PsQueryThreadStartAddress

VOID *__stdcall PsQueryThreadStartAddress(_ETHREAD *Thread, UINT64 QueryThunkAddress){
  VOID *v3; 
  VOID *v5; 
  void *retaddr; 

  if( (Thread->Tcb._bf_0 & 0x400) != 0 )
    return Thread->Win32StartAddress;
  v3 = 0i64;
  if( !(_DWORD)QueryThunkAddress )
    return Thread->Win32StartAddress;
  if( (Thread->SameThreadApcFlags & 8) == 0 )
  {
    v5 = *(VOID **)&Thread->gap438[24];
    _InterlockedOr((volatile signed __int32 *)&retaddr, 0);
    if( (Thread->SameThreadApcFlags & 8) == 0 )
      return v5;
  }
  return v3;
}

Referenced by:

EtwpPsProvTraceThread
NtQueryInformationThread
PspAllocateThread
sub_140A38080