Function at 0x40ec40
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
push 0
push 0x400
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ec8a
push 6
call fcn.00438bca
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ecac
push dword [ebp + 8]
push 0
push 0x400
call fcn.0040f12d
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 0x200
push 1
mov ebx, 0x184
call fcn.0043a640
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ece1
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0x200
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ed0f
push 6
call fcn.00438bca
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40ed48
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [0xa7d27f]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ed3e
push 6
call fcn.00438bca
add esp, 4
mov eax, 0x46c300
jmp 0x40f105
lea eax, [ebp - 8]
push eax
call fcn.0040f736
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ed68
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 8], eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40ed7f
mov eax, 0x46c300
push eax
push 1
mov ebx, 0x174
call fcn.0043a520
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40eda9
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x46c300
push dword [ebp - 8]
call fcn.004010e7
add esp, 8
cmp eax, 0
jne 0x40edf7
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [0xa7d27f]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40ede8
push 6
call fcn.00438bca
add esp, 4
mov eax, 0x46c300
jmp 0x40f105
mov eax, dword [ebp - 8]
test eax, eax
je 0x40ee13
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.00438bd6
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40ee24
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x539828
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume6
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40ee69
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40ee93
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x539843
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume5
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40eed8
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40ef02
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x53985e
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume4
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40ef47
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40ef71
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x539879
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume3
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40efb6
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40efe0
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x539894
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume2
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40f025
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40f04f
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 0
mov ebx, 6
call fcn.004089e3
push reloc.WSOCK32.dll_connect
push 0
push 0x5398af
push reloc.WSOCK32.dll_connect
push 0
push str.DeviceHarddiskVolume1
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x40f094
mov eax, 0x46c300
push eax
push 6
mov ebx, 0x180
call fcn.0043b940
add esp, 0x4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40f0be
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [0xa7d27f]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40f0e4
push 6
call fcn.00438bca
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40f100
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.00438bd6
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40f105
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40f116
push ebx
call fcn.00438be2
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40f126
push ebx
call fcn.00438be2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4