EtwpPerfectHashFunctionSearch
CHAR __fastcall EtwpPerfectHashFunctionSearch(INT16 a1, INT64 a2){
__int64 v2;
__int64 v3;
v2 = (unsigned __int16)(*(_WORD *)(a2 + 2) & __ROR2__(a1, *(_BYTE *)(a2 + 1)));
if( a1 == *(_WORD *)(a2 + 4 * v2 + 8) )
return 1;
while( 1 )
{
v3 = *(unsigned __int8 *)(a2 + 4 * v2 + 6);
if( (_BYTE)v3 == 0xFF )
break;
v2 = *(unsigned __int8 *)(a2 + 4 * v2 + 6);
if( a1 == *(_WORD *)(a2 + 4 * v3 + 8) )
return 1;
}
return 0;
}Referenced by:
EtwpApplyEventIdPayloadFilter
EtwpApplyStackWalkIdFilter