I had expected that if you were returning a failure code you didn't
have to - perhaps even _shouldn't_ - write through the output pointer
arguments. But in fact, now that my implementation of
MsiGetFileVersion _knows_ how to fail (i.e. doesn't just return a
hardcoded value for every call), the MSI build doesn't work unless I
also clear the output strings in the case of failure.
A quick experiment or two with the real Windows version suggests that
the hash function in question is just MD5, repackaged as an array of
four little-endian 32-bit words instead of 16 bytes.