WmiSetNetworkNotify

INT64 __stdcall WmiSetNetworkNotify(VOID *NotifyRoutine){
  int v1; 
  VOID *v3; 
  UINT64 v4; 
  PVOID P; 
  v3 = NotifyRoutine;
  P = 0i64;
  LODWORD(v4) = 0;
  v1 = WmipBuildTraceDeviceList(0x200000i64, (INT64 **)&P, &v4);
  if( v1 >= 0 )
  {
    v1 = WmipSendWmiIrpToTraceDeviceList((__int64)P, v4, 0xAu, 8, (__int64)&v3);
    if( v1 >= 0 )
      v1 = 0;
  }
  if( P )
    WmipFreeTraceDeviceList(P, v4);
  return(unsigned int)v1;
}

Referenced by:

EtwpDisableKernelTrace
EtwpEnableKernelTrace