CreateRemoteThreadEx

// KERNEL32.dll
#include <windows.h>

HANDLE CreateRemoteThreadEx(
    HANDLE hProcess,
    SECURITY_ATTRIBUTES* lpThreadAttributes,   // optional
    UINT_PTR dwStackSize,
    LPTHREAD_START_ROUTINE lpStartAddress,
    void* lpParameter,   // optional
    DWORD dwCreationFlags,
    LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList,   // optional
    DWORD* lpThreadId   // optional
);

<DllImport("KERNEL32.dll", SetLastError:=True, ExactSpelling:=True)>
Public Shared Function CreateRemoteThreadEx(
    hProcess As IntPtr,   ' HANDLE
    lpThreadAttributes As IntPtr,   ' SECURITY_ATTRIBUTES* optional
    dwStackSize As UIntPtr,   ' UINT_PTR
    lpStartAddress As IntPtr,   ' LPTHREAD_START_ROUTINE
    lpParameter As IntPtr,   ' void* optional
    dwCreationFlags As UInteger,   ' DWORD
    lpAttributeList As IntPtr,   ' LPPROC_THREAD_ATTRIBUTE_LIST optional
    lpThreadId As IntPtr   ' DWORD* optional, out
) As IntPtr
End Function

' hProcess : HANDLE
' lpThreadAttributes : SECURITY_ATTRIBUTES* optional
' dwStackSize : UINT_PTR
' lpStartAddress : LPTHREAD_START_ROUTINE
' lpParameter : void* optional
' dwCreationFlags : DWORD
' lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional
' lpThreadId : DWORD* optional, out
Declare PtrSafe Function CreateRemoteThreadEx Lib "kernel32" ( _
    ByVal hProcess As LongPtr, _
    ByVal lpThreadAttributes As LongPtr, _
    ByVal dwStackSize As LongPtr, _
    ByVal lpStartAddress As LongPtr, _
    ByVal lpParameter As LongPtr, _
    ByVal dwCreationFlags As Long, _
    ByVal lpAttributeList As LongPtr, _
    ByVal lpThreadId As LongPtr) As LongPtr
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

CreateRemoteThreadEx = ctypes.windll.kernel32.CreateRemoteThreadEx
CreateRemoteThreadEx.restype = ctypes.c_void_p
CreateRemoteThreadEx.argtypes = [
    wintypes.HANDLE,  # hProcess : HANDLE
    ctypes.c_void_p,  # lpThreadAttributes : SECURITY_ATTRIBUTES* optional
    ctypes.c_size_t,  # dwStackSize : UINT_PTR
    ctypes.c_void_p,  # lpStartAddress : LPTHREAD_START_ROUTINE
    ctypes.POINTER(None),  # lpParameter : void* optional
    wintypes.DWORD,  # dwCreationFlags : DWORD
    wintypes.HANDLE,  # lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional
    ctypes.POINTER(wintypes.DWORD),  # lpThreadId : DWORD* optional, out
]
# GetLastError: use ctypes.GetLastError() (or ctypes.WinDLL(use_last_error=True))

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('KERNEL32.dll')
CreateRemoteThreadEx = Fiddle::Function.new(
  lib['CreateRemoteThreadEx'],
  [
    Fiddle::TYPE_VOIDP,  # hProcess : HANDLE
    Fiddle::TYPE_VOIDP,  # lpThreadAttributes : SECURITY_ATTRIBUTES* optional
    Fiddle::TYPE_UINTPTR_T,  # dwStackSize : UINT_PTR
    Fiddle::TYPE_VOIDP,  # lpStartAddress : LPTHREAD_START_ROUTINE
    Fiddle::TYPE_VOIDP,  # lpParameter : void* optional
    -Fiddle::TYPE_INT,  # dwCreationFlags : DWORD
    Fiddle::TYPE_VOIDP,  # lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional
    Fiddle::TYPE_VOIDP,  # lpThreadId : DWORD* optional, out
  ],
  Fiddle::TYPE_VOIDP)

#[link(name = "kernel32")]
extern "system" {
    fn CreateRemoteThreadEx(
        hProcess: *mut core::ffi::c_void,  // HANDLE
        lpThreadAttributes: *mut SECURITY_ATTRIBUTES,  // SECURITY_ATTRIBUTES* optional
        dwStackSize: usize,  // UINT_PTR
        lpStartAddress: *const core::ffi::c_void,  // LPTHREAD_START_ROUTINE
        lpParameter: *mut (),  // void* optional
        dwCreationFlags: u32,  // DWORD
        lpAttributeList: *mut core::ffi::c_void,  // LPPROC_THREAD_ATTRIBUTE_LIST optional
        lpThreadId: *mut u32  // DWORD* optional, out
    ) -> *mut core::ffi::c_void;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("KERNEL32.dll", SetLastError = true)]
public static extern IntPtr CreateRemoteThreadEx(IntPtr hProcess, IntPtr lpThreadAttributes, UIntPtr dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpAttributeList, IntPtr lpThreadId);
"@
$api = Add-Type -MemberDefinition $sig -Name 'KERNEL32_CreateRemoteThreadEx' -Namespace Win32 -PassThru
# $api::CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)

#uselib "KERNEL32.dll"
#func global CreateRemoteThreadEx "CreateRemoteThreadEx" sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr
; CreateRemoteThreadEx hProcess, varptr(lpThreadAttributes), dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, varptr(lpThreadId)   ; 戻り値は stat
; hProcess : HANDLE -> "sptr"
; lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> "sptr"
; dwStackSize : UINT_PTR -> "sptr"
; lpStartAddress : LPTHREAD_START_ROUTINE -> "sptr"
; lpParameter : void* optional -> "sptr"
; dwCreationFlags : DWORD -> "sptr"
; lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> "sptr"
; lpThreadId : DWORD* optional, out -> "sptr"
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	kernel32 = windows.NewLazySystemDLL("KERNEL32.dll")
	procCreateRemoteThreadEx = kernel32.NewProc("CreateRemoteThreadEx")
)

// hProcess (HANDLE), lpThreadAttributes (SECURITY_ATTRIBUTES* optional), dwStackSize (UINT_PTR), lpStartAddress (LPTHREAD_START_ROUTINE), lpParameter (void* optional), dwCreationFlags (DWORD), lpAttributeList (LPPROC_THREAD_ATTRIBUTE_LIST optional), lpThreadId (DWORD* optional, out)
r1, _, err := procCreateRemoteThreadEx.Call(
	uintptr(hProcess),
	uintptr(lpThreadAttributes),
	uintptr(dwStackSize),
	uintptr(lpStartAddress),
	uintptr(lpParameter),
	uintptr(dwCreationFlags),
	uintptr(lpAttributeList),
	uintptr(lpThreadId),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // HANDLE

function CreateRemoteThreadEx(
  hProcess: THandle;   // HANDLE
  lpThreadAttributes: Pointer;   // SECURITY_ATTRIBUTES* optional
  dwStackSize: NativeUInt;   // UINT_PTR
  lpStartAddress: Pointer;   // LPTHREAD_START_ROUTINE
  lpParameter: Pointer;   // void* optional
  dwCreationFlags: DWORD;   // DWORD
  lpAttributeList: THandle;   // LPPROC_THREAD_ATTRIBUTE_LIST optional
  lpThreadId: Pointer   // DWORD* optional, out
): THandle; stdcall;
  external 'KERNEL32.dll' name 'CreateRemoteThreadEx';

result := DllCall("KERNEL32\CreateRemoteThreadEx"
    , "Ptr", hProcess   ; HANDLE
    , "Ptr", lpThreadAttributes   ; SECURITY_ATTRIBUTES* optional
    , "UPtr", dwStackSize   ; UINT_PTR
    , "Ptr", lpStartAddress   ; LPTHREAD_START_ROUTINE
    , "Ptr", lpParameter   ; void* optional
    , "UInt", dwCreationFlags   ; DWORD
    , "Ptr", lpAttributeList   ; LPPROC_THREAD_ATTRIBUTE_LIST optional
    , "Ptr", lpThreadId   ; DWORD* optional, out
    , "Ptr")   ; return: HANDLE

●CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId) = DLL("KERNEL32.dll", "void* CreateRemoteThreadEx(void*, void*, int, void*, void*, dword, void*, void*)")
# 呼び出し: CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
# hProcess : HANDLE -> "void*"
# lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> "void*"
# dwStackSize : UINT_PTR -> "int"
# lpStartAddress : LPTHREAD_START_ROUTINE -> "void*"
# lpParameter : void* optional -> "void*"
# dwCreationFlags : DWORD -> "dword"
# lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> "void*"
# lpThreadId : DWORD* optional, out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。

const std = @import("std");

extern "kernel32" fn CreateRemoteThreadEx(
    hProcess: ?*anyopaque, // HANDLE
    lpThreadAttributes: [*c]SECURITY_ATTRIBUTES, // SECURITY_ATTRIBUTES* optional
    dwStackSize: usize, // UINT_PTR
    lpStartAddress: ?*anyopaque, // LPTHREAD_START_ROUTINE
    lpParameter: ?*anyopaque, // void* optional
    dwCreationFlags: u32, // DWORD
    lpAttributeList: ?*anyopaque, // LPPROC_THREAD_ATTRIBUTE_LIST optional
    lpThreadId: [*c]u32 // DWORD* optional, out
) callconv(std.os.windows.WINAPI) ?*anyopaque;

proc CreateRemoteThreadEx(
    hProcess: pointer,  # HANDLE
    lpThreadAttributes: ptr SECURITY_ATTRIBUTES,  # SECURITY_ATTRIBUTES* optional
    dwStackSize: uint,  # UINT_PTR
    lpStartAddress: pointer,  # LPTHREAD_START_ROUTINE
    lpParameter: pointer,  # void* optional
    dwCreationFlags: uint32,  # DWORD
    lpAttributeList: pointer,  # LPPROC_THREAD_ATTRIBUTE_LIST optional
    lpThreadId: ptr uint32  # DWORD* optional, out
): pointer {.importc: "CreateRemoteThreadEx", stdcall, dynlib: "KERNEL32.dll".}

pragma(lib, "kernel32");
extern(Windows)
void* CreateRemoteThreadEx(
    void* hProcess,   // HANDLE
    SECURITY_ATTRIBUTES* lpThreadAttributes,   // SECURITY_ATTRIBUTES* optional
    size_t dwStackSize,   // UINT_PTR
    void* lpStartAddress,   // LPTHREAD_START_ROUTINE
    void* lpParameter,   // void* optional
    uint dwCreationFlags,   // DWORD
    void* lpAttributeList,   // LPPROC_THREAD_ATTRIBUTE_LIST optional
    uint* lpThreadId   // DWORD* optional, out
);

ccall((:CreateRemoteThreadEx, "KERNEL32.dll"), stdcall, Ptr{Cvoid},
      (Ptr{Cvoid}, Ptr{SECURITY_ATTRIBUTES}, Csize_t, Ptr{Cvoid}, Ptr{Cvoid}, UInt32, Ptr{Cvoid}, Ptr{UInt32}),
      hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
# hProcess : HANDLE -> Ptr{Cvoid}
# lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> Ptr{SECURITY_ATTRIBUTES}
# dwStackSize : UINT_PTR -> Csize_t
# lpStartAddress : LPTHREAD_START_ROUTINE -> Ptr{Cvoid}
# lpParameter : void* optional -> Ptr{Cvoid}
# dwCreationFlags : DWORD -> UInt32
# lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> Ptr{Cvoid}
# lpThreadId : DWORD* optional, out -> Ptr{UInt32}
# stdcall は 32bit のみ意味を持つ(x64 では無視)。

local ffi = require("ffi")
ffi.cdef[[
void* CreateRemoteThreadEx(
    void* hProcess,
    void* lpThreadAttributes,
    uintptr_t dwStackSize,
    void* lpStartAddress,
    void* lpParameter,
    uint32_t dwCreationFlags,
    void* lpAttributeList,
    uint32_t* lpThreadId);
]]
local kernel32 = ffi.load("kernel32")
-- kernel32.CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
-- hProcess : HANDLE
-- lpThreadAttributes : SECURITY_ATTRIBUTES* optional
-- dwStackSize : UINT_PTR
-- lpStartAddress : LPTHREAD_START_ROUTINE
-- lpParameter : void* optional
-- dwCreationFlags : DWORD
-- lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional
-- lpThreadId : DWORD* optional, out
-- 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。

const koffi = require('koffi');
const lib = koffi.load('KERNEL32.dll');
const CreateRemoteThreadEx = lib.func('__stdcall', 'CreateRemoteThreadEx', 'void *', ['void *', 'void *', 'uintptr_t', 'void *', 'void *', 'uint32_t', 'void *', 'uint32_t *']);
// CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
// hProcess : HANDLE -> 'void *'
// lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> 'void *'
// dwStackSize : UINT_PTR -> 'uintptr_t'
// lpStartAddress : LPTHREAD_START_ROUTINE -> 'void *'
// lpParameter : void* optional -> 'void *'
// dwCreationFlags : DWORD -> 'uint32_t'
// lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> 'void *'
// lpThreadId : DWORD* optional, out -> 'uint32_t *'
// 出力ポインタは koffi.out(...) で包む。構造体は koffi.struct で定義。
// コールバック(関数ポインタ)は koffi.proto/koffi.register で型を定義して渡す(素の void* では JS 関数を渡せない)。

const lib = Deno.dlopen("KERNEL32.dll", {
  CreateRemoteThreadEx: { parameters: ["pointer", "pointer", "usize", "pointer", "pointer", "u32", "pointer", "pointer"], result: "pointer" },
});
// lib.symbols.CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId)
// hProcess : HANDLE -> "pointer"
// lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> "pointer"
// dwStackSize : UINT_PTR -> "usize"
// lpStartAddress : LPTHREAD_START_ROUTINE -> "pointer"
// lpParameter : void* optional -> "pointer"
// dwCreationFlags : DWORD -> "u32"
// lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> "pointer"
// lpThreadId : DWORD* optional, out -> "pointer"
// 文字列引数は "buffer"(NUL 終端のバイト列を Uint8Array で渡す)。
// 値渡し構造体は { struct: [ ...field types... ] } を使用。

<?php
$ffi = FFI::cdef(<<<C
void* CreateRemoteThreadEx(
    void* hProcess,
    void* lpThreadAttributes,
    size_t dwStackSize,
    void* lpStartAddress,
    void* lpParameter,
    uint32_t dwCreationFlags,
    void* lpAttributeList,
    uint32_t* lpThreadId);
C, "KERNEL32.dll");
// $ffi->CreateRemoteThreadEx(hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId);
// hProcess : HANDLE
// lpThreadAttributes : SECURITY_ATTRIBUTES* optional
// dwStackSize : UINT_PTR
// lpStartAddress : LPTHREAD_START_ROUTINE
// lpParameter : void* optional
// dwCreationFlags : DWORD
// lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional
// lpThreadId : DWORD* optional, out
// 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。
// WINAPI(stdcall): x64 では呼出規約が統一されるため問題なし。x86 では __stdcall 対応のラッパが必要な場合あり。

import com.sun.jna.*;
import com.sun.jna.ptr.*;
import com.sun.jna.win32.StdCallLibrary;
import com.sun.jna.win32.W32APIOptions;

