NtSetSystemEnvironmentValueEx

NTSTATUS __stdcall NtSetSystemEnvironmentValueEx(
        _UNICODE_STRING *VariableName,
        _GUID *VendorGuid,
        VOID *Value,
        UINT64 ValueLength,
        UINT64 Attributes){
  unsigned __int16 v8; 
  unsigned __int64 v9; 
  unsigned __int64 v10; 
  char *v11; 
  VOID **PoolWithTag; 
  wchar_t *v13; 
  __int64 v14; 
  NTSTATUS v15; 
  UINT64 v16; 
  char v17; 
  unsigned int ValueLengtha; 
  _UNICODE_STRING Src; 
  _GUID VendorGuida; 

  VendorGuida = 0i64;
  if( !KeGetCurrentThread()->PreviousMode )
  {
    LODWORD(v16) = Attributes;
    return ExSetFirmwareEnvironmentVariable(VariableName, VendorGuid, Value, (unsigned int)ValueLength, v16);
  }
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  if( ((unsigned __int8)VariableName & 3) != 0 )
    goto LABEL_31;
  Src = *VariableName;
  v8 = _mm_cvtsi128_si32(*(__m128i *)VariableName);
  if( !v8 )
    return -1073741819;
  if( ((__int64)Src.Buffer & 1) != 0 )
    ExRaiseDatatypeMisalignment();
  v9 = v8;
  v10 = (unsigned __int64)Src.Buffer + v8;
  if( v10 > 0x7FFFFFFF0000i64 || (wchar_t *)v10 < Src.Buffer )
    MEMORY[0x7FFFFFFF0000] = 0;
  if( ((unsigned __int8)VendorGuid & 3) != 0 )
LABEL_31:
    ExRaiseDatatypeMisalignment();
  ValueLengtha = Value != 0i64 ? ValueLength : 0;
  if( ValueLengtha )
  {
    v11 = (char *)Value + (Value != 0i64 ? ValueLength : 0);
    if( (unsigned __int64)v11 > 0x7FFFFFFF0000i64 || v11 < Value )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  v17 = SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, 1);
  if( v17 )
    goto LABEL_23;
  if( PsIsProcessAppContainer(KeGetCurrentThread()->ApcState.Process) )
    v17 = ExpFirmwareAccessAppContainerCheck(2i64);
  if( !v17 )
    return -1073741727;
LABEL_23:
  VendorGuida = *VendorGuid;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v9 + 2, 1920364101i64);
  v13 = (wchar_t *)PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove(PoolWithTag, Src.Buffer, v9);
  v13[v9 >> 1] = 0;
  v14 = *(_QWORD *)&VendorGuida.Data1 - ExpSecureBootVendorGuid;
  if( *(_QWORD *)&VendorGuida.Data1 == ExpSecureBootVendorGuid )
    v14 = *(_QWORD *)VendorGuida.Data4 - 0x4B788FE7F42860BDi64;
  if( v14 || wcsnicmp(v13, L"Kernel_", 7u) )
  {
    LODWORD(v16) = Attributes;
    v15 = ExpSetFirmwareEnvironmentVariable(v13, &VendorGuida, Value, ValueLengtha, v16, 1);
    ExFreePoolWithTag(v13, 0);
    return v15;
  }
  else
  {
    ExFreePoolWithTag(v13, 0);
    return -1073741790;
  }
}

Referenced by: