#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)

/**
 * The NtSubscribeWnfStateChange routine subscribes to state change notifications for a WNF state name.
 *
 * \param StateName Pointer to the WNF_STATE_NAME to subscribe to.
 * \param ChangeStamp Optional change stamp to start receiving notifications from.
 * \param EventMask Bitmask specifying which events to subscribe to.
 * \param SubscriptionId Optional pointer to a variable that receives the subscription ID.
 * \return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSubscribeWnfStateChange(
    _In_ PCWNF_STATE_NAME StateName,
    _In_opt_ WNF_CHANGE_STAMP ChangeStamp,
    _In_ ULONG EventMask,
    _Out_opt_ PULONG64 SubscriptionId
    );

#endif
#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSubscribeWnfStateChange(
    _In_ PCWNF_STATE_NAME StateName,
    _In_opt_ WNF_CHANGE_STAMP ChangeStamp,
    _In_ ULONG EventMask,
    _Out_opt_ PULONG64 SubscriptionId
    );

#endif
View code on GitHub