Adjust the RunPE state machine as a SetContextThread isn't necessarily required.  As observed in Harasom, the executable image is unmapped and its entrypoint address obtained.  The malware then maps back in code at the same address to redirect execution to its newly-mapped image.  Combined with standardizing on the NtMapViewOfSection name, this module will now properly detect this form of injection.