Function at 0x140021920
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140076100]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r14d, r14d
mov rbp, qword [0x140079440]
mov dword [rsp + 0x48], r14d
mov ebx, r14d
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400219cf
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x48]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x48]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140021984
test eax, eax
js 0x140021b67
test rbx, rbx
je 0x140021b7d
mov rsi, r14
mov edi, r14d
cmp qword [rbx], r14
jbe 0x140021a33
mov rax, r14
nop
lea rax, [rax + rax*4]
movups xmm7, xmmword [rbx + rax*8 + 0x10]
movups xmm6, xmmword [rbx + rax*8 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140021a23
movq rax, xmm6
cmp rax, rbp
je 0x140021a2e
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x1400219f0
jmp 0x140021a33
movq rsi, xmm7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140021b7d
lea rcx, [rsi + 8]
test rcx, rcx
jne 0x140021b19
mov ecx, 8
mov r8d, 8
lea rdx, [rsp + 0x70]
call fcn.1400206f0
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
jne 0x140021b3d
mov esi, 0x58
mov ecx, esi
mov r8d, 0x10
lea rdx, [rsp + 0x70]
call fcn.1400206f0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movd eax, xmm0
movzx ecx, ax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.1400386f0
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14005c7d0
mov qword [rsp + 0x70], rdi
movzx r8d, word [rsp + 0x50]
mov rdx, rdi
mov rcx, qword [rsp + 0x58]
call fcn.1400206f0
mov word [rsp + 0x50], r14w
mov r8d, 0x10
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140020820
nop
mov rcx, rdi
call fcn.14003835c
mov al, 1
jmp 0x140021b7f
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.1400206f0
mov rcx, qword [rsp + 0x60]
add rcx, 8
jne 0x140021a5f
mov ecx, 0x28
mov r8d, 8
lea rdx, [rsp + 0x60]
call fcn.1400206f0
mov rsi, qword [rsp + 0x60]
add rsi, 0x58
mov rcx, rsi
jne 0x140021a85
xorps xmm0, xmm0
jmp 0x140021a9a
test rbx, rbx
je 0x140021b7d
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140038300
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
ret