#ifndef _NTRTL_H
// Environment
NTSYSAPI
NTSTATUS
NTAPI
RtlCreateEnvironment(
_In_ BOOLEAN CloneCurrentEnvironment,
_Out_ PVOID *Environment
);
View code on GitHubIf set, newly created environment are similar to caller's environment.
RtlCreateEnvironment allocate memory in caller's address space, and fills it with new environment block. Environment is pointer to this block.