DECLSPEC_NORETURN
VOID
PspExitThread(
    IN NTSTATUS ExitStatus
    )
{
// [skipped]
    Thread = PsGetCurrentThread();
    Process = THREAD_TO_PROCESS(Thread);
// [skipped]
    if ( (Process->ThreadListHead.Flink == Process->ThreadListHead.Blink)
         && (Process->ThreadListHead.Flink == &Thread->ThreadListEntry) ) {
        LastThread = TRUE;
        if ( ExitStatus == STATUS_THREAD_IS_TERMINATING ) {
            if ( Process->ExitStatus == STATUS_PENDING ) {
                Process->ExitStatus = Process->LastThreadExitStatus;
            }
        } else {
            Process->ExitStatus = ExitStatus;
        }

        DbgkExitProcess(ExitStatus);
    }
// [skipped]
    if ( LastThread && Process->Win32Process ) {
        (PspW32ProcessCallout)(Process,FALSE); // Вот тут он разрегистрируется в csrss-е
        }
// [skipped]
    //
    // If this is the last thread in the process, then clean the address space
    //

    if ( LastThread ) {
        if (!(ExChangeHandle(PspCidTable,Process->UniqueProcessId, PspMarkCidInvalid, PSP_INVALID_ID))) {
            KeBugCheck(CID_HANDLE_DELETION);
        }
        KeQuerySystemTime(&Process->ExitTime);
        PspExitProcess(TRUE,Process);
    }
// [skipped]
}

#include <windows.h>
#include <stdio.h>

void func();
DWORD WINAPI ThreadProc(LPVOID lParam);

int main() {
	func();
	return 0;
}

void func() {
	unsigned int tid;
	char test[30]={0};
	
	memset(&test[0], 'A', 29);
	printf("%s\n", test);


	HANDLE hT1 = CreateThread(NULL, 0, ThreadProc, &test[0], 0, (LPDWORD)&tid);
	HANDLE hT2 = CreateThread(NULL, 0, ThreadProc, &test[0], 0, (LPDWORD)&tid);
	HANDLE hT3 = CreateThread(NULL, 0, ThreadProc, &test[0], 0, (LPDWORD)&tid);

	if ((hT1 == INVALID_HANDLE_VALUE)|		(hT2 == INVALID_HANDLE_VALUE)|		(hT3 == INVALID_HANDLE_VALUE))
		printf("failed\n");

	int lastErr = GetLastError();
	if (lastErr)
		printf("last error = %d\n", lastErr);

}


DWORD WINAPI ThreadProc(LPVOID lParam) {
	char *p = (char *)lParam;

//	Sleep(100);

	printf("i'm thread %d\n", GetCurrentThreadId());
	printf("%s\n", p);

	MessageBox(NULL, TEXT("test"), TEXT("test"), MB_OK);

	return 0;
}

DECLSPEC_NORETURN
VOID
PspExitThread(
    IN NTSTATUS ExitStatus
    )
{
// [skipped]
    Thread = PsGetCurrentThread();
    Process = THREAD_TO_PROCESS(Thread);
// [skipped]
    if ( (Process->ThreadListHead.Flink == Process->ThreadListHead.Blink)
         && (Process->ThreadListHead.Flink == &Thread->ThreadListEntry) ) {
        LastThread = TRUE;
        if ( ExitStatus == STATUS_THREAD_IS_TERMINATING ) {
            if ( Process->ExitStatus == STATUS_PENDING ) {
                Process->ExitStatus = Process->LastThreadExitStatus;
            }
        } else {
            Process->ExitStatus = ExitStatus;
        }

        DbgkExitProcess(ExitStatus);
    }
// [skipped]
    if ( LastThread && Process->Win32Process ) {
        (PspW32ProcessCallout)(Process,FALSE); // Вот тут он разрегистрируется в csrss-е
        }
// [skipped]
    //
    // If this is the last thread in the process, then clean the address space
    //

    if ( LastThread ) {
        if (!(ExChangeHandle(PspCidTable,Process->UniqueProcessId, PspMarkCidInvalid, PSP_INVALID_ID))) {
            KeBugCheck(CID_HANDLE_DELETION);
        }
        KeQuerySystemTime(&Process->ExitTime);
        PspExitProcess(TRUE,Process);
    }
// [skipped]
}