VOID __stdcall EtwpCreateActivityId(_GUID *ActivityId){
volatile signed __int64 *EtwSupport;
EtwSupport = (volatile signed __int64 *)KeGetCurrentPrcb()->EtwSupport;
*(_QWORD *)ActivityId->Data4 = _InterlockedIncrement64(EtwSupport + 1);
*(_QWORD *)&ActivityId->Data1 = *EtwSupport;
}