pub unsafe extern "system" fn PsQueryTotalCycleTimeProcess(
    process: PEPROCESS,
    cycletimestamp: *mut u64,
) -> u64