The CreateRemoteThread function creates a thread that runs in the address space of another process. 

HANDLE CreateRemoteThread(

    HANDLE hProcess,	// handle to process to create thread in  
    LPSECURITY_ATTRIBUTES lpThreadAttributes,	// pointer to thread security attributes 
    DWORD dwStackSize,	// initial thread stack size, in bytes
    LPTHREAD_START_ROUTINE lpStartAddress,	// pointer to thread function 
    LPVOID lpParameter,	// pointer to argument for new thread  
    DWORD dwCreationFlags,	// creation flags 
    LPDWORD lpThreadId 	// pointer to returned thread identifier 
   );	
 

Parameters

hProcess

Identifies the process in which the thread is to be created. 
Windows NT: The handle must have PROCESS_CREATE_THREAD access. For more information, see Process Objects. 

lpThreadAttributes

Pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and determines whether child processes can inherit the returned handle. If lpThreadAttributes is NULL, the thread gets a default security descriptor and the handle cannot be inherited.

dwStackSize

Specifies the size, in bytes, of the stack for the new thread. If this value is zero, the stack size defaults to the same size as that of the primary thread of the process. The stack is allocated automatically in the memory space of the process and is freed when the thread terminates. Note that the stack size grows as necessary. 

lpStartAddress

Points to the starting address of the new thread. This is typically the address of a function declared with the WINAPI calling convention that never returns and that accepts a single 32-bit pointer as an argument. 

lpParameter

Points to a single 32-bit value passed to the thread. 

dwCreationFlags

Specifies additional flags that control the creation of the thread. If the CREATE_SUSPENDED flag is specified, the thread is created in a suspended state and will not run until the ResumeThread function is called. If this value is zero, the thread runs immediately after creation. 

lpThreadId

Points to a 32-bit variable that receives the thread identifier.