PfLogForegroundProcess

INT64 __fastcall PfLogForegroundProcess(INT64 a1){
  int v1; 
  INT64 v3; 
  int v4; 
  int v5; 
  v1 = *(_DWORD *)(a1 - 140);
  v5 = 0;
  v4 = v1;
  v3 = a1 - 1664;
  return PfLogEvent(
           7i64,
           dword_140C5001C
         + (unsigned int)((((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.ReservedTickCountOverlay[1]) << 8)
                         + ((KUSER_SHARED_DATA.TickCountMultiplier
                           * (unsigned __int64)KUSER_SHARED_DATA.TickCount.LowPart) >> 24)) >> 10),
           &v3,
           0x10ui64);
}

Referenced by:

MiTrimOrAgeWorkingSet