Function at 0x90dff0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.vgsvcPageSharingInspectGuest_n
push 3
call fcn.00902480
add esp, 8
mov dword [ebp - 0x210], 0
cmp dword [0x991ee0], 0
je 0x90e10d
cmp dword [0x991ee4], 0
je 0x90e10d
cmp dword [0x991ee8], 0
je 0x90e10d
cmp dword [0x991eec], 0
je 0x90e10d
mov esi, dword [0x991edc]
test esi, esi
je 0x90e10d
push 0
push 2
mov ecx, esi
call dword [section..rdata]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x90e09d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.vgsvcPageSharingInspectGuest:_CreateToolhelp32Snapshot_failed_with__d_n
push 3
call fcn.00902480
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [0x991ee0]
mov ebx, eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
mov ecx, esi
call dword [section..rdata]
call esi
jmp 0x90e0d0
mov eax, dword [ebp - 0x124]
cmp eax, ebx
je 0x90e0ea
lea ecx, [ebp - 0x210]
push ecx
push eax
call fcn.0090e4a0
add esp, 8
mov esi, dword [0x991ee4]
lea eax, [ebp - 0x12c]
push eax
push edi
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
jne 0x90e0d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x991ef8]
test esi, esi
je 0x90e468
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0
push eax
push 0
push eax
push 0xb
mov ecx, esi
call dword [section..rdata]
call esi
mov eax, dword [ebp - 0x208]
test eax, eax
jne 0x90e159
push str.ZwQuerySystemInformation_returned_length_0_n
push 1
call fcn.00902480
add esp, 8
jmp 0x90e468
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxServiceVBoxServicePageSharing.cpp
push eax
call fcn.0091be60
mov edi, eax
add esp, 8
mov dword [ebp - 0x214], edi
test edi, edi
je 0x90e468
mov esi, dword [0x991ef8]
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x208]
mov ecx, esi
push edi
push 0xb
call dword [section..rdata]
call esi
test eax, eax
je 0x90e1b0
push eax
push str.ZwQuerySystemInformation_returned__x__1__n
push 1
call fcn.00902480
add esp, 0xc
jmp 0x90e45f
xor ebx, ebx
mov dword [ebp - 0x20c], ebx
cmp dword [edi], ebx
jbe 0x90e45f
mov eax, 0xffffffe0
lea esi, [edi + 0x20]
sub eax, edi
mov dword [ebp - 0x218], eax
lea ecx, [eax + esi]
movzx eax, word [esi - 2]
add eax, ecx
movzx eax, byte [eax + edi + 0x20]
push eax
push str._n_n___KERNEL__MODULE_NAME:______s
push 4
call fcn.00902480
push esi
push str._n_____executable_______s
push 4
call fcn.00902480
push dword [esi - 0xc]
push str._n_____flags___________0x_08X_n
push 4
call fcn.00902480
add esp, 0x24
cmp dword [esi - 0xc], 0
je 0x90e444
push dword [esi - 0x14]
lea eax, [ebp - 0x210]
push eax
call fcn.0092f8f0
add esp, 8
test eax, eax
jne 0x90e444
push dword [esi - 0x14]
push 0x991e18
call fcn.0092fac0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x90e42e
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxServiceVBoxServicePageSharing.cpp
push 0x248
call fcn.0091be60
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x90e45f
mov ecx, dword [ebp - 0x218]
lea edx, [ebx + 0x44]
movzx eax, word [esi - 2]
add ecx, 0x20
mov edi, dword [ebp - 0x214]
add ecx, esi
add eax, ecx
add eax, edi
push eax
push edx
call fcn.009014d0
add esp, 8
lea eax, [ebp - 0x204]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esi + 1]
push 0x5c
push eax
call fcn.00901460
add esp, 8
test eax, eax
jne 0x90e37f
push 0x94ff90
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0092fd70
push esi
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0092fd70
lea eax, [ebp - 0x204]
push eax
push str.Unexpected_kernel_module_name_try__s_n
push 3
call fcn.00902480
lea eax, [ebp - 0x204]
push eax
call fcn.0092fce0
add esp, 0x28
test al, al
jne 0x90e3ac
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.drivers_
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0092fd70
push esi
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0092fd70
lea eax, [ebp - 0x204]
push eax
push str.Unexpected_kernel_module_name_try__s_n
push 3
call fcn.00902480
lea eax, [ebp - 0x204]
push eax
call fcn.0092fce0
add esp, 0x28
test al, al
jne 0x90e3ac
push esi
push str.Unexpected_kernel_module_name__s_n
push 1
call fcn.00902480
push ebx
call fcn.0091be80
add esp, 0x10
jmp 0x90e43e
inc eax
push 0x5c
push eax
call fcn.00901460
add esp, 8
test eax, eax
jne 0x90e397
push esi
push str.Unexpected_kernel_module_name__s__2__n
jmp 0x90e36a
push eax
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0092fd70
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
lea edi, [ebx + 0x144]
push edi
call fcn.009014d0
mov eax, dword [esi - 0x14]
mov dword [ebx + 0x38], eax
mov eax, dword [esi - 0x10]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi - 0x14]
push 0
push ebx
mov dword [ebx], eax
call fcn.0090e6e0
lea eax, [ebx + 0x44]
push eax
push str._n_n___KERNEL__MODULE_NAME:______s
push 3
call fcn.00902480
push edi
push str._n_____executable_______s
push 3
call fcn.00902480
push dword [ebx + 0x38]
push str._n_____base_address_____010p
push 3
call fcn.00902480
push dword [esi - 0xc]
push str._n_____flags___________0x_08X
push 3
call fcn.00902480
add esp, 0x40
push dword [ebx + 0x3c]
push str._n_____base_size________d
push 3
call fcn.00902480
mov edi, dword [ebp - 0x214]
add esp, 0xc
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.0092f920
add esp, 8
mov ebx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x218]
inc ebx
add esi, 0x11c
mov dword [ebp - 0x20c], ebx
cmp ebx, dword [edi]
jb 0x90e1d0
push edi
call fcn.0091be80
add esp, 4
push 0
push 0x90df90
push 0x991e18
call fcn.0092f840
add esp, 0xc
call fcn.0094bbb0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
xor ecx, ebp
pop edi
pop esi
mov dword [0x991e18], eax
pop ebx
call fcn.00901200
mov esp, ebp
pop ebp
ret