KeThawProcess

VOID __stdcall KeThawProcess(_EPROCESS *TargetProcess, UINT8 DeepFreeze){
  _QWORD **v3; 
  UINT8 OldIrql; 
  INT64 *v6; 
  UINT64 v7; 
  int v8; 
  int v9; 
  _QWORD *i; 
  _QWORD *j; 
  _KTHREAD *v12; 
  _KPRCB *Prcb; 
  v3 = (_QWORD **)((char *)TargetProcess + 48);
  OldIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  v6 = (INT64 *)((char *)TargetProcess + 64);
  Prcb = KeGetCurrentPrcb();
  v7 = 0i64;
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)TargetProcess + 8);
  v8 = *((_DWORD *)TargetProcess + 222);
  v9 = v8 + ((*((_DWORD *)TargetProcess + 158) >> 3) & 1);
  if( v9 )
  {
    if( DeepFreeze )
    {
      _interlockedbittestandreset((volatile signed __int32 *)TargetProcess + 158, 3u);
      v7 = KiQueryUnbiasedInterruptTime(0) - *((_QWORD *)TargetProcess + 9);
    }
    else
    {
      *((_DWORD *)TargetProcess + 222) = v8 - 1;
    }
  }
  if( DeepFreeze && (*((_DWORD *)TargetProcess + 158) & 0x10) != 0 )
  {
    for( i = *v3; i != v3; i = (_QWORD *)*i )
      *(i - 64) += v7;
  }
  if( v9 == 1 )
  {
    for( j = *v3; j != v3; j = (_QWORD *)*j )
    {
      v12 = (_ETHREAD *)(j - 95);
      if( DeepFreeze || (*((_DWORD *)v12 + 29) & 0x200000) == 0 )
        KiThawSingleThread(Prcb, (_KTHREAD *)v12, 0);
    }
    ExReleaseSpinLockExclusiveFromDpcLevel(v6);
    KiExitDispatcher(Prcb, 0i64, AdjustUnwait, 0i64, OldIrql);
  }
  else
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)TargetProcess + 8);
    __writecr8(OldIrql);
  }
}

Referenced by: