#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

//
// Global atoms
//

/**
 * The NtAddAtom routine adds or references a name in the atom table obtained from the current session's Win32
 * callout. This is not the per-process local table managed by AddAtomW. The x64 entry forwards to NtAddAtomEx
 * with Flags = 0.
 *
 * \param AtomName Readable UTF-16 name. User-mode input is captured by Length and
 * terminated by the kernel; a source terminator need not be included. An embedded
 * NUL ends the effective name. NULL does not create an unnamed atom.
 * \param Length Bytes to capture, at most 510 (255 WCHARs). Supply an even length
 * excluding the source terminator. An odd trailing byte is
 * discarded when the captured buffer is terminated; nonzero input requires 2-byte alignment.
 * \param Atom Optional output for the 16-bit identifier. Omitting it does not
 * suppress the addition or its reference-count increment.
 * \return NTSTATUS. Empty names return STATUS_OBJECT_NAME_INVALID; Length above
 * 510 and a NULL name return STATUS_INVALID_PARAMETER.
 * \remarks Ordinary string matching is case-insensitive and preserves the first
 * inserted spelling. Each successful string addition owns a reference to balance
 * with NtDeleteAtom; the identifier is not a handle for NtClose. Integer strings
 * such as L"#123" select integer atoms without allocating a string entry.
 * Kernel-mode callers are not covered by the user-buffer capture rules above.
 * \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-globaladdatomw
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddAtom(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAddAtom(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom
    );

#endif
View code on GitHub