PsFreezeProcess

UINT8 __stdcall PsFreezeProcess(_EPROCESS *Process, UINT8 DeepFreeze){
  int v4; 
  _ETHREAD *CurrentThread; 
  UINT64 SessionId; 

  if( (Process->Flags & 8) != 0 )
    return 0;
  KeFreezeProcess(&Process->Pcb, DeepFreeze);
  if( (Process->Flags & 8) != 0 )
  {
    KeForceResumeProcess(&Process->Pcb);
    return 0;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  if( !v4 && (Process->Flags3 & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(0i64, (INT64)CurrentThread, (INT64)Process, 2i64);
  if( DeepFreeze )
  {
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&Process->ProcessLock, 0i64);
    Process->LastFreezeInterruptTime = KiQueryUnbiasedInterruptTime(1u);
    if( (_InterlockedExchangeAdd64(&Process->ProcessLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&Process->ProcessLock);
    KeAbPostRelease(&Process->ProcessLock);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    if( Process->Win32Process )
    {
      LODWORD(SessionId) = PsGetProcessSessionIdEx((INT64)Process);
      PsInvokeWin32Callout(Win32ProcessFreezeCallout, Process, PsWin32SessionAttachSingle, &SessionId);
    }
    PsSetProcessTelemetryAppState(Process, PsTelemetryAppStateSuspend);
  }
  return 1;
}

Referenced by: