Function at 0x4056e2
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x469fa1
mov eax, dword fs:[0]
push eax
sub esp, 0xc68
mov eax, dword [0x48dcc0]
xor eax, esp
mov dword [esp + 0xc60], eax
push ebx
push esi
push edi
mov eax, dword [0x48dcc0]
xor eax, esp
push eax
lea eax, [esp + 0xc78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x44]
xor ebx, ebx
push ebx
mov dword [esp + 0x1c], eax
push 0x2a
lea eax, [esp + 0x15c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.BetelgeuseDirectory
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push ebx
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [0x4925d8], ebx
je 0x405823
push ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], 0xf
call fcn.004026aa
mov dword [esp + 0xc80], ebx
mov eax, dword [edi + 0x1198]
cmp eax, 4
je 0x40579e
cmp eax, 5
je 0x40579e
push str.v59__
jmp 0x4057a3
push str.v62__
lea eax, [esp + 0x40]
push eax
call fcn.0040386b
push str.6e0b49916f3348e097fcd72b4090fb15
lea eax, [esp + 0x40]
push eax
call fcn.0040386b
push str.___
lea eax, [esp + 0x40]
push eax
call fcn.0040386b
push 0xffffffffffffffff
push ebx
mov eax, 0x4937f8
lea esi, [esp + 0x44]
call fcn.00403926
push str.____
mov eax, esi
push eax
call fcn.0040386b
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x4057f8
lea eax, [esp + 0x40]
cmp dword [0x4925d8], ebx
je 0x40580f
push eax
push dword [0x4937f4]
call dword [0x4925cc]
pop ecx
pop ecx
or dword [esp + 0xc80], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
lea eax, [esp + 0x16]
push eax
lea eax, [esp + 0x1b]
push eax
mov byte [esp + 0x1f], bl
mov byte [esp + 0x1e], bl
call fcn.00403545
cmp byte [esp + 0x16], bl
je 0x405860
push 0xa59
lea ecx, [esp + 0x40]
mov ebx, 0x4937dc
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
push 8
push 1
mov esi, 0x501
push esi
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x406
lea ecx, [esp + 0x40]
mov ebx, 0x4937dc
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 8
push 2
push esi
push dword [edi + 0x20]
call ebx
cmp byte [edi + 0x94], 0
jne 0x4058c4
push 8
pop ecx
mov edx, 0x4937e0
call fcn.0040428e
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
push 3
push esi
push dword [edi + 0x20]
call ebx
lea eax, [edi + 0x11a0]
cmp dword [eax], 4
mov ebx, 0x400
jne 0x4059f0
push 5
pop ecx
mov dword [eax], ecx
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x470]
push ebx
push eax
mov dword [edi + 0x119c], ecx
call fcn.004504d4
add esp, 0xc
push 0x47aef0
lea eax, [esp + 0xb0]
push eax
call fcn.00403ba1
lea esi, [esp + 0xac]
mov dword [esp + 0xc80], 1
call fcn.00403c41
push eax
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x46c]
push eax
push 0x8d
call fcn.00405166
push 0x47af10
lea eax, [esp + 0x40]
push eax
call fcn.00403ba1
mov byte [esp + 0xc80], 2
cmp dword [0x49264c], 0x10
mov ecx, dword [0x492638]
jae 0x40597b
mov ecx, 0x492638
cmp dword [0x492668], 0x10
mov eax, dword [0x492654]
jae 0x40598e
mov eax, 0x492654
push ecx
push eax
lea esi, [esp + 0x44]
call fcn.00403c41
push eax
lea eax, [esp + 0x878]
push ebx
push eax
call fcn.0044f950
add esp, 0x14
push 1
lea eax, [esp + 0x870]
push eax
lea eax, [esp + 0x474]
push eax
call fcn.0040469b
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0xac]
call fcn.00403d1e
mov esi, 0x501
push 8
push 4
push esi
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [edi + 0x119c]
cmp dword [eax], 4
jne 0x405b9d
mov dword [eax], 5
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x470]
push ebx
push eax
call fcn.004504d4
add esp, 0xc
push 0x47af58
lea eax, [esp + 0x78]
push eax
call fcn.00403ba1
lea esi, [esp + 0x74]
mov dword [esp + 0xc80], 3
call fcn.00403c41
push eax
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x1c]
push eax
call fcn.0044f05c
