typedef struct _ETW_REALTIME_CONSUMER
{
    LIST_ENTRY Links;
    void *ProcessHandle;
    EPROCESS *ProcessObject;
    void *NextNotDelivered;
    void *RealtimeConnectContext;
    KEVENT *DisconnectEvent;
    KEVENT *DataAvailableEvent;
    unsigned long *UserBufferCount;
    SINGLE_LIST_ENTRY *UserBufferListHead;
    unsigned long BuffersLost;
    unsigned long EmptyBuffersCount;
    unsigned long LoggerId;
    unsigned char ShutDownRequested;
    unsigned char NewBuffersLost;
    unsigned char Disconnected;
    RTL_BITMAP ReservedBufferSpaceBitMap;
    unsigned char *ReservedBufferSpace;
    unsigned long ReservedBufferSpaceSize;
    unsigned long UserPagesAllocated;
    unsigned long UserPagesReused;
    unsigned char Wow;
} ETW_REALTIME_CONSUMER, *PETW_REALTIME_CONSUMER;