NtSetSystemEnvironmentValue

NTSTATUS __stdcall NtSetSystemEnvironmentValue(UNICODE_STRING *VariableName, UNICODE_STRING *VariableValue){
  unsigned __int16 v2; 
  wchar_t *v4; 
  unsigned __int16 v5; 
  wchar_t *v6; 
  unsigned int v7; 
  unsigned __int16 v8; 
  int v9; 
  unsigned int v10; 
  unsigned __int16 v11; 
  int v12; 
  _ETHREAD *v13; 
  int v14; 
  struct _STRING DestinationString; 
  STRING v16; 
  unsigned int v17; 
  unsigned int v18; 
  int v19; 
  UNICODE_STRING UnicodeString; 
  UNICODE_STRING SourceString; 
  _ETHREAD *CurrentThread; 
  INT8 PreviousMode; 
  v17 = 0;
  v18 = 0;
  *(_QWORD *)&DestinationString.Length = 0i64;
  *(_QWORD *)&v16.Length = 0i64;
  UnicodeString = 0i64;
  SourceString = 0i64;
  DestinationString.Buffer = 0i64;
  v16.Buffer = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = *((_BYTE *)CurrentThread + 562);
  if( PreviousMode )
  {
    if( ((unsigned __int8)VariableName & 3) != 0 )
      goto LABEL_20;
    UnicodeString = *VariableName;
    v2 = _mm_cvtsi128_si32((__m128i)UnicodeString);
    if( !v2 )
      return -1073741670;
    if( ((__int64)UnicodeString.Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v4 = (wchar_t *)((char *)UnicodeString.Buffer + v2);
    if( (unsigned __int64)v4 > 0x7FFFFFFF0000i64 || v4 < UnicodeString.Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( ((unsigned __int8)VariableValue & 3) != 0 )
LABEL_20:
      ExRaiseDatatypeMisalignment();
    SourceString = *VariableValue;
    v5 = _mm_cvtsi128_si32((__m128i)SourceString);
    if( !v5 )
      return -1073741670;
    if( ((__int64)SourceString.Buffer & 1) != 0 )
      ExRaiseDatatypeMisalignment();
    v6 = (wchar_t *)((char *)SourceString.Buffer + v5);
    if( (unsigned __int64)v6 > 0x7FFFFFFF0000i64 || v6 < SourceString.Buffer )
      MEMORY[0x7FFFFFFF0000] = 0;
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    UnicodeString = *VariableName;
    SourceString = *VariableValue;
  }
  v7 = RtlxUnicodeStringToAnsiSize(&UnicodeString);
  v8 = v7;
  v17 = v7;
  DestinationString.Buffer = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v7, 0x72766E45ui64);
  if( !DestinationString.Buffer )
    return -1073741670;
  DestinationString.MaximumLength = v8;
  v9 = RtlUnicodeStringToAnsiString(&DestinationString, &UnicodeString, 0);
  v19 = v9;
  if( v9 >= 0 )
  {
    v10 = RtlxUnicodeStringToAnsiSize(&SourceString);
    v11 = v10;
    v18 = v10;
    v16.Buffer = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v10, 0x72766E45ui64);
    if( v16.Buffer )
    {
      v16.MaximumLength = v11;
      v12 = RtlUnicodeStringToAnsiString(&v16, &SourceString, 0);
      v19 = v12;
      if( v12 >= 0 )
      {
        v13 = (_ETHREAD *)KeGetCurrentThread();
        --*((_WORD *)v13 + 242);
        ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
        v14 = HalSetEnvironmentVariable(DestinationString.Buffer, v16.Buffer);
        ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        ExFreePoolWithTag(DestinationString.Buffer, 0);
        ExFreePoolWithTag(v16.Buffer, 0);
        return v14 != 0 ? 0xC000009A : 0;
      }
      else
      {
        ExFreePoolWithTag(DestinationString.Buffer, 0);
        ExFreePoolWithTag(v16.Buffer, 0);
        return v12;
      }
    }
    else
    {
      ExFreePoolWithTag(DestinationString.Buffer, 0);
      return -1073741670;
    }
  }
  else
  {
    ExFreePoolWithTag(DestinationString.Buffer, 0);
    return v9;
  }
}

Referenced by: