Ntquerywnfstatedata Ntdlldll Better -

The function signature (reconstructed via reverse engineering) is:

return 0;

First, you need to open the WNF state using NtOpenWnfState (another undocumented function) and then query it. ntquerywnfstatedata ntdlldll better