Function at 0x4058da
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x38c]
test eax, eax
je 0x405aa1
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.00433220
pop ecx
test eax, eax
pop ecx
je 0x405aa1
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.00433220
and byte [eax], 0
push str.TEMP
call fcn.00433fa0
add esp, 0xc
test eax, eax
je 0x405956
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4059be
push 0x455c08
call fcn.00433fa0
test eax, eax
pop ecx
je 0x405977
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4059be
mov edi, 0x104
push edi
call fcn.00433b6e
pop ecx
mov dword [ebp - 8], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 8]
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4059a9
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call fcn.00433a3f
cmp dword [ebp - 0xc], 0
pop ecx
je 0x405aa1
jmp 0x4059c3
mov edi, 0x104
push 0x24
call fcn.00406be4
push eax
push str.This_E_Transcript_file_is_in_a_temporary_folder._Do_you_want_to_save_it_to_a_different_folder__r_n_r_nIf_you_choose_Yes__you_will_be_prompted_for_a_save_location__and_the_transcript_will_be_automatically_re_launched_from_there.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x405aa1
push 0x5c
push dword [esi + 0x38c]
call fcn.00433220
pop ecx
inc eax
pop ecx
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
push 0x4c
lea eax, [ebp - 0x58]
pop ebx
push ebx
push 0
push eax
call fcn.004339b0
lea eax, [ebp - 0x15c]
push 0x2e
push dword [esi + 0x38c]
mov dword [ebp - 0x3c], eax
lea eax, [esi + 0x514]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], str.E_transcript_Files__.ptx_.exe_
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], str.Save_E_Transcript_File_As
mov dword [ebp - 0x24], 0x80e
call fcn.00433220
mov edi, 0x2000
inc eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.00433b6e
add esp, 0x18
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x405a98
push 0x20
push dword [esi + 0x38c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push 0
jne 0x405aa8
call fcn.00406be4
push eax
push str.Could_not_open_this_E_Transcript_file_for_reading.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call fcn.00433a3f
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebx, dword [sym.imp.KERNEL32.dll__lclose]
push eax
mov dword [ebp - 8], eax
call ebx
push 0x12
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [ebp - 8], 0xffffffff
jne 0x405add
push 0
call fcn.00406be4
push eax
push str.Could_not_create_the_destination_E_Transcript_file_for_writing.
jmp 0x405a90
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x405afd
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x405add
push dword [ebp - 0xc]
call ebx
push dword [ebp - 8]
call ebx
push str..ptx
push 0x2e
push dword [esi + 0x38c]
call fcn.00433220
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x405b4c
push 0x104
push dword [ebp - 4]
push dword [0x45fb8c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x455bfc
push dword [ebp - 4]
call edi
jmp 0x405b52
mov eax, dword [ebp - 4]
and byte [eax], 0
push dword [ebp - 0x3c]
push dword [ebp - 4]
call edi
push 0x5c
push dword [ebp - 0x3c]
call fcn.00433220
and byte [eax], 0
pop ecx
pop ecx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x405b81
push 0x455b4c
push dword [ebp - 0x3c]
call edi
push dword [ebp - 0x3c]
lea eax, [esi + 0x514]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
lea ecx, [esi + 0x288]
push ecx
mov ecx, esi
call dword [eax]
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x405bc0
push 0
call fcn.00406be4
push eax
push str.Could_not_launch_the_new_copy_of_the_E_Transcript_file__will_run_from_the_temporary_folder_instead.
jmp 0x405a90
push 1
pop eax
jmp 0x405aa3