fild dword [esp + 0x20]
mov eax, dword [esp + 0x20]
pop ecx
test eax, eax
jge 0x405a7b
fadd qword [0x485660]
fdiv qword [0x485658]
fmul qword [0x485650]
fadd qword [0x485648]
call fcn.00454c80
cmp eax, 0x32
lea eax, [esp + 0x46c]
push eax
jge 0x405aa6
push 0x8b
jmp 0x405aab
push 0x8c
call fcn.00405166
push 0x47af78
lea eax, [esp + 0x40]
push eax
call fcn.00403ba1
push 0x47afc4
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0xc88], 4
call fcn.00403ba1
mov byte [esp + 0xc80], 5
cmp byte [0x4925e8], 0
je 0x405af8
lea esi, [esp + 0xac]
call fcn.00403c41
jmp 0x405afd
mov eax, 0x47a94b
cmp dword [0x49264c], 0x10
mov edx, dword [0x492638]
jae 0x405b11
mov edx, 0x492638
cmp dword [0x492668], 0x10
mov ecx, dword [0x492654]
jae 0x405b25
mov ecx, 0x492654
push eax
push edx
push ecx
lea esi, [esp + 0x48]
call fcn.00403c41
push eax
lea eax, [esp + 0x87c]
push eax
call fcn.00402f62
add esp, 0x14
lea eax, [esp + 0x46c]
push eax
call fcn.00404a07
push 1
lea eax, [esp + 0x870]
push eax
lea eax, [esp + 0x474]
push eax
call fcn.0040469b
lea eax, [esp + 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0xac]
call fcn.00403d1e
mov eax, esi
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0x74]
call fcn.00403d1e
mov esi, 0x501
push 8
push 5
pop ebx
push ebx
push esi
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [edi + 0x11a8]
cmp dword [eax], 4
jne 0x405d07
mov dword [eax], ebx
push 0x47afdc
lea eax, [esp + 0xe8]
push eax
call fcn.00403ba1
push 0x103
lea eax, [esp + 0x369]
push 0
mov dword [esp + 0xc88], 6
push eax
mov byte [esp + 0x370], 0
call fcn.00451d90
add esp, 0xc
lea esi, [esp + 0xe4]
call fcn.00403c41
push eax
lea eax, [esp + 0x158]
push eax
push str._s_s
lea eax, [esp + 0x370]
push 0x104
push eax
call fcn.0044f950
add esp, 0x14
push 0x47b008
lea eax, [esp + 0x40]
push eax
call fcn.00403ba1
push 0x47b020
lea eax, [esp + 0xb0]
push eax
mov byte [esp + 0xc88], 7
call fcn.00403ba1
push 0x8f7
push 0x8f6
lea esi, [esp + 0xb4]
mov byte [esp + 0xc88], 8
call fcn.00403c41
push eax
lea eax, [esp + 0x370]
push eax
lea esi, [esp + 0x4c]
call fcn.00403c41
mov ecx, dword [esp + 0x28]
push eax
call fcn.00404dc4
test al, al
je 0x405cd9
lea eax, [esp + 0x364]
push eax
call fcn.00404a07
push 0x47b030
lea eax, [esp + 0x78]
push eax
call fcn.00403ba1
push 1
lea esi, [esp + 0x78]
mov byte [esp + 0xc84], 9
call fcn.00403c41
push eax
lea eax, [esp + 0x36c]
push eax
call fcn.0040469b
call fcn.0040f255
mov eax, esi
call fcn.00403d1e
lea eax, [esp + 0xac]
call fcn.00403d1e
lea eax, [esp + 0x3c]
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0xe4]
call fcn.00403d1e
mov esi, 0x501
push 0x534
lea ecx, [esp + 0x40]
mov ebx, 0x4937dc
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
push 0x535
lea ecx, [esp + 0x40]
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
push 8
push 6
push esi
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [edi + 0x11a4]
cmp dword [eax], 4
jne 0x405edf
mov dword [eax], 5
call fcn.0040e7b0
mov bl, al
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x470]
push 0x400
push eax
call fcn.004504d4
add esp, 0xc
push 0x47b108
lea eax, [esp + 0x120]
push eax
call fcn.00403ba1
lea esi, [esp + 0x11c]
mov dword [esp + 0xc80], 0xa
call fcn.00403c41
push eax
lea eax, [esp + 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x47b120
lea eax, [esp + 0xb0]
push eax
call fcn.00403ba1
lea esi, [esp + 0xac]
mov byte [esp + 0xc80], 0xb
call fcn.00403c41
push eax
lea eax, [esp + 0x870]
push eax
call fcn.00402f62
pop ecx
pop ecx
push 0x47b134
lea eax, [esp + 0x78]
push eax
call fcn.00403ba1
push 0x49b
push 0x49a
lea esi, [esp + 0x7c]
mov byte [esp + 0xc88], 0xc
call fcn.00403c41
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x478]
push eax
lea eax, [esp + 0x87c]
push eax
call fcn.00404dc4
test al, al
je 0x405eb1
lea eax, [esp + 0x46c]
push eax
call fcn.00404a07
push 0x47b144
lea eax, [esp + 0xe8]
push eax
call fcn.00403ba1
push 1
lea esi, [esp + 0xe8]
mov byte [esp + 0xc84], 0xd
call fcn.00403c41
push eax
lea eax, [esp + 0x474]
push eax
call fcn.0040469b
xor eax, eax
test bl, bl
setne al
lea ecx, [esp + 0x3c]
mov ebx, 0x4937dc
add eax, 0x58b
push eax
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004026c6
mov eax, esi
call fcn.00403d1e
lea eax, [esp + 0x74]
call fcn.00403d1e
lea eax, [esp + 0xac]
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0x11c]
call fcn.00403d1e
mov esi, 0x501
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 8
push 7
push esi
push dword [edi + 0x20]
call ebx
push 8
push 8
push esi
push dword [edi + 0x20]
call ebx
cmp byte [edi + 0x94], 0
jne 0x40607b
cmp dword [0x4925d8], 0
je 0x405f20
push 6
call dword [0x4925c4]
pop ecx
test eax, eax
jne 0x40607b
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x260]
push 0x104
push eax
call fcn.004504d4
add esp, 0xc
push 0x47b17c
lea eax, [esp + 0xb0]
push eax
call fcn.00403ba1
lea esi, [esp + 0xac]
mov dword [esp + 0xc80], 0xe
call fcn.00403c41
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x47b198
lea eax, [esp + 0x78]
push eax
call fcn.00403ba1
push 0x47b1a8
lea eax, [esp + 0xe8]
push eax
mov byte [esp + 0xc88], 0xf
call fcn.00403ba1
push 0x790
push 0x78f
lea esi, [esp + 0xec]
mov byte [esp + 0xc88], 0x10
call fcn.00403c41
push eax
lea eax, [esp + 0x268]
push eax
lea esi, [esp + 0x84]
call fcn.00403c41
mov ecx, dword [esp + 0x28]
push eax
call fcn.00404dc4
test al, al
je 0x40604d
push 0x47b1b4
lea eax, [esp + 0x120]
push eax
call fcn.00403ba1
mov byte [esp + 0xc80], 0x11
cmp dword [0x492668], 0x10
mov eax, dword [0x492654]
jae 0x40600c
mov eax, 0x492654
push eax
lea esi, [esp + 0x120]
call fcn.00403c41
push eax
lea eax, [esp + 0x874]
push 0x400
push eax
call fcn.0044f950
add esp, 0x10
push 0
lea eax, [esp + 0x870]
push eax
lea eax, [esp + 0x264]
push eax
call fcn.0040469b
mov eax, esi
call fcn.00403d1e
lea eax, [esp + 0xe4]
call fcn.00403d1e
lea eax, [esp + 0x74]
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0xac]
call fcn.00403d1e
mov esi, 0x501
lea eax, [edi + 0x1194]
cmp dword [eax], 4
jne 0x40619c
mov dword [eax], 5
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x260]
push 0x104
push eax
call fcn.004504d4
add esp, 0xc
push 0x47b1c4
lea eax, [esp + 0x78]
push eax
call fcn.00403ba1
lea esi, [esp + 0x74]
mov dword [esp + 0xc80], 0x12
call fcn.00403c41
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x47b1d4
lea eax, [esp + 0xe8]
push eax
call fcn.00403ba1
push 0x47b1e0
lea eax, [esp + 0x120]
push eax
mov byte [esp + 0xc88], 0x13
call fcn.00403ba1
push 0x249
push 0x248
lea esi, [esp + 0x124]
mov byte [esp + 0xc88], 0x14
call fcn.00403c41
push eax
lea eax, [esp + 0x268]
push eax
lea esi, [esp + 0xf4]
call fcn.00403c41
mov ecx, dword [esp + 0x28]
push eax
call fcn.00404dc4
test al, al
je 0x40616e
push 1
push 0x47b1e8
lea eax, [esp + 0x264]
push eax
call fcn.0040469b
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x11c]
call fcn.00403d1e
lea eax, [esp + 0xe4]
call fcn.00403d1e
or dword [esp + 0xc80], 0xffffffff
lea eax, [esp + 0x74]
call fcn.00403d1e
mov esi, 0x501
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0x411
lea ecx, [esp + 0x24]
mov ebx, 0x4937dc
call fcn.00403342
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.004026c6
push 8
push 8
push esi
push dword [edi + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 5
push 0x500
push dword [edi + 0x20]
call esi
xor eax, eax
inc eax
mov ecx, dword [esp + 0xc78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc60]
xor ecx, esp
call fcn.0044e6cf
mov esp, ebp
pop ebp
ret 4