PsSuspendThread

NTSTATUS __stdcall PsSuspendThread(_ETHREAD *Thread, UINT64 *PreviousSuspendCount){
  _ETHREAD *CurrentThread; 
  _EX_RUNDOWN_REF *p_RundownProtect; 
  unsigned int v6; 
  int v8; 

  v8 = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_RundownProtect = &Thread->RundownProtect;
  if( ExAcquireRundownProtection(&Thread->RundownProtect) )
  {
    if( (Thread->CrossThreadFlags & 1) != 0 )
    {
      v6 = -1073741749;
    }
    else
    {
      v8 = KeSuspendThread(&Thread->Tcb);
      v6 = 0;
    }
    ExReleaseRundownProtection(p_RundownProtect);
  }
  else
  {
    v6 = -1073741749;
  }
  if( PreviousSuspendCount )
  {
    *(_DWORD *)PreviousSuspendCount = v8;
    if( !v8 && (Thread->Tcb.Process->Flags3 & 0x100000) != 0 )
      EtwTiLogSuspendResumeThread(v6, (INT64)CurrentThread, (INT64)Thread, 1);
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v6;
}

Referenced by: