[Release] - Win7 GetPsSuspendThreadAddr

ULONG  GetPsSuspendThread(IN ULONG NtSuspendThread_Index)
{
UCHAR *cPtr, *pOpcode;
ULONG Length, CallCount=0;
ULONG uNtSuspendThread=0;
ULONG uPsSuspendThread=0;

uNtSuspendThread=GetFuncAddress_Index(NtSuspendThread_Index);
if (uNtSuspendThread==0) return;
for (cPtr = (PUCHAR)uNtSuspendThread; cPtr < (PUCHAR)uNtSuspendThread + PAGE_SIZE; cPtr += Length) 
{
  Length = SizeOfCode(cPtr, &pOpcode);
  if (!Length) return; 
  if (*pOpcode == 0xE8)
  {
   CallCount=CallCount+1;
   if (CallCount==3)
   {
    uPsSuspendThread=(*(PULONG)(pOpcode+1)+(ULONG)cPtr + 5);
    return uPsSuspendThread;
   }
  }
}
}