33 DPRINT(
"RtlInitializeContext: (hProcess: %p, ThreadContext: %p, Teb: %p\n",
40 ThreadContext->Ebp = 0;
41 ThreadContext->Eax = 0;
42 ThreadContext->Ebx = 1;
43 ThreadContext->Ecx = 2;
44 ThreadContext->Edx = 3;
45 ThreadContext->Esi = 4;
46 ThreadContext->Edi = 5;
49 ThreadContext->SegGs = 0;
60 ThreadContext->Eip = (
ULONG)ThreadStartAddress;
61 ThreadContext->Esp = (
ULONG)InitialTeb;
69 ThreadContext->Esp -=
sizeof(
PVOID);
71 (
PVOID)ThreadContext->Esp,
72 (
PVOID)&ThreadStartParam,
77 ThreadContext->Esp -=
sizeof(
PVOID);
#define EFLAGS_INTERRUPT_MASK
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
_In_ HANDLE ProcessHandle
NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
ULONG(NTAPI * PTHREAD_START_ROUTINE)(PVOID Parameter)
NTSTATUS NTAPI NtQueueApcThread(IN HANDLE ThreadHandle, IN PKNORMAL_ROUTINE ApcRoutine, IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
NTSTATUS NTAPI RtlQueueApcWow64Thread(_In_ HANDLE ThreadHandle, _In_ PKNORMAL_ROUTINE ApcRoutine, _In_opt_ PVOID NormalContext, _In_opt_ PVOID SystemArgument1, _In_opt_ PVOID SystemArgument2)
VOID NTAPI RtlInitializeContext(IN HANDLE ProcessHandle, OUT PCONTEXT ThreadContext, IN PVOID ThreadStartParam OPTIONAL, IN PTHREAD_START_ROUTINE ThreadStartAddress, IN PINITIAL_TEB InitialTeb)
PULONG MinorVersion OPTIONAL
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2