34 DPRINT(
"RtlInitializeContext: (hProcess: %p, ThreadContext: %p, StackBase: %p\n",
41 ThreadContext->Ebp = 0;
42 ThreadContext->Eax = 0;
43 ThreadContext->Ebx = 1;
44 ThreadContext->Ecx = 2;
45 ThreadContext->Edx = 3;
46 ThreadContext->Esi = 4;
47 ThreadContext->Edi = 5;
50 ThreadContext->SegGs = 0;
61 ThreadContext->Eip = (
ULONG)ThreadStartAddress;
62 ThreadContext->Esp = (
ULONG)StackBase;
70 ThreadContext->Esp -=
sizeof(
PVOID);
72 (
PVOID)ThreadContext->Esp,
73 (
PVOID)&ThreadStartParam,
78 ThreadContext->Esp -=
sizeof(
PVOID);
#define EFLAGS_INTERRUPT_MASK
_In_opt_ HANDLE _In_opt_ PIO_APC_ROUTINE ApcRoutine
VOID(NTAPI * PKNORMAL_ROUTINE)(IN PVOID NormalContext OPTIONAL, IN PVOID SystemArgument1 OPTIONAL, IN PVOID SystemArgument2 OPTIONAL)
_In_ HANDLE ProcessHandle
NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
ULONG(NTAPI * PTHREAD_START_ROUTINE)(PVOID Parameter)
NTSTATUS NTAPI NtQueueApcThread(IN HANDLE ThreadHandle, IN PKNORMAL_ROUTINE ApcRoutine, IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2)
NTSTATUS NTAPI RtlQueueApcWow64Thread(_In_ HANDLE ThreadHandle, _In_ PKNORMAL_ROUTINE ApcRoutine, _In_opt_ PVOID NormalContext, _In_opt_ PVOID SystemArgument1, _In_opt_ PVOID SystemArgument2)
VOID NTAPI RtlInitializeContext(_In_ HANDLE ProcessHandle, _Out_ PCONTEXT ThreadContext, _In_opt_ PVOID ThreadStartParam, _In_ PTHREAD_START_ROUTINE ThreadStartAddress, _In_ PVOID StackBase)
_In_opt_ PVOID _In_opt_ PVOID SystemArgument1
_In_opt_ PVOID _In_opt_ PVOID _In_opt_ PVOID SystemArgument2