ExpSystemErrorHandler2

VOID __stdcall ExpSystemErrorHandler2(UINT64 a1, UINT64 a2, INT64 a3, const VOID *a4, CHAR a5){
  int v6; 
  unsigned int v7; 
  int v8; 
  unsigned int v9; 
  __int64 i; 
  char *Buffer; 
  char *v12; 
  char *v13; 
  _PS_SYSTEM_DLL_INFO *SystemDllInfo; 
  VOID *v15; 
  unsigned __int16 v16; 
  char *PoolWithTag; 
  char *v18; 
  INT8 *v19; 
  __int64 v20; 
  char *v21; 
  __int64 v22; 
  unsigned int v23; 
  char *v24; 
  char *v25; 
  int j; 
  char *BugCheckParameter4; 
  int v28; 
  NTSTATUS v29; 
  INT64 v30; 
  _UNICODE_STRING UnicodeString; 
  _STRING SourceString; 
  _STRING v33; 
  int v34; 
  _DWORD BugCheckParameter1[3]; 
  _STRING DestinationString; 
  UINT64 BugCheckParameter2[2]; 
  __int128 v38; 
  __int64 v39; 
  INT8 Dst[40]; 
  INT8 pszDest[256]; 

  v6 = a3;
  v7 = a1;
  BugCheckParameter1[0] = a1;
  *(_QWORD *)&BugCheckParameter1[1] = a4;
  *(_QWORD *)&DestinationString.Length = 0i64;
  v30 = 0i64;
  SourceString = 0i64;
  UnicodeString = 0i64;
  v33 = 0i64;
  v8 = 5;
  if( (unsigned int)a2 <= 5 )
    v8 = a2;
  v9 = v8;
  v34 = v8;
  Dst[0] = 0;
  *(_OWORD *)BugCheckParameter2 = 0i64;
  v38 = 0i64;
  v39 = 0i64;
  memmove(BugCheckParameter2, a4, 8 * v8);
  DestinationString.Buffer = 0i64;
  for( i = 0i64; ; i = (unsigned int)(i + 1) )
  {
    v28 = i;
    if( (unsigned int)i >= v9 )
      break;
    if( _bittest(&v6, i) )
    {
      strcat_s(Dst, 0x20ui64, (INT8 *)" %s");
      v29 = RtlUnicodeStringToAnsiString(&DestinationString, *((_UNICODE_STRING **)a4 + i), 1u);
      Buffer = (char *)L"???";
      if( v29 >= 0 )
        Buffer = DestinationString.Buffer;
      BugCheckParameter2[(unsigned int)i] = (UINT64)Buffer;
    }
    else
    {
      strcat_s(Dst, 0x20ui64, (INT8 *)" %x");
    }
  }
  strcat_s(Dst, 0x20ui64, (INT8 *)"\n");
  v12 = Dst;
  v13 = "Unknown Hard Error";
  SystemDllInfo = PsQuerySystemDllInfo(PsNativeSystemDll);
  if( SystemDllInfo )
  {
    v15 = (VOID *)*((_QWORD *)SystemDllInfo + 3);
    if( KeGetCurrentThread()->ApcState.Process == PsInitialSystemProcess )
      v15 = (VOID *)*((_QWORD *)SystemDllInfo + 4);
    if( RtlFindMessage(v15, 0xBui64, (_BYTE)NlsMbCodePageTag != 0 ? 0x409 : 0, v7, (UINT16 **)&v30) < 0 )
    {
      v12 = "Unknown Hard Error";
      goto LABEL_42;
    }
    if( (*(_BYTE *)(v30 + 2) & 1) != 0 )
    {
      RtlInitUnicodeString(&UnicodeString, (PCWSTR)(v30 + 4));
      v16 = RtlxUnicodeStringToAnsiSize(&UnicodeString);
      SourceString.Length = v16;
      PoolWithTag = (char *)ExAllocatePoolWithTag(0x200ui64, v16 + 16i64, 544371269i64);
      v18 = PoolWithTag;
      if( !PoolWithTag )
      {
LABEL_20:
        v18 = "Unknown Hard Error";
        v19 = (INT8 *)"Unknown Hard Error";
        v20 = -1i64;
        goto LABEL_28;
      }
      SourceString.MaximumLength = v16 + 16;
      SourceString.Buffer = PoolWithTag;
      if( RtlUnicodeStringToAnsiString(&SourceString, &UnicodeString, 0) < 0 )
      {
        ExFreePoolWithTag(v18, 0);
        goto LABEL_20;
      }
      v20 = -1i64;
    }
    else
    {
      v21 = (char *)(v30 + 4);
      v20 = -1i64;
      v22 = -1i64;
      do
        ++v22;
      while( v21[v22] );
      v23 = v22 + 16;
      v24 = (char *)ExAllocatePoolWithTag(0x200ui64, (unsigned int)(v22 + 16), 544371269i64);
      v18 = v24;
      if( !v24 )
      {
        v19 = (INT8 *)"Unknown Hard Error";
        v18 = "Unknown Hard Error";
LABEL_28:
        if( v18 == "Unknown Hard Error" )
        {
          j = v28;
        }
        else
        {
          v25 = v18;
          do
            ++v20;
          while( v18[v20] );
          while( (_DWORD)v20 && *v25 >= 32 )
          {
            ++v25;
            LODWORD(v20) = v20 - 1;
          }
          *v25 = 0;
          v19 = v25 + 1;
          for( j = v20 - 1; j && *v19 && *v19 <= 32; --j )
            ++v19;
        }
        v12 = (char *)&CallbackIdentifier;
        if( j )
          v12 = v19;
        goto LABEL_42;
      }
      strcpy_s(v24, v23, v21);
    }
    v19 = Dst;
    goto LABEL_28;
  }
LABEL_42:
  if( RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"\nSTOP: %lx %s\n") < 0 )
    RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"\nHardError %lx\n");
  MmLockPagableSectionByHandle(ExPageLockHandle);
  v30 = (INT64)"Unknown Hard Error";
  BugCheckParameter4 = "Unknown Hard Error";
  *(_QWORD *)&BugCheckParameter1[1] = "Unknown Hard Error";
  RtlInitAnsiString(&SourceString, pszDest);
  if( RtlAnsiStringToUnicodeString(&UnicodeString, &SourceString, 1u) >= 0 )
  {
    v33.Length = RtlxUnicodeStringToOemSize(&UnicodeString.Length);
    v33.MaximumLength = v33.Length;
    v13 = (char *)ExAllocatePoolWithTag(0x200ui64, v33.Length, 544371269i64);
    v33.Buffer = v13;
    v30 = (INT64)v13;
    if( v13 )
      RtlUnicodeStringToOemString(&v33, &UnicodeString, 0);
  }
  if( RtlStringCbPrintfA(pszDest, 0x100ui64, v12) < 0 )
    RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"Exception Processing Message %lx Parameters %Ix %Ix %Ix %Ix");
  RtlInitAnsiString(&SourceString, pszDest);
  if( RtlAnsiStringToUnicodeString(&UnicodeString, &SourceString, 1u) >= 0 )
  {
    v33.Length = RtlxUnicodeStringToOemSize(&UnicodeString.Length);
    v33.MaximumLength = v33.Length;
    BugCheckParameter4 = (char *)ExAllocatePoolWithTag(0x200ui64, v33.Length, 544371269i64);
    v33.Buffer = BugCheckParameter4;
    if( BugCheckParameter4 )
      RtlUnicodeStringToOemString(&v33, &UnicodeString, 0);
  }
  if( !PsGetCurrentServerSilo() )
  {
    if( a5 )
      PoShutdownBugCheck(
        1u,
        0x4Cui64,
        BugCheckParameter1[0],
        (UINT64)BugCheckParameter2,
        (UINT64)v13,
        (UINT64)BugCheckParameter4);
    KeBugCheckEx(0x4Cu, (PVOID)BugCheckParameter1[0], BugCheckParameter2, v13, BugCheckParameter4);
  }
  PsTerminateServerSilo();
}

Referenced by: