WCHAR *__stdcall RtlGetNtSystemRoot(){ _KSPIN_LOCK *v0; if( PsIsCurrentThreadInServerSilo() ) return PsGetCurrentServerSiloGlobals(v0)->UserSharedData->NtSystemRoot; else return(_WORD *)(&KUSER_SHARED_DATA + 48); }