NtGetEnvironmentVariableEx

INT64 __stdcall NtGetEnvironmentVariableEx(
        WCHAR *VariableName,
        GUID *VendorGuid,
        PVOID Value,
        UINT64 *ValueLength,
        UINT64 *Attributes){
  _ETHREAD *CurrentThread; 
  unsigned int EnvironmentVariable; 
  if( dword_140C19650 != 2 )
    return 3221225474i64;
  if( *((_BYTE *)KeGetCurrentThread() + 562) )
    return 3221225569i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 242);
  ExAcquireFastMutexUnsafe(&ExpEnvironmentLock);
  EnvironmentVariable = IoGetEnvironmentVariableEx(VariableName, VendorGuid, Value, ValueLength, Attributes);
  ExReleaseFastMutexUnsafe(&ExpEnvironmentLock);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return EnvironmentVariable;
}

Referenced by: