PsResumeProcess

__int64 __fastcall PsResumeProcess(__int64 a1){
  _ETHREAD *CurrentThread; 
  struct _EX_RUNDOWN_REF *v3; 
  _QWORD *NextProcessThread; 
  unsigned int v5; 
  _QWORD *v6; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  v3 = (struct _EX_RUNDOWN_REF *)(a1 + 1112);
  if( ExAcquireRundownProtection((PEX_RUNDOWN_REF)(a1 + 1112)) )
  {
    NextProcessThread = PsGetNextProcessThread(a1, 0i64);
    v5 = 0;
    while( 1 )
    {
      v6 = NextProcessThread;
      if( !NextProcessThread )
        break;
      if( (*((_DWORD *)NextProcessThread + 29) & 0x200000) == 0 )
        KeResumeThread((_KTHREAD *)NextProcessThread);
      NextProcessThread = PsGetNextProcessThread(a1, v6);
    }
    ExReleaseRundownProtection(v3);
  }
  else
  {
    v5 = -1073741558;
  }
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  if( (*(_DWORD *)(a1 + 2172) & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(v5, (INT64)CurrentThread, a1, 1i64);
  return v5;
}

Referenced by: