EtwpDemuxPrivateTraceHandle

NTSTATUS __stdcall EtwpDemuxPrivateTraceHandle(PLEARNING_MODE_DATA *a1, UINT16 a2, UINT16 *a3){
  int v5; 
  _ETW_SILODRIVERSTATE *EtwSiloState; 
  _ETHREAD *CurrentThread; 
  ULONG_PTR v9; 
  _ETW_PRIV_HANDLE_DEMUX_TABLE *p_PrivHandleDemuxTable; 
  INT64 Root; 
  NTSTATUS v12; 
  int v13; 
  NTSTATUS v14; 
  INT64 v15; 
  __int64 **v16; 
  __int64 *i; 
  UINT64 v18; 

  v5 = (int)a1;
  if( a2 >= 0x40u )
  {
    EtwSiloState = PsGetCurrentServerSiloGlobals((_KSPIN_LOCK *)a1)->EtwSiloState;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --CurrentThread->Tcb.KernelApcDisable;
    v9 = (_DWORD)EtwSiloState + 4096;
    ExAcquirePushLockExclusiveEx(&EtwSiloState->PrivHandleDemuxTable.Lock, 0i64);
    p_PrivHandleDemuxTable = &EtwSiloState->PrivHandleDemuxTable;
    LODWORD(v18) = v5;
    Root = (INT64)EtwSiloState->PrivHandleDemuxTable.Tree.Root;
    v12 = 0;
    if( (p_PrivHandleDemuxTable->Tree._bf_0 & 1) != 0 )
    {
      if( Root )
        Root ^= (unsigned __int64)p_PrivHandleDemuxTable;
      else
        Root = 0i64;
    }
    v13 = p_PrivHandleDemuxTable->Tree._bf_0 & 1;
    if( Root )
    {
      do
      {
        v14 = PidNodeCompare(&v18, Root);
        if( v14 >= 0 )
        {
          if( v14 <= 0 )
            break;
          v15 = *(_QWORD *)(Root + 8);
        }
        else
        {
          v15 = *(_QWORD *)Root;
        }
        if( v13 && v15 )
          Root ^= v15;
        else
          Root = v15;
      }
      while( Root );
      if( Root )
      {
        v16 = (__int64 **)(Root + 32);
        for( i = *v16; i != (__int64 *)v16; i = (__int64 *)*i )
        {
          if( *((_WORD *)i + 9) == a2 )
          {
            *a3 = *((_WORD *)i + 8);
            goto LABEL_23;
          }
        }
      }
    }
    v12 = -1073741162;
LABEL_23:
    ExReleasePushLockEx(v9, 0);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    return v12;
  }
  else
  {
    *a3 = a2;
    return 0;
  }
}

Referenced by: