KeThawProcess

VOID __stdcall KeThawProcess(_EPROCESS *TargetProcess, UINT8 DeepFreeze){
  _LIST_ENTRY *p_ThreadListHead; 
  UINT8 OldIrql; 
  unsigned int *p_ProcessLock; 
  UINT64 v7; 
  unsigned int FreezeCount; 
  unsigned __int32 v9; 
  _LIST_ENTRY *i; 
  _LIST_ENTRY *j; 
  _LIST_ENTRY **p_Blink; 
  struct _KPRCB *Prcb; 

  p_ThreadListHead = &TargetProcess->Pcb.ThreadListHead;
  OldIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  p_ProcessLock = &TargetProcess->Pcb.ProcessLock;
  Prcb = KeGetCurrentPrcb();
  v7 = 0i64;
  ExAcquireSpinLockExclusiveAtDpcLevel((INT64 *)&TargetProcess->Pcb.ProcessLock);
  FreezeCount = TargetProcess->Pcb.FreezeCount;
  v9 = FreezeCount + (((unsigned __int32)TargetProcess->Pcb._bf_0 >> 3) & 1);
  if( v9 )
  {
    if( DeepFreeze )
    {
      _interlockedbittestandreset(&TargetProcess->Pcb.ProcessFlags, 3u);
      v7 = KiQueryUnbiasedInterruptTime(0) - TargetProcess->Pcb.DeepFreezeStartTime;
    }
    else
    {
      TargetProcess->Pcb.FreezeCount = FreezeCount - 1;
    }
  }
  if( DeepFreeze && (TargetProcess->Pcb._bf_0 & 0x10) != 0 )
  {
    for( i = p_ThreadListHead->Flink; i != p_ThreadListHead; i = i->Flink )
      i[-32].Flink = (_LIST_ENTRY *)((char *)i[-32].Flink + v7);
  }
  if( v9 == 1 )
  {
    for( j = p_ThreadListHead->Flink; j != p_ThreadListHead; j = j->Flink )
    {
      p_Blink = &j[-48].Blink;
      if( DeepFreeze || (*((_DWORD *)p_Blink + 29) & 0x200000) == 0 )
        KiThawSingleThread(Prcb, (_KTHREAD *)p_Blink, 0);
    }
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)p_ProcessLock);
    KiExitDispatcher(Prcb, 0i64, AdjustUnwait, 0i64, OldIrql);
  }
  else
  {
    ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&TargetProcess->Pcb.ProcessLock);
    __writecr8(OldIrql);
  }
}

Referenced by: