Really I didn't find ZwNotifyChangeKey on web , but it call
NtNotifyChangeKey() which have exactly the same format and you can see that
on
http://undocumented.ntinternals.net/
NTSYSAPI
NTSTATUS
NTAPI
NtNotifyChangeKey(
IN HANDLE KeyHandle,
IN HANDLE EventHandle,
IN PIO_APC_ROUTINE ApcRoutine,
IN PVOID ApcRoutineContext,
IN PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG NotifyFilter,
IN BOOLEAN WatchSubtree,
OUT PVOID RegChangesDataBuffer,
IN ULONG RegChangesDataBufferLength,
IN BOOLEAN Asynchronous );
So simply set ZwNotifyChangeKey instead of NtNotifyChangeKey
Arkady