> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/malware-essentials/processes/threads.md).

# Threads

A thread is a type of object that Windows schedules for execution within a proces. it holds the state of the CPU, including its regiters; and a call stack, which is the set of CPU instructions to execute. Every functional program will have at least one threat that is used to execute the program's entry point, however, many applications run multiple threads to allow multiple pieces of work to execute in parallel.

\
The simplest thread creation functions are [CreateThread](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createthread), which creates a new thread in the calling process, and [CreateRemoteThread](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethread), which can create a new thread in another process. The most important argument is the function pointer as this act as the new thread's entry point for execution. Both of these APIs call into [CreateRemoteThreadEx](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createremotethreadex), whcih then calls the NTCreateThreadEx kernel function.