Function at 0x1400040e8
Capabilities:
Check for software breakpoints
Disable driver code integrity

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and qword [r8], 0
lea rdx, str.CiInitialize
mov r14d, r9d
mov r13, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14000412e
mov eax, 0xc000007a
jmp 0x140004184
xor eax, eax
lea rdi, [rbp - 0x28]
xor ebx, ebx
mov r15d, 0x1000
lea ecx, [rax + 0x25]
rep stosb byte [rdi], al
cmp r14d, 0x3fab
jae 0x140004193
mov edi, ebx
lea rdx, [rbp - 0x28]
add rdi, rsi
mov rcx, rdi
call fcn.140004bf8
test dword [rbp - 7], r15d
jne 0x14000417f
movzx ecx, byte [rbp - 0x28]
mov eax, ecx
cmp ecx, 5
jne 0x140004175
cmp byte [rdi], 0xe9
je 0x14000431e
add ebx, eax
cmp ebx, 0x100
jb 0x14000414a
mov eax, 0xc0000001
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13d, 3
mov r14d, ebx
lea rdx, [rbp - 0x28]
add r14, rsi
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 7], r15d
jne 0x14000417f
movzx ecx, byte [rbp - 0x28]
cmp ecx, r13d
jne 0x140004257
xor eax, eax
lea rdi, [rbp - 0x50]
lea rdx, [rbp - 0x50]
lea ecx, [rax + 0x25]
rep stosb byte [rdi], al
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 0x2f], r15d
jne 0x140004254
cmp byte [rbp - 0x50], 3
jne 0x140004254
cmp byte [r14], 0x4c
jne 0x140004254
lea eax, [rbx + 1]
cmp byte [rax + rsi], 0x8b
jne 0x140004254
lea edi, [rbx + 3]
mov r14d, edi
lea rdx, [rbp - 0x50]
add r14, rsi
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 0x2f], r15d
jne 0x140004254
cmp byte [rbp - 0x50], 3
jne 0x140004254
mov al, byte [r14]
sub al, 0x44
test al, 0xf7
je 0x140004223
lea eax, [rdi + 1]
cmp byte [rax + rsi], 0x8b
jne 0x140004254
add edi, 3
lea rdx, [rbp - 0x50]
mov r14d, edi
add r14, rsi
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 0x2f], r15d
jne 0x140004254
mov al, byte [rbp - 0x50]
cmp al, 3
jne 0x14000426d
cmp byte [r14], 0x48
jne 0x140004254
lea eax, [rdi + 1]
cmp byte [rax + rsi], 0x8b
je 0x1400042a3
mov cl, byte [rbp - 0x28]
movzx eax, cl
add ebx, eax
cmp ebx, 0x100
jb 0x140004199
jmp 0x14000417f
cmp al, 5
jne 0x140004254
cmp byte [r14], 0x48
jne 0x140004254
lea eax, [rdi + 1]
cmp byte [rax + rsi], 0x89
jne 0x140004254
add edi, 5
lea rdx, [rbp - 0x50]
mov r14d, edi
add r14, rsi
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 0x2f], r15d
jne 0x140004254
cmp byte [rbp - 0x50], 3
jne 0x140004254
jmp 0x140004245
add edi, 3
lea rdx, [rbp - 0x50]
mov r14d, edi
add r14, rsi
mov rcx, r14
call fcn.140004bf8
test dword [rbp - 0x2f], r15d
jne 0x140004254
cmp byte [rbp - 0x50], 2
jne 0x140004254
cmp byte [r14], 0x8b
jne 0x140004254
lea eax, [rdi + 1]
cmp byte [rax + rsi], 0xcd
jne 0x140004254
lea r14d, [rdi + 2]
test r14d, r14d
je 0x140004254
mov edi, r14d
lea rdx, [rbp - 0x28]
add rdi, rsi
mov r13d, 5
mov rcx, rdi
call fcn.140004bf8
test dword [rbp - 7], r15d
jne 0x14000417f
mov cl, byte [rbp - 0x28]
cmp cl, r13b
jne 0x140004257
cmp byte [rdi], 0xe8
jne 0x140004257
mov r13, qword [rbp + 0x50]
mov ebx, r14d
mov edx, dword [rdi + 1]
test edx, edx
je 0x14000417f
movzx ecx, cl
mov eax, ebx
add rcx, rax
movsxd r14, edx
add r14, rsi
add r14, rcx
xor edi, edi
lea rbx, [rdi + r14]
mov esi, edi
mov rcx, rbx
lea rdx, [rbp - 0x28]
call fcn.140004bf8
test dword [rbp - 7], r15d
jne 0x14000417f
movzx eax, byte [rbp - 0x28]
cmp eax, 6
jne 0x14000436b
mov ecx, 0xd89
cmp word [rbx], cx
je 0x14000437a
add edi, eax
cmp edi, 0x100
jb 0x14000433c
jmp 0x14000417f
cmp dword [rbx + 2], 0
je 0x14000417f
movsxd rax, dword [rbx + 2]
movzx ecx, byte [rbp - 0x28]
add rcx, rax
sub rcx, qword [rbp + 0x40]
add rcx, rsi
add rcx, r14
add rcx, qword [rbp + 0x48]
mov qword [r13], rcx
xor eax, eax
jmp 0x140004184