public interface Kernel32 extends StdCallLibrary {
    Kernel32 INSTANCE = Native.load("kernel32", Kernel32.class);
    Pointer CreateRemoteThreadEx(
        Pointer hProcess,   // HANDLE
        Pointer lpThreadAttributes,   // SECURITY_ATTRIBUTES* optional
        long dwStackSize,   // UINT_PTR
        Callback lpStartAddress,   // LPTHREAD_START_ROUTINE
        Pointer lpParameter,   // void* optional
        int dwCreationFlags,   // DWORD
        Pointer lpAttributeList,   // LPPROC_THREAD_ATTRIBUTE_LIST optional
        IntByReference lpThreadId   // DWORD* optional, out
    );
}

@[Link("kernel32")]
lib LibKERNEL32
  fun CreateRemoteThreadEx = CreateRemoteThreadEx(
    hProcess : Void*,   # HANDLE
    lpThreadAttributes : SECURITY_ATTRIBUTES*,   # SECURITY_ATTRIBUTES* optional
    dwStackSize : LibC::SizeT,   # UINT_PTR
    lpStartAddress : Void*,   # LPTHREAD_START_ROUTINE
    lpParameter : Void*,   # void* optional
    dwCreationFlags : UInt32,   # DWORD
    lpAttributeList : Void*,   # LPPROC_THREAD_ATTRIBUTE_LIST optional
    lpThreadId : UInt32*   # DWORD* optional, out
  ) : Void*
end
# 構造体/GUID/enum は lib 内に対応する型定義が必要。
# 呼出規約: x64 は規約統一のため OK。x86(32bit)は WINAPI=stdcall だが Crystal の fun に stdcall 付与構文がなく非対応。

import 'dart:ffi';
import 'package:ffi/ffi.dart';

typedef CreateRemoteThreadExNative = Pointer<Void> Function(Pointer<Void>, Pointer<Void>, UintPtr, Pointer<Void>, Pointer<Void>, Uint32, Pointer<Void>, Pointer<Uint32>);
typedef CreateRemoteThreadExDart = Pointer<Void> Function(Pointer<Void>, Pointer<Void>, int, Pointer<Void>, Pointer<Void>, int, Pointer<Void>, Pointer<Uint32>);
final CreateRemoteThreadEx = DynamicLibrary.open('KERNEL32.dll')
    .lookupFunction<CreateRemoteThreadExNative, CreateRemoteThreadExDart>('CreateRemoteThreadEx');
// hProcess : HANDLE -> Pointer<Void>
// lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> Pointer<Void>
// dwStackSize : UINT_PTR -> UintPtr
// lpStartAddress : LPTHREAD_START_ROUTINE -> Pointer<Void>
// lpParameter : void* optional -> Pointer<Void>
// dwCreationFlags : DWORD -> Uint32
// lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> Pointer<Void>
// lpThreadId : DWORD* optional, out -> Pointer<Uint32>
// 文字列は package:ffi の "...".toNativeUtf16()/toNativeUtf8() で変換。

{$mode objfpc}{$H+}
function CreateRemoteThreadEx(
  hProcess: THandle;   // HANDLE
  lpThreadAttributes: Pointer;   // SECURITY_ATTRIBUTES* optional
  dwStackSize: NativeUInt;   // UINT_PTR
  lpStartAddress: Pointer;   // LPTHREAD_START_ROUTINE
  lpParameter: Pointer;   // void* optional
  dwCreationFlags: DWORD;   // DWORD
  lpAttributeList: THandle;   // LPPROC_THREAD_ATTRIBUTE_LIST optional
  lpThreadId: Pointer   // DWORD* optional, out
): THandle; stdcall;
  external 'KERNEL32.dll' name 'CreateRemoteThreadEx';

import Foreign
import Foreign.C.Types
import Foreign.C.String

foreign import stdcall safe "CreateRemoteThreadEx"
  c_CreateRemoteThreadEx :: Ptr () -> Ptr () -> CUIntPtr -> Ptr () -> Ptr () -> Word32 -> Ptr () -> Ptr Word32 -> IO (Ptr ())
-- hProcess : HANDLE -> Ptr ()
-- lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> Ptr ()
-- dwStackSize : UINT_PTR -> CUIntPtr
-- lpStartAddress : LPTHREAD_START_ROUTINE -> Ptr ()
-- lpParameter : void* optional -> Ptr ()
-- dwCreationFlags : DWORD -> Word32
-- lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> Ptr ()
-- lpThreadId : DWORD* optional, out -> Ptr Word32
-- 要 GHC(Windows)。stdcall は x64 では ccall として扱われる。ブロックする API は safe 呼び出し推奨。

open Ctypes
open Foreign

let createremotethreadex =
  foreign "CreateRemoteThreadEx"
    ((ptr void) @-> (ptr void) @-> size_t @-> (ptr void) @-> (ptr void) @-> uint32_t @-> (ptr void) @-> (ptr uint32_t) @-> returning (ptr void))
(* hProcess : HANDLE -> (ptr void) *)
(* lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> (ptr void) *)
(* dwStackSize : UINT_PTR -> size_t *)
(* lpStartAddress : LPTHREAD_START_ROUTINE -> (ptr void) *)
(* lpParameter : void* optional -> (ptr void) *)
(* dwCreationFlags : DWORD -> uint32_t *)
(* lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> (ptr void) *)
(* lpThreadId : DWORD* optional, out -> (ptr uint32_t) *)
(* foreign は cdecl 前提。x64 Windows では WINAPI と一致。構造体は ctypes structure を定義のこと。 *)

(cffi:define-foreign-library kernel32 (t "KERNEL32.dll"))
(cffi:use-foreign-library kernel32)

(cffi:defcfun ("CreateRemoteThreadEx" create-remote-thread-ex :convention :stdcall) :pointer
  (h-process :pointer)   ; HANDLE
  (lp-thread-attributes :pointer)   ; SECURITY_ATTRIBUTES* optional
  (dw-stack-size :uint64)   ; UINT_PTR
  (lp-start-address :pointer)   ; LPTHREAD_START_ROUTINE
  (lp-parameter :pointer)   ; void* optional
  (dw-creation-flags :uint32)   ; DWORD
  (lp-attribute-list :pointer)   ; LPPROC_THREAD_ATTRIBUTE_LIST optional
  (lp-thread-id :pointer))   ; DWORD* optional, out
; isize/usize(INT_PTR/SIZE_T)は x64 前提で :int64/:uint64。x86 では :int32/:uint32。

use Win32::API;
my $CreateRemoteThreadEx = Win32::API::More->new('KERNEL32',
    'HANDLE CreateRemoteThreadEx(HANDLE hProcess, LPVOID lpThreadAttributes, WPARAM dwStackSize, LPVOID lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, HANDLE lpAttributeList, LPVOID lpThreadId)');
# my $ret = $CreateRemoteThreadEx->Call($hProcess, $lpThreadAttributes, $dwStackSize, $lpStartAddress, $lpParameter, $dwCreationFlags, $lpAttributeList, $lpThreadId);
# hProcess : HANDLE -> HANDLE
# lpThreadAttributes : SECURITY_ATTRIBUTES* optional -> LPVOID
# dwStackSize : UINT_PTR -> WPARAM
# lpStartAddress : LPTHREAD_START_ROUTINE -> LPVOID
# lpParameter : void* optional -> LPVOID
# dwCreationFlags : DWORD -> DWORD
# lpAttributeList : LPPROC_THREAD_ATTRIBUTE_LIST optional -> HANDLE
# lpThreadId : DWORD* optional, out -> LPVOID
# 値渡し構造体は pack() した文字列、または Win32::API::Struct を使用。
# コールバック(関数ポインタ)は Perl sub を直接渡せません。Win32::API::Callback を使用してください。