Function at 0x140141070
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rsi, rcx
mov rbx, r9
xor r15d, r15d
mov edi, r15d
lea r14, str.amd64
nop word [rax + rax]
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.BstkRT.dll_RTStrIStr]
mov rcx, rax
test rax, rax
jne 0x140141258
inc rdi
add r14, 0x10
cmp rdi, 0xc
jb 0x1401410b0
mov dword [rsi + 0x408], 0x57f00
movzx edx, byte [r12]
test dl, dl
je 0x140141127
movsx eax, dl
sub eax, 0x30
cmp eax, 0xa
jae 0x140141117
movsx ecx, byte [rbx - 1]
lea eax, [rcx - 0x21]
cmp eax, 0xf
jb 0x14014111f
lea eax, [rcx - 0x3a]
cmp eax, 7
jb 0x14014111f
lea eax, [rcx - 0x5b]
cmp eax, 6
jb 0x14014111f
lea eax, [rcx - 0x7b]
cmp eax, 4
jb 0x14014111f
inc rbx
movzx edx, byte [rbx]
jmp 0x1401410e4
test dl, dl
jne 0x14014128b
mov edx, 0x2d
mov rcx, r12
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140141156
nop dword [rax]
mov byte [rax], 0x20
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140141140
mov rcx, r12
call qword [sym.imp.BstkRT.dll_RTStrStrip]
lea rcx, [rsi + 0x3e8]
mov rdx, rax
call qword [sym.imp.BstkRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov ecx, dword [rsi + 0x408]
mov eax, ecx
and eax, 0xf00
mov rdi, qword [rsp + 0x68]
cmp eax, 0xf00
jne 0x14014135f
mov rbx, r15
lea rdx, str.images_pxeboot_vmlinuz
mov r14d, 0x5a4d
mov r12d, 0x14c
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x78], 0xffffffffffffffff
lea r9, [rsp + 0x78]
mov r8d, 0x781
mov rdx, qword [rbx + rdx]
mov rcx, rdi
call qword [sym.imp.BstkRT.dll_RTVfsFileOpen]
test eax, eax
js 0x140141344
mov qword [rsp + 0x20], r15
mov r9d, VarR4FromUI1
mov r8, r13
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.BstkRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140141323
cmp word [r13], r14w
jne 0x140141323
movsxd rdx, dword [r13 + 0x3c]
mov qword [rsp + 0x20], r15
mov r9d, 0x108
mov r8, r13
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.BstkRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140141323
cmp dword [r13], 0x4550
jne 0x140141323
movzx eax, word [r13 + 4]
cmp ax, r12w
jne 0x140141305
and dword [rsi + 0x408], 0xfffff0ff
jmp 0x140141323
add rdi, rdi
lea rax, str.amd64
mov ebx, dword [rax + rdi*8 + 8]
add rbx, rcx
mov eax, dword [rax + rdi*8 + 0xc]
or eax, 0x57000
mov dword [rsi + 0x408], eax
cmp byte [rbx], 0x2d
jne 0x140141288
nop dword [rax]
inc rbx
cmp byte [rbx], 0x2d
je 0x140141280
mov byte [rcx], r15b
test rbx, rbx
je 0x140141127
mov edx, 0x2d
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1401412c6
nop word [rax + rax]
mov byte [rax], 0x2e
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x1401412b0
mov rcx, rbx
call qword [sym.imp.BstkRT.dll_RTStrStrip]
lea rcx, [rsi + 0x3c8]
mov rdx, rax
call qword [sym.imp.BstkRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov byte [rbx], 0
jmp 0x140141127
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8664
cmp ax, cx
jne 0x140141323
and dword [rsi + 0x408], 0xfffff1ff
or dword [rsi + 0x408], 0x100
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.BstkRT.dll_RTVfsFileRelease]
mov ecx, dword [rsi + 0x408]
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x14014135f
jmp 0x14014134a
mov ecx, dword [rsi + 0x408]
add rbx, 8
cmp rbx, 0x10
lea rdx, str.images_pxeboot_vmlinuz
jb 0x1401411b0
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x1401413c4
lea r14, str.EFI_BOOT_grubaa64.efi
mov rbx, r14
nop word [rax + rax]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, r13
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.BstkRT.dll_RTVfsQueryPathInfo]
test eax, eax
js 0x1401413b1
mov eax, dword [r13 + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x1401413da
inc r15
add rbx, 0x10
cmp r15, 2
jb 0x140141380
mov ecx, dword [rsi + 0x408]
and ecx, 0xf00
xor eax, eax
cmp ecx, 0xf00
sete al
jmp 0x1401412ed
add r15, r15
mov ecx, dword [rsi + 0x408]
and ecx, 0xfffff0ff
or ecx, dword [r14 + r15*8 + 8]
mov dword [rsi + 0x408], ecx
jmp 0x1401413c4