Provides a service for ring 0 clients to create Win32 threads that execute only at ring 0, which allows the use of Win32 blocking functions. Preserves EBX, EDI, ESI, EBP, and segment registers.
ECX
The size of the ring 3 stack for the thread being created. The recommended stack size is 4096.
EDX
DWORD to pass to startup function specified in ESI.
EBX
Pointer to ring 0 function where execution starts.
ESI
If this is a synchronous thread create, specify FALSE. Otherwise the value is the address of a callback procedure that is called if the create fails. The DWORD parameter passed in EDX is passed to the callback procedure.