SSIG_HashData receives a writable digest-byte pointer in EDI
Ghidra v1804 · 39698f0
EDI is a writable output-buffer address, not an integer. The complete helper pushes EDI unchanged at 0041d395 as Sha1_Finalize's digest argument. The complete finalizer writes four individual bytes per state word for five words, producing a 20-byte digest. Its only caller creates stack storage with the allocation probe, saves ESP into EDI at 0041d5c7, fills it, writes a tail byte and calls the helper with that same pointer. Retype only the existing EDI slot to uint8_t*. Preserve the helper's custom ESI input, stack byte count, EDI storage, all names, void return and RET 4. The generator has no incoming refs; this is API-only output provenance and byte-store proof, without a runtime signature or buffer-capacity claim. No prototype, convention, Mac-pairing or API-table change.
Changes 1, applied together
Retype variable
win 0x0041d370 EDItypeint32_t→uint8_t *