push    edi             ; CreateSuspended
lea     ecx, [ebp+UserStack]
push    ecx             ; UserStack
lea     ecx, [ebp+ThreadContext]
push    ecx             ; ThreadContext
lea     ecx, [ebp+ClientId]
push    ecx             ; ClientId
mov     esi, [ebp+ProcessHandle]
push    esi             ; ProcessHandle
push    eax             ; ObjectAttributes
push    1F03FFh         ; DesiredAccess
lea     eax, [ebp+ThreadHandle]
push    eax             ; ThreadHandle
call    ds:NtCreateThread