ExpSystemErrorHandler2

VOID __fastcall ExpSystemErrorHandler2(UINT64 a1, UINT64 a2, INT64 a3, const VOID *a4, CHAR a5){
  int v6; 
  unsigned int v7; 
  unsigned int v8; 
  unsigned int v9; 
  __int64 i; 
  char *Buffer; 
  char *v12; 
  char *v13; 
  INT64 *SystemDllInfo; 
  void *v15; 
  WCHAR v16; 
  unsigned __int16 v17; 
  char *PoolWithTag; 
  char *v19; 
  char *v20; 
  __int64 v21; 
  CHAR *Text; 
  __int64 v23; 
  unsigned int v24; 
  CHAR *v25; 
  char *v26; 
  int j; 
  char *BugCheckParameter4; 
  INT8 v29; 
  INT8 v30; 
  _EJOB *CurrentServerSilo; 
  int v32; 
  NTSTATUS v33; 
  PMESSAGE_RESOURCE_ENTRY v34; 
  UNICODE_STRING UnicodeString; 
  struct _STRING SourceString; 
  STRING v37; 
  unsigned int v38; 
  _DWORD BugCheckParameter1[3]; 
  struct _STRING DestinationString; 
  ULONG_PTR BugCheckParameter2[2]; 
  __int128 v42; 
  __int64 v43; 
  char pszFormat[40]; 
  char pszDest[256]; 
  v6 = a3;
  v7 = a1;
  BugCheckParameter1[0] = a1;
  *(_QWORD *)&BugCheckParameter1[1] = a4;
  *(_QWORD *)&DestinationString.Length = 0i64;
  v34 = 0i64;
  SourceString = 0i64;
  UnicodeString = 0i64;
  v37 = 0i64;
  v8 = 5;
  if( (unsigned int)a2 <= 5 )
    v8 = a2;
  v9 = v8;
  v38 = v8;
  pszFormat[0] = 0;
  *(_OWORD *)BugCheckParameter2 = 0i64;
  v42 = 0i64;
  v43 = 0i64;
  memmove((UINT8 *)BugCheckParameter2, (UINT8 *)a4, 8i64 * v8);
  DestinationString.Buffer = 0i64;
  for( i = 0i64; ; i = (unsigned int)(i + 1) )
  {
    v32 = i;
    if( (unsigned int)i >= v9 )
      break;
    if( _bittest(&v6, i) )
    {
      strcat_s(pszFormat, 0x20ui64, (PSTR)" %s");
      v33 = RtlUnicodeStringToAnsiString(&DestinationString, *((UNICODE_STRING **)a4 + i), 1u);
      Buffer = (char *)L"???";
      if( v33 >= 0 )
        Buffer = DestinationString.Buffer;
      BugCheckParameter2[(unsigned int)i] = (ULONG_PTR)Buffer;
    }
    else
    {
      strcat_s(pszFormat, 0x20ui64, (PSTR)" %x");
    }
  }
  strcat_s(pszFormat, 0x20ui64, (PSTR)"\n");
  v12 = pszFormat;
  v13 = "Unknown Hard Error";
  SystemDllInfo = PsQuerySystemDllInfo(0);
  if( SystemDllInfo )
  {
    v15 = (void *)SystemDllInfo[3];
    if( *((PEPROCESS *)KeGetCurrentThread() + 23) == PsInitialSystemProcess )
      v15 = (void *)SystemDllInfo[4];
    if( RtlFindMessage(v15, 0xBui64, (_BYTE)NlsMbCodePageTag != 0 ? 0x409 : 0, v7, (INT64)&v34) < 0 )
    {
      v12 = "Unknown Hard Error";
      goto LABEL_42;
    }
    if( (v34->Flags & 1) != 0 )
    {
      RtlInitUnicodeString(&UnicodeString, (PCWSTR)v34->Text, v16);
      v17 = RtlxUnicodeStringToAnsiSize(&UnicodeString);
      SourceString.Length = v17;
      PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v17 + 16i64, 0x20727245ui64);
      v19 = PoolWithTag;
      if( !PoolWithTag )
      {
LABEL_20:
        v19 = "Unknown Hard Error";
        v20 = "Unknown Hard Error";
        v21 = -1i64;
        goto LABEL_28;
      }
      SourceString.MaximumLength = v17 + 16;
      SourceString.Buffer = PoolWithTag;
      if( RtlUnicodeStringToAnsiString(&SourceString, &UnicodeString, 0) < 0 )
      {
        ExFreePoolWithTag(v19, 0);
