Function at 0x1400219b0
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140077100]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov rbp, qword [0x14007a4c8]
mov dword [rsp + 0x48], r14d
mov ebx, r14d
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140021a5f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140021a14
test eax, eax
js 0x140021bf7
test rbx, rbx
je 0x140021c0d
mov rsi, r14
mov edi, r14d
cmp qword [rbx], r14
jbe 0x140021ac3
mov rax, r14
nop
lea rax, [rax + rax*4]
movups xmm7, xmmword [rbx + rax*8 + 0x10]
movups xmm6, xmmword [rbx + rax*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140021ab3
movq rax, xmm6
cmp rax, rbp
je 0x140021abe
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140021a80
jmp 0x140021ac3
movq rsi, xmm7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140021c0d
lea rcx, [rsi + 8]
test rcx, rcx
jne 0x140021ba9
mov ecx, 8
mov r8d, 8
lea rdx, [rsp + 0x70]
call fcn.140020780
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
jne 0x140021bcd
mov esi, 0x58
mov ecx, esi
mov r8d, 0x10
lea rdx, [rsp + 0x70]
call fcn.140020780
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movd eax, xmm0
movzx ecx, ax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.140036870
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14005a8b0
mov qword [rsp + 0x70], rdi
movzx r8d, word [rsp + 0x50]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.140020780
mov word [rsp + 0x50], r14w
mov r8d, 0x10
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400208b0
nop
mov rcx, rdi
call fcn.1400364dc
mov al, 1
jmp 0x140021c0f
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.140020780
mov rcx, qword [rsp + 0x60]
add rcx, 8
jne 0x140021aef
mov ecx, 0x28
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.140020780
mov rsi, qword [rsp + 0x60]
add rsi, 0x58
mov rcx, rsi
jne 0x140021b15
xorps xmm0, xmm0
jmp 0x140021b2a
test rbx, rbx
je 0x140021c0d
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140036480
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret