Function at 0x49e202
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
push 0
push 0x400
call dword [sym.imp.kernel32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x49e24c
push 6
call fcn.0053559b
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49e26e
push dword [ebp + 8]
push 0
push 0x400
call fcn.0049e6ab
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.005383c0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49e2a3
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0x200
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.psapi.dll_GetProcessImageFileNameA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x49e2d1
push 6
call fcn.0053559b
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49e2e8
mov eax, 0x618809
jmp 0x49e683
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x49e30a
push 6
call fcn.0053559b
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.0049eccd
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49e32a
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 8], eax
push SysStringLen
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x49e341
mov eax, 0x618809
push eax
push 1
mov ebx, 0x174
call fcn.00538400
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49e36b
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x618809
push dword [ebp - 8]
call fcn.0049e165
add esp, 8
cmp eax, 0
jne 0x49e397
mov eax, 0x618843
jmp 0x49e683
mov eax, dword [ebp - 8]
test eax, eax
je 0x49e3b3
push eax
mov ebx, eax
call fcn.0049d8e2
inc eax
push eax
call fcn.00535595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e3c4
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x618845
push SysStringLen
push 0
push str.DeviceHarddiskVolume6
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e409
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e433
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x618860
push SysStringLen
push 0
push str.DeviceHarddiskVolume5
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e478
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e4a2
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x61887b
push SysStringLen
push 0
push str.DeviceHarddiskVolume4
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e4e7
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e511
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x618896
push SysStringLen
push 0
push str.DeviceHarddiskVolume3
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e556
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e580
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x6188b1
push SysStringLen
push 0
push str.DeviceHarddiskVolume2
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e5c5
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e5ef
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.oleaut32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.0049dd5e
push SysStringLen
push 0
push 0x6188cc
push SysStringLen
push 0
push str.DeviceHarddiskVolume1
push SysStringLen
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x49e634
mov eax, 0x618809
push eax
push 6
mov ebx, 0x180
call fcn.00536980
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e65e
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49e67e
push eax
mov ebx, eax
call fcn.0049d8e2
inc eax
push eax
call fcn.00535595
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x49e683
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x49e694
push ebx
call fcn.0053558f
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x49e6a4
push ebx
call fcn.0053558f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4