NtResumeThread

NTSTATUS __stdcall NtResumeThread(VOID *ThreadHandle, UINT64 *PreviousSuspendCount){
  char PreviousMode; 
  __int64 v5; 
  NTSTATUS result; 
  UINT64 Tag; 
  UINT64 PreviousSuspendCounta; 
  PVOID Object; 

  LODWORD(PreviousSuspendCounta) = 0;
  Object = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode && PreviousSuspendCount )
  {
    v5 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)PreviousSuspendCount < 0x7FFFFFFF0000i64 )
      v5 = (__int64)PreviousSuspendCount;
    *(_DWORD *)v5 = *(_DWORD *)v5;
  }
  LODWORD(Tag) = 1968403280;
  result = ObReferenceObjectByHandleWithTag(
             ThreadHandle,
             0x1000ui64,
             (_OBJECT_TYPE *)PsThreadType,
             PreviousMode,
             Tag,
             &Object,
             0i64);
  if( result >= 0 )
  {
    PsResumeThread((_ETHREAD *)Object, &PreviousSuspendCounta);
    ObfDereferenceObjectWithTag(Object, 0x75537350ui64);
    if( PreviousSuspendCount )
      *(_DWORD *)PreviousSuspendCount = PreviousSuspendCounta;
    return 0;
  }
  return result;
}

Referenced by: