first you should get the return address that obviously points to the calling dll/exe.
you can do it by getting the 32bit value pointed by [esp+4] at the beginning of the hook (first operation) because when you use the inline assembly it's executed after the usual "push ebp; mov ebp,esp" sequence.
then you must obtain the "module" value which is nothing else than the starting address of the one you got (because I guess that you can't use directly the retrieved one, maybe try) and sincerely at the moment I don't know if exists an api to do it or if you must do a math calculation or a work-around.
for example the return address is 00b198fc while the module is 00400000
now get the process handle.
and finally call GetModuleFileNameEx:
http://msdn.microsoft.com/en-us/library ... 85%29.aspxnote that I have not tested this steps and so I don't have a working example code, do it by yourself
