Function at 0x1401539e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rsi, rcx
mov rbx, r9
xor r15d, r15d
mov edi, r15d
lea r14, str.amd64
nop word [rax + rax]
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.VBoxRT.dll_RTStrIStr]
mov rcx, rax
test rax, rax
jne 0x140153bc8
inc rdi
add r14, 0x10
cmp rdi, 0xc
jb 0x140153a20
mov dword [rsi + 0x408], 0x57f00
movzx edx, byte [r12]
test dl, dl
je 0x140153a97
movsx eax, dl
sub eax, 0x30
cmp eax, 0xa
jae 0x140153a87
movsx ecx, byte [rbx - 1]
lea eax, [rcx - 0x21]
cmp eax, 0xf
jb 0x140153a8f
lea eax, [rcx - 0x3a]
cmp eax, 7
jb 0x140153a8f
lea eax, [rcx - 0x5b]
cmp eax, 6
jb 0x140153a8f
lea eax, [rcx - 0x7b]
cmp eax, 4
jb 0x140153a8f
inc rbx
movzx edx, byte [rbx]
jmp 0x140153a54
test dl, dl
jne 0x140153bfb
mov edx, 0x2d
mov rcx, r12
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140153ac6
nop dword [rax]
mov byte [rax], 0x20
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140153ab0
mov rcx, r12
call qword [sym.imp.VBoxRT.dll_RTStrStrip]
lea rcx, [rsi + 0x3e8]
mov rdx, rax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov ecx, dword [rsi + 0x408]
mov eax, ecx
and eax, 0xf00
mov rdi, qword [rsp + 0x68]
cmp eax, 0xf00
jne 0x140153ccf
mov rbx, r15
lea rdx, str.images_pxeboot_vmlinuz
mov r14d, 0x5a4d
mov r12d, 0x14c
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x78], 0xffffffffffffffff
lea r9, [rsp + 0x78]
mov r8d, 0x781
mov rdx, qword [rbx + rdx]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTVfsFileOpen]
test eax, eax
js 0x140153cb4
mov qword [rsp + 0x20], r15
mov r9d, VarR4FromUI1
mov r8, r13
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140153c93
cmp word [r13], r14w
jne 0x140153c93
movsxd rdx, dword [r13 + 0x3c]
mov qword [rsp + 0x20], r15
mov r9d, 0x108
mov r8, r13
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140153c93
cmp dword [r13], 0x4550
jne 0x140153c93
movzx eax, word [r13 + 4]
cmp ax, r12w
jne 0x140153c75
and dword [rsi + 0x408], 0xfffff0ff
jmp 0x140153c93
add rdi, rdi
lea rax, str.amd64
mov ebx, dword [rax + rdi*8 + 8]
add rbx, rcx
mov eax, dword [rax + rdi*8 + 0xc]
or eax, 0x57000
mov dword [rsi + 0x408], eax
cmp byte [rbx], 0x2d
jne 0x140153bf8
nop dword [rax]
inc rbx
cmp byte [rbx], 0x2d
je 0x140153bf0
mov byte [rcx], r15b
test rbx, rbx
je 0x140153a97
mov edx, 0x2d
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140153c36
nop word [rax + rax]
mov byte [rax], 0x2e
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140153c20
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrStrip]
lea rcx, [rsi + 0x3c8]
mov rdx, rax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov byte [rbx], 0
jmp 0x140153a97
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8664
cmp ax, cx
jne 0x140153c93
and dword [rsi + 0x408], 0xfffff1ff
or dword [rsi + 0x408], 0x100
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileRelease]
mov ecx, dword [rsi + 0x408]
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x140153ccf
jmp 0x140153cba
mov ecx, dword [rsi + 0x408]
add rbx, 8
cmp rbx, 0x10
lea rdx, str.images_pxeboot_vmlinuz
jb 0x140153b20
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x140153d34
lea r14, str.EFI_BOOT_grubaa64.efi
mov rbx, r14
nop word [rax + rax]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, r13
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTVfsQueryPathInfo]
test eax, eax
js 0x140153d21
mov eax, dword [r13 + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x140153d4a
inc r15
add rbx, 0x10
cmp r15, 2
jb 0x140153cf0
mov ecx, dword [rsi + 0x408]
and ecx, 0xf00
xor eax, eax
cmp ecx, 0xf00
sete al
jmp 0x140153c5d
add r15, r15
mov ecx, dword [rsi + 0x408]
and ecx, 0xfffff0ff
or ecx, dword [r14 + r15*8 + 8]
mov dword [rsi + 0x408], ecx
jmp 0x140153d34