JunkThread proc par1:DWORD, par2:DWORD
invoke Sleep,100
invoke ExitThread,0
ret
JunkThread endp


FSK:
Mov edx, esp
word 0340Fh


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
NewZwDeviceIoControlFile:
mov eax, dword ptr [esp] ;ZwDIOCTLF Return
.if eax>=060000000h
	mov eax, dword ptr [esp+96] ;DeviceIoControl Return
.if eax>=060000000h
	lea eax, ZwDIOCTLFBackupBytes
	mov eax, dword ptr [eax+1]
	call FSK
	RETN 028H
.endif
.endif

;Block

mov eax, dword ptr [esp+92]  ;pBytesReturned
.if eax!=0
mov ecx, dword ptr [esp+88] ;OutBufferSize
mov dword ptr [eax], ecx
.endif
mov eax, 0
RETN 028H





NewZwCreateThread:
;Block CreateRemoteThread
mov eax, dword ptr [esp+16]
.if eax==0FFFFFFFFh ;Check for -1 (this process)
lea eax, ZwCTBackupBytes
mov eax, dword ptr [eax+1]
call FSK 	
RETN 020H
.endif

;Block
invoke CreateThread,0,0,addr JunkThread,0,0,addr TID
mov ecx, dword ptr [esp+4]
mov dword ptr [ecx], eax ;Give Fake Handle
invoke GetCurrentThreadId
mov ZwHelper.TID, eax
invoke GetCurrentProcessId
mov ZwHelper.PID, eax
mov eax, dword ptr [esp+20]
assume eax:ptr _CLIENT_ID
mov ecx, ZwHelper.PID              ;Give Fake _CLIENT_ID
mov [eax].PID, ecx ;Give Fake PID
mov ecx, ZwHelper.TID
mov [eax].TID, ecx ;Give Fake TID
assume eax:nothing
mov eax, 0 ;Fake STATUS_SUCCESS
RETN 020H