> Is there a way to go into the thread function, knowing only the thread
> handle?

Yes, it's a 2-step process.

**Step 1 - Convert the thread handle to a thread ID**

In [Process Explorer][1]'s menu bar, check the following:

 - *View* → *Show Lower Pane*
 - *View* → *Lower Pane View* → *Handles*
 - *View* → *Select Columns...* → *Handle* tab → check all checkboxes

Next, select your target process in Process Explorer's list of processes. You'll then see in the lower pane the list of handles for that process, including thread handles. Find the thread ID associated with your target handle. For the example below, thread handle `0x228` is associated with thread ID `3000`:

![Handle to ID][2]

Though handle values are shown in hexadecimal in Process Explorer, thread IDs are shown in decimal. Thus thread ID `3000` in decimal is equal to thread ID `0xBB8` in hexadecimal.

**Step 2 - Find EIP for the thread ID**

In OllyDbg's menu bar, select *View* → *Threads*. Right-click on the thread whose *Ident* corresponds to the thread ID you found in Step 1 (`0xBB8` in the example below), and select *Show registers*:

![Threads][3]

This will show you the current `EIP` for that thread, which is the next instruction to be executed once that thread is resumed:

![Registers][4]


  [1]: https://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
  [2]: https://i.sstatic.net/mddAT.png
  [3]: https://i.sstatic.net/YC5Hk.png
  [4]: https://i.sstatic.net/iKgc4.png