#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtFindAtom routine looks up a name in the atom table selected by the session Win32 callout. Use
 * NtAddAtom when a new ordinary string reference is required, not merely lookup.
 *
 * \param AtomName Readable UTF-16 name. The user-mode copy is terminated after capture; matching is
 * case-insensitive and an embedded NUL ends the effective name.
 * \param Length Bytes to capture, at most 510 (255 WCHARs). Use an even count and 2-byte-aligned source. The
 * kernel discards an odd trailing byte.
 * \param Atom Optional 16-bit output; NULL performs a lookup without returning the ID.
 * \return STATUS_OBJECT_NAME_NOT_FOUND if absent, STATUS_OBJECT_NAME_INVALID for an empty captured name, or
 * the lookup's NTSTATUS. On the native x64 path and WoW64, failure paths leave a supplied output identifier
 * unchanged.
 * \remarks For ordinary non-AppContainer callers, lookup does not add a reference: do not delete an atom
 * merely because lookup found it. Lowbox lookup can establish internal bookkeeping references; that
 * implementation detail is not a caller-owned NtAddAtom reference. Integer strings in the range L"#1" through
 * L"#49151" resolve without a prior string-table insertion.
 * \see https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-globalfindatomw
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFindAtom(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwFindAtom(
    _In_reads_bytes_opt_(Length) PCWSTR AtomName,
    _In_ ULONG Length,
    _Out_opt_ PRTL_ATOM Atom
    );

#endif
View code on GitHub