#ifndef _NTPSAPI_H
//
// Processes
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Resumes the specified process.
 *
 * \param ProcessHandle A handle to the process to be resumed.
 * \return NTSTATUS Successful or errant status.
 * \remarks Use NtCreateProcessStateChange instead.
 * \remarks Requires PROCESS_SUSPEND_RESUME (0x800) and uses PsMultiResumeProcess. Resuming does not prove every thread
 * is runnable: individual suspension counts, process freezing and ordinary waits are separate state. The WoW64
 * suspend path uses RtlWow64SuspendProcess, whereas this resume wrapper forwards directly.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtResumeProcess(
    _In_ HANDLE ProcessHandle
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwResumeProcess(
    _In_ HANDLE ProcessHandle
    );

#endif
View code on GitHub