Function PsSetCreateProcessNotifyRoutine 

pub unsafe extern "system" fn PsSetCreateProcessNotifyRoutine(
    notifyroutine: PCREATE_PROCESS_NOTIFY_ROUTINE,
    remove: bool,
) -> NTSTATUS