PsSuspendProcess

NTSTATUS __stdcall PsSuspendProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  _EX_RUNDOWN_REF *p_RundownProtect; 
  _ETHREAD *NextProcessThread; 
  unsigned int v5; 
  _ETHREAD *v6; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_RundownProtect = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) == 1 )
  {
    NextProcessThread = (_ETHREAD *)PsGetNextProcessThread(Process, 0i64);
    v5 = 0;
    while( 1 )
    {
      v6 = NextProcessThread;
      if( !NextProcessThread )
        break;
      if( (NextProcessThread->Tcb._bf_0 & 0x200000) == 0 )
        PsSuspendThread(NextProcessThread, 0i64);
      NextProcessThread = (_ETHREAD *)PsGetNextProcessThread(Process, v6);
    }
    ExReleaseRundownProtection(p_RundownProtect);
  }
  else
  {
    v5 = -1073741558;
  }
  if( (Process->Flags3 & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(v5, (INT64)CurrentThread, (INT64)Process, 0i64);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v5;
}

Referenced by: