VfCheckUserHandle

VOID __stdcall VfCheckUserHandle(VOID *Handle){
  _EPROCESS *Process; 
  UINT16 v3; 
  unsigned int v4; 
  __int64 v5; 
  VOID **v6; 
  VOID *v7; 
  VOID *v8; 
  NTSTATUS v9; 
  _ADAPTER_OBJECT *v10; 
  char v11; 
  UINT64 v12; 
  PVOID Object; 
  UINT64 ReturnLength; 
  VOID *BackTrace[8]; 
  _UNICODE_STRING ObjectTypeName[4]; 

  memset(BackTrace, 0i64, sizeof(BackTrace));
  if( (MmVerifierData & 0x100) != 0 )
  {
    Process = KeGetCurrentThread()->ApcState.Process;
    if( PsInitialSystemProcess )
    {
      if( Process != PsInitialSystemProcess && Process != *(_EPROCESS **)&PsIdleProcess )
      {
        if( Handle )
        {
          v3 = RtlCaptureStackBackTrace(2ui64, 8ui64, BackTrace, 0i64);
          v4 = v3;
          v5 = 0i64;
          if( v3 )
          {
            v6 = BackTrace;
            do
            {
              v7 = *v6;
              if( VfDriverIsKernelImageAddress(*v6) )
              {
                if( (_DWORD)KernelVerifier )
                  break;
              }
              else
              {
                if( (unsigned int)VfTargetDriversIsEnabled(v8) )
                  break;
                if( !ViDriverXDVBase
                  || !ViDriverXDVImageSize
                  || (unsigned __int64)v7 < ViDriverXDVBase
                  || (unsigned __int64)v7 >= ViDriverXDVBase + (unsigned __int64)(unsigned int)ViDriverXDVImageSize )
                {
                  return;
                }
              }
              v5 = (unsigned int)(v5 + 1);
              ++v6;
            }
            while( (unsigned int)v5 < v4 );
            if( (unsigned int)v5 < v4 && !(unsigned int)VfUtilIsLocalSystem(Process) )
            {
              Object = 0i64;
              v9 = ObReferenceObjectByHandle(Handle, 0i64, 0i64, 1, &Object, 0i64);
              v10 = (_ADAPTER_OBJECT *)Object;
              if( v9 < 0 )
                goto LABEL_25;
              v11 = 0;
              if( ObQueryTypeName(Object, ObjectTypeName, 0x40ui64, &ReturnLength) >= 0
                && ((unsigned __int8)RtlEqualUnicodeString(ObjectTypeName, &ViDesktopTypeName, 0)
                 || (unsigned __int8)RtlEqualUnicodeString(ObjectTypeName, &ViWindowStationTypeName, 0)) )
              {
                v11 = 1;
              }
              HalPutDmaAdapter(v10);
              if( !v11 )
              {
LABEL_25:
                if( ViHandleBreaksEnabled )
                  VerifierBugCheckIfAppropriate(
                    0xC4ui64,
                    0xF6u,
                    (ULONG_PTR)Handle,
                    (ULONG_PTR)Process,
                    (ULONG_PTR)BackTrace[v5],
                    v12);
              }
            }
          }
        }
      }
    }
  }
}

Referenced by: