Function at 0x40fc87
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x73c
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x6a8]
mov esi, edx
push 0
push eax
call fcn.0041a3d0
add esp, 0xc
mov dword [ebp - 0x6c8], 0x43a7c0
xor eax, eax
mov dword [ebp - 0x6c4], 0x43828c
mov dword [ebp - 0x6f4], eax
xor ecx, ecx
mov dword [ebp - 0x6e0], eax
xor edi, edi
push 0x104
push eax
mov dword [ebp - 0x6d0], eax
xor ebx, ebx
mov byte [ebp - 0x6c9], al
mov dword [ebp - 0x6e4], eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x6c0], 0x43a7c4
mov dword [ebp - 0x6bc], 0x43a7c8
mov dword [ebp - 0x6b8], 0x43a7cc
mov dword [ebp - 0x6b4], 0x43a7d0
mov dword [ebp - 0x6b0], 0x43a7d4
mov dword [ebp - 0x6ac], 0x43a7d8
mov dword [ebp - 0x6d4], ecx
call fcn.0041a3d0
add esp, 0xc
push dword [esi + 4]
push str.FindProcessOccupyDisk_for_PhyDrive__d
call fcn.0040ffe0
push 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0041a3d0
add esp, 0x14
lea eax, [ebp - 0x298]
push dword [esi + 4]
push str..PhysicalDrive_d
push 0x80
push eax
call fcn.00401360
add esp, 0x10
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x40f486
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryDosDeviceA_failed_error:_u
call fcn.0040ffe0
push 0x4384f4
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0041d7b1
add esp, 0x14
jmp 0x40f49a
lea eax, [ebp - 0x218]
push eax
push str.QueryDosDeviceA_success__s
call fcn.0040ffe0
add esp, 8
xor ecx, ecx
cmp byte [ebp - 0x218], cl
je 0x40f4c7
cmp ecx, 0x104
jge 0x40f4c7
movsx ax, byte [ebp + ecx - 0x218]
mov word [ebp + ecx*2 - 0x6a8], ax
inc ecx
cmp byte [ebp + ecx - 0x218], bl
jne 0x40f4a4
lea eax, [ebp - 0x6a8]
mov dword [0x441530], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x4414e0], ebx
jne 0x40f550
push str.Ntdll
call eax
mov esi, eax
test esi, esi
jne 0x40f530
cmp word [0x4403d8], 0x20
jb 0x40f505
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40f530
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f530
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.NtQueryObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x4414e0], eax
mov eax, 0xc0000002
cmove edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp dword [0x441500], ebx
jne 0x40f5c8
push str.NtDll
call eax
mov esi, eax
test esi, esi
jne 0x40f5a9
cmp word [0x4403d8], 0x20
jb 0x40f57e
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40f5a9
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f5a9
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.NtDuplicateObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x441500], eax
test eax, eax
jne 0x40f5c8
test edi, edi
mov eax, 0xc0000002
cmovns edi, eax
cmp dword [0x4414f0], ebx
jne 0x40f667
push str.NtDll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40f629
cmp word [0x4403d8], 0x20
jb 0x40f5fe
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40f629
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f629
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.NtClose
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414f0], eax
test eax, eax
jne 0x40f667
test edi, edi
js 0x40f647
mov edi, 0xc0000002
mov ecx, edi
call fcn.0040eab0
push eax
push str.Warning:_Could_not_enumerate_process_handles:__s
call fcn.0040ffe0
mov edi, dword [ebp - 0x6d4]
add esp, 8
jmp 0x40fdfa
test edi, edi
js 0x40f647
cmp dword [0x4414e4], ebx
jne 0x40f715
mov eax, dword [0x4414f8]
test eax, eax
jne 0x40f6ee
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40f6d5
cmp word [0x4403d8], 0x20
jb 0x40f6aa
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40f6d5
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f6d5
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.RtlCreateHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414f8], eax
test eax, eax
je 0x40f642
push 0
push 0
push 0x100000
push 0x200000
push 0
push 3
call eax
mov dword [0x4414e4], eax
test eax, eax
jne 0x40f715
mov edi, 0x80000001
jmp 0x40f647
lea ecx, [ebp - 0x6d4]
call fcn.0040ed10
mov edi, eax
test edi, edi
js 0x40f647
mov ecx, dword [0x441530]
mov dword [ebp - 0x708], ebx
mov dword [ebp - 0x6f0], 1
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f743
sub ecx, edx
mov dword [ebp - 0x6e8], 0x200
sar ecx, 1
movzx eax, cx
mov ecx, 0x200
mov dword [ebp - 0x714], eax
call fcn.0040ec80
mov edi, dword [ebp - 0x6d4]
mov ebx, eax
mov dword [ebp - 0x6dc], ebx
test ebx, ebx
je 0x40fdfa
push dword [edi]
push str.handles__NumberOfHandles___lu
call fcn.0040ffe0
add esp, 8
cmp dword [edi], 0x2710
ja 0x40fdfa
push 0
call fcn.0041e6a3
mov ecx, dword [edi]
xor esi, esi
add esp, 4
mov dword [ebp - 0x70c], eax
mov dword [ebp - 0x710], edx
mov dword [ebp - 0x6ec], esi
test ecx, ecx
je 0x40fdfa
lea edx, [edi + 8]
mov dword [ebp - 0x700], edx
cmp esi, ecx
mov dword [ebp - 0x6fc], 8
mov eax, 0x51eb851f
mov ecx, esi
sbb edi, edi
and edi, edx
mul esi
mov dword [ebp - 0x6d8], edi
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
jne 0x40f822
push ecx
call fcn.0041e6a3
add esp, 4
sub eax, dword [ebp - 0x70c]
sbb edx, dword [ebp - 0x710]
test edx, edx
jg 0x40fdee
jl 0x40f822
cmp eax, 0xa
ja 0x40fde0
mov eax, dword [ebp - 0x6e0]
test eax, eax
je 0x40f846
cmp dword [ebp - 0x6d0], 0xffffffff
je 0x40f846
push eax
call dword [0x4414f0]
mov dword [ebp - 0x6e0], 0
test edi, edi
je 0x40f84f
mov eax, dword [edi + 4]
jmp 0x40f852
or eax, 0xffffffff
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp + ecx*4 - 0x708], eax
mov esi, dword [ebp - 0x708]
mov ebx, dword [ebp - 0x704]
cmp esi, ebx
je 0x40f8e6
inc ecx
and ecx, 0x80000001
jns 0x40f87d
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp byte [ebp - 0x6c9], 0
mov dword [ebp - 0x6f0], ecx
je 0x40f8c6
mov eax, dword [ebp - 0x6e4]
and eax, 7
push dword [ebp + eax*4 - 0x6c8]
lea eax, [ebp - 0x110]
push eax
push dword [ebp + ecx*4 - 0x708]
push str.___06u___s___s_
call fcn.0040ffe0
add esp, 0x10
mov byte [ebp - 0x6c9], 0
xor eax, eax
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x6d0]
test eax, eax
je 0x40f8e6
cmp eax, 0xffffffff
je 0x40f8dc
push eax
call dword [0x4414f0]
mov dword [ebp - 0x6d0], 0
mov ecx, dword [ebp - 0x6d4]
mov eax, dword [ebp - 0x6ec]
cmp eax, dword [ecx]
jae 0x40fdee
mov edi, dword [edi + 4]
cmp edi, dword [ebp - 0x6f4]
je 0x40fdb2
mov ecx, dword [ebp - 0x6d8]
test byte [ecx + 0xc], 0x23
je 0x40fdb2
cmp esi, ebx
je 0x40fa53
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jne 0x40f93a
mov dword [ebp - 0x6d0], 0xffffffff
jmp 0x40fdb2
mov eax, dword [0x4414e8]
test eax, eax
jne 0x40f9b8
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40f998
cmp word [0x4403d8], 0x20
jb 0x40f96d
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40f998
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40f998
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.NtOpenProcess
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414e8], eax
test eax, eax
jne 0x40f9b8
mov dword [ebp - 0x6d0], eax
jmp 0x40fdb2
lea ecx, [ebp - 0x720]
mov dword [ebp - 0x720], edi
push ecx
lea ecx, [ebp - 0x738]
mov dword [ebp - 0x71c], 0
push ecx
push 0x450
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x738], 0x18
push ecx
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x730], 0
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x724], 0
call eax
test eax, eax
jns 0x40fa4d
mov dword [ebp - 0x6d0], 0
cmp eax, 0xc0000022
jne 0x40fdb2
mov eax, dword [ebp - 0x6d8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x6f4], eax
jmp 0x40fdb2
mov ecx, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x6d0]
cmp eax, 0xffffffff
je 0x40fdb2
push 0
push 0
push 0
lea edx, [ebp - 0x6e0]
push edx
push 0xffffffffffffffff
push dword [ecx + 8]
push eax
call dword [0x441500]
test eax, eax
js 0x40fdb2
push dword [ebp - 0x6e0]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x40fdb2
mov ebx, dword [ebp - 0x6dc]
mov esi, dword [ebp - 0x6e8]
lea eax, [ebp - 0x6f8]
push eax
push esi
push ebx
push 1
push dword [ebp - 0x6e0]
call dword [0x4414e0]
mov edi, eax
cmp edi, 0x80000005
je 0x40fad9
cmp edi, 0xc0000004
je 0x40fad9
cmp edi, 0xc0000023
jne 0x40fb93
push dword [ebp - 0x6f8]
push esi
push str.SearchProcess:_Realloc_from__d_to__d
call fcn.0040ffe0
mov eax, dword [ebp - 0x6f8]
add esp, 0xc
mov dword [ebp - 0x6e8], eax
mov eax, dword [0x4414f4]
test eax, eax
jne 0x40fb6c
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40fb57
cmp word [0x4403d8], 0x20
jb 0x40fb2c
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40fb57
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40fb57
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414f4], eax
test eax, eax
je 0x40fb77
push ebx
push 0
push dword [0x4414e4]
call eax
mov esi, dword [ebp - 0x6e8]
mov ecx, esi
call fcn.0040ec80
sub dword [ebp - 0x6fc], 1
mov ebx, eax
jne 0x40faa4
mov dword [ebp - 0x6dc], ebx
test edi, edi
jns 0x40fbc3
mov ecx, edi
