Function at 0x406881
Capabilities:
Create directory
Get common file path
Get program files directory

Disassembly:
push 0x60
mov eax, 0x43a04a
call fcn.00424c9a
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x44]
xor edi, edi
push edi
push 0x2a
mov esi, 0x456f40
push esi
push edi
mov dword [ebp - 0x4c], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.BetelgeuseDirectory
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 8
push 1
push 0x501
push dword [ebx + 0x20]
call esi
push 0x532
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 8
push 2
push 0x501
push dword [ebx + 0x20]
call esi
push 0x533
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
cmp byte [ebx + 0x94], 0
jne 0x406936
cmp dword [ebx + 0x11ac], 5
je 0x406936
push dword [ebp - 0x4c]
call fcn.00405b2f
push 8
push 3
mov edi, 0x501
push edi
push dword [ebx + 0x20]
call esi
push 8
push 4
push edi
push dword [ebx + 0x20]
call esi
cmp dword [ebx + 0x11a0], 4
jne 0x406967
mov dword [ebx + 0x11a0], 5
call fcn.0040612c
push 0x533
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 8
push 5
pop edi
push edi
push 0x501
push dword [ebx + 0x20]
call esi
cmp dword [ebx + 0x11b0], 4
jne 0x4069b2
mov dword [ebx + 0x11b0], edi
mov edi, dword [ebp - 0x4c]
call fcn.00405e99
call fcn.00410c58
push 0x534
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 0x535
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 8
push 6
mov edi, 0x501
push edi
push dword [ebx + 0x20]
call esi
cmp dword [ebx + 0x11a8], 4
jne 0x406a25
mov dword [ebx + 0x11a8], 5
call fcn.0040feb9
mov ecx, dword [ebp - 0x4c]
mov byte [ebp - 0x50], al
push dword [ebp - 0x50]
call fcn.00405fcb
push 8
push 7
push edi
push dword [ebx + 0x20]
call esi
push 0x536
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 0x537
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 8
push 8
push 0x501
push dword [ebx + 0x20]
call esi
lea eax, [ebx + 0x1198]
cmp dword [eax], 4
jne 0x406a94
mov edi, dword [ebp - 0x4c]
mov dword [eax], 5
call fcn.00405caf
push 0x538
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x2c]
call fcn.004033b1
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402614
cmp dword [ebx + 0x11a8], 5
jne 0x406af4
push 0x440820
lea eax, [ebp - 0x48]
push eax
mov dword [ebx + 0x11a8], edi
call fcn.00404040
lea esi, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.004040e0
push eax
call fcn.004062ca
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004041bd
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebx + 0x11a4]
cmp dword [eax], 5
mov edi, 0x440894
jne 0x406b37
and dword [eax], 0
push edi
lea eax, [ebp - 0x48]
push eax
call fcn.00404040
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 1
call fcn.004040e0
push eax
call fcn.004062ca
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004041bd
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebx + 0x11b0], 5
jne 0x406b80
and dword [ebx + 0x11b0], 0
push 0x4406f0
lea eax, [ebp - 0x48]
push eax
call fcn.00404040
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 2
call fcn.004040e0
push eax
call fcn.004062ca
call fcn.00410c58
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004041bd
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebx + 0x11a0], 5
jne 0x406bc0
and dword [ebx + 0x11a0], 0
push edi
lea eax, [ebp - 0x48]
push eax
call fcn.00404040
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 3
call fcn.004040e0
push eax
call fcn.004062ca
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004041bd
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x539
push 0x45a178
xor ecx, ecx
lea edi, [ebp - 0x6c]
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
push 8
push 8
push 0x501
push dword [ebx + 0x20]
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 5
push 0x500
push dword [ebx + 0x20]
call esi
xor eax, eax
inc eax
call fcn.00424d1d
ret 4