_VWIN32_CreateRing0Thread

Provides a service for ring 0 clients to create Win32 threads that execute only at ring 0, which allows the use of Win32 blocking functions. Preserves EBX, EDI, ESI, EBP, and segment registers.

• Returns a Win32 ring 3 handle in EAX and a ring 0 thread handle in EDX if successful; otherwise EAX contains 0.

ECX

The size of the ring 3 stack for the thread being created. The recommended stack size is 4096.

EDX

DWORD to pass to startup function specified in ESI.

EBX

Pointer to ring 0 function where execution starts.

ESI

If this is a synchronous thread create, specify FALSE. Otherwise the value is the address of a callback procedure that is called if the create fails. The DWORD parameter passed in EDX is passed to the callback procedure.