PsGetCurrentThreadTeb

VOID *__fastcall PsGetCurrentThreadTeb(){
  _ETHREAD *CurrentThread; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( (*((_DWORD *)CurrentThread + 29) & 0x400) != 0 || *((_BYTE *)CurrentThread + 586) == 1 )
    return 0i64;
  else
    return(VOID *)*((_QWORD *)CurrentThread + 30);
}

Referenced by:

EtwTraceThread
EtwpPsProvTraceThread