NtQuerySystemEnvironmentValue

NTSTATUS __stdcall NtQuerySystemEnvironmentValue(
        _UNICODE_STRING *VariableName,
        PWCHAR VariableValue,
        UINT16 ValueLength,
        UINT16 *ReturnLength){
  __int64 v7; 
  unsigned __int16 v8; 
  wchar_t *v10; 
  unsigned int v11; 
  unsigned __int16 v12; 
  int v13; 
  void *PoolWithTag; 
  _ETHREAD *v15; 
  NTSTATUS EnvironmentVariable; 
  INT8 v17; 
  int v18; 
  INT8 PreviousMode; 
  UNICODE_STRING UnicodeString; 
  struct _STRING DestinationString; 
  unsigned int v22; 
  int v23; 
  PVOID P; 
  _ETHREAD *CurrentThread; 
  v22 = 0;
  *(_QWORD *)&DestinationString.Length = 0i64;
  UnicodeString = 0i64;
  DestinationString.Buffer = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = *((_BYTE *)CurrentThread + 562);
  if( PreviousMode )
  {
    if( ((unsigned __int8)VariableName & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    v7 = 0x7FFFFFFF0000i64;
    UnicodeString = *VariableName;
    v8 = _mm_cvtsi128_si32((__m128i)UnicodeString);
    if( !v8 )
      return -1073741819;
    if( ((__int64)UnicodeString.Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v10 = (wchar_t *)((char *)UnicodeString.Buffer + v8);
    if( (unsigned __int64)v10 > 0x7FFFFFFF0000i64 || v10 < UnicodeString.Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
    ProbeForWrite(VariableValue, ValueLength, 2ui64);
    if( ReturnLength )
    {
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v7 = (__int64)ReturnLength;
      *(_WORD *)v7 = *(_WORD *)v7;
    }
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    UnicodeString = *VariableName;
  }
  v11 = RtlxUnicodeStringToAnsiSize(&UnicodeString);
  v12 = v11;
  v22 = v11;
  DestinationString.Buffer = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v11, 0x72766E45ui64);
  if( !DestinationString.Buffer )
    return -1073741670;
  DestinationString.MaximumLength = v12;
  v13 = RtlUnicodeStringToAnsiString(&DestinationString, &UnicodeString, 0);
  v23 = v13;
  if( v13 >= 0 )
  {
    PoolWithTag = ExAllocatePoolWithTag(NonPagedPoolNx, 0x400ui64, 0x72766E45ui64);
    P = PoolWithTag;
    if( PoolWithTag )
    {
      v15 = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)v15 + 242);
      ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
      EnvironmentVariable = HalGetEnvironmentVariable((UINT8 *)DestinationString.Buffer, (UINT8 *)0x400);
      ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      if( EnvironmentVariable )
      {
        ExFreePoolWithTag(PoolWithTag, 0);
        return -1073741823;
      }
      else
      {
        RtlInitAnsiString(&DestinationString, (PCSZ)PoolWithTag, v17);
        UnicodeString.Buffer = VariableValue;
        UnicodeString.MaximumLength = ValueLength;
        UnicodeString.Length = 0;
        v18 = RtlAnsiStringToUnicodeString(&UnicodeString, &DestinationString, 0);
        v23 = v18;
        if( ReturnLength )
          *ReturnLength = UnicodeString.Length;
        ExFreePoolWithTag(PoolWithTag, 0);
        return v18;
      }
    }
    else
    {
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      return -1073741670;
    }
  }
  else
  {
    ExFreePoolWithTag(DestinationString.Buffer, 0);
    return v13;
  }
}

Referenced by: