PsResumeProcess

NTSTATUS __stdcall PsResumeProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  _EX_RUNDOWN_REF *p_RundownProtect; 
  _LIST_ENTRY **NextProcessThread; 
  unsigned int v5; 
  _ETHREAD *v6; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_RundownProtect = &Process->RundownProtect;
  if( ExAcquireRundownProtection(&Process->RundownProtect) == 1 )
  {
    NextProcessThread = PsGetNextProcessThread(Process, 0i64);
    v5 = 0;
    while( 1 )
    {
      v6 = (_ETHREAD *)NextProcessThread;
      if( !NextProcessThread )
        break;
      if( (*((_DWORD *)NextProcessThread + 29) & 0x200000) == 0 )
        KeResumeThread((_KTHREAD *)NextProcessThread);
      NextProcessThread = PsGetNextProcessThread(Process, v6);
    }
    ExReleaseRundownProtection(p_RundownProtect);
  }
  else
  {
    v5 = -1073741558;
  }
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  if( (Process->Flags3 & 0x80000) != 0 )
    EtwTiLogSuspendResumeProcess(v5, (INT64)CurrentThread, (INT64)Process, 1i64);
  return v5;
}

Referenced by: