov dword [edi + 0xbd0], 0
mov dword [edi + 0xbd4], 0
mov dword [edi + 0xbd8], 0
mov dword [edi + 0xbdc], 0
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CDialogBuilder::constructor_void_]
mov byte [ebp - 4], 0x2e
lea edx, [edi + 0xd30]
mov ecx, edx
mov dword [ebp - 0x18], edx
call fcn.00487bc0
mov byte [ebp - 4], 0x2f
mov dword [edx], vtable.CPathTreeCtrl.0
mov dword [edx + 0x5c], 0
mov byte [ebp - 4], 0x30
lea edx, [edi + 0xd90]
mov ecx, edx
mov dword [ebp - 0x18], edx
call fcn.00487bc0
mov byte [ebp - 4], 0x31
mov dword [edx], vtable.CTypeTreeCtrl.0
mov dword [edx + 0x5c], 0
mov byte [ebp - 4], 0x32
lea edx, [edi + 0xdf0]
mov ecx, edx
mov dword [ebp - 0x18], edx
call fcn.00487bc0
mov byte [ebp - 4], 0x33
mov dword [edx], vtable.CTimeTreeCtrl.0
mov byte [ebp - 4], 0x34
lea ecx, [edi + 0xe84]
mov word [edi + 0xe4c], 0
mov dword [edi + 0xe50], 0
mov dword [edi + 0xe54], 0
mov dword [edi + 0xe58], 0
mov dword [edi + 0xe5c], 0
mov dword [edi + 0xe60], 0
mov dword [edi + 0xe64], 0
mov dword [edi + 0xe68], 0x1000001
mov dword [edi + 0xe6c], 0
mov dword [edi + 0xe70], 0
mov dword [edi + 0xe74], 0
mov dword [edi + 0xe78], 6
mov dword [edi + 0xe7c], 0
mov dword [edi + 0xe80], 0
call fcn.004ab8a0
mov byte [ebp - 4], 0x35
mov dword [edi + 0xe8c], 0
mov dword [edi + 0xe90], 0
push 0x53
lea ecx, [edi + 0xe98]
mov dword [edi + 0xe94], 0
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CStdStringPtrMap::constructor_int_]
mov byte [ebp - 4], 0x36
mov dword [edi + 0xea8], 0
mov dword [edi + 0xeac], 0
mov dword [edi + 0xeb0], 0
mov byte [ebp - 4], 0x37
mov dword [edi + 0xeb4], 0
mov dword [edi + 0xeb8], 0
mov dword [edi + 0xebc], 0
mov byte [ebp - 4], 0x38
mov dword [edi + 0xec0], 0
mov dword [edi + 0xec4], 0
mov dword [edi + 0xec8], 0
mov dword [edi + 0xecc], 0
mov dword [0x6b889c], edi
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
push 0x80004005
call fcn.0040b250
int3