NTSTATUS __stdcall EtwpOpenConsumer(PVOID *Handle){
return ObOpenObjectByPointer(
*((PVOID *)KeGetCurrentThread() + 23),
0x200u,
0i64,
0x28u,
(POBJECT_TYPE)PsProcessType,
0,
Handle);
}