Function at 0x140003db0
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
call sym.VBoxNetAdp.sys_RTR0Init
test eax, eax
js 0x140003e2c
xorps xmm0, xmm0
lea rcx, [0x14002c300]
xor eax, eax
movups xmmword [0x14002c300], xmm0
mov qword [0x14002c380], rax
movups xmmword [0x14002c310], xmm0
movups xmmword [0x14002c320], xmm0
movups xmmword [0x14002c330], xmm0
movups xmmword [0x14002c340], xmm0
movups xmmword [0x14002c350], xmm0
movups xmmword [0x14002c360], xmm0
movups xmmword [0x14002c370], xmm0
call fcn.140001350
test eax, eax
jns 0x140003e48
call sym.VBoxNetAdp.sys_RTR0Term
mov ebx, 0xc0000001
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [0x14002c2b8]
xor r8d, r8d
xor edx, edx
movups xmmword [0x14002c2a0], xmm0
movups xmmword [0x14002c2b0], xmm0
movups xmmword [0x14002c2c0], xmm0
movups xmmword [0x14002c2d0], xmm0
movups xmmword [0x14002c2e0], xmm0
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r8d, r8d
lea rcx, [0x14002c2d0]
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea r14, [0x14002c2a0]
mov dword [rsp + 0x40], 0x30
xor ebp, ebp
mov qword [rsp + 0x30], r14
lea rax, [0x1400032e0]
mov qword [0x14002c2a8], r14
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x40]
mov qword [0x14002c2a0], r14
mov edx, 0x1fffff
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0x58], 0x200
mov qword [rsp + 0x50], rbp
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
jne 0x14000408f
mov rcx, qword [rsp + 0xa0]
lea rax, [0x14002c2e8]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0xa0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jne 0x14000408f
xor r8d, r8d
lea rcx, [0x14002c288]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rax, [0x140003240]
mov byte [0x14002c281], bpl
lea rdx, [0x14002c240]
mov qword [0x14002c250], rax
lea r8, [0x14002c2b0]
mov qword [0x14002c258], rdx
mov rcx, r14
mov byte [0x14002c280], 1
mov byte [0x14002c278], bpl
call qword [sym.imp.ntoskrnl.exe_ExInterlockedInsertTailList]
xor r8d, r8d
lea edx, [rbp + 1]
lea rcx, [0x14002c2d0]
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
xorps xmm0, xmm0
lea edx, [rbp + 1]
xor eax, eax
lea rcx, [0x14002c1f0]
mov r8b, 1
mov qword [0x14002c230], rax
movups xmmword [0x14002c1f0], xmm0
movups xmmword [0x14002c200], xmm0
movups xmmword [0x14002c210], xmm0
movups xmmword [0x14002c220], xmm0
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor r9d, r9d
lea rdx, [rsp + 0xa8]
xor r8d, r8d
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0xa0], 5
mov eax, 0x80
mov dword [0x14002c220], eax
jne 0x140004032
cmp dword [rsp + 0xa8], ebp
mov ecx, 0x480
cmove eax, ecx
mov dword [0x14002c220], eax
mov r8, rdi
mov dword [0x14002c224], 0x100
mov rdx, rsi
lea rcx, [0x14002c228]
call fcn.140002740
mov ebx, eax
test eax, eax
je 0x140003e33
cmp qword [0x14002c2e8], rbp
je 0x140004096
xor r8d, r8d
lea rcx, [0x14002c2b8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [0x14002c2e8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
jmp 0x140004096
mov qword [0x14002c2e8], rbp
call fcn.140002fd0
test eax, eax
js 0x140003e31
call fcn.140003080
jmp 0x140003e31