#ifndef _NTPSAPI_H
//
// Processes
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Suspends the specified process.
 *
 * \param ProcessHandle A handle to the process to be suspended.
 * \return NTSTATUS Successful or errant status.
 * \remarks Use NtCreateProcessStateChange instead.
 * \remarks Requires PROCESS_SUSPEND_RESUME (0x800) and applies process suspension through PsSuspendProcess. This is not
 * an atomic snapshot of all process state and can stop a thread while it owns a lock. Balance suspension with
 * NtResumeProcess; never suspend the process responsible for issuing the matching resume.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendProcess(
    _In_ HANDLE ProcessHandle
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSuspendProcess(
    _In_ HANDLE ProcessHandle
    );

#endif
View code on GitHub