Impossible, that function used the registry EBP plus a offset in the stack for the arguments, if u can make a shellcode then
see this:


EDX = address to 0
EBX = value 80020004h
EDI = length for string
ECX = address for string

the values as 80020004,0,4008 i know not why is write

Here is it:

Option Explicit
 
Private Type environstruct
    k       As Long '8
    null    As Long '0
    envstr  As Long 'StrPtr(str)
End Type
 
'MSVBVM60
Private Declare Function rtcEnvironBstr Lib "MSVBVM60" (ByRef struct As environstruct) As String
 
Private Sub Form_Load()
    Dim es  As environstruct
 
    With es
        .k = 8
        .envstr = StrPtr("TMP")
    End With
 
    MsgBox StrConv(rtcEnvironBstr(es), vbFromUnicode)
End Sub

@RHL: You need to improve your debugging skills