        goto LABEL_20;
      }
      v21 = -1i64;
    }
    else
    {
      Text = (CHAR *)v34->Text;
      v21 = -1i64;
      v23 = -1i64;
      do
        ++v23;
      while( Text[v23] );
      v24 = v23 + 16;
      v25 = (CHAR *)ExAllocatePoolWithTag(NonPagedPoolNx, (unsigned int)(v23 + 16), 0x20727245ui64);
      v19 = v25;
      if( !v25 )
      {
        v20 = "Unknown Hard Error";
        v19 = "Unknown Hard Error";
LABEL_28:
        if( v19 == "Unknown Hard Error" )
        {
          j = v32;
        }
        else
        {
          v26 = v19;
          do
            ++v21;
          while( v19[v21] );
          while( (_DWORD)v21 && *v26 >= 32 )
          {
            ++v26;
            LODWORD(v21) = v21 - 1;
          }
          *v26 = 0;
          v20 = v26 + 1;
          for( j = v21 - 1; j && *v20 && *v20 <= 32; --j )
            ++v20;
        }
        v12 = (char *)CallbackIdentifier;
        if( j )
          v12 = v20;
        goto LABEL_42;
      }
      strcpy_s(v25, v24, Text);
    }
    v20 = pszFormat;
    goto LABEL_28;
  }
LABEL_42:
  if( (int)RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"\nSTOP: %lx %s\n") < 0 )
    RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"\nHardError %lx\n");
  MmLockPagableSectionByHandle(ExPageLockHandle);
  v34 = (PMESSAGE_RESOURCE_ENTRY)"Unknown Hard Error";
  BugCheckParameter4 = "Unknown Hard Error";
  *(_QWORD *)&BugCheckParameter1[1] = "Unknown Hard Error";
  RtlInitAnsiString(&SourceString, pszDest, v29);
  if( RtlAnsiStringToUnicodeString(&UnicodeString, &SourceString, 1u) >= 0 )
  {
    v37.Length = RtlxUnicodeStringToOemSize(&UnicodeString);
    v37.MaximumLength = v37.Length;
    v13 = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v37.Length, 0x20727245ui64);
    v37.Buffer = v13;
    v34 = (PMESSAGE_RESOURCE_ENTRY)v13;
    if( v13 )
      RtlUnicodeStringToOemString(&v37, &UnicodeString, 0);
  }
  if( (int)RtlStringCbPrintfA(pszDest, 0x100ui64, v12) < 0 )
    RtlStringCbPrintfA(pszDest, 0x100ui64, (INT8 *)"Exception Processing Message %lx Parameters %Ix %Ix %Ix %Ix");
  RtlInitAnsiString(&SourceString, pszDest, v30);
  if( RtlAnsiStringToUnicodeString(&UnicodeString, &SourceString, 1u) >= 0 )
  {
    v37.Length = RtlxUnicodeStringToOemSize(&UnicodeString);
    v37.MaximumLength = v37.Length;
    BugCheckParameter4 = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, v37.Length, 0x20727245ui64);
    v37.Buffer = BugCheckParameter4;
    if( BugCheckParameter4 )
      RtlUnicodeStringToOemString(&v37, &UnicodeString, 0);
  }
  CurrentServerSilo = PsGetCurrentServerSilo();
  if( !CurrentServerSilo )
  {
    if( a5 )
      PoShutdownBugCheck(
        1u,
        0x4Cui64,
        BugCheckParameter1[0],
        (UINT64)BugCheckParameter2,
        (UINT64)v13,
        (UINT64)BugCheckParameter4);
    KeBugCheckEx(
      0x4Cu,
      BugCheckParameter1[0],
      (ULONG_PTR)BugCheckParameter2,
      (ULONG_PTR)v13,
      (ULONG_PTR)BugCheckParameter4);
  }
  PsTerminateServerSilo(CurrentServerSilo, v7);
}

Referenced by: