Function at 0x40bd20
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, edx
push 0x206
push eax
mov word [ebp - 0x318], ax
lea eax, [ebp - 0x316]
push eax
call fcn.004198c0
add esp, 0xc
mov dword [ebp - 0x540], 0x42abb4
xor eax, eax
mov dword [ebp - 0x53c], 0x428edc
xor edi, edi
mov dword [ebp - 0x550], eax
mov byte [ebp - 0x110], al
push 0x103
push eax
lea eax, [ebp - 0x10f]
mov dword [ebp - 0x538], 0x42abb8
push eax
mov dword [ebp - 0x534], 0x42abbc
mov dword [ebp - 0x530], 0x42abc0
mov dword [ebp - 0x52c], 0x42abc4
mov dword [ebp - 0x528], 0x42abc8
mov dword [ebp - 0x524], 0x42abcc
mov dword [ebp - 0x54c], edi
mov dword [ebp - 0x568], edi
mov dword [ebp - 0x554], edi
mov dword [ebp - 0x548], edi
mov byte [ebp - 0x541], 0
call fcn.004198c0
add esp, 0xc
push dword [esi + 4]
push str.FindProcessOccupyDisk_for_PhyDrive__d
call fcn.0040c4e0
add esp, 8
lea edx, [ebp - 0x318]
mov ecx, esi
call fcn.0040bb90
lea eax, [ebp - 0x318]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x430124], eax
cmp dword [0x43011c], edi
jne 0x40be8c
push str.Ntdll
call ebx
mov esi, eax
test esi, esi
jne 0x40be71
cmp word [0x430110], 0x20
jb 0x40be46
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040c4e0
add esp, 4
jmp 0x40be71
push str.Ntdll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40be71
mov cx, word [0x430110]
movzx eax, cx
inc cx
mov word [0x430110], cx
mov dword [eax*4 + 0x432980], esi
push str.NtQueryObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x43011c], eax
mov eax, 0xc0000002
cmove edi, eax
cmp dword [0x430130], 0
jne 0x40bf05
push str.NtDll
call ebx
mov esi, eax
test esi, esi
jne 0x40bee6
cmp word [0x430110], 0x20
jb 0x40bebb
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040c4e0
add esp, 4
jmp 0x40bee6
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40bee6
mov cx, word [0x430110]
movzx eax, cx
inc cx
mov word [0x430110], cx
mov dword [eax*4 + 0x432980], esi
push str.NtDuplicateObject
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x430130], eax
test eax, eax
jne 0x40bf05
test edi, edi
mov eax, 0xc0000002
cmovns edi, eax
cmp dword [0x430108], 0
jne 0x40bf9d
push str.NtDll
call ebx
mov esi, eax
test esi, esi
jne 0x40bf63
cmp word [0x430110], 0x20
jb 0x40bf38
push str.Error:_MAX_LIBRARY_HANDLES_is_too_small_n
call fcn.0040c4e0
add esp, 4
jmp 0x40bf63
push str.NtDll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40bf63
mov cx, word [0x430110]
movzx eax, cx
inc cx
mov word [0x430110], cx
mov dword [eax*4 + 0x432980], esi
push str.NtClose
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x430108], eax
test eax, eax
jne 0x40bf9d
test edi, edi
js 0x40bf81
mov edi, 0xc0000002
mov ecx, edi
call fcn.0040b140
push eax
push str.Warning:_Could_not_enumerate_process_handles:__s
call fcn.0040c4e0
add esp, 8
xor ebx, ebx
jmp 0x40c47c
test edi, edi
js 0x40bf81
call fcn.0040b2f0
mov edi, eax
test edi, edi
js 0x40bf81
lea ecx, [ebp - 0x54c]
call fcn.0040b590
mov edi, eax
test edi, edi
js 0x40bf81
mov ecx, dword [0x430124]
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x570], 1
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40bfe0
sub ecx, edx
mov dword [ebp - 0x558], 0x200
sar ecx, 1
movzx eax, cx
mov ecx, 0x200
mov dword [ebp - 0x584], eax
call fcn.0040b470
mov ebx, eax
mov dword [ebp - 0x560], ebx
test ebx, ebx
je 0x40c47c
mov ecx, dword [ebp - 0x54c]
xor eax, eax
lea edx, [ecx + 8]
cmp eax, dword [ecx]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x554]
sbb edi, edi
and edi, edx
mov dword [ebp - 0x56c], edx
mov dword [ebp - 0x588], 8
mov dword [ebp - 0x580], edi
test eax, eax
je 0x40c06d
cmp dword [ebp - 0x548], 0xffffffff
je 0x40c06d
push eax
call dword [0x430108]
mov dword [ebp - 0x554], 0
test edi, edi
je 0x40c076
mov eax, dword [edi + 4]
jmp 0x40c079
or eax, 0xffffffff
mov ecx, dword [ebp - 0x570]
mov dword [ebp + ecx*4 - 0x578], eax
mov esi, dword [ebp - 0x578]
mov ebx, dword [ebp - 0x574]
cmp esi, ebx
je 0x40c10d
inc ecx
and ecx, 0x80000001
jns 0x40c0a4
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp byte [ebp - 0x541], 0
mov dword [ebp - 0x570], ecx
je 0x40c0ed
mov eax, dword [ebp - 0x550]
and eax, 7
push dword [ebp + eax*4 - 0x540]
lea eax, [ebp - 0x110]
push eax
push dword [ebp + ecx*4 - 0x578]
push str.___06u___s___s_
call fcn.0040c4e0
add esp, 0x10
mov byte [ebp - 0x541], 0
xor eax, eax
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x548]
test eax, eax
je 0x40c10d
cmp eax, 0xffffffff
je 0x40c103
push eax
call dword [0x430108]
mov dword [ebp - 0x548], 0
mov ecx, dword [ebp - 0x54c]
mov eax, dword [ebp - 0x55c]
cmp eax, dword [ecx]
jae 0x40c476
mov eax, dword [edi + 4]
cmp eax, dword [ebp - 0x568]
je 0x40c45b
test byte [edi + 0xc], 0x23
je 0x40c45b
cmp esi, ebx
je 0x40c18a
push eax
lea ecx, [ebp - 0x548]
call fcn.0040b6e0
add esp, 4
test eax, eax
jns 0x40c18a
mov dword [ebp - 0x548], 0
cmp eax, 0xc0000022
jne 0x40c45b
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x56c]
mov ecx, dword [ebp - 0x54c]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x55c]
inc eax
add edx, 0x1c
jmp 0x40c027
mov eax, dword [ebp - 0x548]
cmp eax, 0xffffffff
je 0x40c45b
push 0
push 0
push 0
lea ecx, [ebp - 0x554]
push ecx
push 0xffffffffffffffff
push dword [edi + 8]
push eax
call dword [0x430130]
test eax, eax
js 0x40c45b
push dword [ebp - 0x554]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x40c45b
mov ebx, dword [ebp - 0x560]
mov edi, dword [ebp - 0x588]
jmp 0x40c1e0
lea eax, [ebp - 0x564]
push eax
push dword [ebp - 0x558]
push ebx
push 1
push dword [ebp - 0x554]
call dword [0x43011c]
mov esi, eax
cmp esi, 0x80000005
je 0x40c216
cmp esi, 0xc0000004
je 0x40c216
cmp esi, 0xc0000023
jne 0x40c252
push dword [ebp - 0x564]
push dword [ebp - 0x558]
push str.SearchProcess:_Realloc_from__d_to__d
call fcn.0040c4e0
mov eax, dword [ebp - 0x564]
add esp, 0xc
mov ecx, ebx
mov dword [ebp - 0x558], eax
call fcn.0040b500
mov ecx, dword [ebp - 0x558]
call fcn.0040b470
mov ebx, eax
dec edi
jne 0x40c1e0
mov edi, dword [ebp - 0x580]
mov dword [ebp - 0x560], ebx
test esi, esi
jns 0x40c298
mov ecx, esi
call fcn.0040b140
push eax
push dword [edi + 4]
push dword [edi + 8]
push str.SearchProcess:_NtQueryObject_failed_for_handle__X_of_process__ld:__s
call fcn.0040c4e0
mov eax, dword [ebp - 0x55c]
add esp, 0x10
mov edx, dword [ebp - 0x56c]
inc eax
mov ecx, dword [ebp - 0x54c]
add edx, 0x1c
jmp 0x40c027
mov eax, dword [ebp - 0x584]
cmp ax, word [ebx]
ja 0x40c45b
movzx eax, ax
push eax
push dword [ebx + 4]
push dword [0x430124]
call fcn.00414950
add esp, 0xc
test eax, eax
jne 0x40c45b
mov eax, dword [ebp - 0x550]
or eax, dword [edi + 0xc]
mov byte [ebp - 0x541], 1
mov dword [ebp - 0x550], eax
test al, 0x20
je 0x40c2ea
and eax, 3
or eax, 4
mov dword [ebp - 0x550], eax
cmp byte [ebp - 0x110], 0
jne 0x40c306
push dword [0x430124]
push str.WARNING:_The_following_process_es__or_service_s__are_accessing__S:
call fcn.0040c4e0
add esp, 8
mov ecx, dword [ebp - 0x548]
mov dword [ebp - 0x57c], 0x104
call fcn.0040b7e0
mov esi, eax
lea eax, [ebp - 0x110]
test esi, esi
je 0x40c365
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call fcn.00413ba8
mov eax, dword [ebp - 0x55c]
add esp, 4
mov edx, dword [ebp - 0x56c]
inc eax
mov ecx, dword [ebp - 0x54c]
add edx, 0x1c
jmp 0x40c027
push ecx
mov ecx, dword [ebp - 0x548]
push eax
call fcn.0040bc90
add esp, 8
test eax, eax
setne al
test al, al
jne 0x40c45b
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x520]
push eax
push 0
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test al, al
je 0x40c3e3
push 0
push 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x520]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x55c]
mov edx, dword [ebp - 0x56c]
inc eax
mov ecx, dword [ebp - 0x54c]
add edx, 0x1c
jmp 0x40c027
push 0x104
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0x548]
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
push 0
setne al
test al, al
lea eax, [ebp - 0x110]
je 0x40c445
push 0
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x520]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x55c]
mov edx, dword [ebp - 0x56c]
inc eax
mov ecx, dword [ebp - 0x54c]
add edx, 0x1c
jmp 0x40c027
push dword [edi + 4]
push str.Unknown_Process_0x_llx
push 0x104
push eax
call fcn.004136cf
add esp, 0x14
mov eax, dword [ebp - 0x55c]
mov edx, dword [ebp - 0x56c]
inc eax
mov ecx, dword [ebp - 0x54c]
add edx, 0x1c
jmp 0x40c027
mov ebx, dword [ebp - 0x560]
cmp byte [ebp - 0x110], 0
je 0x40c494
push str.You_should_close_these_applications_before_attempting_to_reformat_the_drive.
call fcn.0040c4e0
add esp, 4
jmp 0x40c4a7
push dword [0x430124]
push str.NOTE:_Could_not_identify_the_process_es__or_service_s__accessing__S
call fcn.0040c4e0
add esp, 8
mov ecx, ebx
call fcn.0040b500
mov ecx, dword [ebp - 0x54c]
call fcn.0040b500
call fcn.0040b3b0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004136c0
mov esp, ebp
pop ebp
ret