Function PsSetCreateThreadNotifyRoutine 

pub unsafe extern "system" fn PsSetCreateThreadNotifyRoutine(
    notifyroutine: PCREATE_THREAD_NOTIFY_ROUTINE,
) -> NTSTATUS