Pushes a value to the stack of a Context structure.

Calculates the total stack space used by the fake stack frame. Uses a minimal implementation of RtlVirtualUnwind to parse the unwind codes for target

Retrieves the runtime function entry for given fake ret address and calls CalculateFunctionStackSize, which will recursively calculate the total stack

Uses the offset within the StackFrame structure to calculate the return address for fake frame.

Calculates the image base for the given stack frame and adds it to the image base map.

Retrieves the pid of the lsass process.

Initialises the spoofed thread state before it begins to execute by building a fake call stack via modifying rsp and appropriate stack data.

Takes a target call stack and configures it ready for use via loading any required dlls, resolving module addresses and calculating spoofed return add

Sets the specified privilege in the current process access token. Based on: https://docs.microsoft.com/en-us/windows/win32/secauthz/enabling-and-disab

Dummy function used as start address for spoofed thread.

Handles the inevitable crash of the fake thread and redirects it to gracefully exit via RtlExitUserThread.