PfLogForegroundProcess
INT64 __fastcall PfLogForegroundProcess(INT64 a1){
int v1;
INT64 v3;
int v4;
int v5;
v1 = *(_DWORD *)(a1 - 140);
v5 = 0;
v4 = v1;
v3 = a1 - 1664;
return PfLogEvent(
7i64,
dword_140C5001C
+ (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier
* (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
+ ((KUSER_SHARED_DATA.TickCountMultiplier
* (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10),
&v3,
0x10ui64);
}Referenced by:
MiTrimOrAgeWorkingSet