[WoW] [7.3.5.25864]

[MrNoble]

The TLS callback is obfuscated, but I'm guessing that's what they are doing. It must be checking if the start address resided inside a module.

I just found out a way to bypass this by starting the Thread 1 byte after the start location of the thread.
So next time i do a CRT i make my first byte 0x90 (nop) and patch some other data to start the thread at the second byte.
Might be helpfull for someone.