ZwQuerySystemEnvironmentValueEx

NTSTATUS __stdcall ZwQuerySystemEnvironmentValueEx(
        _UNICODE_STRING *VariableName,
        _GUID *VendorGuid,
        VOID *Value,
        UINT64 *ValueLength,
        UINT64 *Attributes){
  NTSTATUS result; 

  _disable();
  __readeflags();
  KiServiceInternal();
  return result;
}

Referenced by:

BiDeleteEfiVariable
SepRmVerifyLsaProtectionLevel