ExpCheckForWorker

VOID __stdcall ExpCheckForWorker(VOID *p, UINT64 Size){
  char *BugCheckParameter4; 
  VOID **i; 
  VOID **NextPartition; 
  VOID **v6; 
  unsigned __int16 j; 
  __int64 v8; 
  __int64 v9; 
  char **v10; 
  unsigned __int8 CurrentIrql; 
  char **v12; 
  int k; 
  char *m; 

  BugCheckParameter4 = (char *)p + Size;
  for( i = 0i64; ; i = v6 )
  {
    NextPartition = PsGetNextPartition(i);
    v6 = NextPartition;
    if( !NextPartition )
      break;
    if( NextPartition != (VOID **)PspSystemPartition || NextPartition[2] )
    {
      for( j = 0; j < (unsigned __int16)KeNumberNodes; ++j )
      {
        v8 = 0i64;
        v9 = KeNodeBlock[j];
        if( (_UNKNOWN *)v9 == (_UNKNOWN *)((char *)&KiNodeInit + 384 * j) )
          v9 = 0i64;
        do
        {
          v10 = *(char ***)(*(_QWORD *)(*((_QWORD *)v6[2] + 1) + 8i64 * *(unsigned __int16 *)(v9 + 146)) + v8);
          if( ((unsigned __int8)v10 & 1) == 0 && v10 )
          {
            CurrentIrql = KeGetCurrentIrql();
            __writecr8(2ui64);
            KiAcquireKobjectLockSafe(v10);
            v12 = v10 + 3;
            for( k = 0; k < 32; ++k )
            {
              for( m = *v12; m != (char *)&v10[2 * k + 3]; m = *(char **)m )
              {
                if( m >= p && m < BugCheckParameter4 )
                  KeBugCheckEx(0xE4u, 0i64, m, p, BugCheckParameter4);
              }
              v12 += 2;
            }
            _InterlockedAnd((volatile signed __int32 *)v10, 0xFFFFFF7F);
            __writecr8(CurrentIrql);
          }
          v8 += 8i64;
        }
        while( v8 < 64 );
      }
    }
  }
}

Referenced by: