NTSTATUS __stdcall NtSuspendProcess(VOID *ProcessHandle){
int v1;
UINT64 Tag;
_EPROCESS *Process;
Process = 0i64;
LODWORD(Tag) = 1968403280;
v1 = ObReferenceObjectByHandleWithTag(
ProcessHandle,
0x800ui64,
(_OBJECT_TYPE *)PsProcessType,
KeGetCurrentThread()->PreviousMode,
Tag,
(VOID **)&Process,
0i64);
if( v1 >= 0 )
{
v1 = PsSuspendProcess(Process);
ObfDereferenceObjectWithTag(Process, 0x75537350ui64);
}
return v1;
}