#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtCreateKeyedEvent routine creates a keyed event for multiplexing thread rendezvous by opaque key
 * values. It can back multiple user-mode synchronization objects without allocating a separate kernel event
 * for each key. A release pairs with one wait, rather than setting a persistent event signal or accumulating
 * a semaphore count.
 *
 * \param KeyedEventHandle Receives a handle owned by the caller; close it with NtClose.
 * \param DesiredAccess Requested access, including KEYEDEVENT_WAIT (0x1) and/or
 * KEYEDEVENT_WAKE (0x2). KEYEDEVENT_ALL_ACCESS is 0xF0003 and excludes SYNCHRONIZE.
 * \param ObjectAttributes Optional name, root directory and security attributes.
 * \param Flags Reserved. Must be zero; nonzero values return STATUS_INVALID_PARAMETER_4.
 * \return STATUS_SUCCESS for a new object, or STATUS_OBJECT_NAME_EXISTS when
 * OBJ_OPENIF opens an existing named object. Other failures are returned as NTSTATUS.
 * \remarks On x64, a valid output slot is cleared before Flags
 * validation. Matching requires the same keyed-event object, key value and process;
 * sharing a named object or handle does not make equal keys match across processes.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateKeyedEvent(
    _Out_ PHANDLE KeyedEventHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _Reserved_ ULONG Flags
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateKeyedEvent(
    _Out_ PHANDLE KeyedEventHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _Reserved_ ULONG Flags
    );

#endif
View code on GitHub