NTSTATUS __stdcall EtwpOpenConsumer(PVOID *Handle){
_KPROCESSOR_MODE AccessMode;
LOBYTE(AccessMode) = 0;
return ObOpenObjectByPointer(
KeGetCurrentThread()->ApcState.Process,
0x200ui64,
0i64,
40,
(POBJECT_TYPE)PsProcessType,
AccessMode,
Handle);
}