Consider using registry keys to get Windows boot time (getting rid of NtQuerySystemInformation, which is unstable)

[rdbo]

Check modified time of: HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters\BootId may be a better indicator than using the NT API

[rdbo]

https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryinfokeya

LastWriteTime is useful here

[rdbo]

Another way would be to create a static variable in process.c that stores the Windows boot time from the GetTickCount/GetTickCount64 functions.

[rdbo]

Another possibility: use Unix timestamps across all platforms instead of boot-relative time