Function at 0x1400078c0
Capabilities:
Disable driver code integrity
Get common file path
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
lea rbp, [r11 - 0x1b8]
sub rsp, 0x2a0
mov rax, qword [0x1400c8040]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov qword [r11 + 0x18], rdi
lea rcx, [rsp + 0x70]
mov qword [r11 + 0x20], r13
xor edi, edi
mov qword [rdx], rdi
mov r12, rdx
mov eax, dword [str.CI.dll]
mov edx, 0x104
mov dword [rsp + 0x20], eax
mov r13d, edi
movzx eax, word [0x14007acfc]
mov word [rsp + 0x24], ax
movzx eax, byte [0x14007acfe]
mov qword [r11 - 0x20], r14
mov byte [rsp + 0x26], al
mov qword [r11 - 0x28], r15
mov byte [rsp + 0x70], dil
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140007949
lea rcx, str._CI_Failed_to_get_ciMap_n
call fcn.140007850
jmp 0x140007998
lea r8, [0x14007ad00]
mov edx, 0x208
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [rsp + 0x20]
mov edx, 0x208
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdx, rax
lea rcx, str._CI_CiMap_pointer____p_n
mov r13, rax
call fcn.140007850
mov ecx, dword [str.CI.dll]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x38], ecx
xor edx, edx
movzx ecx, word [0x14007acfc]
xor r8d, r8d
mov word [rsp + 0x3c], cx
mov r15, rdi
movzx ecx, byte [0x14007acfe]
mov byte [rsp + 0x3e], cl
lea ecx, [rdx + 0xb]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, eax
cmp eax, 0xc0000004
jne 0x140007b1a
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x20]
add r8, r8
mov qword [rsp + 0x2c0], rsi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, edi
mov r14d, eax
cmp dword [rsi], ebx
jbe 0x140007af6
nop word [rax + rax]
mov eax, ebx
mov edx, 2
imul rcx, rax, 0x128
lea rax, [rsp + 0x70]
add rcx, 8
add rcx, rsi
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140007a60
movups xmm0, xmmword [rcx]
lea rdx, [rbp - 0x68]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
lea rcx, [rsp + 0x38]
movzx eax, word [rbp - 0x6a]
add rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007aef
inc ebx
cmp ebx, dword [rsi]
jb 0x140007a40
jmp 0x140007af6
mov r15, qword [rbp - 0x80]
mov r14d, edi
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x2c0]
test r14d, r14d
mov r14, qword [rsp + 0x298]
jns 0x140007b35
lea rcx, str._CI_Failed_to_get_ciBase_n
call fcn.140007850
jmp 0x140007b44
mov rdx, r15
lea rcx, str._CI_CiBase_address____p_n
call fcn.140007850
xor edx, edx
lea rcx, str.CI.dll
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
test rax, rax
jne 0x140007b6b
lea rcx, str._CI_Failed_to_load_libary_n
call fcn.140007850
lea rdx, str.CiInitialize
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x140007b91
lea rcx, str._CI_Failed_to_Get_CiInitialize_address_n
call fcn.140007850
jmp 0x140007ba0
mov rdx, rbx
lea rcx, str._CI_CiInitialize_address___0x_p_n
call fcn.140007850
cmp dword [0x1401e8428], 0x3fab
mov r10d, edi
movzx eax, byte [0x14007ad18]
mov r9d, edi
movups xmm1, xmmword [0x14007ad08]
mov r8, rbx
mov byte [rsp + 0x60], al
movsd xmm0, qword [0x14007ad20]
mov eax, dword [0x14007ad28]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x14007ad2c]
mov byte [rsp + 0x4c], al
movups xmmword [rsp + 0x50], xmm1
movsd qword [rsp + 0x40], xmm0
jb 0x140007c63
lea rax, [rsp + 0x50]
sub r8, rax
nop word [rax + rax]
mov ecx, edi
lea rax, [rsp + 0x50]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007c14
test dl, dl
jne 0x140007c5f
inc ecx
inc rax
cmp ecx, 0x10
jb 0x140007c07
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
mov r10d, eax
cmp r9d, 0xff
jl 0x140007c00
movd eax, xmm1
movzx ecx, di
test al, al
je 0x140007cc0
nop word [rax + rax]
inc cx
movzx eax, cx
cmp byte [rsp + rax + 0x50], dil
jne 0x140007c50
jmp 0x140007cc0
xor cl, cl
jmp 0x140007c20
lea rax, [rsp + 0x40]
sub r8, rax
nop dword [rax + rax]
mov ecx, edi
lea rax, [rsp + 0x40]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007c84
test dl, dl
jne 0x140007ceb
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140007c77
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
mov r10d, eax
cmp r9d, 0xff
jl 0x140007c70
mov ecx, edi
cmp byte [rsp + 0x40], cl
je 0x140007cc0
inc cx
movzx eax, cx
cmp byte [rsp + rax + 0x40], dil
jne 0x140007cb3
movzx r8d, cx
movsxd rcx, r10d
lea rax, [rcx + r8]
mov edx, dword [rax + rbx]
add rbx, 4
add rdx, rcx
add rdx, r8
add rbx, rdx
jne 0x140007cef
lea rcx, str._CI_Failed_to_get_CipInitialize_n
call fcn.140007850
jmp 0x140007cfe
xor cl, cl
jmp 0x140007c90
mov rdx, rbx
lea rcx, str._CI_CipInitialize_address____p_n
call fcn.140007850
movzx eax, word [0x14007ad38]
mov r8, rbx
movsd xmm0, qword [0x14007ad30]
mov r10d, edi
mov word [rsp + 0x30], ax
mov r9d, edi
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
sub r8, rax
nop dword [rax]
mov ecx, edi
lea rax, [rsp + 0x28]
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140007d48
test dl, dl
jne 0x140007dd8
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140007d37
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x140007d30
cmp byte [rsp + 0x28], dil
je 0x140007d8d
nop word [rax + rax]
inc di
movzx eax, di
cmp byte [rsp + rax + 0x28], 0
jne 0x140007d80
movzx edx, di
add r15, 4
mov rdi, qword [rsp + 0x2d0]
lea rax, [r10 + rdx]
movsxd r8, dword [rax + rbx]
sub r8, r13
mov r13, qword [rsp + 0x2d8]
add r8, r10
add r8, rdx
add rbx, r8
add rbx, r15
mov r15, qword [rsp + 0x290]
jne 0x140007ddf
lea rcx, str._CI_Failed_to_get_G_CiOptions_n
call fcn.140007850
mov eax, 0xc0000001
jmp 0x140007df0
xor cl, cl
jmp 0x140007d54
mov rdx, rbx
lea rcx, str._CI_G_CiOptions_address___0x_p_n
call fcn.140007850
xor eax, eax
mov qword [r12], rbx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140077fb0
add rsp, 0x2a0
pop r12
pop rbx
pop rbp
ret