Ntquerywnfstatedata Ntdlldll Better [extra Quality]

Although not documented in official Microsoft documentation, analysis reveals a prototype similar to:

follows this bit layout:

Based on community research and reverse engineering of ntdll.dll , the function typically requires: ntquerywnfstatedata ntdlldll better

NTSTATUS NtQueryWnfStateData( HANDLE StateHandle, VOID* UnknownBuffer1, // often a WNF change stamp buffer ULONG UnknownSize, VOID* Buffer, // output data ULONG BufferSize, ULONG* ReturnLength ); // output data ULONG BufferSize