Function at 0x14001db60
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140072100]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov rbp, qword [0x140075448]
mov dword [rsp + 0x48], r14d
mov ebx, r14d
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001dc0f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001dbc4
test eax, eax
js 0x14001dda7
test rbx, rbx
je 0x14001ddbd
mov rsi, r14
mov edi, r14d
cmp qword [rbx], r14
jbe 0x14001dc73
mov rax, r14
nop
lea rax, [rax + rax*4]
movups xmm7, xmmword [rbx + rax*8 + 0x10]
movups xmm6, xmmword [rbx + rax*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14001dc63
movq rax, xmm6
cmp rax, rbp
je 0x14001dc6e
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x14001dc30
jmp 0x14001dc73
movq rsi, xmm7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x14001ddbd
lea rcx, [rsi + 8]
test rcx, rcx
jne 0x14001dd59
mov ecx, 8
mov r8d, 8
lea rdx, [rsp + 0x70]
call fcn.14001cb50
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
jne 0x14001dd7d
mov esi, 0x58
mov ecx, esi
mov r8d, 0x10
lea rdx, [rsp + 0x70]
call fcn.14001cb50
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movd eax, xmm0
movzx ecx, ax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.140031940
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140055980
mov qword [rsp + 0x70], rdi
movzx r8d, word [rsp + 0x50]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.14001cb50
mov word [rsp + 0x50], r14w
mov r8d, 0x10
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001cc80
nop
mov rcx, rdi
call fcn.1400315ac
mov al, 1
jmp 0x14001ddbf
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.14001cb50
mov rcx, qword [rsp + 0x60]
add rcx, 8
jne 0x14001dc9f
mov ecx, 0x28
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.14001cb50
mov rsi, qword [rsp + 0x60]
add rsi, 0x58
mov rcx, rsi
jne 0x14001dcc5
xorps xmm0, xmm0
jmp 0x14001dcda
test rbx, rbx
je 0x14001ddbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140031550
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret