Function at 0x140153760
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rsi, rcx
mov rbx, r9
xor r15d, r15d
mov edi, r15d
lea r14, str.amd64
nop word [rax + rax]
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.VBoxRT.dll_RTStrIStr]
mov rcx, rax
test rax, rax
jne 0x140153948
inc rdi
add r14, 0x10
cmp rdi, 0xc
jb 0x1401537a0
mov dword [rsi + 0x7e8], 0x57f00
movzx edx, byte [r12]
test dl, dl
je 0x140153817
movsx eax, dl
sub eax, 0x30
cmp eax, 0xa
jae 0x140153807
movsx ecx, byte [rbx - 1]
lea eax, [rcx - 0x21]
cmp eax, 0xf
jb 0x14015380f
lea eax, [rcx - 0x3a]
cmp eax, 7
jb 0x14015380f
lea eax, [rcx - 0x5b]
cmp eax, 6
jb 0x14015380f
lea eax, [rcx - 0x7b]
cmp eax, 4
jb 0x14015380f
inc rbx
movzx edx, byte [rbx]
jmp 0x1401537d4
test dl, dl
jne 0x14015397b
mov edx, 0x2d
mov rcx, r12
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140153846
nop dword [rax]
mov byte [rax], 0x20
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x140153830
mov rcx, r12
call qword [sym.imp.VBoxRT.dll_RTStrStrip]
lea rcx, [rsi + 0x7c8]
mov rdx, rax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov ecx, dword [rsi + 0x7e8]
mov eax, ecx
and eax, 0xf00
mov rdi, qword [rsp + 0x68]
cmp eax, 0xf00
jne 0x140153a4f
mov rbx, r15
lea rdx, str.images_pxeboot_vmlinuz
mov r14d, 0x5a4d
mov r12d, 0x14c
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x78], 0xffffffffffffffff
lea r9, [rsp + 0x78]
mov r8d, 0x781
mov rdx, qword [rbx + rdx]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTVfsFileOpen]
test eax, eax
js 0x140153a34
mov qword [rsp + 0x20], r15
mov r9d, VarR4FromUI1
mov r8, r13
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140153a13
cmp word [r13], r14w
jne 0x140153a13
movsxd rdx, dword [r13 + 0x3c]
mov qword [rsp + 0x20], r15
mov r9d, 0x108
mov r8, r13
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileReadAt]
test eax, eax
js 0x140153a13
cmp dword [r13], 0x4550
jne 0x140153a13
movzx eax, word [r13 + 4]
cmp ax, r12w
jne 0x1401539f5
and dword [rsi + 0x7e8], 0xfffff0ff
jmp 0x140153a13
add rdi, rdi
lea rax, str.amd64
mov ebx, dword [rax + rdi*8 + 8]
add rbx, rcx
mov eax, dword [rax + rdi*8 + 0xc]
or eax, 0x57000
mov dword [rsi + 0x7e8], eax
cmp byte [rbx], 0x2d
jne 0x140153978
nop dword [rax]
inc rbx
cmp byte [rbx], 0x2d
je 0x140153970
mov byte [rcx], r15b
test rbx, rbx
je 0x140153817
mov edx, 0x2d
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1401539b6
nop word [rax + rax]
mov byte [rax], 0x2e
lea rcx, [rax + 1]
mov edx, 0x2d
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x1401539a0
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTStrStrip]
lea rcx, [rsi + 0x7a8]
mov rdx, rax
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
mov byte [rbx], 0
jmp 0x140153817
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x8664
cmp ax, cx
jne 0x140153a13
and dword [rsi + 0x7e8], 0xfffff1ff
or dword [rsi + 0x7e8], 0x100
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.VBoxRT.dll_RTVfsFileRelease]
mov ecx, dword [rsi + 0x7e8]
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x140153a4f
jmp 0x140153a3a
mov ecx, dword [rsi + 0x7e8]
add rbx, 8
cmp rbx, 0x10
lea rdx, str.images_pxeboot_vmlinuz
jb 0x1401538a0
mov eax, ecx
and eax, 0xf00
cmp eax, 0xf00
jne 0x140153ab4
lea r14, str.EFI_BOOT_grubaa64.efi
mov rbx, r14
nop word [rax + rax]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, r13
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_RTVfsQueryPathInfo]
test eax, eax
js 0x140153aa1
mov eax, dword [r13 + 0x30]
and eax, 0xf000
cmp eax, 0x8000
je 0x140153aca
inc r15
add rbx, 0x10
cmp r15, 2
jb 0x140153a70
mov ecx, dword [rsi + 0x7e8]
and ecx, 0xf00
xor eax, eax
cmp ecx, 0xf00
sete al
jmp 0x1401539dd
add r15, r15
mov ecx, dword [rsi + 0x7e8]
and ecx, 0xfffff0ff
or ecx, dword [r14 + r15*8 + 8]
mov dword [rsi + 0x7e8], ecx
jmp 0x140153ab4