NtSuspendThread - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTPSAPI_H
//
// Threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * Suspends the specified thread.
 *
 * \param ThreadHandle A handle to the thread to be suspended.
 * \param PreviousSuspendCount Optional. A pointer to a variable that receives the thread's previous suspend count.
 * \return NTSTATUS Successful or errant status.
 * \remarks Increments suspension through PsSuspendThread, using THREAD_SUSPEND_RESUME (0x2). PreviousSuspendCount is an
 * optional 4-byte output reporting the count before this operation. Balance the count with resume calls; do
 * not assume a successful call is a safe application-level pause point or that one resume removes multiple
 * suspensions.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendThread(
    _In_ HANDLE ThreadHandle,
    _Out_opt_ PULONG PreviousSuspendCount
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSuspendThread(
    _In_ HANDLE ThreadHandle,
    _Out_opt_ PULONG PreviousSuspendCount
    );

#endif

View code on GitHub

NtDoc

Suspends a thread.

Parameters

Related Win32 API

See also

NTinternals.net (undocumented.ntinternals.net)

PreviousSuspendCount

Suspend count for ThreadHandle thread before function call.

Documented by

See also