Function at 0x458f81
Capabilities:
Check if file exists
Create thread

Disassembly:
push 0x9c
mov eax, 0x4b4720
call fcn.00473acf
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov esi, ecx
mov dword [eax], ebx
cmp edi, ebx
je 0x459540
mov ecx, edi
call fcn.004139da
mov ecx, edi
mov dword [ebp - 0x64], eax
call fcn.0041433d
push eax
lea ecx, [ebp - 0x60]
call fcn.00418464
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x64], ebx
je 0x458fd0
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0xa4]
call fcn.0042d1df
mov byte [ebp - 4], 2
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004330a8
mov byte [ebp - 4], 3
push str.onekey_opti
lea ecx, [ebp - 0x60]
call fcn.004286e1
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test eax, eax
jne 0x459022
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.winmaster.oneopti
call fcn.00418464
mov byte [ebp - 4], 4
jmp 0x459136
push str.clean_cion
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x45904c
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.fixmaster.fixicon
call fcn.00418464
mov byte [ebp - 4], 5
jmp 0x459136
push str.restart_explorer
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x45907f
push 0x31
push 0x4c8fec
push 0x4c8fd0
push ebx
call edi
cmp eax, 1
jne 0x459208
call fcn.004216ca
jmp 0x459208
push str.create_restore
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x4590c3
push 0x31
push 0x4c8fec
push 0x4c8fa4
push ebx
call edi
cmp eax, 1
jne 0x459208
push ebx
push ebx
push esi
push 0x44a9ad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xac], eax
jmp 0x459208
push str.clean_rubbish
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x4590ea
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.cleanmaster.autoclean
call fcn.00418464
mov byte [ebp - 4], 6
jmp 0x459136
push str.clean_private
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459111
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.cleanmaster.privacy
call fcn.00418464
mov byte [ebp - 4], 7
jmp 0x459136
push str.hosts_mgr
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459146
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.netmaster.hosts
call fcn.00418464
mov byte [ebp - 4], 8
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00454998
jmp 0x459208
push str.clean_memory
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459166
call fcn.00420578
call fcn.004205ea
jmp 0x459208
push str.close_screen
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459190
push 2
push 0xf170
push 0x112
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x459208
push str.lock_screen
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x4591c1
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.rundll32.exe_user32.dll_LockWorkStation
call fcn.00418464
mov byte [ebp - 4], 9
mov byte [ebp - 4], 3
call fcn.00420dff
pop ecx
jmp 0x459208
push str.open_cdrom
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x4591e1
push ebx
mov ecx, esi
call fcn.00442867
test al, al
jne 0x459208
push ebx
jmp 0x459201
push str.close_cdrom
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459208
push 1
mov ecx, esi
call fcn.00442867
test al, al
jne 0x459208
push 1
mov ecx, esi
call fcn.00454c10
push str.shutdown
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x45921d
push 1
jmp 0x459244
push str.reboot
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x459232
push 2
jmp 0x459244
push str.logoff
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x45924f
push ebx
call fcn.004219b1
pop ecx
jmp 0x4592f7
push str.sleep
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x45926a
call fcn.0042048e
jmp 0x4592f7
push str.hibernation
lea ecx, [ebp - 0x60]
call fcn.004286e1
test eax, eax
jne 0x4592f7
call fcn.004342da
cmp eax, 0x13
jge 0x45928f
call sub.POWRPROF.dll_IsPwrHibernateAllowed
movzx eax, al
jmp 0x4592b6
push 0x4b
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.00473120
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
call sub.POWRPROF.dll_GetPwrCapabilities
cmp byte [ebp - 0x54], bl
je 0x4592b4
cmp byte [ebp - 0x56], bl
jne 0x4592f2
xor eax, eax
cmp eax, ebx
jne 0x4592f2
push 0x24
push 0x4c3e90
push 0x4c8f48
push dword [esi + 4]
call edi
cmp eax, 6
jne 0x4593e6
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.powercfg.exe__h_on
call fcn.00418464
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 3
call fcn.00420dff
pop ecx
call fcn.00420409
cmp dword [ebp - 0x64], 0x65
jne 0x45942c
push 0x65
lea ecx, [esi + 0x24]
call fcn.00418ab8
push 0x66
lea ecx, [esi + 0x24]
mov edi, eax
call fcn.00418ab8
push ebx
mov ecx, edi
mov esi, eax
call fcn.004139de
push 1
mov ecx, esi
call fcn.004139de
push ebx
push str._PCMaster
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x459408
lea ecx, [ebp - 0x88]
call fcn.0042d1df
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push 0x4c649c
call fcn.00418464
mov byte [ebp - 4], 0x10
push ecx
mov eax, esp
mov dword [ebp - 0x70], esp
push eax
lea ecx, [ebp - 0x8c]
call fcn.004330a8
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x8c]
call fcn.004330ec
mov byte [ebp - 4], 0x12
push dword [ebp - 0x64]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4593c3
push ebx
push ecx
lea eax, [ebp - 0x64]
mov ecx, esp
mov dword [ebp - 0x70], esp
push eax
call fcn.0040a8a7
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x12
call fcn.00420ec1
pop ecx
pop ecx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
call fcn.0042d237
jmp 0x459514
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xa4]
call fcn.0042d237
jmp 0x459531
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x459417
push 9
jmp 0x459419
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x459514
cmp dword [ebp - 0x64], 0x66
jne 0x459485
push 0x65
lea ecx, [esi + 0x24]
call fcn.00418ab8
push 0x66
lea ecx, [esi + 0x24]
mov edi, eax
call fcn.00418ab8
push 1
mov ecx, edi
mov esi, eax
call fcn.004139de
push ebx
mov ecx, esi
call fcn.004139de
push ebx
push str._PCMaster
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x459514
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x459514
cmp dword [ebp - 0x64], 0x67
jne 0x459514
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push ebx
push str._PCMaster
call esi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [ebp - 0x64], eax
call edi
test eax, eax
je 0x4594ba
push ebx
push ebx
push 2
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push str.pcmaster_radar_flowwindow
call esi
push eax
mov dword [ebp - 0x64], eax
call edi
test eax, eax
je 0x4594f8
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4594f8
push ebx
push str.pcmaster_radar
call esi
push eax
mov dword [ebp - 0x64], eax
call edi
test eax, eax
je 0x4594f8
push ebx
push ebx
push 0x10
push dword [ebp - 0x64]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x4c2df8
call esi
mov esi, eax
push esi
call edi
test eax, eax
je 0x459514
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.00409a10
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xa4]
call fcn.0042d237
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x60]
add ecx, 0xfffffff0
call fcn.00409a10
xor eax, eax
call fcn.00473b52
ret 0x10