Function at 0x140021b60
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov rbp, qword [0x140079448]
mov dword [rsp + 0x48], r14d
mov ebx, r14d
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140021c0f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140021bc4
test eax, eax
js 0x140021da7
test rbx, rbx
je 0x140021dbd
mov rsi, r14
mov edi, r14d
cmp qword [rbx], r14
jbe 0x140021c73
mov rax, r14
nop
lea rax, [rax + rax*4]
movups xmm7, xmmword [rbx + rax*8 + 0x10]
movups xmm6, xmmword [rbx + rax*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140021c63
movq rax, xmm6
cmp rax, rbp
je 0x140021c6e
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140021c30
jmp 0x140021c73
movq rsi, xmm7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140021dbd
lea rcx, [rsi + 8]
test rcx, rcx
jne 0x140021d59
mov ecx, 8
mov r8d, 8
lea rdx, [rsp + 0x70]
call fcn.140020b50
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
jne 0x140021d7d
mov esi, 0x58
mov ecx, esi
mov r8d, 0x10
lea rdx, [rsp + 0x70]
call fcn.140020b50
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movd eax, xmm0
movzx ecx, ax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.140035940
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140059980
mov qword [rsp + 0x70], rdi
movzx r8d, word [rsp + 0x50]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.140020b50
mov word [rsp + 0x50], r14w
mov r8d, 0x10
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140020c80
nop
mov rcx, rdi
call fcn.1400355ac
mov al, 1
jmp 0x140021dbf
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.140020b50
mov rcx, qword [rsp + 0x60]
add rcx, 8
jne 0x140021c9f
mov ecx, 0x28
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.140020b50
mov rsi, qword [rsp + 0x60]
add rsi, 0x58
mov rcx, rsi
jne 0x140021cc5
xorps xmm0, xmm0
jmp 0x140021cda
test rbx, rbx
je 0x140021dbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140035550
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret