And a note for 3): It's importatnt to create a thread with CREATE_SUSPENDED, and at thread runtime we have to suspend thread while checking out its registers so that to get the true values.
SuspendThread(thdl); GetThreadContext(thdl, &ctx); ... ResumeThread(thdl); 0x4C56
