EtwpPerfectHashFunctionSearch

CHAR __fastcall EtwpPerfectHashFunctionSearch(INT16 a1, INT64 a2){
  __int64 v2; 
  __int64 v3; 
  v2 = (unsigned __int16)(*(_WORD *)(a2 + 2) & __ROR2__(a1, *(_BYTE *)(a2 + 1)));
  if( a1 == *(_WORD *)(a2 + 4 * v2 + 8) )
    return 1;
  while( 1 )
  {
    v3 = *(unsigned __int8 *)(a2 + 4 * v2 + 6);
    if( (_BYTE)v3 == 0xFF )
      break;
    v2 = *(unsigned __int8 *)(a2 + 4 * v2 + 6);
    if( a1 == *(_WORD *)(a2 + 4 * v3 + 8) )
      return 1;
  }
  return 0;
}

Referenced by:

EtwpApplyEventIdPayloadFilter
EtwpApplyStackWalkIdFilter