PsSuspendProcess

INT64 __stdcall PsSuspendProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  struct _EX_RUNDOWN_REF *v3; 
  _QWORD *NextProcessThread; 
  unsigned int v5; 
  _QWORD *v6; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v3 = (struct _EX_RUNDOWN_REF *)((char *)Process + 1112);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)Process + 139) )
  {
    NextProcessThread = PsGetNextProcessThread((__int64)Process, 0i64);
    v5 = 0;
    while( 1 )
    {
      v6 = NextProcessThread;
      if( !NextProcessThread )
        break;
      if( (*((_DWORD *)NextProcessThread + 29) & 0x200000) == 0 )
        PsSuspendThread((__int64)NextProcessThread, 0i64);
      NextProcessThread = PsGetNextProcessThread((__int64)Process, v6);
    }
    ExReleaseRundownProtection(v3);
  }
  else
  {
    v5 = -1073741558;
  }
  if( (*((_DWORD *)Process + 543) & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(v5, (INT64)CurrentThread, (INT64)Process, 0i64);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v5;
}

Referenced by: