PsResumeThread

__int64 __fastcall PsResumeThread(__int64 a1, _DWORD *a2){
  int v4; 
  _ETHREAD *CurrentThread; 
  int v6; 
  __int64 v7; 
  int v8; 
  v4 = KeResumeThread((_KTHREAD *)a1);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = v4;
  if( v4 == 1 )
  {
    v7 = *(_QWORD *)(a1 + 544);
    v8 = *(_DWORD *)(v7 + 2172);
    if( (v8 & 0x8000) == 0 )
    {
      _InterlockedOr((volatile signed __int32 *)(v7 + 2172), 0x8000u);
      v8 = *(_DWORD *)(v7 + 2172);
    }
    if( (v8 & 0x100000) != 0 )
      EtwTiLogSuspendResumeThread(0i64, (INT64)CurrentThread, a1, 0);
  }
  if( a2 )
    *a2 = v6;
  return 0i64;
}

Referenced by: