#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtCancelTimer routine deactivates an ordinary timer and removes pending timer completion APCs without
 * clearing its current signal state. Canceling an inactive timer is also successful.
 *
 * \param TimerHandle Handle with TIMER_MODIFY_STATE (0x2).
 * \param CurrentState Optional writable byte receiving the timer's signal state,
 * not whether an active timer was removed. A canceled, signaled notification timer
 * remains signaled; rearm it to clear the signal.
 * \return NTSTATUS indicating whether cancellation completed.
 * \remarks Cancellation is not a join for a user callback already executing on
 * another thread; synchronize callback/context lifetime separately. For a Timer2/IR
 * compatibility object, CurrentState must be NULL; the ordinary
 * timer's state-output contract does not apply to those objects.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCancelTimer(
    _In_ HANDLE TimerHandle,
    _Out_opt_ PBOOLEAN CurrentState
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCancelTimer(
    _In_ HANDLE TimerHandle,
    _Out_opt_ PBOOLEAN CurrentState
    );

#endif
View code on GitHub