call fcn.0040eab0
mov esi, dword [ebp - 0x6d8]
push eax
push dword [esi + 4]
push dword [esi + 8]
push str.SearchProcess:_NtQueryObject_failed_for_handle__X_of_process__ld:__s
call fcn.0040ffe0
add esp, 0x10
jmp 0x40fdb2
mov eax, dword [ebp - 0x714]
cmp ax, word [ebx]
ja 0x40fdb2
movzx eax, ax
push eax
push dword [ebx + 4]
push dword [0x441530]
call fcn.0041e701
add esp, 0xc
test eax, eax
jne 0x40fdb2
mov eax, dword [ebp - 0x6d8]
mov ecx, dword [ebp - 0x6e4]
mov byte [ebp - 0x6c9], 1
or ecx, dword [eax + 0xc]
mov dword [ebp - 0x6e4], ecx
test cl, 0x20
je 0x40fc1c
and ecx, 3
or ecx, 4
mov dword [ebp - 0x6e4], ecx
cmp byte [ebp - 0x110], 0
jne 0x40fc38
push dword [0x441530]
push str.WARNING:_The_following_process_es__or_service_s__are_accessing__S:
call fcn.0040ffe0
add esp, 8
mov ecx, dword [ebp - 0x6d0]
mov dword [ebp - 0x718], 0x104
call fcn.0040ef50
mov esi, eax
test esi, esi
je 0x40fc81
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call fcn.0041d78b
add esp, 4
jmp 0x40fdb2
mov esi, dword [ebp - 0x6d0]
push 2
push 0x103
call fcn.0041d603
add esp, 8
mov edi, eax
push 0x103
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x40fce3
push 0
push 0
push 0x103
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x40fce3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x40fcf0
push edi
call fcn.0041d78b
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x40fdb2
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test al, al
je 0x40fd43
push esi
push esi
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x4a0]
push eax
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x40fdb2
push 0x104
lea eax, [ebp - 0x4a0]
push eax
push dword [ebp - 0x6d0]
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
setne bl
test eax, eax
je 0x40fd8a
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x4a0]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test bl, bl
jne 0x40fdb2
mov eax, dword [ebp - 0x6d8]
push 0
push dword [eax + 4]
lea eax, [ebp - 0x110]
push str.Unknown_Process_0x_llx
push 0x104
push eax
call fcn.00401360
add esp, 0x14
mov edi, dword [ebp - 0x6d4]
mov esi, dword [ebp - 0x6ec]
mov edx, dword [ebp - 0x700]
inc esi
add edx, 0x1c
mov dword [ebp - 0x6ec], esi
mov ecx, dword [edi]
mov dword [ebp - 0x700], edx
cmp esi, ecx
jb 0x40f7d1
jmp 0x40fdf4
mov ebx, dword [ebp - 0x6dc]
mov edi, dword [ebp - 0x6d4]
jmp 0x40fdfa
mov edi, dword [ebp - 0x6d4]
mov ebx, dword [ebp - 0x6dc]
cmp byte [ebp - 0x110], 0
je 0x40fe12
push str.You_should_close_these_applications_before_attempting_to_reformat_the_drive.
call fcn.0040ffe0
add esp, 4
jmp 0x40fe25
push dword [0x441530]
push str.NOTE:_Could_not_identify_the_process_es__or_service_s__accessing__S
call fcn.0040ffe0
add esp, 8
mov eax, dword [0x4414f4]
test ebx, ebx
je 0x40feb0
test eax, eax
jne 0x40fea0
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40fe8b
cmp word [0x4403d8], 0x20
jb 0x40fe60
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40fe8b
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40fe8b
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414f4], eax
test eax, eax
je 0x40feb0
push ebx
push 0
push dword [0x4414e4]
call eax
mov eax, dword [0x4414f4]
test edi, edi
je 0x40ff2d
test eax, eax
jne 0x40ff22
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40ff0d
cmp word [0x4403d8], 0x20
jb 0x40fee2
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40ff0d
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40ff0d
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.RtlFreeHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4414f4], eax
test eax, eax
je 0x40ff2d
push edi
push 0
push dword [0x4414e4]
call eax
mov ecx, dword [0x4414e4]
test ecx, ecx
je 0x40ffc1
mov eax, dword [0x441508]
test eax, eax
jne 0x40ffb4
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x40ff99
cmp word [0x4403d8], 0x20
jb 0x40ff6e
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040ffe0
add esp, 4
jmp 0x40ff99
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40ff99
mov cx, word [0x4403d8]
movzx eax, cx
inc cx
mov word [0x4403d8], cx
mov dword [eax*4 + 0x441ca0], esi
push str.RtlDestroyHeap
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x441508], eax
test eax, eax
je 0x40ffc1
mov ecx, dword [0x4414e4]
push ecx
call eax
neg eax
sbb eax, eax
and dword [0x4414e4], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418e9d
mov esp, ebp
pop ebp
ret