PsResumeThread

NTSTATUS __stdcall PsResumeThread(_ETHREAD *Thread, UINT64 *PreviousSuspendCount){
  int v4; 
  _ETHREAD *CurrentThread; 
  int v6; 
  _EPROCESS *Process; 
  unsigned int Flags3; 

  v4 = KeResumeThread(&Thread->Tcb);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = v4;
  if( v4 == 1 )
  {
    Process = Thread->Tcb.Process;
    Flags3 = Process->Flags3;
    if( (Flags3 & 0x8000) == 0 )
    {
      _InterlockedOr((volatile signed __int32 *)&Process->2172, 0x8000u);
      Flags3 = Process->Flags3;
    }
    if( (Flags3 & 0x100000) != 0 )
      EtwTiLogSuspendResumeThread(0i64, (INT64)CurrentThread, (INT64)Thread, 0);
  }
  if( PreviousSuspendCount )
    *(_DWORD *)PreviousSuspendCount = v6;
  return 0;
}

Referenced by: