Function at 0x14001fb60
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140074100]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov rbp, qword [0x140077448]
mov dword [rsp + 0x48], r14d
mov ebx, r14d
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001fc0f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001fbc4
test eax, eax
js 0x14001fda7
test rbx, rbx
je 0x14001fdbd
mov rsi, r14
mov edi, r14d
cmp qword [rbx], r14
jbe 0x14001fc73
mov rax, r14
nop
lea rax, [rax + rax*4]
movups xmm7, xmmword [rbx + rax*8 + 0x10]
movups xmm6, xmmword [rbx + rax*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14001fc63
movq rax, xmm6
cmp rax, rbp
je 0x14001fc6e
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x14001fc30
jmp 0x14001fc73
movq rsi, xmm7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x14001fdbd
lea rcx, [rsi + 8]
test rcx, rcx
jne 0x14001fd59
mov ecx, 8
mov r8d, 8
lea rdx, [rsp + 0x70]
call fcn.14001eb50
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
jne 0x14001fd7d
mov esi, 0x58
mov ecx, esi
mov r8d, 0x10
lea rdx, [rsp + 0x70]
call fcn.14001eb50
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movd eax, xmm0
movzx ecx, ax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.1400339c0
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140057a00
mov qword [rsp + 0x70], rdi
movzx r8d, word [rsp + 0x50]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.14001eb50
mov word [rsp + 0x50], r14w
mov r8d, 0x10
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001ec80
nop
mov rcx, rdi
call fcn.14003362c
mov al, 1
jmp 0x14001fdbf
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.14001eb50
mov rcx, qword [rsp + 0x60]
add rcx, 8
jne 0x14001fc9f
mov ecx, 0x28
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.14001eb50
mov rsi, qword [rsp + 0x60]
add rsi, 0x58
mov rcx, rsi
jne 0x14001fcc5
xorps xmm0, xmm0
jmp 0x14001fcda
test rbx, rbx
je 0x14001fdbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400335d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret