#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtCreateTimer routine creates an initially inactive, nonsignaled ordinary waitable timer.
 *
 * \param TimerHandle Receives a caller-owned handle; release it with NtClose.
 * \param DesiredAccess Requested access. TIMER_QUERY_STATE (0x1) permits queries,
 * TIMER_MODIFY_STATE (0x2) permits setting/canceling, and SYNCHRONIZE permits waits.
 * \param ObjectAttributes Optional name, root directory and security attributes.
 * \param TimerType NotificationTimer (0) retains its signal across waits;
 * SynchronizationTimer (1) consumes the signal on a successful wait.
 * \return STATUS_SUCCESS for a new timer. With OBJ_OPENIF, an existing named timer
 * is opened with STATUS_OBJECT_NAME_EXISTS without changing its type or state.
 * An unsupported TimerType returns STATUS_INVALID_PARAMETER_4.
 * \remarks On x64, a failed type check leaves TimerHandle
 * unchanged. WoW64 copies a zero-initialized local handle after the native call,
 * including on this failure. Only use the returned handle on a successful status.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtCreateTimer(
    _Out_ PHANDLE TimerHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _In_ TIMER_TYPE TimerType
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwCreateTimer(
    _Out_ PHANDLE TimerHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_opt_ PCOBJECT_ATTRIBUTES ObjectAttributes,
    _In_ TIMER_TYPE TimerType
    );

#endif
View code on GitHub