Function at 0x140007a70
Capabilities:
Disable driver code integrity
Get common file path
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
lea rbp, [r11 - 0x1b8]
sub rsp, 0x2a0
mov rax, qword [0x1400cc010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov qword [r11 + 0x18], rdi
lea rcx, [rsp + 0x70]
mov qword [r11 + 0x20], r13
xor edi, edi
mov qword [rdx], rdi
mov r12, rdx
mov eax, dword [str.CI.dll]
mov edx, 0x104
mov dword [rsp + 0x20], eax
mov r13d, edi
movzx eax, word [0x14007ec24]
mov word [rsp + 0x24], ax
movzx eax, byte [0x14007ec26]
mov qword [r11 - 0x20], r14
mov byte [rsp + 0x26], al
mov qword [r11 - 0x28], r15
mov byte [rsp + 0x70], dil
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140007af9
lea rcx, str._CI_Failed_to_get_ciMap_n
call fcn.140007a10
jmp 0x140007b48
lea r8, [0x14007ec28]
mov edx, 0x208
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [rsp + 0x20]
mov edx, 0x208
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdx, rax
lea rcx, str._CI_CiMap_pointer____p_n
mov r13, rax
call fcn.140007a10
mov ecx, dword [str.CI.dll]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x38], ecx
xor edx, edx
movzx ecx, word [0x14007ec24]
xor r8d, r8d
mov word [rsp + 0x3c], cx
mov r15, rdi
movzx ecx, byte [0x14007ec26]
mov byte [rsp + 0x3e], cl
lea ecx, [rdx + 0xb]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, eax
cmp eax, 0xc0000004
jne 0x140007cca
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x20]
add r8, r8
mov qword [rsp + 0x2c0], rsi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, edi
mov r14d, eax
cmp dword [rsi], ebx
jbe 0x140007ca6
nop word [rax + rax]
mov eax, ebx
mov edx, 2
imul rcx, rax, 0x128
lea rax, [rsp + 0x70]
add rcx, 8
add rcx, rsi
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140007c10
movups xmm0, xmmword [rcx]
lea rdx, [rbp - 0x68]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
lea rcx, [rsp + 0x38]
movzx eax, word [rbp - 0x6a]
add rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007c9f
inc ebx
cmp ebx, dword [rsi]
jb 0x140007bf0
jmp 0x140007ca6
mov r15, qword [rbp - 0x80]
mov r14d, edi
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x2c0]
test r14d, r14d
mov r14, qword [rsp + 0x298]
jns 0x140007ce5
lea rcx, str._CI_Failed_to_get_ciBase_n
call fcn.140007a10
jmp 0x140007cf4
mov rdx, r15
lea rcx, str._CI_CiBase_address____p_n
call fcn.140007a10
xor edx, edx
lea rcx, str.CI.dll
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
jne 0x140007d1b
lea rcx, str._CI_Failed_to_load_libary_n
call fcn.140007a10
lea rdx, str.CiInitialize
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140007d41
lea rcx, str._CI_Failed_to_Get_CiInitialize_address_n
call fcn.140007a10
jmp 0x140007d50
mov rdx, rbx
lea rcx, str._CI_CiInitialize_address___0x_p_n
call fcn.140007a10
cmp dword [0x1401ec4e0], 0x3fab
mov r10d, edi
movzx eax, byte [0x14007ec40]
mov r9d, edi
movups xmm1, xmmword [0x14007ec30]
mov r8, rbx
mov byte [rsp + 0x60], al
movsd xmm0, qword [0x14007ec48]
mov eax, dword [0x14007ec50]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x14007ec54]
mov byte [rsp + 0x4c], al
movups xmmword [rsp + 0x50], xmm1
movsd qword [rsp + 0x40], xmm0
jb 0x140007e13
lea rax, [rsp + 0x50]
sub r8, rax
nop word [rax + rax]
mov ecx, edi
lea rax, [rsp + 0x50]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007dc4
test dl, dl
jne 0x140007e0f
inc ecx
inc rax
cmp ecx, 0x10
jb 0x140007db7
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
mov r10d, eax
cmp r9d, 0xff
jl 0x140007db0
movd eax, xmm1
movzx ecx, di
test al, al
je 0x140007e70
nop word [rax + rax]
inc cx
movzx eax, cx
cmp byte [rsp + rax + 0x50], dil
jne 0x140007e00
jmp 0x140007e70
xor cl, cl
jmp 0x140007dd0
lea rax, [rsp + 0x40]
sub r8, rax
nop dword [rax + rax]
mov ecx, edi
lea rax, [rsp + 0x40]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007e34
test dl, dl
jne 0x140007e9b
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140007e27
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
mov r10d, eax
cmp r9d, 0xff
jl 0x140007e20
mov ecx, edi
cmp byte [rsp + 0x40], cl
je 0x140007e70
inc cx
movzx eax, cx
cmp byte [rsp + rax + 0x40], dil
jne 0x140007e63
movzx r8d, cx
movsxd rcx, r10d
lea rax, [rcx + r8]
mov edx, dword [rax + rbx]
add rbx, 4
add rdx, rcx
add rdx, r8
add rbx, rdx
jne 0x140007e9f
lea rcx, str._CI_Failed_to_get_CipInitialize_n
call fcn.140007a10
jmp 0x140007eae
xor cl, cl
jmp 0x140007e40
mov rdx, rbx
lea rcx, str._CI_CipInitialize_address____p_n
call fcn.140007a10
movzx eax, word [0x14007ec60]
mov r8, rbx
movsd xmm0, qword [0x14007ec58]
mov r10d, edi
mov word [rsp + 0x30], ax
mov r9d, edi
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
sub r8, rax
nop dword [rax]
mov ecx, edi
lea rax, [rsp + 0x28]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007ef8
test dl, dl
jne 0x140007f88
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140007ee7
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x140007ee0
cmp byte [rsp + 0x28], dil
je 0x140007f3d
nop word [rax + rax]
inc di
movzx eax, di
cmp byte [rsp + rax + 0x28], 0
jne 0x140007f30
movzx edx, di
add r15, 4
mov rdi, qword [rsp + 0x2d0]
lea rax, [r10 + rdx]
movsxd r8, dword [rax + rbx]
sub r8, r13
mov r13, qword [rsp + 0x2d8]
add r8, r10
add r8, rdx
add rbx, r8
add rbx, r15
mov r15, qword [rsp + 0x290]
jne 0x140007f8f
lea rcx, str._CI_Failed_to_get_G_CiOptions_n
call fcn.140007a10
mov eax, 0xc0000001
jmp 0x140007fa0
xor cl, cl
jmp 0x140007f04
mov rdx, rbx
lea rcx, str._CI_G_CiOptions_address___0x_p_n
call fcn.140007a10
xor eax, eax
mov qword [r12], rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14007b8c0
add rsp, 0x2a0
pop r12
pop rbx
pop rbp
ret