PsQueryThreadStartAddress
VOID *__stdcall PsQueryThreadStartAddress(_ETHREAD *Thread, UINT64 QueryThunkAddress){
VOID *v3;
VOID *v5;
void *retaddr;
if( (Thread->Tcb._bf_0 & 0x400) != 0 )
return Thread->Win32StartAddress;
v3 = 0i64;
if( !(_DWORD)QueryThunkAddress )
return Thread->Win32StartAddress;
if( (Thread->SameThreadApcFlags & 8) == 0 )
{
v5 = *(VOID **)&Thread->gap438[24];
_InterlockedOr((volatile signed __int32 *)&retaddr, 0);
if( (Thread->SameThreadApcFlags & 8) == 0 )
return v5;
}
return v3;
}Referenced by:
EtwpPsProvTraceThread
NtQueryInformationThread
PspAllocateThread
sub_140A38080