KeCheckForTimer

VOID __stdcall KeCheckForTimer(VOID *BlockStart, UINT64 BlockSize){
  char *BugCheckParameter4; 
  unsigned int v4; 
  _KPRCB **v5; 
  unsigned int v6; 
  __int64 v7; 
  _LIST_ENTRY *p_Entry; 
  volatile signed __int32 *v9; 
  unsigned __int8 CurrentIrql; 
  _LIST_ENTRY *Flink; 
  char *v12; 
  unsigned __int64 v13; 
  char *v14; 
  char *v15; 
  unsigned int ActiveProcessorCount; 
  _KPRCB **v17; 
  __int64 v18; 
  unsigned int v19; 
  UINT64 SpinCount; 

  if( (KeTimerCheckFlags & 1) != 0 )
  {
    BugCheckParameter4 = (char *)BlockStart + BlockSize;
    v4 = 0;
    ActiveProcessorCount = KeQueryActiveProcessorCountEx(0xFFFFu);
    if( ActiveProcessorCount )
    {
      v5 = &KiProcessorBlock;
      v17 = &KiProcessorBlock;
      do
      {
        v6 = 0;
        v7 = 0i64;
        v18 = 0i64;
        do
        {
          v19 = 0;
          p_Entry = &(*v5)->TimerTable.TimerEntries[(unsigned __int64)v6][0].Entry;
          v9 = (volatile signed __int32 *)((char *)(*v5)->TimerTable.TimerEntries + v7);
          do
          {
            CurrentIrql = KeGetCurrentIrql();
            __writecr8(2ui64);
            LODWORD(SpinCount) = 0;
            while( _interlockedbittestandset64(v9, 0i64) )
            {
              do
                KeYieldProcessorEx(&SpinCount);
              while( *(_QWORD *)v9 );
            }
            Flink = p_Entry->Flink;
            if( p_Entry->Flink != p_Entry )
            {
              v12 = (char *)BlockStart - 64;
              do
              {
                v13 = (unsigned __int64)&Flink[-2];
                Flink = Flink->Flink;
                if( v13 > (unsigned __int64)v12 && v13 < (unsigned __int64)BugCheckParameter4 )
                  KeBugCheckEx(0xC7u, 0i64, (PVOID)v13, BlockStart, BugCheckParameter4);
                v14 = (char *)(KiWaitAlways ^ _byteswap_uint64(v13 ^ __ROL8__(
                                                                       *(_QWORD *)(v13 + 48) ^ KiWaitNever,
                                                                       KiWaitNever)));
                if( v14 )
                {
                  if( v14 > v12 && v14 < BugCheckParameter4 )
                    KeBugCheckEx(0xC7u, (PVOID)1, v14, BlockStart, BugCheckParameter4);
                  v15 = (char *)*((_QWORD *)v14 + 3);
                  if( v15 >= BlockStart && v15 < BugCheckParameter4 )
                    KeBugCheckEx(0xC7u, (PVOID)2, v15, BlockStart, BugCheckParameter4);
                }
              }
              while( Flink != p_Entry );
            }
            _InterlockedAnd64((volatile signed __int64 *)v9, 0i64);
            __writecr8(CurrentIrql);
            p_Entry += 2;
            v9 += 8;
            ++v19;
          }
          while( v19 < 0x100 );
          ++v6;
          v5 = v17;
          v7 = v18 + 0x2000;
          v18 += 0x2000i64;
        }
        while( v6 < 2 );
        v5 = v17 + 1;
        ++v4;
        ++v17;
      }
      while( v4 < ActiveProcessorCount );
    }
  }
}

Referenced by:

ExFreeHeapPool
ExpFreePoolChecks
VerifierKeInitializeTimerEx