PsSuspendThread

__int64 __fastcall PsSuspendThread(__int64 a1, _DWORD *a2){
  _ETHREAD *CurrentThread; 
  struct _EX_RUNDOWN_REF *v5; 
  unsigned int v6; 
  int v8; 
  v8 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v5 = (struct _EX_RUNDOWN_REF *)(a1 + 1272);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)(a1 + 1272)) )
  {
    if( (*(_DWORD *)(a1 + 1296) & 1) != 0 )
    {
      v6 = -1073741749;
    }
    else
    {
      v8 = KeSuspendThread(a1);
      v6 = 0;
    }
    ExReleaseRundownProtection(v5);
  }
  else
  {
    v6 = -1073741749;
  }
  if( a2 )
  {
    *a2 = v8;
    if( !v8 && (*(_DWORD *)(*(_QWORD *)(a1 + 544) + 2172i64) & 0x100000) != 0 )
      EtwTiLogSuspendResumeThread(v6, (INT64)CurrentThread, a1, 1);
  }
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v6;
}

Referenced by: