KeResumeThread
UINT64 __stdcall KeResumeThread(_ETHREAD *Thread){
UINT8 OldIrql;
_KPRCB *CurrentPrcb;
volatile signed __int32 *v4;
unsigned int SuspendCount;
char v6;
OldIrql = KeGetCurrentIrql();
__writecr8(2ui64);
CurrentPrcb = KeGetCurrentPrcb();
v4 = (volatile signed __int32 *)Thread->Tcb.gap2E0;
KiAcquireKobjectLockSafe(Thread->Tcb.gap2E0);
SuspendCount = Thread->Tcb.SuspendCount;
if( Thread->Tcb.SuspendCount )
{
v6 = Thread->Tcb.SuspendCount - 1;
Thread->Tcb.SuspendCount = v6;
if( !v6 && (*(&Thread->Tcb.MiscFlags + 1) & 0x4000) == 0 )
KiResumeThread(&Thread->Tcb, CurrentPrcb, 0);
}
_InterlockedAnd(v4, 0xFFFFFF7F);
KiExitDispatcher(CurrentPrcb, 0i64, AdjustUnwait, 0i64, OldIrql);
return SuspendCount;
}Referenced by:
KeAlertResumeThread
PsResumeProcess
PsResumeThread