#ifndef _NTPEBTEB_H

// rev
typedef struct _TPP_CALLBACK_RECORD
{
    PVOID Callback;         // Function pointer recorded at callback entry
    PVOID Parameter;        // First argument passed to Callback
    PVOID SubProcessTag;    // TEB SubProcessTag active at callback entry
    ULONGLONG Timestamp;    // InterruptTime snapshot at callback entry
} TPP_CALLBACK_RECORD, *PTPP_CALLBACK_RECORD;

#endif
View code on GitHub