KeFreezeProcess

VOID __stdcall KeFreezeProcess(_EPROCESS *TargetProcess, UINT8 DeepFreeze){
  UINT8 OldIrql; 
  _KPRCB *CurrentPrcb; 
  unsigned int *p_ProcessLock; 
  unsigned int FreezeCount; 
  unsigned __int32 v8; 
  _LIST_ENTRY *p_ThreadListHead; 
  _LIST_ENTRY *i; 
  _LIST_ENTRY **p_Blink; 

  OldIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  CurrentPrcb = KeGetCurrentPrcb();
  p_ProcessLock = &TargetProcess->Pcb.ProcessLock;
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)&TargetProcess->Pcb.ProcessLock);
  FreezeCount = TargetProcess->Pcb.FreezeCount;
  v8 = FreezeCount + (((unsigned __int32)TargetProcess->Pcb._bf_0 >> 3) & 1);
  if( DeepFreeze )
  {
    TargetProcess->Pcb.DeepFreezeStartTime = KiQueryUnbiasedInterruptTime(0);
    _interlockedbittestandset(&TargetProcess->Pcb.ProcessFlags, 3u);
  }
  else
  {
    TargetProcess->Pcb.FreezeCount = FreezeCount + 1;
  }
  if( v8 )
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&TargetProcess->Pcb.ProcessLock);
    __writecr8(OldIrql);
  }
  else
  {
    p_ThreadListHead = &TargetProcess->Pcb.ThreadListHead;
    for( i = TargetProcess->Pcb.ThreadListHead.Flink; i != p_ThreadListHead; i = i->Flink )
    {
      p_Blink = &i[-48].Blink;
      if( DeepFreeze || (*((_DWORD *)p_Blink + 29) & 0x200000) == 0 )
        KiFreezeSingleThread(CurrentPrcb, (_KTHREAD *)p_Blink);
    }
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)p_ProcessLock);
    KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, 0i64, OldIrql);
  }
}

Referenced by: