NtAlertResumeThread

INT64 __fastcall NtAlertResumeThread(VOID *ThreadHandle, UINT64 *PreviousSuspendCount){
  KPROCESSOR_MODE v4; 
  __int64 v5; 
  INT64 result; 
  int v7; 
  PVOID Object; 
  Object = 0i64;
  v4 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v4 && PreviousSuspendCount )
  {
    v5 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)PreviousSuspendCount < 0x7FFFFFFF0000i64 )
      v5 = (__int64)PreviousSuspendCount;
    *(_DWORD *)v5 = *(_DWORD *)v5;
  }
  LODWORD(result) = ObReferenceObjectByHandleWithTag(
                      ThreadHandle,
                      2u,
                      (POBJECT_TYPE)PsThreadType,
                      v4,
                      0x75537350u,
                      &Object,
                      0i64);
  if( (int)result >= 0 )
  {
    if( v4 && (*((_DWORD *)Object + 29) & 0x400) != 0 )
    {
      ObfDereferenceObjectWithTag(Object, 0x75537350ui64);
      return 3221225506i64;
    }
    else
    {
      v7 = KeAlertResumeThread((_KTHREAD *)Object);
      ObfDereferenceObjectWithTag(Object, 0x75537350ui64);
      if( PreviousSuspendCount )
        *(_DWORD *)PreviousSuspendCount = v7;
      return 0i64;
    }
  }
  return result;
}

Referenced by: