NtEnumerateSystemEnvironmentValuesEx

NTSTATUS __stdcall NtEnumerateSystemEnvironmentValuesEx(
        UINT64 InformationClass,
        VOID *Buffer,
        UINT64 *BufferLength,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  unsigned int v10; 
  NTSTATUS result; 
  INT8 PreviousMode; 
  __int64 v13; 
  unsigned int v14; 
  _ETHREAD *v15; 
  NTSTATUS v16; 
  VOID **LockedBuffer; 
  char Length[12]; 
  VOID *LockVariable; 
  _ETHREAD *CurrentThread; 

  v10 = InformationClass;
  memset(Length, 0, sizeof(Length));
  LockVariable = 0i64;
  if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
    return -1073741822;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  PreviousMode = CurrentThread->Tcb.PreviousMode;
  if( PreviousMode )
  {
    v13 = 0x7FFFFFFF0000i64;
    if( (unsigned __int64)BufferLength < 0x7FFFFFFF0000i64 )
      v13 = (__int64)BufferLength;
    *(_DWORD *)v13 = *(_DWORD *)v13;
    v14 = *(_DWORD *)BufferLength;
    *(_DWORD *)Length = *(_DWORD *)BufferLength;
    if( !Buffer )
    {
      *(_DWORD *)Length = 0;
      v14 = 0;
    }
    if( v14 )
      ProbeForWrite((UINT64)Buffer, v14, 4i64);
    if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeSystemEnvironmentPrivilege, PreviousMode) )
      return -1073741727;
  }
  else
  {
    *(_DWORD *)Length = Buffer != 0i64 ? *(_DWORD *)BufferLength : 0;
  }
  if( !*(_DWORD *)Length
    || (result = ExLockUserBuffer(
                   Buffer,
                   *(unsigned int *)Length,
                   PreviousMode,
                   IoWriteAccess,
                   (VOID **)&Length[4],
                   &LockVariable),
        result >= 0) )
  {
    v15 = (_ETHREAD *)KeGetCurrentThread();
    --v15->Tcb.KernelApcDisable;
    ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    v16 = IoEnumerateEnvironmentVariablesEx(
            (WCHAR *)v10,
            0i64,
            *(PVOID *)&Length[4],
            (UINT64 *)Length,
            (UINT64 *)LockedBuffer);
    ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&WheapDeferredInternalLogsEventLock + 2752));
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( LockVariable )
      ExUnlockUserBuffer(LockVariable);
    *(_DWORD *)BufferLength = *(_DWORD *)Length;
    return v16;
  }
  return result;
}

Referenced by: