Which function or file is responsible for initialization of g_37HashSeed

Question

I'm checking tcpip.sys file in IDA and found that in the .data part there is an int called g_37HashSeed. This seed is an input for a hash function that I look into. Can someone tell me which program or function is responsible for initializing this seed?

.data:00000001C020512C g_37HashSeed    dd ?                    ; DATA XREF: IppSendError+33E↑r
.data:00000001C020512C                                         ; IppFindPath+31↑r ...
.data:00000001C0205130 IppNSWorkerQueue dq ?                   ; DATA XREF: IppResolveNeighbor+31C↑o
.data:00000001C0205130                                         ; IppNeighborSolicitationWorker+2E↑o ...
.data:00000001C0205138 qword_1C0205138 dq ?                    ; DATA XREF: IppResolveNeighbor+315↑r
.data:00000001C0205138                                         ; IppResolveNeighbor+339↑w ...
.data:00000001C0205140 ; KSPIN_LOCK IppNSWorkItemLock
.data:00000001C0205140 IppNSWorkItemLock dq ?                  ; DATA XREF: IppNeighborSetTimeout+253↑o

Answer 1

It looks like the g_37HashSeed variable is initialized in the function IppInitSharedHashContext, in the file tcpip.sys:

IppInitSharedHashContext proc near
sub     rsp, 28h
or      edx, 0FFFFFFFFh
mov     ecx, 1
call    RandomNumber
mov     cs:g_37HashSeed, eax
mov     al, 1
add     rsp, 28h
retn
IppInitSharedHashContext endp

The RandomNumber function seems to be a simple LCG (https://en.wikipedia.org/wiki/Linear_congruential_generator) with the parameters a=1664525, c=1013904223.

You can find this by yourself by right clicking on g_37HashSeed in IDA and select List cross references to....