NtSetSystemEnvironmentValue

NTSTATUS __stdcall NtSetSystemEnvironmentValue(
        _UNICODE_STRING *VariableName,
        _UNICODE_STRING *VariableValue,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  unsigned __int16 v8; 
  wchar_t *v10; 
  unsigned __int16 v11; 
  wchar_t *v12; 
  unsigned int v13; 
  unsigned __int16 v14; 
  int v15; 
  unsigned int v16; 
  unsigned __int16 v17; 
  int v18; 
  _ETHREAD *CurrentThread; 
  NTSTATUS v20; 
  _STRING DestinationString; 
  _STRING v22; 
  unsigned int v23; 
  unsigned int v24; 
  int v25; 
  _UNICODE_STRING UnicodeString; 
  _UNICODE_STRING SourceString[3]; 
  CHAR PreviousMode; 

  v23 = 0;
  v24 = 0;
  *(_QWORD *)&DestinationString.Length = 0i64;
  *(_QWORD *)&v22.Length = 0i64;
  UnicodeString = 0i64;
  SourceString[0] = 0i64;
  DestinationString.Buffer = 0i64;
  v22.Buffer = 0i64;
  SourceString[1].Buffer = (wchar_t *)KeGetCurrentThread();
  PreviousMode = *((_BYTE *)SourceString[1].Buffer + 562);
  if( PreviousMode )
  {
    if( ((unsigned __int8)VariableName & 3) != 0 )
      goto LABEL_20;
    UnicodeString = *VariableName;
    v8 = _mm_cvtsi128_si32((__m128i)UnicodeString);
    if( !v8 )
      return -1073741670;
    if( ((__int64)UnicodeString.Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v10 = (wchar_t *)((char *)UnicodeString.Buffer + v8);
    if( (unsigned __int64)v10 > 0x7FFFFFFF0000i64 || v10 < UnicodeString.Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( ((unsigned __int8)VariableValue & 3) != 0 )
LABEL_20:
      ExRaiseDatatypeMisalignment();
    SourceString[0] = *VariableValue;
    v11 = _mm_cvtsi128_si32((__m128i)SourceString[0]);
    if( !v11 )
      return -1073741670;
    if( ((__int64)SourceString[0].Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v12 = (wchar_t *)((char *)SourceString[0].Buffer + v11);
    if( (unsigned __int64)v12 > 0x7FFFFFFF0000i64 || v12 < SourceString[0].Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    UnicodeString = *VariableName;
    SourceString[0] = *VariableValue;
  }
  v13 = RtlxUnicodeStringToAnsiSize(&UnicodeString);
  v14 = v13;
  v23 = v13;
  DestinationString.Buffer = (char *)ExAllocatePoolWithTag(0x200ui64, v13, 1920364101i64);
  if( !DestinationString.Buffer )
    return -1073741670;
  DestinationString.MaximumLength = v14;
  v15 = RtlUnicodeStringToAnsiString(&DestinationString, &UnicodeString, 0);
  v25 = v15;
  if( v15 >= 0 )
  {
    v16 = RtlxUnicodeStringToAnsiSize(SourceString);
    v17 = v16;
    v24 = v16;
    v22.Buffer = (char *)ExAllocatePoolWithTag(0x200ui64, v16, 1920364101i64);
    if( v22.Buffer )
    {
      v22.MaximumLength = v17;
      v18 = RtlUnicodeStringToAnsiString(&v22, SourceString, 0);
      v25 = v18;
      if( v18 >= 0 )
      {
        CurrentThread = (_ETHREAD *)KeGetCurrentThread();
        --CurrentThread->Tcb.KernelApcDisable;
        ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
        v20 = HalSetEnvironmentVariable(DestinationString.Buffer, v22.Buffer);
        ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        ExFreePoolWithTag(DestinationString.Buffer, 0);
        ExFreePoolWithTag(v22.Buffer, 0);
        return v20 != 0 ? 0xC000009A : 0;
      }
      else
      {
        ExFreePoolWithTag(DestinationString.Buffer, 0);
        ExFreePoolWithTag(v22.Buffer, 0);
        return v18;
      }
    }
    else
    {
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      return -1073741670;
    }
  }
  else
  {
    ExFreePoolWithTag(DestinationString.Buffer, 0);
    return v15;
  }
}

Referenced by: