Reads : Windows Internal Part 1

Ideas

Calling NtSuspendProcess to suspend AV temporarily

But how to restore ^ ?