Function at 0x4bd7a0
Capabilities:
Create directory
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
push str.Optimize
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x3a0]
mov edx, 0x80000001
mov dword [ebp - 0x3a8], 0
call fcn.004bff10
add esp, 0xc
test eax, eax
jle 0x4bd7fd
lea eax, [ebp - 0x3a0]
push eax
call fcn.004cf355
add esp, 4
test eax, eax
jne 0x4bdae3
cmp dword [0x506e0c], 0
je 0x4bd84c
cmp dword [0x506e0c], 0
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x3a4], ecx
je 0x4bd84c
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4bd84c
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bd845
lea edx, [ebp - 0x3a4]
push edx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [ebp - 0x218]
call fcn.0047c070
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.history.txt
mov eax, edi
push eax
call esi
mov ecx, edi
call fcn.0047af20
test eax, eax
je 0x4bd8c0
lea ebx, [ebp - 0x110]
call fcn.0047c6f0
push str.history.txt
mov ecx, ebx
push ecx
call esi
mov ecx, ebx
call fcn.0047af20
test eax, eax
je 0x4bd8a1
mov edx, edi
push edx
mov ecx, ebx
call fcn.0047d8f0
add esp, 4
jmp 0x4bd8b5
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ebx, [ebp - 0x218]
call fcn.0047b860
lea ebx, [ebp - 0x110]
call fcn.0047c6f0
push 0x4ee77c
mov edx, ebx
push edx
call esi
push 0
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
mov ecx, ebx
push ecx
call edi
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
mov eax, ebx
push eax
call edi
call fcn.0047c6f0
push str._vault
mov ecx, ebx
push ecx
call esi
push 0
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x80
mov eax, ebx
push eax
call edi
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffffe
push eax
mov edx, ebx
push edx
call edi
cmp dword [0x506e0c], 0
push 0x104
lea ecx, [ebp - 0x320]
mov edx, CreateStatusWindowA
je 0x4bd97b
push str.ProgramFilesDir__x86_
push str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.004bff10
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
test eax, eax
jne 0x4bd9a5
push str.C:Program_Files__x86_
lea eax, [ebp - 0x218]
push eax
jmp 0x4bd9b3
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.004bff10
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0xc
test eax, eax
jne 0x4bd9a5
push 0x4ec31c
lea eax, [ebp - 0x218]
push eax
jmp 0x4bd9b3
lea ecx, [ebp - 0x320]
push ecx
lea edx, [ebp - 0x218]
push edx
call edi
push 0x4f2008
lea eax, [ebp - 0x218]
push eax
call esi
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x320]
push edx
mov dword [0x5060a8], 0xf
call edi
cmp dword [0x506e0c], 0
je 0x4bda2c
cmp dword [0x506e0c], 0
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3a4], eax
je 0x4bda2c
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4bda2c
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4bda25
lea ecx, [ebp - 0x3a4]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 1
push 0
push 2
lea edx, [ebp - 0x320]
push 0x486eb0
push edx
call fcn.00486cb0
add esp, 0x14
lea ebx, [ebp - 0x320]
call fcn.0047b990
mov esi, ebx
test eax, eax
je 0x4bda5e
push str.Removed_all_the_BillP_Studios_files_and_folders
jmp 0x4bda63
push str.Some_BillP_Studios_files_and_folders_still_exist
call fcn.0047da70
add esp, 4
push 2
push 0x4e8d64
lea eax, [ebp - 0x3a0]
push 0x80
push eax
call fcn.00402ee0
push str.Optimize
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x3a0]
mov edx, 0x80000001
call fcn.004c0250
push str.Update
push str.SoftwareBillP_StudiosWinPatrolOptions
mov ecx, 0x4e2ca8
mov edx, 0x80000001
call fcn.004c0250
call fcn.004cc300
call fcn.004cbcf0
call fcn.004cbed0
call fcn.004cc060
push 1
call fcn.004cd760
add esp, 0x24
push 1
call fcn.004cd8c0
add esp, 4
call fcn.004caed0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret