RtlAssert
INT8 __fastcall RtlAssert(const INT8 *a1, const INT8 *a2, INT64 a3, INT64 a4){
int v6;
const INT8 *v8;
NTSTATUS v9;
INT64 v10;
bool v11;
int v12;
int v13;
__int64 v15;
char Response;
_CONTEXT ContextRecord;
v6 = a3;
RtlCaptureContext(&ContextRecord);
while( 1 )
{
LODWORD(v15) = v6;
v8 = &File;
if( a4 )
v8 = (const INT8 *)a4;
DbgPrintEx(0x65u, 0, "\n*** Assertion failed: %s%s\n*** Source File: %s, line %ld\n\n", v8, a1, a2, v15);
LOBYTE(v9) = KUSER_SHARED_DATA.KdDebuggerEnabled & 3;
if( (KUSER_SHARED_DATA.KdDebuggerEnabled & 3) != 3 )
return v9;
v9 = DbgPrompt((INT64)"Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread(boipt)? ");
if( !v9 )
{
__debugbreak();
LABEL_18:
LOBYTE(v9) = RtlpTerminateCurrentProcess(v10);
return v9;
}
if( Response > 98 )
{
v12 = Response - 105;
v11 = Response == 105;
}
else
{
if( Response == 98 || Response == 66 )
goto LABEL_16;
v12 = Response - 73;
v11 = Response == 73;
}
if( v11 )
return v9;
v13 = v12 - 6;
if( !v13 )
{
LABEL_16:
DbgPrintEx(0x65u, 0, "Execute '.cxr %p' to dump context\n", &ContextRecord);
__debugbreak();
}
v10 = (unsigned int)(v13 - 1);
if( !(_DWORD)v10 )
goto LABEL_18;
if( (_DWORD)v10 == 4 )
ZwTerminateThread((VOID *)0xFFFFFFFFFFFFFFFEi64, -1073741823);
}
}Referenced by:
KseDriverUnloadImage
KseShimDatabaseBootInitialize
KseShimDatabaseClose
KsepEngineInitialize
KsepEngineReadFlags
KsepEngineUninitialize
KsepGetShimCallbacksForDriver
KsepRegistryCreateKey
KsepRegistryOpenKey
KsepRegistryQueryDWORD
KsepRegistryQuerySZ
KsepRegistryQueryValue
KsepStringConcatenate
KsepStringDuplicate
KsepStringDuplicateUnicode
KsepStringFree
KsepStringSplitMultiString
KsepStringTransform