#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtOpenTimer routine opens an existing named ordinary timer without arming it or consuming its signal.
 *
 * \param TimerHandle Receives a caller-owned handle; release it with NtClose.
 * \param DesiredAccess Requested access: TIMER_QUERY_STATE (0x1),
 * TIMER_MODIFY_STATE (0x2), and/or SYNCHRONIZE for waits.
 * \param ObjectAttributes Identifies the timer by name and optional root directory.
 * \return NTSTATUS indicating whether a handle was opened.
 * \remarks Native x64 name-lookup failure leaves TimerHandle
 * unchanged; the WoW64 thunk copies its zero-initialized local handle on that failure.
 * Attribute conversion may fail earlier. Do not treat output preservation as portable.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtOpenTimer(
    _Out_ PHANDLE TimerHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PCOBJECT_ATTRIBUTES ObjectAttributes
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwOpenTimer(
    _Out_ PHANDLE TimerHandle,
    _In_ ACCESS_MASK DesiredAccess,
    _In_ PCOBJECT_ATTRIBUTES ObjectAttributes
    );

#endif
View code on GitHub