ComputeEventEntryHash
UINT64 __stdcall ComputeEventEntryHash(
EVENT_DESCRIPTOR *EventDescriptor,
UINT8 NumAggregateFields,
UINT8 UserDataCount,
EVENT_DATA_DESCRIPTOR *UserData){
__int64 v5;
char v6;
UINT8 v7;
__int64 v8;
__int64 v9;
__int64 v10;
UINT64 Hash;
LODWORD(Hash) = 0;
v5 = UserDataCount;
v6 = (char)EventDescriptor;
RunningHash(&Hash, (UINT8 *)(UserDataCount + 16i64), 8ui64);
v7 = v6 + 2;
if( v7 < NumAggregateFields )
{
v8 = v5 + 16i64 * v7;
v9 = (unsigned __int8)(NumAggregateFields - v7);
do
{
RunningHash(&Hash, *(UINT8 **)v8, *(unsigned int *)(v8 + 8));
v8 = v10 + 16;
--v9;
}
while( v9 );
}
return 32769 * ((9 * (_DWORD)Hash) ^ ((unsigned int)(9 * Hash) >> 11));
}Referenced by:
InsertEventEntryInLookUpTable