#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
#if (PHNT_VERSION >= PHNT_WINDOWS_8)

// rev
/**
 * The NtAddAtomEx routine adds or references an atom with an optional entry-visibility flag. The name capture
 * and reference-ownership rules are those of NtAddAtom.
 *
 * \param AtomName Readable UTF-16 name; the kernel terminates the user-mode copy.
 * \param Length Bytes to capture, at most 510 (255 WCHARs). Use an even byte count;
 * nonzero user input requires 2-byte alignment on x64 and WoW64.
 * \param Atom Optional 16-bit output. NULL still performs the addition.
 * \param Flags ATOM_FLAG_NONE (0) or ATOM_FLAG_GLOBAL (0x2); other bits return
 * STATUS_INVALID_PARAMETER. The flag is stored only when a new entry is allocated.
 * \return NTSTATUS describing the addition. A successful string add creates a
 * reference that the caller must balance with NtDeleteAtom.
 * \remarks Both flag values use the table obtained from the same session Win32
 * callout. Bit 0x2 is an entry flag consulted by RtlpAllowsLowBoxAccess, not a switch
 * to a separate machine-global table. Re-adding an existing name with different
 * Flags increments its reference count but does not change its stored flag.
 * Lowbox/AppContainer visibility and accounting are context-sensitive; do not
 * infer cross-session visibility or access to every existing atom from this flag.
 * \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-globaladdatomexw
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtAddAtomEx(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom,
    _In_ ULONG Flags
    );

#endif
#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwAddAtomEx(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom,
    _In_ ULONG Flags
    );

#endif
View code on GitHub