KeResumeThread
UINT64 __stdcall KeResumeThread(_ETHREAD *Thread){
UINT8 OldIrql;
_KPRCB *CurrentPrcb;
volatile signed __int32 *v4;
unsigned int v5;
char v6;
OldIrql = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
v4 = (volatile signed __int32 *)((char *)Thread + 736);
KiAcquireKobjectLockSafe((char *)Thread + 736);
v5 = *((char *)Thread + 644);
if( *((_BYTE *)Thread + 644) )
{
v6 = *((_BYTE *)Thread + 644) - 1;
*((_BYTE *)Thread + 644) = v6;
if( !v6 && (*((_DWORD *)Thread + 30) & 0x4000) == 0 )
KiResumeThread((_KTHREAD *)Thread, CurrentPrcb, 0);
}
_InterlockedAnd(v4, 0xFFFFFF7F);
KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, 0i64, OldIrql);
return v5;
}Referenced by:
KeAlertResumeThread
PsResumeProcess
PsResumeThread