Function at 0x404a69
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x35c]
test eax, eax
je 0x404c30
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
and dword [ebp - 0xc], 0
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.0042a630
pop ecx
test eax, eax
pop ecx
je 0x404c30
lea eax, [ebp - 0x15c]
push 0x5c
push eax
call fcn.0042a630
and byte [eax], 0
push str.TEMP
call fcn.0042b3d0
add esp, 0xc
test eax, eax
je 0x404ae5
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404b4d
push 0x43d9ac
call fcn.0042b3d0
test eax, eax
pop ecx
je 0x404b06
push eax
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x404b4d
mov edi, 0x104
push edi
call fcn.0042b315
pop ecx
mov dword [ebp - 8], eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebp - 8]
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404b38
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call fcn.0042b268
cmp dword [ebp - 0xc], 0
pop ecx
je 0x404c30
jmp 0x404b52
mov edi, 0x104
push 0x24
call fcn.00405cc3
push eax
push str.This_E_Transcript_file_is_in_a_temporary_folder._Do_you_want_to_save_it_to_a_different_folder__r_n_r_nIf_you_choose_Yes__you_will_be_prompted_for_a_save_location__and_the_transcript_will_be_automatically_re_launched_from_there.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x404c30
push 0x5c
push dword [esi + 0x35c]
call fcn.0042a630
pop ecx
inc eax
pop ecx
push eax
lea eax, [ebp - 0x15c]
push eax
call ebx
push 0x4c
lea eax, [ebp - 0x58]
pop ebx
push ebx
push 0
push eax
call fcn.0042b210
lea eax, [ebp - 0x15c]
push 0x2e
push dword [esi + 0x35c]
mov dword [ebp - 0x3c], eax
lea eax, [esi + 0x4e0]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], str.E_transcript_Files__.ptx_.exe_
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], str.Save_E_Transcript_File_As
mov dword [ebp - 0x24], 0x80e
call fcn.0042a630
mov edi, 0x2000
inc eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042b315
add esp, 0x18
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x404c27
push 0x20
push dword [esi + 0x35c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push 0
jne 0x404c37
call fcn.00405cc3
push eax
push str.Could_not_open_this_E_Transcript_file_for_reading.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 4]
call fcn.0042b268
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lcreat]
mov ebx, dword [sym.imp.KERNEL32.dll__lclose]
push eax
mov dword [ebp - 8], eax
call ebx
push 0x12
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp dword [ebp - 8], 0xffffffff
jne 0x404c6c
push 0
call fcn.00405cc3
push eax
push str.Could_not_create_the_destination_E_Transcript_file_for_writing.
jmp 0x404c1f
push edi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll__lread]
test eax, eax
je 0x404c8c
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll__lwrite]
jmp 0x404c6c
push dword [ebp - 0xc]
call ebx
push dword [ebp - 8]
call ebx
push str..ptx
push 0x2e
push dword [esi + 0x35c]
call fcn.0042a630
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x404cdb
push 0x104
push dword [ebp - 4]
push dword [0x446760]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x43d9a0
push dword [ebp - 4]
call edi
jmp 0x404ce1
mov eax, dword [ebp - 4]
and byte [eax], 0
push dword [ebp - 0x3c]
push dword [ebp - 4]
call edi
push 0x5c
push dword [ebp - 0x3c]
call fcn.0042a630
and byte [eax], 0
pop ecx
pop ecx
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jge 0x404d10
push 0x43d99c
push dword [ebp - 0x3c]
call edi
push dword [ebp - 0x3c]
lea eax, [esi + 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi]
lea ecx, [esi + 0x258]
push ecx
mov ecx, esi
call dword [eax]
push 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x404d4f
push 0
call fcn.00405cc3
push eax
push str.Could_not_launch_the_new_copy_of_the_E_Transcript_file__will_run_from_the_temporary_folder_instead.
jmp 0x404c1f
push 1
pop eax
jmp 0x404c32