PsThawProcess

VOID __stdcall PsThawProcess(_EPROCESS *Process, UINT8 DeepFreeze){
  _ETHREAD *CurrentThread; 
  INT64 v5; 
  unsigned int ProcessNtdllType; 
  _QWORD **SharedInformation; 
  int v8; 
  UINT64 SessionId; 
  _ETHREAD *v10; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v10 = CurrentThread;
  if( DeepFreeze )
  {
    if( Process->Win32Process && (Process->Flags & 8) == 0 )
    {
      LODWORD(SessionId) = PsGetProcessSessionIdEx((INT64)Process);
      PsInvokeWin32Callout(Win32ProcessThawCallout, Process, PsWin32SessionAttachSingle, &SessionId);
    }
    v5 = 0i64;
    --CurrentThread->Tcb.KernelApcDisable;
    ExAcquirePushLockExclusiveEx(&Process->ProcessLock, 0i64);
    if( Process->LastFreezeInterruptTime )
    {
      v5 = KiQueryUnbiasedInterruptTime(1u) - Process->LastFreezeInterruptTime;
      Process->LastFreezeInterruptTime = 0i64;
      Process->TotalUnbiasedFrozenTime += v5;
    }
    if( (_InterlockedExchangeAdd64(&Process->ProcessLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&Process->ProcessLock);
    KeAbPostRelease(&Process->ProcessLock);
    KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    if( (*(_BYTE *)&Process->Pcb.SecureState & 1) != 0 )
    {
      VslUpdateFreezeTimeBias((INT64)Process, v5);
    }
    else
    {
      *(_QWORD *)PspFreezeTimeBiasAddress += v5;
      ProcessNtdllType = PsWow64GetProcessNtdllType((INT64)Process);
      if( ProcessNtdllType )
      {
        SharedInformation = (_QWORD **)PspWow64GetSharedInformation(ProcessNtdllType);
        *SharedInformation[8] += v5;
      }
    }
  }
  KeThawProcess(&Process->Pcb, DeepFreeze);
  if( v8 == 1 && (Process->Flags3 & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(0i64, (INT64)CurrentThread, (INT64)Process, 3i64);
  if( DeepFreeze )
    PsSetProcessTelemetryAppState(Process, PsTelemetryAppStateResume);
}

Referenced by: