Tags exist because file names are not reliable. pcwszMemberTag corresponds to what has been set as pwszReferenceTag when the member was added to the catalog (using the CryptCATPutMemberInfo function for example).

To be really compliant with how the API is supposed to work, I think you're supposed to get the member information first, before you can fully setup WINTRUST_CATALOG_INFO. To determine member information, you must use the CryptCATEnumerateMember function (there is also a CryptCATGetMemberInfo function but you can't use it - chicken and egg issue - you don't have the tag) and determine what member you are interested in by any way you want (using other CRYPTCATMEMBER structure fields)

Using an hexadecimal representation of the hash of a file for the reference tag is common usage (MakeCat probably does it so it looks like the standard), but I don't think it's mandatory at all - the Java stuff in the other answer is not using this convention (see also this link: RE: CryptCATGetMemberInfo samples with a Microsoft guy answer.)