#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)

/**
 * The NtQueryWnfStateData routine queries the data associated with a WNF state name.
 *
 * \param StateName Pointer to the WNF_STATE_NAME to query.
 * \param TypeId Optional pointer to a WNF_TYPE_ID structure specifying the type of the state data.
 * \param ExplicitScope Optional pointer to a security identifier (SID) for explicit scope.
 * \param ChangeStamp Pointer to a variable that receives the change stamp.
 * \param Buffer Pointer to a buffer that receives the state data.
 * \param BufferLength On input, the size of the buffer in bytes; on output, the number of bytes written.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryWnfStateData(
    _In_ PCWNF_STATE_NAME StateName,
    _In_opt_ PCWNF_TYPE_ID TypeId,
    _In_opt_ PCSID ExplicitScope,
    _Out_ PWNF_CHANGE_STAMP ChangeStamp,
    _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
    _Inout_ PULONG BufferLength
    );

#endif
#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryWnfStateData(
    _In_ PCWNF_STATE_NAME StateName,
    _In_opt_ PCWNF_TYPE_ID TypeId,
    _In_opt_ const VOID* ExplicitScope,
    _Out_ PWNF_CHANGE_STAMP ChangeStamp,
    _Out_writes_bytes_opt_(*BufferLength) PVOID Buffer,
    _Inout_ PULONG BufferLength
    );

#endif
View code on GitHub