pub unsafe extern "system" fn RtlGetUnloadEventTraceEx(
    ElementSize: *mut PULONG,
    ElementCount: *mut PULONG,
    EventTrace: *mut PVOID
)