Function at 0x406ea1
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x46c]
test eax, eax
je 0x407068
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.0044ab00
pop ecx
test eax, eax
pop ecx
je 0x407068
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.0044ab00
and byte [eax], 0
push str.TEMP
call fcn.0044b8b7
add esp, 0xc
test eax, eax
je 0x406f1d
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x406f85
push 0x485f80
call fcn.0044b8b7
test eax, eax
pop ecx
je 0x406f3e
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x406f85
mov edi, 0x104
push edi
call fcn.0044b48e
pop ecx
mov dword [ebp - 8], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 8]
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406f70
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call fcn.0044b35f
cmp dword [ebp - 0xc], 0
pop ecx
je 0x407068
jmp 0x406f8a
mov edi, 0x104
push 0x24
call fcn.0040825c
push eax
push str.This_E_Transcript_file_is_in_a_temporary_folder._Do_you_want_to_save_it_to_a_different_folder__r_n_r_nIf_you_choose_Yes__you_will_be_prompted_for_a_save_location__and_the_transcript_will_be_automatically_re_launched_from_there.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x407068
push 0x5c
push dword [esi + 0x46c]
call fcn.0044ab00
pop ecx
inc eax
pop ecx
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
push 0x4c
lea eax, [ebp - 0x58]
pop ebx
push ebx
push 0
push eax
call fcn.0044b2a0
lea eax, [ebp - 0x15c]
push 0x2e
push dword [esi + 0x46c]
mov dword [ebp - 0x3c], eax
lea eax, [esi + 0x608]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], str.E_transcript_Files__.ptx_.exe_
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], str.Save_E_Transcript_File_As
mov dword [ebp - 0x24], 0x80e
call fcn.0044ab00
mov edi, 0x2000
inc eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.0044b48e
add esp, 0x18
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x40705f
push 0x20
push dword [esi + 0x46c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push 0
jne 0x40706f
call fcn.0040825c
push eax
push str.Could_not_open_this_E_Transcript_file_for_reading.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call fcn.0044b35f
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebx, dword [sym.imp.KERNEL32.dll__lclose]
push eax
mov dword [ebp - 8], eax
call ebx
push 0x12
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [ebp - 8], 0xffffffff
jne 0x4070a4
push 0
call fcn.0040825c
push eax
push str.Could_not_create_the_destination_E_Transcript_file_for_writing.
jmp 0x407057
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x4070c4
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x4070a4
push dword [ebp - 0xc]
call ebx
push dword [ebp - 8]
call ebx
push str..ptx
push 0x2e
push dword [esi + 0x46c]
call fcn.0044ab00
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x407113
push 0x104
push dword [ebp - 4]
push dword [0x493b24]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x485f74
push dword [ebp - 4]
call edi
jmp 0x407119
mov eax, dword [ebp - 4]
and byte [eax], 0
push dword [ebp - 0x3c]
push dword [ebp - 4]
call edi
push 0x5c
push dword [ebp - 0x3c]
call fcn.0044ab00
and byte [eax], 0
pop ecx
pop ecx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x407148
push 0x485ec4
push dword [ebp - 0x3c]
call edi
push dword [ebp - 0x3c]
lea eax, [esi + 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esi + 0xbc]
add esi, 0xbc
call fcn.00408250
push eax
mov ecx, esi
call dword [edi]
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x407190
push 0
call fcn.0040825c
push eax
push str.Could_not_launch_the_new_copy_of_the_E_Transcript_file__will_run_from_the_temporary_folder_instead.
jmp 0x407057
push 1
pop eax
jmp 0x40706a