#ifndef _NTDBG_H

/**
 * Stops debugging a process.
 *
 * \param ProcessHandle A handle to the process.
 * \param DebugObjectHandle A handle to the debug object.
 * \return NTSTATUS Successful or errant status.
 * \remarks Removes the specified debug association rather than closing either handle. The
 * entry references the process and checks protected-process compatibility before invoking the
 * removal path. Pending debugger-event and target-lifetime handling is separate from ordinary NtClose cleanup.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtRemoveProcessDebug(
    _In_ HANDLE ProcessHandle,
    _In_ HANDLE DebugObjectHandle
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwRemoveProcessDebug(
    _In_ HANDLE ProcessHandle,
    _In_ HANDLE DebugObjectHandle
    );

#endif
View code on GitHub