Function at 0x14000ce10
Capabilities:
Attach user process memory
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xe8
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rbp + 7], rax
mov rsi, qword [rbp + 0x7f]
mov r14, r9
mov r12, r8
mov r13, rdx
mov edi, ecx
call fcn.140009ec0
mov r15, rax
test rax, rax
jne 0x14000ce74
cmp byte [0x14003dcf0], al
je 0x14000d00b
mov edx, edi
lea rcx, [0x1400141d0]
call fcn.14000ca70
xor al, al
jmp 0x14000d04d
xorps xmm0, xmm0
mov qword [rbp - 0x71], 0
lea rdx, [rbp - 0x29]
mov rcx, r15
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp - 0x69], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
cmp edi, 4
jne 0x14000cef0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rsi
xorps xmm1, xmm1
mov qword [rsp + 0x28], r13
lea rax, [rbp - 0x69]
mov dword [rbp - 0x59], 0x30
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x59]
mov dword [rbp - 0x41], 0x200
xor edx, edx
lea rcx, [rbp - 0x71]
movdqu xmmword [rbp - 0x51], xmm0
movdqu xmmword [rbp - 0x39], xmm1
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov esi, eax
jmp 0x14000cf78
cmp qword [0x14003d9b0], 0
jne 0x14000cf23
lea rcx, [0x1400142a0]
call fcn.14000b600
mov qword [0x14003d9b0], rax
test rax, rax
jne 0x14000cf23
lea rcx, [rbp - 0x29]
mov esi, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000cf90
xor ecx, ecx
call fcn.14000cd50
movzx ebx, al
lea rcx, [rbp - 0x71]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov edx, 0x1fffff
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
lea r9, [rax - 1]
mov dword [rsp + 0x30], eax
mov rax, qword [0x14003d9b0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
call qword [0x1400153f0]
movzx ecx, bl
mov esi, eax
call fcn.14000cd50
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, esi
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x14000cfb4
cmp byte [0x14003dcf0], 0
je 0x14000d00b
mov r9d, esi
lea rcx, [0x140014210]
mov r8, r13
mov edx, edi
call fcn.14000ca70
xor al, al
jmp 0x14000d04d
test r14, r14
je 0x14000d01b
cmp edi, 4
jne 0x14000cfc3
mov eax, dword [rbp - 0x61]
jmp 0x14000d018
lea rdx, [rbp - 0x29]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
xor edx, edx
mov rcx, qword [rbp - 0x71]
mov r8, qword [r8]
call fcn.14000c390
lea rcx, [rbp - 0x29]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rbx, rbx
jne 0x14000d00f
cmp byte [0x14003dcf0], bl
je 0x14000d00b
lea rcx, [0x140014270]
call fcn.14000ca70
xor al, al
jmp 0x14000d04d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsGetThreadId]
mov dword [r14], eax
test r12, r12
je 0x14000d02a
mov rax, qword [rbp - 0x71]
mov qword [r12], rax
jmp 0x14000d04b
lea rdx, [rbp - 0x29]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp - 0x71]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, 1
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14000ed70
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret