NtQuerySystemEnvironmentValueEx

NTSTATUS __stdcall NtQuerySystemEnvironmentValueEx(
        _UNICODE_STRING *VariableName,
        _GUID *VendorGuid,
        VOID *Value,
        UINT64 *ValueLength,
        UINT64 *Attributes){
  char v10; 
  NTSTATUS v11; 
  char v12; 
  unsigned __int16 v13; 
  unsigned __int64 v14; 
  char *v15; 
  __int64 v16; 
  unsigned int v17; 
  __int64 v18; 
  VOID **PoolWithTag; 
  WCHAR *v20; 
  NTSTATUS FirmwareEnvironmentVariable; 
  char IsMember[4]; 
  UINT64 ValueLengtha; 
  PVOID P; 
  VOID *Src[2]; 
  _GUID VendorGuida; 

  *(_OWORD *)Src = 0i64;
  P = 0i64;
  VendorGuida = 0i64;
  ValueLengtha = 0i64;
  if( !KeGetCurrentThread()->PreviousMode )
    return ExGetFirmwareEnvironmentVariable((const VOID **)VariableName, VendorGuid, Value, ValueLength, Attributes);
  v10 = SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, 1);
  if( !v10 )
  {
    if( PsIsProcessAppContainer(KeGetCurrentThread()->ApcState.Process) )
      v10 = ExpFirmwareAccessAppContainerCheck(1i64);
    if( !v10 )
    {
      IsMember[0] = 0;
      v11 = RtlCheckTokenMembershipEx(0i64, SeExports->SeUserModeDriversSid, 0i64, (UINT8 *)IsMember);
      v12 = IsMember[0];
      if( v11 < 0 )
        v12 = 0;
      IsMember[0] = v12;
      if( !v12 )
        return -1073741727;
    }
  }
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  if( ((unsigned __int8)VariableName & 3) != 0 )
    goto LABEL_35;
  *(_UNICODE_STRING *)Src = *VariableName;
  v13 = _mm_cvtsi128_si32(*(__m128i *)Src);
  if( !v13 )
    return -1073741819;
  if( ((__int64)Src[1] & 1) != 0 )
    ExRaiseDatatypeMisalignment();
  v14 = v13;
  v15 = (char *)Src[1] + v13;
  if( (unsigned __int64)v15 > 0x7FFFFFFF0000i64 || v15 < Src[1] )
    MEMORY[0x7FFFFFFF0000] = 0;
  if( ((unsigned __int8)VendorGuid & 3) != 0 )
LABEL_35:
    ExRaiseDatatypeMisalignment();
  v16 = (__int64)ValueLength;
  if( (unsigned __int64)ValueLength >= 0x7FFFFFFF0000i64 )
    v16 = 0x7FFFFFFF0000i64;
  *(_DWORD *)v16 = *(_DWORD *)v16;
  v17 = *(_DWORD *)ValueLength;
  LODWORD(ValueLengtha) = *(_DWORD *)ValueLength;
  if( !Value )
  {
    LODWORD(ValueLengtha) = 0;
    v17 = 0;
  }
  if( v17 )
    ProbeForWrite((UINT64)Value, v17, 1i64);
  if( Attributes )
  {
    v18 = (__int64)Attributes;
    if( (unsigned __int64)Attributes >= 0x7FFFFFFF0000i64 )
      v18 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v18 = *(_DWORD *)v18;
  }
  VendorGuida = *VendorGuid;
  PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v14 + 2, 1920364101i64);
  v20 = (WCHAR *)PoolWithTag;
  P = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove(PoolWithTag, Src[1], v14);
  v20[v14 >> 1] = 0;
  FirmwareEnvironmentVariable = ExpGetFirmwareEnvironmentVariable(
                                  v20,
                                  &VendorGuida,
                                  Value,
                                  &ValueLengtha,
                                  (UINT64 *)((char *)&ValueLengtha + 4),
                                  1);
  ExFreePoolWithTag(v20, 0);
  *(_DWORD *)ValueLength = ValueLengtha;
  if( Attributes )
    *(_DWORD *)Attributes = HIDWORD(ValueLengtha);
  return FirmwareEnvironmentVariable;
}

Referenced by: