标签：
通过MD5加密算法原理的介绍，会了解到MD5在加密的过程中，有几个固定的流程(特征)，在逆向分析的过程中通过这些特征可以识别出当前使用的是MD5的加密算法，从而更高效的分析还原算法。
整理下MD5加密的几个特征：
1. 处理的数据是512位为1组，补位数据的填充方式
2. 4个初始常数 A=0X67452301L，B=0XEFCDAB89L，C=0X98BADCFEL，D=0X10325476L (4个初始常数的值为主要特征)
3. 4轮Hash运算 (每轮的移位次数及运算的常量为主要特征)
第一轮
a=FF(a,b,c,d,M0,7,0xd76aa478)
b=FF(d,a,b,c,M1,12,0xe8c7b756)
c=FF(c,d,a,b,M2,17,0x242070db)
d=FF(b,c,d,a,M3,22,0xc1bdceee)
a=FF(a,b,c,d,M4,7,0xf57c0faf)
b=FF(d,a,b,c,M5,12,0x4787c62a)
c=FF(c,d,a,b,M6,17,0xa8304613)
d=FF(b,c,d,a,M7,22,0xfd469501)
a=FF(a,b,c,d,M8,7,0x698098d8)
b=FF(d,a,b,c,M9,12,0x8b44f7af)
c=FF(c,d,a,b,M10,17,0xffff5bb1)
d=FF(b,c,d,a,M11,22,0x895cd7be)
a=FF(a,b,c,d,M12,7,0x6b901122)
b=FF(d,a,b,c,M13,12,0xfd987193)
c=FF(c,d,a,b,M14,17,0xa679438e)
d=FF(b,c,d,a,M15,22,0x49b40821)
第二轮
a=GG(a,b,c,d,M1,5,0xf61e2562)
b=GG(d,a,b,c,M6,9,0xc040b340)
c=GG(c,d,a,b,M11,14,0x265e5a51)
d=GG(b,c,d,a,M0,20,0xe9b6c7aa)
a=GG(a,b,c,d,M5,5,0xd62f105d)
b=GG(d,a,b,c,M10,9,0x02441453)
c=GG(c,d,a,b,M15,14,0xd8a1e681)
d=GG(b,c,d,a,M4,20,0xe7d3fbc8)
a=GG(a,b,c,d,M9,5,0x21e1cde6)
b=GG(d,a,b,c,M14,9,0xc33707d6)
c=GG(c,d,a,b,M3,14,0xf4d50d87)
d=GG(b,c,d,a,M8,20,0x455a14ed)
a=GG(a,b,c,d,M13,5,0xa9e3e905)
b=GG(d,a,b,c,M2,9,0xfcefa3f8)
c=GG(c,d,a,b,M7,14,0x676f02d9)
d=GG(b,c,d,a,M12,20,0x8d2a4c8a)
第三轮
a=HH(a,b,c,d,M5,4,0xfffa3942)
b=HH(d,a,b,c,M8,11,0x8771f681)
c=HH(c,d,a,b,M11,16,0x6d9d6122)
d=HH(b,c,d,a,M14,23,0xfde5380c)
a=HH(a,b,c,d,M1,4,0xa4beea44)
b=HH(d,a,b,c,M4,11,0x4bdecfa9)
c=HH(c,d,a,b,M7,16,0xf6bb4b60)
d=HH(b,c,d,a,M10,23,0xbebfbc70)
a=HH(a,b,c,d,M13,4,0x289b7ec6)
b=HH(d,a,b,c,M0,11,0xeaa127fa)
c=HH(c,d,a,b,M3,16,0xd4ef3085)
d=HH(b,c,d,a,M6,23,0x04881d05)
a=HH(a,b,c,d,M9,4,0xd9d4d039)
b=HH(d,a,b,c,M12,11,0xe6db99e5)
c=HH(c,d,a,b,M15,16,0x1fa27cf8)
d=HH(b,c,d,a,M2,23,0xc4ac5665)
第四轮
a=II(a,b,c,d,M0,6,0xf4292244)
b=II(d,a,b,c,M7,10,0x432aff97)
c=II(c,d,a,b,M14,15,0xab9423a7)
d=II(b,c,d,a,M5,21,0xfc93a039)
a=II(a,b,c,d,M12,6,0x655b59c3)
b=II(d,a,b,c,M3,10,0x8f0ccc92)
c=II(c,d,a,b,M10,15,0xffeff47d)
d=II(b,c,d,a,M1,21,0x85845dd1)
a=II(a,b,c,d,M8,6,0x6fa87e4f)
b=II(d,a,b,c,M15,10,0xfe2ce6e0)
c=II(c,d,a,b,M6,15,0xa3014314)
d=II(b,c,d,a,M13,21,0x4e0811a1)
a=II(a,b,c,d,M4,6,0xf7537e82)
b=II(d,a,b,c,M11,10,0xbd3af235)
c=II(c,d,a,b,M2,15,0x2ad7d2bb)
d=II(b,c,d,a,M9,21,0xeb86d391)
当前也有很多MD5的算法变形，要还原这些变形的算法，首先就要找到所有变形的地方，然后修改标准算法，一般变形的几个地方：
1. 对数据补位填充的变形
2. 4个初始常数的变形
3. 4轮Hash运算的变形
下面为标准MD5在OD的特征：
初始4个常数：
004012B0 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4] 004012B4 |. 33C9 XOR ECX,ECX 004012B6 |. 8948 14 MOV DWORD PTR DS:[EAX+14],ECX 004012B9 |. 8948 10 MOV DWORD PTR DS:[EAX+10],ECX 004012BC |. C700 01234567 MOV DWORD PTR DS:[EAX],67452301 004012C2 |. C740 04 89ABC>MOV DWORD PTR DS:[EAX+4],EFCDAB89 004012C9 |. C740 08 FEDCB>MOV DWORD PTR DS:[EAX+8],98BADCFE 004012D0 |. C740 0C 76543>MOV DWORD PTR DS:[EAX+C],10325476 004012D7 \. C3 RETN
Hash运算:
00401400 /$ 83EC 40 SUB ESP,40 00401403 |. 8B4C24 48 MOV ECX,DWORD PTR SS:[ESP+48] 00401407 |. 53 PUSH EBX 00401408 |. 55 PUSH EBP 00401409 |. 56 PUSH ESI 0040140A |. 8B7424 50 MOV ESI,DWORD PTR SS:[ESP+50] 0040140E |. 57 PUSH EDI 0040140F |. 6A 40 PUSH 40 00401411 |. 8D5424 14 LEA EDX,DWORD PTR SS:[ESP+14] 00401415 |. 8B06 MOV EAX,DWORD PTR DS:[ESI] 00401417 |. 8B7E 04 MOV EDI,DWORD PTR DS:[ESI+4] 0040141A |. 8B5E 08 MOV EBX,DWORD PTR DS:[ESI+8] 0040141D |. 8B6E 0C MOV EBP,DWORD PTR DS:[ESI+C] 00401420 |. 51 PUSH ECX 00401421 |. 52 PUSH EDX 00401422 |. 894424 60 MOV DWORD PTR SS:[ESP+60],EAX 00401426 |. E8 75090000 CALL MD5KeyGe.00401DA0 0040142B |. 8BC7 MOV EAX,EDI 0040142D |. 8B5424 60 MOV EDX,DWORD PTR SS:[ESP+60] 00401431 |. F7D0 NOT EAX 00401433 |. 8BCB MOV ECX,EBX 00401435 |. 23C5 AND EAX,EBP 00401437 |. 23CF AND ECX,EDI 00401439 |. 0BC1 OR EAX,ECX 0040143B |. 8B4C24 1C MOV ECX,DWORD PTR SS:[ESP+1C] 0040143F |. 03C1 ADD EAX,ECX 00401441 |. 8D8C02 78A46A>LEA ECX,DWORD PTR DS:[EDX+EAX+D76AA478] 00401448 |. 8BD7 MOV EDX,EDI 0040144A |. 8BC1 MOV EAX,ECX 0040144C |. C1E8 19 SHR EAX,19 0040144F |. C1E1 07 SHL ECX,7 00401452 |. 0BC1 OR EAX,ECX 00401454 |. 03C7 ADD EAX,EDI 00401456 |. 8BC8 MOV ECX,EAX 00401458 |. 23D0 AND EDX,EAX 0040145A |. F7D1 NOT ECX 0040145C |. 23CB AND ECX,EBX 0040145E |. 0BCA OR ECX,EDX 00401460 |. 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20] 00401464 |. 03CA ADD ECX,EDX 00401466 |. 8D9429 56B7C7>LEA EDX,DWORD PTR DS:[ECX+EBP+E8C7B756] 0040146D |. 8BCA MOV ECX,EDX 0040146F |. C1E9 14 SHR ECX,14 00401472 |. C1E2 0C SHL EDX,0C 00401475 |. 0BCA OR ECX,EDX 00401477 |. 03C8 ADD ECX,EAX 00401479 |. 8BD1 MOV EDX,ECX 0040147B |. 8BE9 MOV EBP,ECX 0040147D |. F7D2 NOT EDX 0040147F |. 23D7 AND EDX,EDI 00401481 |. 23E8 AND EBP,EAX 00401483 |. 0BD5 OR EDX,EBP 00401485 |. 8B6C24 24 MOV EBP,DWORD PTR SS:[ESP+24] 00401489 |. 03D5 ADD EDX,EBP 0040148B |. 8BE9 MOV EBP,ECX 0040148D |. 8D9C13 DB7020>LEA EBX,DWORD PTR DS:[EBX+EDX+242070DB] 00401494 |. 8BD3 MOV EDX,EBX 00401496 |. C1EA 0F SHR EDX,0F 00401499 |. C1E3 11 SHL EBX,11 0040149C |. 0BD3 OR EDX,EBX 0040149E |. 03D1 ADD EDX,ECX 004014A0 |. 8BDA MOV EBX,EDX 004014A2 |. 23EA AND EBP,EDX 004014A4 |. F7D3 NOT EBX 004014A6 |. 23D8 AND EBX,EAX 004014A8 |. 0BDD OR EBX,EBP 004014AA |. 8B6C24 28 MOV EBP,DWORD PTR SS:[ESP+28] 004014AE |. 03DD ADD EBX,EBP 004014B0 |. 8D9C1F EECEBD>LEA EBX,DWORD PTR DS:[EDI+EBX+C1BDCEEE] 004014B7 |. 8BFB MOV EDI,EBX 004014B9 |. C1E7 16 SHL EDI,16 004014BC |. C1EB 0A SHR EBX,0A 004014BF |. 0BFB OR EDI,EBX 004014C1 |. 8BDA MOV EBX,EDX 004014C3 |. 03FA ADD EDI,EDX 004014C5 |. 897C24 60 MOV DWORD PTR SS:[ESP+60],EDI 004014C9 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004014CD |. F7D7 NOT EDI 004014CF |. 23F9 AND EDI,ECX 004014D1 |. 23DD AND EBX,EBP 004014D3 |. 8B6C24 2C MOV EBP,DWORD PTR SS:[ESP+2C] 004014D7 |. 0BFB OR EDI,EBX 004014D9 |. 03FD ADD EDI,EBP 004014DB |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004014DF |. 8BEB MOV EBP,EBX 004014E1 |. 8D8438 AF0F7C>LEA EAX,DWORD PTR DS:[EAX+EDI+F57C0FAF] 004014E8 |. 8BF8 MOV EDI,EAX 004014EA |. C1EF 19 SHR EDI,19 004014ED |. C1E0 07 SHL EAX,7 004014F0 |. 0BF8 OR EDI,EAX 004014F2 |. 03FB ADD EDI,EBX 004014F4 |. 8BC7 MOV EAX,EDI 004014F6 |. 23EF AND EBP,EDI 004014F8 |. F7D0 NOT EAX 004014FA |. 23C2 AND EAX,EDX 004014FC |. 0BC5 OR EAX,EBP 004014FE |. 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+30] 00401502 |. 03C5 ADD EAX,EBP 00401504 |. 8D8C01 2AC687>LEA ECX,DWORD PTR DS:[ECX+EAX+4787C62A] 0040150B |. 8BC1 MOV EAX,ECX 0040150D |. C1E8 14 SHR EAX,14 00401510 |. C1E1 0C SHL ECX,0C 00401513 |. 0BC1 OR EAX,ECX 00401515 |. 03C7 ADD EAX,EDI 00401517 |. 8BC8 MOV ECX,EAX 00401519 |. 8BE8 MOV EBP,EAX 0040151B |. F7D1 NOT ECX 0040151D |. 23CB AND ECX,EBX 0040151F |. 23EF AND EBP,EDI 00401521 |. 0BCD OR ECX,EBP 00401523 |. 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 00401527 |. 03CD ADD ECX,EBP 00401529 |. 8BE8 MOV EBP,EAX 0040152B |. 8D940A 134630>LEA EDX,DWORD PTR DS:[EDX+ECX+A8304613] 00401532 |. 8BCA MOV ECX,EDX 00401534 |. C1E9 0F SHR ECX,0F 00401537 |. C1E2 11 SHL EDX,11 0040153A |. 0BCA OR ECX,EDX 0040153C |. 03C8 ADD ECX,EAX 0040153E |. 8BD1 MOV EDX,ECX 00401540 |. 23E9 AND EBP,ECX 00401542 |. F7D2 NOT EDX 00401544 |. 23D7 AND EDX,EDI 00401546 |. 0BD5 OR EDX,EBP 00401548 |. 8B6C24 38 MOV EBP,DWORD PTR SS:[ESP+38] 0040154C |. 03D5 ADD EDX,EBP 0040154E |. 8D9C13 019546>LEA EBX,DWORD PTR DS:[EBX+EDX+FD469501] 00401555 |. 8BD3 MOV EDX,EBX 00401557 |. C1E2 16 SHL EDX,16 0040155A |. C1EB 0A SHR EBX,0A 0040155D |. 0BD3 OR EDX,EBX 0040155F |. 8BD9 MOV EBX,ECX 00401561 |. 03D1 ADD EDX,ECX 00401563 |. 895424 60 MOV DWORD PTR SS:[ESP+60],EDX 00401567 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 0040156B |. F7D2 NOT EDX 0040156D |. 23D0 AND EDX,EAX 0040156F |. 23DD AND EBX,EBP 00401571 |. 8B6C24 3C MOV EBP,DWORD PTR SS:[ESP+3C] 00401575 |. 0BD3 OR EDX,EBX 00401577 |. 03D5 ADD EDX,EBP 00401579 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 0040157D |. 8BEB MOV EBP,EBX 0040157F |. 8DBC17 D89880>LEA EDI,DWORD PTR DS:[EDI+EDX+698098D8] 00401586 |. 8BD7 MOV EDX,EDI 00401588 |. C1EA 19 SHR EDX,19 0040158B |. C1E7 07 SHL EDI,7 0040158E |. 0BD7 OR EDX,EDI 00401590 |. 03D3 ADD EDX,EBX 00401592 |. 8BFA MOV EDI,EDX 00401594 |. 23EA AND EBP,EDX 00401596 |. F7D7 NOT EDI 00401598 |. 23F9 AND EDI,ECX 0040159A |. 0BFD OR EDI,EBP 0040159C |. 8B6C24 40 MOV EBP,DWORD PTR SS:[ESP+40] 004015A0 |. 03FD ADD EDI,EBP 004015A2 |. 8D8438 AFF744>LEA EAX,DWORD PTR DS:[EAX+EDI+8B44F7AF] 004015A9 |. 8BF8 MOV EDI,EAX 004015AB |. C1EF 14 SHR EDI,14 004015AE |. C1E0 0C SHL EAX,0C 004015B1 |. 0BF8 OR EDI,EAX 004015B3 |. 03FA ADD EDI,EDX 004015B5 |. 8BC7 MOV EAX,EDI 004015B7 |. F7D0 NOT EAX 004015B9 |. 8BEF MOV EBP,EDI 004015BB |. 23C3 AND EAX,EBX 004015BD |. 23EA AND EBP,EDX 004015BF |. 0BC5 OR EAX,EBP 004015C1 |. 8B6C24 44 MOV EBP,DWORD PTR SS:[ESP+44] 004015C5 |. 03C5 ADD EAX,EBP 004015C7 |. 8BEF MOV EBP,EDI 004015C9 |. 8D8C01 B15BFF>LEA ECX,DWORD PTR DS:[ECX+EAX+FFFF5BB1] 004015D0 |. 8BC1 MOV EAX,ECX 004015D2 |. C1E8 0F SHR EAX,0F 004015D5 |. C1E1 11 SHL ECX,11 004015D8 |. 0BC1 OR EAX,ECX 004015DA |. 03C7 ADD EAX,EDI 004015DC |. 8BC8 MOV ECX,EAX 004015DE |. 23E8 AND EBP,EAX 004015E0 |. F7D1 NOT ECX 004015E2 |. 23CA AND ECX,EDX 004015E4 |. 0BCD OR ECX,EBP 004015E6 |. 8B6C24 48 MOV EBP,DWORD PTR SS:[ESP+48] 004015EA |. 03CD ADD ECX,EBP 004015EC |. 8D9C0B BED75C>LEA EBX,DWORD PTR DS:[EBX+ECX+895CD7BE] 004015F3 |. 8BCB MOV ECX,EBX 004015F5 |. C1E1 16 SHL ECX,16 004015F8 |. C1EB 0A SHR EBX,0A 004015FB |. 0BCB OR ECX,EBX 004015FD |. 8BD8 MOV EBX,EAX 004015FF |. 03C8 ADD ECX,EAX 00401601 |. 894C24 60 MOV DWORD PTR SS:[ESP+60],ECX 00401605 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 00401609 |. F7D1 NOT ECX 0040160B |. 23CF AND ECX,EDI 0040160D |. 23DD AND EBX,EBP 0040160F |. 8B6C24 4C MOV EBP,DWORD PTR SS:[ESP+4C] 00401613 |. 0BCB OR ECX,EBX 00401615 |. 03CD ADD ECX,EBP 00401617 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 0040161B |. 8BEB MOV EBP,EBX 0040161D |. 8D940A 221190>LEA EDX,DWORD PTR DS:[EDX+ECX+6B901122] 00401624 |. 8BCA MOV ECX,EDX 00401626 |. C1E9 19 SHR ECX,19 00401629 |. C1E2 07 SHL EDX,7 0040162C |. 0BCA OR ECX,EDX 0040162E |. 03CB ADD ECX,EBX 00401630 |. 8BD1 MOV EDX,ECX 00401632 |. 23E9 AND EBP,ECX 00401634 |. F7D2 NOT EDX 00401636 |. 23D0 AND EDX,EAX 00401638 |. 0BD5 OR EDX,EBP 0040163A |. 8B6C24 50 MOV EBP,DWORD PTR SS:[ESP+50] 0040163E |. 03D5 ADD EDX,EBP 00401640 |. 8DBC17 937198>LEA EDI,DWORD PTR DS:[EDI+EDX+FD987193] 00401647 |. 8BD7 MOV EDX,EDI 00401649 |. C1EA 14 SHR EDX,14 0040164C |. C1E7 0C SHL EDI,0C 0040164F |. 0BD7 OR EDX,EDI 00401651 |. 03D1 ADD EDX,ECX 00401653 |. 8BEA MOV EBP,EDX 00401655 |. 8BFA MOV EDI,EDX 00401657 |. F7D5 NOT EBP 00401659 |. 23F9 AND EDI,ECX 0040165B |. 23DD AND EBX,EBP 0040165D |. 0BFB OR EDI,EBX 0040165F |. 8B5C24 54 MOV EBX,DWORD PTR SS:[ESP+54] 00401663 |. 03FB ADD EDI,EBX 00401665 |. 8BDA MOV EBX,EDX 00401667 |. 8D8438 8E4379>LEA EAX,DWORD PTR DS:[EAX+EDI+A679438E] 0040166E |. 8BF8 MOV EDI,EAX 00401670 |. C1EF 0F SHR EDI,0F 00401673 |. C1E0 11 SHL EAX,11 00401676 |. 0BF8 OR EDI,EAX 00401678 |. 03FA ADD EDI,EDX 0040167A |. 8BC7 MOV EAX,EDI 0040167C |. 23DF AND EBX,EDI 0040167E |. F7D0 NOT EAX 00401680 |. 894424 64 MOV DWORD PTR SS:[ESP+64],EAX 00401684 |. 23C1 AND EAX,ECX 00401686 |. 0BC3 OR EAX,EBX 00401688 |. 8B5C24 58 MOV EBX,DWORD PTR SS:[ESP+58] 0040168C |. 03C3 ADD EAX,EBX 0040168E |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401692 |. 8D9C03 2108B4>LEA EBX,DWORD PTR DS:[EBX+EAX+49B40821] 00401699 |. 8BC3 MOV EAX,EBX 0040169B |. C1E0 16 SHL EAX,16 0040169E |. C1EB 0A SHR EBX,0A 004016A1 |. 0BC3 OR EAX,EBX 004016A3 |. 8BDA MOV EBX,EDX 004016A5 |. 03C7 ADD EAX,EDI 004016A7 |. 894424 60 MOV DWORD PTR SS:[ESP+60],EAX 004016AB |. 23D8 AND EBX,EAX 004016AD |. 8BC7 MOV EAX,EDI 004016AF |. 23C5 AND EAX,EBP 004016B1 |. 8B6C24 20 MOV EBP,DWORD PTR SS:[ESP+20] 004016B5 |. 0BD8 OR EBX,EAX 004016B7 |. 03DD ADD EBX,EBP 004016B9 |. 8BEF MOV EBP,EDI 004016BB |. 8D8C19 62251E>LEA ECX,DWORD PTR DS:[ECX+EBX+F61E2562] 004016C2 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004016C6 |. 8BC1 MOV EAX,ECX 004016C8 |. C1E8 1B SHR EAX,1B 004016CB |. C1E1 05 SHL ECX,5 004016CE |. 0BC1 OR EAX,ECX 004016D0 |. 8B4C24 64 MOV ECX,DWORD PTR SS:[ESP+64] 004016D4 |. 03C3 ADD EAX,EBX 004016D6 |. 23CB AND ECX,EBX 004016D8 |. 23E8 AND EBP,EAX 004016DA |. 0BCD OR ECX,EBP 004016DC |. 8B6C24 34 MOV EBP,DWORD PTR SS:[ESP+34] 004016E0 |. 03CD ADD ECX,EBP 004016E2 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004016E6 |. F7D3 NOT EBX 004016E8 |. 8D940A 40B340>LEA EDX,DWORD PTR DS:[EDX+ECX+C040B340] 004016EF |. 23D8 AND EBX,EAX 004016F1 |. 8BCA MOV ECX,EDX 004016F3 |. C1E9 17 SHR ECX,17 004016F6 |. C1E2 09 SHL EDX,9 004016F9 |. 0BCA OR ECX,EDX 004016FB |. 03C8 ADD ECX,EAX 004016FD |. 8BD1 MOV EDX,ECX 004016FF |. 23D5 AND EDX,EBP 00401701 |. 8B6C24 48 MOV EBP,DWORD PTR SS:[ESP+48] 00401705 |. 0BDA OR EBX,EDX 00401707 |. 03DD ADD EBX,EBP 00401709 |. 8DBC1F 515A5E>LEA EDI,DWORD PTR DS:[EDI+EBX+265E5A51] 00401710 |. 8BD7 MOV EDX,EDI 00401712 |. C1EA 12 SHR EDX,12 00401715 |. C1E7 0E SHL EDI,0E 00401718 |. 0BD7 OR EDX,EDI 0040171A |. 8BF8 MOV EDI,EAX 0040171C |. 03D1 ADD EDX,ECX 0040171E |. F7D7 NOT EDI 00401720 |. 8BDA MOV EBX,EDX 00401722 |. 23F9 AND EDI,ECX 00401724 |. 23D8 AND EBX,EAX 00401726 |. 0BFB OR EDI,EBX 00401728 |. 8B5C24 1C MOV EBX,DWORD PTR SS:[ESP+1C] 0040172C |. 03FB ADD EDI,EBX 0040172E |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401732 |. 8D9C3B AAC7B6>LEA EBX,DWORD PTR DS:[EBX+EDI+E9B6C7AA] 00401739 |. 8BFB MOV EDI,EBX 0040173B |. C1E7 14 SHL EDI,14 0040173E |. C1EB 0C SHR EBX,0C 00401741 |. 0BFB OR EDI,EBX 00401743 |. 8BD9 MOV EBX,ECX 00401745 |. 03FA ADD EDI,EDX 00401747 |. 897C24 60 MOV DWORD PTR SS:[ESP+60],EDI 0040174B |. 8BF9 MOV EDI,ECX 0040174D |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 00401751 |. F7D7 NOT EDI 00401753 |. 23FA AND EDI,EDX 00401755 |. 23DD AND EBX,EBP 00401757 |. 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+30] 0040175B |. 0BFB OR EDI,EBX 0040175D |. 03FD ADD EDI,EBP 0040175F |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401763 |. 8D8438 5D102F>LEA EAX,DWORD PTR DS:[EAX+EDI+D62F105D] 0040176A |. 8BF8 MOV EDI,EAX 0040176C |. C1EF 1B SHR EDI,1B 0040176F |. C1E0 05 SHL EAX,5 00401772 |. 0BF8 OR EDI,EAX 00401774 |. 8BC2 MOV EAX,EDX 00401776 |. 03FB ADD EDI,EBX 00401778 |. F7D0 NOT EAX 0040177A |. 8BEA MOV EBP,EDX 0040177C |. 23C3 AND EAX,EBX 0040177E |. 23EF AND EBP,EDI 00401780 |. 0BC5 OR EAX,EBP 00401782 |. 8B6C24 44 MOV EBP,DWORD PTR SS:[ESP+44] 00401786 |. 03C5 ADD EAX,EBP 00401788 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 0040178C |. F7D3 NOT EBX 0040178E |. 8D8C01 531444>LEA ECX,DWORD PTR DS:[ECX+EAX+2441453] 00401795 |. 23DF AND EBX,EDI 00401797 |. 8BC1 MOV EAX,ECX 00401799 |. C1E8 17 SHR EAX,17 0040179C |. C1E1 09 SHL ECX,9 0040179F |. 0BC1 OR EAX,ECX 004017A1 |. 03C7 ADD EAX,EDI 004017A3 |. 8BC8 MOV ECX,EAX 004017A5 |. 23CD AND ECX,EBP 004017A7 |. 8B6C24 58 MOV EBP,DWORD PTR SS:[ESP+58] 004017AB |. 0BD9 OR EBX,ECX 004017AD |. 03DD ADD EBX,EBP 004017AF |. 8D941A 81E6A1>LEA EDX,DWORD PTR DS:[EDX+EBX+D8A1E681] 004017B6 |. 8BCA MOV ECX,EDX 004017B8 |. C1E9 12 SHR ECX,12 004017BB |. C1E2 0E SHL EDX,0E 004017BE |. 0BCA OR ECX,EDX 004017C0 |. 8BD7 MOV EDX,EDI 004017C2 |. 03C8 ADD ECX,EAX 004017C4 |. F7D2 NOT EDX 004017C6 |. 8BD9 MOV EBX,ECX 004017C8 |. 23D0 AND EDX,EAX 004017CA |. 23DF AND EBX,EDI 004017CC |. 0BD3 OR EDX,EBX 004017CE |. 8B5C24 2C MOV EBX,DWORD PTR SS:[ESP+2C] 004017D2 |. 03D3 ADD EDX,EBX 004017D4 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004017D8 |. 8D9C13 C8FBD3>LEA EBX,DWORD PTR DS:[EBX+EDX+E7D3FBC8] 004017DF |. 8BD3 MOV EDX,EBX 004017E1 |. C1E2 14 SHL EDX,14 004017E4 |. C1EB 0C SHR EBX,0C 004017E7 |. 0BD3 OR EDX,EBX 004017E9 |. 8BD8 MOV EBX,EAX 004017EB |. 03D1 ADD EDX,ECX 004017ED |. 895424 60 MOV DWORD PTR SS:[ESP+60],EDX 004017F1 |. 8BD0 MOV EDX,EAX 004017F3 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004017F7 |. F7D2 NOT EDX 004017F9 |. 23D1 AND EDX,ECX 004017FB |. 23DD AND EBX,EBP 004017FD |. 8B6C24 40 MOV EBP,DWORD PTR SS:[ESP+40] 00401801 |. 0BD3 OR EDX,EBX 00401803 |. 03D5 ADD EDX,EBP 00401805 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401809 |. 8BE9 MOV EBP,ECX 0040180B |. 8DBC17 E6CDE1>LEA EDI,DWORD PTR DS:[EDI+EDX+21E1CDE6] 00401812 |. 8BD7 MOV EDX,EDI 00401814 |. C1EA 1B SHR EDX,1B 00401817 |. C1E7 05 SHL EDI,5 0040181A |. 0BD7 OR EDX,EDI 0040181C |. 8BF9 MOV EDI,ECX 0040181E |. 03D3 ADD EDX,EBX 00401820 |. F7D7 NOT EDI 00401822 |. 23FB AND EDI,EBX 00401824 |. 23EA AND EBP,EDX 00401826 |. 0BFD OR EDI,EBP 00401828 |. 8B6C24 54 MOV EBP,DWORD PTR SS:[ESP+54] 0040182C |. 03FD ADD EDI,EBP 0040182E |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 00401832 |. F7D3 NOT EBX 00401834 |. 8D8438 D60737>LEA EAX,DWORD PTR DS:[EAX+EDI+C33707D6] 0040183B |. 23DA AND EBX,EDX 0040183D |. 8BF8 MOV EDI,EAX 0040183F |. C1EF 17 SHR EDI,17 00401842 |. C1E0 09 SHL EAX,9 00401845 |. 0BF8 OR EDI,EAX 00401847 |. 03FA ADD EDI,EDX 00401849 |. 8BC7 MOV EAX,EDI 0040184B |. 23C5 AND EAX,EBP 0040184D |. 8B6C24 28 MOV EBP,DWORD PTR SS:[ESP+28] 00401851 |. 0BD8 OR EBX,EAX 00401853 |. 03DD ADD EBX,EBP 00401855 |. 8D8C19 870DD5>LEA ECX,DWORD PTR DS:[ECX+EBX+F4D50D87] 0040185C |. 8BC1 MOV EAX,ECX 0040185E |. C1E8 12 SHR EAX,12 00401861 |. C1E1 0E SHL ECX,0E 00401864 |. 0BC1 OR EAX,ECX 00401866 |. 8BCA MOV ECX,EDX 00401868 |. 03C7 ADD EAX,EDI 0040186A |. F7D1 NOT ECX 0040186C |. 8BD8 MOV EBX,EAX 0040186E |. 23CF AND ECX,EDI 00401870 |. 23DA AND EBX,EDX 00401872 |. 0BCB OR ECX,EBX 00401874 |. 8B5C24 3C MOV EBX,DWORD PTR SS:[ESP+3C] 00401878 |. 03CB ADD ECX,EBX 0040187A |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 0040187E |. 8D9C0B ED145A>LEA EBX,DWORD PTR DS:[EBX+ECX+455A14ED] 00401885 |. 8BCB MOV ECX,EBX 00401887 |. C1E1 14 SHL ECX,14 0040188A |. C1EB 0C SHR EBX,0C 0040188D |. 0BCB OR ECX,EBX 0040188F |. 8BDF MOV EBX,EDI 00401891 |. 03C8 ADD ECX,EAX 00401893 |. 894C24 60 MOV DWORD PTR SS:[ESP+60],ECX 00401897 |. 8BCF MOV ECX,EDI 00401899 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 0040189D |. F7D1 NOT ECX 0040189F |. 23C8 AND ECX,EAX 004018A1 |. 23DD AND EBX,EBP 004018A3 |. 8B6C24 50 MOV EBP,DWORD PTR SS:[ESP+50] 004018A7 |. 0BCB OR ECX,EBX 004018A9 |. 03CD ADD ECX,EBP 004018AB |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 004018AF |. 8BE8 MOV EBP,EAX 004018B1 |. 8D940A 05E9E3>LEA EDX,DWORD PTR DS:[EDX+ECX+A9E3E905] 004018B8 |. 8BCA MOV ECX,EDX 004018BA |. C1E9 1B SHR ECX,1B 004018BD |. C1E2 05 SHL EDX,5 004018C0 |. 0BCA OR ECX,EDX 004018C2 |. 8BD0 MOV EDX,EAX 004018C4 |. 03CB ADD ECX,EBX 004018C6 |. F7D2 NOT EDX 004018C8 |. 23D3 AND EDX,EBX 004018CA |. 23E9 AND EBP,ECX 004018CC |. 0BD5 OR EDX,EBP 004018CE |. 8B6C24 24 MOV EBP,DWORD PTR SS:[ESP+24] 004018D2 |. 03D5 ADD EDX,EBP 004018D4 |. 8B6C24 60 MOV EBP,DWORD PTR SS:[ESP+60] 004018D8 |. F7D3 NOT EBX 004018DA |. 8DBC17 F8A3EF>LEA EDI,DWORD PTR DS:[EDI+EDX+FCEFA3F8] 004018E1 |. 23D9 AND EBX,ECX 004018E3 |. 8BD7 MOV EDX,EDI 004018E5 |. C1EA 17 SHR EDX,17 004018E8 |. C1E7 09 SHL EDI,9 004018EB |. 0BD7 OR EDX,EDI 004018ED |. 03D1 ADD EDX,ECX 004018EF |. 8BFA MOV EDI,EDX 004018F1 |. 23FD AND EDI,EBP 004018F3 |. 8B6C24 38 MOV EBP,DWORD PTR SS:[ESP+38] 004018F7 |. 0BDF OR EBX,EDI 004018F9 |. 03DD ADD EBX,EBP 004018FB |. 8D8418 D9026F>LEA EAX,DWORD PTR DS:[EAX+EBX+676F02D9] 00401902 |. 8BF8 MOV EDI,EAX 00401904 |. C1EF 12 SHR EDI,12 00401907 |. C1E0 0E SHL EAX,0E 0040190A |. 0BF8 OR EDI,EAX 0040190C |. 8BC1 MOV EAX,ECX 0040190E |. 03FA ADD EDI,EDX 00401910 |. F7D0 NOT EAX 00401912 |. 8BDF MOV EBX,EDI 00401914 |. 23C2 AND EAX,EDX 00401916 |. 23D9 AND EBX,ECX 00401918 |. 0BC3 OR EAX,EBX 0040191A |. 8B5C24 4C MOV EBX,DWORD PTR SS:[ESP+4C] 0040191E |. 03C3 ADD EAX,EBX 00401920 |. 8B5C24 60 MOV EBX,DWORD PTR SS:[ESP+60] 00401924 |. 8D9C03 8A4C2A>LEA EBX,DWORD PTR DS:[EBX+EAX+8D2A4C8A] 0040192B |. 8BC3 MOV EAX,EBX 0040192D |. C1E0 14 SHL EAX,14 00401930 |. C1EB 0C SHR EBX,0C 00401933 |. 0BC3 OR EAX,EBX 00401935 |. 03C7 ADD EAX,EDI 00401937 |. 8B6C24 30 MOV EBP,DWORD PTR SS:[ESP+30] 0040193B |. 8BDA MOV EBX,EDX 0040193D |. 33DF XOR EBX,EDI 0040193F |. 33D8 XOR EBX,EAX 00401941 |. 03DD ADD EBX,EBP 00401943 |. 8B6C24 3C MOV EBP,DWORD PTR SS:[ESP+3C] 00401947 |. 8D8C19 4239FA>LEA ECX,DWORD PTR DS:[ECX+EBX+FFFA3942] 0040194E |. 8BD9 MOV EBX,ECX 00401950 |. C1EB 1C SHR EBX,1C 00401953 |. C1E1 04 SHL ECX,4 00401956 |. 0BD9 OR EBX,ECX 00401958 |. 8BCF MOV ECX,EDI 0040195A |. 03D8 ADD EBX,EAX 0040195C |. 33C8 XOR ECX,EAX 0040195E |. 33CB XOR ECX,EBX 00401960 |. 03CD ADD ECX,EBP 00401962 |. 8B6C24 48 MOV EBP,DWORD PTR SS:[ESP+48] 00401966 |. 8D8C0A 81F671>LEA ECX,DWORD PTR DS:[EDX+ECX+8771F681] 0040196D |. 8BD1 MOV EDX,ECX 0040196F |. C1EA 15 SHR EDX,15 00401972 |. C1E1 0B SHL ECX,0B 00401975 |. 0BD1 OR EDX,ECX 00401977 |. 03D3 ADD EDX,EBX 00401979 |. 8BCA MOV ECX,EDX 0040197B |. 33C8 XOR ECX,EAX 0040197D |. 33CB XOR ECX,EBX 0040197F |. 03CD ADD ECX,EBP 00401981 |. 8B6C24 54 MOV EBP,DWORD PTR SS:[ESP+54] 00401985 |. 8D8C0F 22619D>LEA ECX,DWORD PTR DS:[EDI+ECX+6D9D6122] 0040198C |. 8BF9 MOV EDI,ECX 0040198E |. C1EF 10 SHR EDI,10 00401991 |. C1E1 10 SHL ECX,10 00401994 |. 0BF9 OR EDI,ECX 00401996 |. 8BCA MOV ECX,EDX 00401998 |. 03FA ADD EDI,EDX 0040199A |. 33CF XOR ECX,EDI 0040199C |. 894C24 60 MOV DWORD PTR SS:[ESP+60],ECX 004019A0 |. 33CB XOR ECX,EBX 004019A2 |. 03CD ADD ECX,EBP 004019A4 |. 8B6C24 20 MOV EBP,DWORD PTR SS:[ESP+20] 004019A8 |. 8D8408 0C38E5>LEA EAX,DWORD PTR DS:[EAX+ECX+FDE5380C] 004019AF |. 8BC8 MOV ECX,EAX 004019B1 |. C1E1 17 SHL ECX,17 004019B4 |. C1E8 09 SHR EAX,9 004019B7 |. 0BC8 OR ECX,EAX 004019B9 |. 8B4424 60 MOV EAX,DWORD PTR SS:[ESP+60] 004019BD |. 03CF ADD ECX,EDI 004019BF |. 33C1 XOR EAX,ECX 004019C1 |. 03C5 ADD EAX,EBP 004019C3 |. 8B6C24 2C MOV EBP,DWORD PTR SS:[ESP+2C] 004019C7 |. 8D9C03 44EABE>LEA EBX,DWORD PTR DS:[EBX+EAX+A4BEEA44] 004019CE |. 8BC3 MOV EAX,EBX 004019D0 |. C1E8 1C SHR EAX,1C 004019D3 |. C1E3 04 SHL EBX,4 004019D6 |. 0BC3 OR EAX,EBX 004019D8 |. 8BDF MOV EBX,EDI 004019DA |. 03C1 ADD EAX,ECX 004019DC |. 33D9 XOR EBX,ECX 004019DE |. 33D8 XOR EBX,EAX 004019E0 |. 03DD ADD EBX,EBP 004019E2 |. 8B6C24 38 MOV EBP,DWORD PTR SS:[ESP+38] 004019E6 |. 8D941A A9CFDE>LEA EDX,DWORD PTR DS:[EDX+EBX+4BDECFA9] 004019ED |. 8BDA MOV EBX,EDX 004019EF |. C1EB 15 SHR EBX,15 004019F2 |. C1E2 0B SHL EDX,0B 004019F5 |. 0BDA OR EBX,EDX 004019F7 |. 03D8 ADD EBX,EAX 004019F9 |. 8BD3 MOV EDX,EBX 004019FB |. 33D1 XOR EDX,ECX 004019FD |. 33D0 XOR EDX,EAX 004019FF |. 03D5 ADD EDX,EBP 00401A01 |. 8DBC17 604BBB>LEA EDI,DWORD PTR DS:[EDI+EDX+F6BB4B60] 00401A08 |. 8BD7 MOV EDX,EDI 00401A0A |. C1EA 10 SHR EDX,10 00401A0D |. C1E7 10 SHL EDI,10 00401A10 |. 0BD7 OR EDX,EDI 00401A12 |. 8BFB MOV EDI,EBX 00401A14 |. 03D3 ADD EDX,EBX 00401A16 |. 33FA XOR EDI,EDX 00401A18 |. 8BEF MOV EBP,EDI 00401A1A |. 33E8 XOR EBP,EAX 00401A1C |. 036C24 44 ADD EBP,DWORD PTR SS:[ESP+44] 00401A20 |. 8DAC29 70BCBF>LEA EBP,DWORD PTR DS:[ECX+EBP+BEBFBC70] 00401A27 |. 8BCD MOV ECX,EBP 00401A29 |. C1E1 17 SHL ECX,17 00401A2C |. C1ED 09 SHR EBP,9 00401A2F |. 0BCD OR ECX,EBP 00401A31 |. 8B6C24 50 MOV EBP,DWORD PTR SS:[ESP+50] 00401A35 |. 03CA ADD ECX,EDX 00401A37 |. 33F9 XOR EDI,ECX 00401A39 |. 03FD ADD EDI,EBP 00401A3B |. 8B6C24 1C MOV EBP,DWORD PTR SS:[ESP+1C] 00401A3F |. 8DBC38 C67E9B>LEA EDI,DWORD PTR DS:[EAX+EDI+289B7EC6] 00401A46 |. 8BC7 MOV EAX,EDI 00401A48 |. C1E8 1C SHR EAX,1C 00401A4B |. C1E7 04 SHL EDI,4 00401A4E |. 0BC7 OR EAX,EDI 00401A50 |. 8BFA MOV EDI,EDX 00401A52 |. 03C1 ADD EAX,ECX 00401A54 |. 33F9 XOR EDI,ECX 00401A56 |. 33F8 XOR EDI,EAX 00401A58 |. 03FD ADD EDI,EBP 00401A5A |. 8B6C24 28 MOV EBP,DWORD PTR SS:[ESP+28] 00401A5E |. 8D9C3B FA27A1>LEA EBX,DWORD PTR DS:[EBX+EDI+EAA127FA] 00401A65 |. 8BFB MOV EDI,EBX 00401A67 |. C1EF 15 SHR EDI,15 00401A6A |. C1E3 0B SHL EBX,0B 00401A6D |. 0BFB OR EDI,EBX 00401A6F |. 03F8 ADD EDI,EAX 00401A71 |. 8BDF MOV EBX,EDI 00401A73 |. 33D9 XOR EBX,ECX 00401A75 |. 33D8 XOR EBX,EAX 00401A77 |. 03DD ADD EBX,EBP 00401A79 |. 8D941A 8530EF>LEA EDX,DWORD PTR DS:[EDX+EBX+D4EF3085] 00401A80 |. 8BDA MOV EBX,EDX 00401A82 |. C1EB 10 SHR EBX,10 00401A85 |. C1E2 10 SHL EDX,10 00401A88 |. 0BDA OR EBX,EDX 00401A8A |. 8BD7 MOV EDX,EDI 00401A8C |. 03DF ADD EBX,EDI 00401A8E |. 33D3 XOR EDX,EBX 00401A90 |. 8BEA MOV EBP,EDX 00401A92 |. 33E8 XOR EBP,EAX 00401A94 |. 036C24 34 ADD EBP,DWORD PTR SS:[ESP+34] 00401A98 |. 8DAC29 051D88>LEA EBP,DWORD PTR DS:[ECX+EBP+4881D05] 00401A9F |. 8BCD MOV ECX,EBP 00401AA1 |. C1E1 17 SHL ECX,17 00401AA4 |. C1ED 09 SHR EBP,9 00401AA7 |. 0BCD OR ECX,EBP 00401AA9 |. 8B6C24 40 MOV EBP,DWORD PTR SS:[ESP+40] 00401AAD |. 03CB ADD ECX,EBX 00401AAF |. 33D1 XOR EDX,ECX 00401AB1 |. 03D5 ADD EDX,EBP 00401AB3 |. 8D9410 39D0D4>LEA EDX,DWORD PTR DS:[EAX+EDX+D9D4D039] 00401ABA |. 8BC2 MOV EAX,EDX 00401ABC |. C1E8 1C SHR EAX,1C 00401ABF |. C1E2 04 SHL EDX,4 00401AC2 |. 0BC2 OR EAX,EDX 00401AC4 |. 8BD3 MOV EDX,EBX 00401AC6 |. 03C1 ADD EAX,ECX 00401AC8 |. 33D1 XOR EDX,ECX 00401ACA |. 33D0 XOR EDX,EAX 00401ACC |. 035424 4C ADD EDX,DWORD PTR SS:[ESP+4C] 00401AD0 |. 8DBC17 E599DB>LEA EDI,DWORD PTR DS:[EDI+EDX+E6DB99E5] 00401AD7 |. 8BD7 MOV EDX,EDI 00401AD9 |. C1EA 15 SHR EDX,15 00401ADC |. C1E7 0B SHL EDI,0B 00401ADF |. 0BD7 OR EDX,EDI 00401AE1 |. 03D0 ADD EDX,EAX 00401AE3 |. 8BFA MOV EDI,EDX 00401AE5 |. 33F9 XOR EDI,ECX 00401AE7 |. 33F8 XOR EDI,EAX 00401AE9 |. 037C24 58 ADD EDI,DWORD PTR SS:[ESP+58] 00401AED |. 8D9C3B F87CA2>LEA EBX,DWORD PTR DS:[EBX+EDI+1FA27CF8] 00401AF4 |. 8BFB MOV EDI,EBX 00401AF6 |. C1EF 10 SHR EDI,10 00401AF9 |. C1E3 10 SHL EBX,10 00401AFC |. 0BFB OR EDI,EBX 00401AFE |. 8BDA MOV EBX,EDX 00401B00 |. 03FA ADD EDI,EDX 00401B02 |. 33DF XOR EBX,EDI 00401B04 |. 33D8 XOR EBX,EAX 00401B06 |. 035C24 24 ADD EBX,DWORD PTR SS:[ESP+24] 00401B0A |. 8D8C19 6556AC>LEA ECX,DWORD PTR DS:[ECX+EBX+C4AC5665] 00401B11 |. 8BD9 MOV EBX,ECX 00401B13 |. C1E3 17 SHL EBX,17 00401B16 |. C1E9 09 SHR ECX,9 00401B19 |. 0BD9 OR EBX,ECX 00401B1B |. 8BCA MOV ECX,EDX 00401B1D |. 03DF ADD EBX,EDI 00401B1F |. F7D1 NOT ECX 00401B21 |. 0BCB OR ECX,EBX 00401B23 |. 33CF XOR ECX,EDI 00401B25 |. 034C24 1C ADD ECX,DWORD PTR SS:[ESP+1C] 00401B29 |. 8D8408 442229>LEA EAX,DWORD PTR DS:[EAX+ECX+F4292244] 00401B30 |. 8BC8 MOV ECX,EAX 00401B32 |. C1E9 1A SHR ECX,1A 00401B35 |. C1E0 06 SHL EAX,6 00401B38 |. 0BC8 OR ECX,EAX 00401B3A |. 8BC7 MOV EAX,EDI 00401B3C |. 03CB ADD ECX,EBX 00401B3E |. F7D0 NOT EAX 00401B40 |. 0BC1 OR EAX,ECX 00401B42 |. 33C3 XOR EAX,EBX 00401B44 |. 034424 38 ADD EAX,DWORD PTR SS:[ESP+38] 00401B48 |. 8D9402 97FF2A>LEA EDX,DWORD PTR DS:[EDX+EAX+432AFF97] 00401B4F |. 8BC2 MOV EAX,EDX 00401B51 |. C1E8 16 SHR EAX,16 00401B54 |. C1E2 0A SHL EDX,0A 00401B57 |. 0BC2 OR EAX,EDX 00401B59 |. 8BD3 MOV EDX,EBX 00401B5B |. 03C1 ADD EAX,ECX 00401B5D |. F7D2 NOT EDX 00401B5F |. 0BD0 OR EDX,EAX 00401B61 |. 33D1 XOR EDX,ECX 00401B63 |. 035424 54 ADD EDX,DWORD PTR SS:[ESP+54] 00401B67 |. 8DBC17 A72394>LEA EDI,DWORD PTR DS:[EDI+EDX+AB9423A7] 00401B6E |. 8BD7 MOV EDX,EDI 00401B70 |. C1EA 11 SHR EDX,11 00401B73 |. C1E7 0F SHL EDI,0F 00401B76 |. 0BD7 OR EDX,EDI 00401B78 |. 8BF9 MOV EDI,ECX 00401B7A |. 03D0 ADD EDX,EAX 00401B7C |. F7D7 NOT EDI 00401B7E |. 0BFA OR EDI,EDX 00401B80 |. 33F8 XOR EDI,EAX 00401B82 |. 037C24 30 ADD EDI,DWORD PTR SS:[ESP+30] 00401B86 |. 8D9C3B 39A093>LEA EBX,DWORD PTR DS:[EBX+EDI+FC93A039] 00401B8D |. 8BFB MOV EDI,EBX 00401B8F |. C1E7 15 SHL EDI,15 00401B92 |. C1EB 0B SHR EBX,0B 00401B95 |. 0BFB OR EDI,EBX 00401B97 |. 8BD8 MOV EBX,EAX 00401B99 |. 03FA ADD EDI,EDX 00401B9B |. F7D3 NOT EBX 00401B9D |. 0BDF OR EBX,EDI 00401B9F |. 33DA XOR EBX,EDX 00401BA1 |. 035C24 4C ADD EBX,DWORD PTR SS:[ESP+4C] 00401BA5 |. 8D8C19 C3595B>LEA ECX,DWORD PTR DS:[ECX+EBX+655B59C3] 00401BAC |. 8BD9 MOV EBX,ECX 00401BAE |. C1EB 1A SHR EBX,1A 00401BB1 |. C1E1 06 SHL ECX,6 00401BB4 |. 0BD9 OR EBX,ECX 00401BB6 |. 8BCA MOV ECX,EDX 00401BB8 |. 03DF ADD EBX,EDI 00401BBA |. F7D1 NOT ECX 00401BBC |. 0BCB OR ECX,EBX 00401BBE |. 33CF XOR ECX,EDI 00401BC0 |. 034C24 28 ADD ECX,DWORD PTR SS:[ESP+28] 00401BC4 |. 8D8408 92CC0C>LEA EAX,DWORD PTR DS:[EAX+ECX+8F0CCC92] 00401BCB |. 8BC8 MOV ECX,EAX 00401BCD |. C1E9 16 SHR ECX,16 00401BD0 |. C1E0 0A SHL EAX,0A 00401BD3 |. 0BC8 OR ECX,EAX 00401BD5 |. 8BC7 MOV EAX,EDI 00401BD7 |. 03CB ADD ECX,EBX 00401BD9 |. F7D0 NOT EAX 00401BDB |. 0BC1 OR EAX,ECX 00401BDD |. 33C3 XOR EAX,EBX 00401BDF |. 034424 44 ADD EAX,DWORD PTR SS:[ESP+44] 00401BE3 |. 8D9402 7DF4EF>LEA EDX,DWORD PTR DS:[EDX+EAX+FFEFF47D] 00401BEA |. 8BC2 MOV EAX,EDX 00401BEC |. C1E8 11 SHR EAX,11 00401BEF |. C1E2 0F SHL EDX,0F 00401BF2 |. 0BC2 OR EAX,EDX 00401BF4 |. 8BD3 MOV EDX,EBX 00401BF6 |. 03C1 ADD EAX,ECX 00401BF8 |. F7D2 NOT EDX 00401BFA |. 0BD0 OR EDX,EAX 00401BFC |. 33D1 XOR EDX,ECX 00401BFE |. 035424 20 ADD EDX,DWORD PTR SS:[ESP+20] 00401C02 |. 8DBC17 D15D84>LEA EDI,DWORD PTR DS:[EDI+EDX+85845DD1] 00401C09 |. 8BD7 MOV EDX,EDI 00401C0B |. C1E2 15 SHL EDX,15 00401C0E |. C1EF 0B SHR EDI,0B 00401C11 |. 0BD7 OR EDX,EDI 00401C13 |. 8BF9 MOV EDI,ECX 00401C15 |. 03D0 ADD EDX,EAX 00401C17 |. F7D7 NOT EDI 00401C19 |. 0BFA OR EDI,EDX 00401C1B |. 33F8 XOR EDI,EAX 00401C1D |. 037C24 3C ADD EDI,DWORD PTR SS:[ESP+3C] 00401C21 |. 8D9C3B 4F7EA8>LEA EBX,DWORD PTR DS:[EBX+EDI+6FA87E4F] 00401C28 |. 8BFB MOV EDI,EBX 00401C2A |. C1EF 1A SHR EDI,1A 00401C2D |. C1E3 06 SHL EBX,6 00401C30 |. 0BFB OR EDI,EBX 00401C32 |. 8BD8 MOV EBX,EAX 00401C34 |. 03FA ADD EDI,EDX 00401C36 |. F7D3 NOT EBX 00401C38 |. 0BDF OR EBX,EDI 00401C3A |. 33DA XOR EBX,EDX 00401C3C |. 035C24 58 ADD EBX,DWORD PTR SS:[ESP+58] 00401C40 |. 8D8C19 E0E62C>LEA ECX,DWORD PTR DS:[ECX+EBX+FE2CE6E0] 00401C47 |. 8BD9 MOV EBX,ECX 00401C49 |. C1EB 16 SHR EBX,16 00401C4C |. C1E1 0A SHL ECX,0A 00401C4F |. 0BD9 OR EBX,ECX 00401C51 |. 8BCA MOV ECX,EDX 00401C53 |. 03DF ADD EBX,EDI 00401C55 |. F7D1 NOT ECX 00401C57 |. 0BCB OR ECX,EBX 00401C59 |. 33CF XOR ECX,EDI 00401C5B |. 034C24 34 ADD ECX,DWORD PTR SS:[ESP+34] 00401C5F |. 8D8408 144301>LEA EAX,DWORD PTR DS:[EAX+ECX+A3014314] 00401C66 |. 8BC8 MOV ECX,EAX 00401C68 |. C1E9 11 SHR ECX,11 00401C6B |. C1E0 0F SHL EAX,0F 00401C6E |. 0BC8 OR ECX,EAX 00401C70 |. 8BC7 MOV EAX,EDI 00401C72 |. 03CB ADD ECX,EBX 00401C74 |. F7D0 NOT EAX 00401C76 |. 0BC1 OR EAX,ECX 00401C78 |. 33C3 XOR EAX,EBX 00401C7A |. 034424 50 ADD EAX,DWORD PTR SS:[ESP+50] 00401C7E |. 8D9402 A11108>LEA EDX,DWORD PTR DS:[EDX+EAX+4E0811A1] 00401C85 |. 8BC2 MOV EAX,EDX 00401C87 |. C1E0 15 SHL EAX,15 00401C8A |. C1EA 0B SHR EDX,0B 00401C8D |. 0BC2 OR EAX,EDX 00401C8F |. 8BD3 MOV EDX,EBX 00401C91 |. 03C1 ADD EAX,ECX 00401C93 |. F7D2 NOT EDX 00401C95 |. 0BD0 OR EDX,EAX 00401C97 |. 33D1 XOR EDX,ECX 00401C99 |. 035424 2C ADD EDX,DWORD PTR SS:[ESP+2C] 00401C9D |. 8DBC17 827E53>LEA EDI,DWORD PTR DS:[EDI+EDX+F7537E82] 00401CA4 |. 8BD7 MOV EDX,EDI 00401CA6 |. C1EA 1A SHR EDX,1A 00401CA9 |. C1E7 06 SHL EDI,6 00401CAC |. 0BD7 OR EDX,EDI 00401CAE |. 8BF9 MOV EDI,ECX 00401CB0 |. 03D0 ADD EDX,EAX 00401CB2 |. F7D7 NOT EDI 00401CB4 |. 0BFA OR EDI,EDX 00401CB6 |. 33F8 XOR EDI,EAX 00401CB8 |. 037C24 48 ADD EDI,DWORD PTR SS:[ESP+48] 00401CBC |. 8D9C3B 35F23A>LEA EBX,DWORD PTR DS:[EBX+EDI+BD3AF235] 00401CC3 |. 8BFB MOV EDI,EBX 00401CC5 |. C1EF 16 SHR EDI,16 00401CC8 |. C1E3 0A SHL EBX,0A 00401CCB |. 0BFB OR EDI,EBX 00401CCD |. 8BD8 MOV EBX,EAX 00401CCF |. 03FA ADD EDI,EDX 00401CD1 |. F7D3 NOT EBX 00401CD3 |. 0BDF OR EBX,EDI 00401CD5 |. 6A 40 PUSH 40 00401CD7 |. 33DA XOR EBX,EDX 00401CD9 |. 6A 00 PUSH 0 00401CDB |. 035C24 2C ADD EBX,DWORD PTR SS:[ESP+2C] 00401CDF |. 8D8C19 BBD2D7>LEA ECX,DWORD PTR DS:[ECX+EBX+2AD7D2BB] 00401CE6 |. 8BD9 MOV EBX,ECX 00401CE8 |. C1EB 11 SHR EBX,11 00401CEB |. C1E1 0F SHL ECX,0F 00401CEE |. 0BD9 OR EBX,ECX 00401CF0 |. 8BCA MOV ECX,EDX 00401CF2 |. 03DF ADD EBX,EDI 00401CF4 |. F7D1 NOT ECX 00401CF6 |. 0BCB OR ECX,EBX 00401CF8 |. 33CF XOR ECX,EDI 00401CFA |. 03CD ADD ECX,EBP 00401CFC |. 8B6E 08 MOV EBP,DWORD PTR DS:[ESI+8] 00401CFF |. 03EB ADD EBP,EBX 00401D01 |. 8D8408 91D386>LEA EAX,DWORD PTR DS:[EAX+ECX+EB86D391] 00401D08 |. 8B0E MOV ECX,DWORD PTR DS:[ESI] 00401D0A |. 03CA ADD ECX,EDX 00401D0C |. 8BD0 MOV EDX,EAX 00401D0E |. C1E2 15 SHL EDX,15 00401D11 |. C1E8 0B SHR EAX,0B 00401D14 |. 0BD0 OR EDX,EAX 00401D16 |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4] 00401D19 |. 03D3 ADD EDX,EBX 00401D1B |. 8B5E 0C MOV EBX,DWORD PTR DS:[ESI+C] 00401D1E |. 03C2 ADD EAX,EDX 00401D20 |. 03DF ADD EBX,EDI 00401D22 |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 00401D25 |. 8D4424 24 LEA EAX,DWORD PTR SS:[ESP+24] 00401D29 |. 50 PUSH EAX 00401D2A |. 890E MOV DWORD PTR DS:[ESI],ECX 00401D2C |. 896E 08 MOV DWORD PTR DS:[ESI+8],EBP 00401D2F |. 895E 0C MOV DWORD PTR DS:[ESI+C],EBX 00401D32 |. E8 D9000000 CALL MD5KeyGe.00401E10 00401D37 |. 83C4 18 ADD ESP,18 00401D3A |. 5F POP EDI 00401D3B |. 5E POP ESI 00401D3C |. 5D POP EBP 00401D3D |. 5B POP EBX 00401D3E |. 83C4 40 ADD ESP,40 00401D41 \. C3 RETN
下面为标准MD5在IDA的特征：
初始4个常数：
.text:004012B0 sub_4012B0 proc near ; CODE XREF: sub_4010A0+140p .text:004012B0 .text:004012B0 arg_0= dword ptr 4 .text:004012B0 .text:004012B0 8B 44 24 04 mov eax, [esp+arg_0] .text:004012B4 33 C9 xor ecx, ecx .text:004012B6 89 48 14 mov [eax+14h], ecx .text:004012B9 89 48 10 mov [eax+10h], ecx .text:004012BC C7 00 01 23 45 67 mov dword ptr [eax], 67452301h .text:004012C2 C7 40 04 89 AB CD EF mov dword ptr [eax+4], 0EFCDAB89h .text:004012C9 C7 40 08 FE DC BA 98 mov dword ptr [eax+8], 98BADCFEh .text:004012D0 C7 40 0C 76 54 32 10 mov dword ptr [eax+0Ch], 10325476h .text:004012D7 C3 retn .text:004012D7 sub_4012B0 endp
4轮hash运算(f5)：
int __cdecl sub_401400(int a1, int a2) { int v2; // esi@1 int b; // edi@1 int c; // ebx@1 int d; // ebp@1 unsigned int v6; // eax@1 unsigned int v7; // ebp@1 unsigned int v8; // ebx@1 int v9; // edx@1 unsigned int v10; // edi@1 int v11; // edi@1 unsigned int v12; // edi@1 unsigned int v13; // ebp@1 unsigned int v14; // edx@1 int v15; // ecx@1 unsigned int v16; // edx@1 int v17; // edx@1 unsigned int v18; // edx@1 unsigned int v19; // edi@1 unsigned int v20; // eax@1 unsigned int v21; // eax@1 unsigned int v22; // edx@1 int v23; // ecx@1 unsigned int v24; // edi@1 int v25; // edx@1 unsigned int v26; // eax@1 int v27; // edi@1 unsigned int v28; // eax@1 unsigned int v29; // ecx@1 unsigned int v30; // ebx@1 int v31; // eax@1 int v32; // ecx@1 unsigned int v33; // ecx@1 unsigned int v34; // edi@1 int v35; // edx@1 unsigned int v36; // eax@1 int v37; // edi@1 unsigned int v38; // ecx@1 int v39; // eax@1 unsigned int v40; // edx@1 int v41; // ecx@1 unsigned int v42; // edi@1 int v43; // edx@1 unsigned int v44; // eax@1 int v45; // edi@1 unsigned int v46; // ecx@1 int v47; // eax@1 unsigned int v48; // edx@1 int v49; // ecx@1 unsigned int v50; // edi@1 int v51; // edx@1 unsigned int v52; // eax@1 int v53; // edi@1 unsigned int v54; // eax@1 unsigned int v55; // ecx@1 int v56; // ebx@1 unsigned int v57; // edx@1 unsigned int v58; // edi@1 unsigned int v59; // eax@1 int v60; // ecx@1 unsigned int v61; // eax@1 unsigned int v62; // edx@1 int v63; // ebx@1 unsigned int v64; // edi@1 int v65; // edx@1 unsigned int v66; // ecx@1 unsigned int v67; // eax@1 unsigned int v68; // ebx@1 int v69; // edi@1 unsigned int v70; // edx@1 int v71; // ebx@1 unsigned int v72; // ecx@1 unsigned int v73; // eax@1 unsigned int v74; // edi@1 int v75; // edx@1 unsigned int v76; // ebx@1 int v77; // edi@1 unsigned int v78; // ecx@1 int v79; // ebx@1 unsigned int v80; // eax@1 int v81; // ecx@1 unsigned int v82; // edx@1 int v83; // eax@1 unsigned int v84; // edi@1 int v85; // edx@1 unsigned int v86; // ebx@1 int v87; // edi@1 unsigned int v88; // ecx@1 int v89; // ebx@1 unsigned int v90; // eax@1 int v91; // ecx@1 unsigned int v92; // edx@1 int v93; // eax@1 unsigned int v94; // edi@1 int v95; // edx@1 unsigned int v96; // ebx@1 int v97; // edi@1 unsigned int v98; // ecx@1 int v99; // ebx@1 unsigned int v100; // eax@1 int v101; // ecx@1 unsigned int v102; // edx@1 int v103; // eax@1 unsigned int v104; // edi@1 int v105; // edx@1 unsigned int v106; // ebx@1 int v107; // edi@1 unsigned int v108; // ecx@1 int v109; // ebx@1 int v110; // ebp@1 unsigned int v111; // eax@1 int v112; // ecx@1 int v113; // edx@1 int v114; // ebx@1 int v116; // [sp+10h] [bp-28955B78h]@1 int v117; // [sp+14h] [bp-28955B74h]@1 int v118; // [sp+18h] [bp-28955B70h]@1 int v119; // [sp+1Ch] [bp-28955B6Ch]@1 int v120; // [sp+20h] [bp-28955B68h]@1 int v121; // [sp+24h] [bp-28955B64h]@1 int v122; // [sp+28h] [bp-28955B60h]@1 int v123; // [sp+2Ch] [bp-28955B5Ch]@1 int v124; // [sp+30h] [bp-28955B58h]@1 int v125; // [sp+34h] [bp-28955B54h]@1 int v126; // [sp+38h] [bp-28955B50h]@1 int v127; // [sp+3Ch] [bp-28955B4Ch]@1 int v128; // [sp+40h] [bp-28955B48h]@1 int v129; // [sp+44h] [bp-28955B44h]@1 int v130; // [sp+48h] [bp-28955B40h]@1 int v131; // [sp+4Ch] [bp-28955B3Ch]@1 int a; // [sp+54h] [bp-28955B34h]@1 unsigned int v133; // [sp+54h] [bp-28955B34h]@1 unsigned int v134; // [sp+54h] [bp-28955B34h]@1 unsigned int v135; // [sp+54h] [bp-28955B34h]@1 unsigned int v136; // [sp+54h] [bp-28955B34h]@1 unsigned int v137; // [sp+54h] [bp-28955B34h]@1 unsigned int v138; // [sp+54h] [bp-28955B34h]@1 unsigned int v139; // [sp+54h] [bp-28955B34h]@1 v2 = a1; b = *(_DWORD *)(a1 + 4); c = *(_DWORD *)(a1 + 8); d = *(_DWORD *)(a1 + 12); a = *(_DWORD *)a1; sub_401DA0(&v116, a2, 64); v6 = b + (((a + v116 + (b & c | d & ~b) + 0xD76AA478) << 7) | ((a + v116 + (b & c | d & ~b) + 0xD76AA478u) >> 25)); //循环右移25位相当于左移7位 v7 = v6 + (((v117 + (v6 & b | c & ~v6) + d + 0xE8C7B756) << 12) | ((v117 + (v6 & b | c & ~v6) + d + 0xE8C7B756) >> 20)); v8 = c + v118 + (v6 & v7 | b & ~v7) - 0xDBDF8F25; v9 = v7 + ((v8 << 17) | (v8 >> 15)); v10 = v9 + (((b + v119 + (v9 & v7 | v6 & ~v9) + 0xC1BDCEEE) >> 10) | ((b + v119 + (v9 & v7 | v6 & ~v9) + 0xC1BDCEEE) << 22)); v133 = v10; v11 = v120 + (v10 & v9 | v7 & ~v10); v12 = v133 + (((v6 + v11 - 176418897) << 7) | ((v6 + v11 - 176418897) >> 25)); v13 = v12 + (((v7 + v121 + (v12 & v133 | v9 & ~v12) - 0xB87839D6) << 12) | ((v7 + v121 + (v12 & v133 | v9 & ~v12) - 0xB87839D6) >> 20)); v14 = v9 + v122 + (v12 & v13 | v133 & ~v13) - 1473231341; v15 = v13 + ((v14 << 17) | (v14 >> 15)); v16 = v15 + (((v133 + v123 + (v15 & v13 | v12 & ~v15) + 0xFD469501) >> 10) | ((v133 + v123 + (v15 & v13 | v12 & ~v15) + 0xFD469501) << 22)); v134 = v16; v17 = v124 + (v16 & v15 | v13 & ~v16); v18 = v134 + (((v12 + v17 - 0x967F6728) << 7) | ((v12 + v17 - 0x967F6728) >> 25)); v19 = v18 + (((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) << 12) | ((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) >> 20)); v20 = v126 + (v18 & (v18 + (((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) << 12) | ((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) >> 20))) | v134 & ~(v18 + (((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) << 12) | ((v13 + v125 + (v18 & v134 | v15 & ~v18) + 0x8B44F7AF) >> 20)))); v21 = v19 + (((v15 + v20 - 42063) << 17) | ((v15 + v20 - 42063) >> 15)); v135 = v21 + (((v134 + v127 + (v21 & v19 | v18 & ~v21) - 1990404162) >> 10) | ((v134 + v127 + (v21 & v19 | v18 & ~v21) - 1990404162) << 22)); v22 = v18 + v128 + (v135 & v21 | v19 & ~v135) + 1804603682; v23 = v135 + ((v22 << 7) | (v22 >> 25)); v24 = v19 + v129 + (v23 & v135 | v21 & ~v23) - 40341101; v25 = v23 + ((v24 << 12) | (v24 >> 20)); v26 = v21 + v130 + (~v25 & v135 | v23 & v25) - 1502002290; v27 = v25 + ((v26 << 17) | (v26 >> 15)); v28 = v27 + (((v135 + v131 + (v27 & v25 | v23 & ~v27) + 1236535329) >> 10) | ((v135 + v131 + (v27 & v25 | v23 & ~v27) + 1236535329) << 22)); v136 = v28; v29 = v23 + v117 + (~v25 & v27 | v28 & v25) - 165796510; v30 = v28; v31 = v28 + (32 * v29 | (v29 >> 27)); v32 = v122 + (v31 & v27 | v30 & ~v27); v33 = v31 + (((v25 + v32 - 1069501632) << 9) | ((unsigned int)(v25 + v32 - 1069501632) >> 23)); v34 = v27 + v127 + (v136 & v33 | v31 & ~v30) + 643717713; v35 = v33 + ((v34 << 14) | (v34 >> 18)); v137 = v35 + (((v136 + v116 + (v31 & v35 | v33 & ~v31) - 373897302) >> 12) | ((v136 + v116 + (v31 & v35 | v33 & ~v31) - 373897302) << 20)); v36 = v31 + v121 + (v137 & v33 | v35 & ~v33) - 701558691; v37 = v137 + (32 * v36 | (v36 >> 27)); v38 = v33 + v126 + (v37 & v35 | v137 & ~v35) + 38016083; v39 = v37 + ((v38 << 9) | (v38 >> 23)); v40 = v35 + v131 + (v137 & (v37 + ((v38 << 9) | (v38 >> 23))) | v37 & ~v137) - 660478335; v41 = v39 + ((v40 << 14) | (v40 >> 18)); v138 = v41 + (((v137 + v120 + (v37 & v41 | v39 & ~v37) - 405537848) >> 12) | ((v137 + v120 + (v37 & v41 | v39 & ~v37) - 405537848) << 20)); v42 = v37 + v125 + (v138 & v39 | v41 & ~v39) + 568446438; v43 = v138 + (32 * v42 | (v42 >> 27)); v44 = v39 + v130 + (v43 & v41 | v138 & ~v41) - 1019803690; v45 = v43 + ((v44 << 9) | (v44 >> 23)); v46 = v41 + v119 + (v138 & (v43 + ((v44 << 9) | (v44 >> 23))) | v43 & ~v138) - 187363961; v47 = v45 + ((v46 << 14) | (v46 >> 18)); v139 = v47 + (((v138 + v124 + (v43 & v47 | v45 & ~v43) + 1163531501) >> 12) | ((v138 + v124 + (v43 & v47 | v45 & ~v43) + 1163531501) << 20)); v48 = v43 + v129 + (v139 & v45 | v47 & ~v45) - 1444681467; v49 = v139 + (32 * v48 | (v48 >> 27)); v50 = v45 + v118 + (v49 & v47 | v139 & ~v47) - 51403784; v51 = v49 + ((v50 << 9) | (v50 >> 23)); v52 = v47 + v123 + (v139 & (v49 + ((v50 << 9) | (v50 >> 23))) | v49 & ~v139) + 1735328473; v53 = v51 + ((v52 << 14) | (v52 >> 18)); v54 = v53 + (((v139 + v128 + (v49 & v53 | v51 & ~v49) - 1926607734) >> 12) | ((v139 + v128 + (v49 & v53 | v51 & ~v49) - 1926607734) << 20)); v55 = v49 + v121 + (v54 ^ v53 ^ v51) - 378558; v56 = v54 + (16 * v55 | (v55 >> 28)); v57 = v56 + (((v51 + v124 + (v56 ^ v54 ^ v53) - 2022574463) << 11) | ((v51 + v124 + (v56 ^ v54 ^ v53) - 2022574463) >> 21)); v58 = v57 + (((v53 + v127 + (v56 ^ v54 ^ v57) + 1839030562) << 16) | ((v53 + v127 + (v56 ^ v54 ^ v57) + 1839030562) >> 16)); v59 = v54 + v130 + (v56 ^ v58 ^ v57) - 35309556; v60 = v58 + ((v59 >> 9) | (v59 << 23)); v61 = v60 + (16 * (v56 + v117 + (v60 ^ v58 ^ v57) - 1530992060) | ((v56 + v117 + (v60 ^ v58 ^ v57) - 1530992060) >> 28)); v62 = v57 + v120 + (v61 ^ v60 ^ v58) + 1272893353; v63 = v61 + ((v62 << 11) | (v62 >> 21)); v64 = v58 + v123 + (v61 ^ v60 ^ (v61 + ((v62 << 11) | (v62 >> 21)))) - 155497632; v65 = v63 + ((v64 << 16) | (v64 >> 16)); v66 = v65 + (((v60 + v126 + (v61 ^ v65 ^ v63) - 1094730640) >> 9) | ((v60 + v126 + (v61 ^ v65 ^ v63) - 1094730640) << 23)); v67 = v66 + (16 * (v61 + v129 + (v66 ^ v65 ^ v63) + 681279174) | ((v61 + v129 + (v66 ^ v65 ^ v63) + 681279174) >> 28)); v68 = v63 + v116 + (v67 ^ v66 ^ v65) - 358537222; v69 = v67 + ((v68 << 11) | (v68 >> 21)); v70 = v65 + v119 + (v67 ^ v66 ^ (v67 + ((v68 << 11) | (v68 >> 21)))) - 722521979; v71 = v69 + ((v70 << 16) | (v70 >> 16)); v72 = v71 + (((v66 + v122 + (v67 ^ v71 ^ v69) + 76029189) >> 9) | ((v66 + v122 + (v67 ^ v71 ^ v69) + 76029189) << 23)); v73 = v72 + (16 * (v67 + v125 + (v72 ^ v71 ^ v69) - 640364487) | ((v67 + v125 + (v72 ^ v71 ^ v69) - 640364487) >> 28)); v74 = v69 + v128 + (v73 ^ v72 ^ v71) - 421815835; v75 = v73 + ((v74 << 11) | (v74 >> 21)); v76 = v71 + v131 + (v73 ^ v72 ^ (v73 + ((v74 << 11) | (v74 >> 21)))) + 530742520; v77 = v75 + ((v76 << 16) | (v76 >> 16)); v78 = v72 + v118 + (v73 ^ v77 ^ v75) - 995338651; v79 = v77 + ((v78 >> 9) | (v78 << 23)); v80 = v73 + v116 + (v77 ^ (v79 | ~v75)) - 198630844; v81 = v79 + ((v80 << 6) | (v80 >> 26)); v82 = v75 + v123 + (v79 ^ (v81 | ~v77)) + 1126891415; v83 = v81 + ((v82 << 10) | (v82 >> 22)); v84 = v77 + v130 + (v81 ^ (v83 | ~v79)) - 1416354905; v85 = v83 + ((v84 << 15) | (v84 >> 17)); v86 = v79 + v121 + (v83 ^ (v85 | ~v81)) - 57434055; v87 = v85 + ((v86 >> 11) | (v86 << 21)); v88 = v81 + v128 + (v85 ^ (v87 | ~v83)) + 1700485571; v89 = v87 + ((v88 << 6) | (v88 >> 26)); v90 = v83 + v119 + (v87 ^ (v89 | ~v85)) - 1894986606; v91 = v89 + ((v90 << 10) | (v90 >> 22)); v92 = v85 + v126 + (v89 ^ (v91 | ~v87)) - 1051523; v93 = v91 + ((v92 << 15) | (v92 >> 17)); v94 = v87 + v117 + (v91 ^ (v93 | ~v89)) - 2054922799; v95 = v93 + ((v94 >> 11) | (v94 << 21)); v96 = v89 + v124 + (v93 ^ (v95 | ~v91)) + 1873313359; v97 = v95 + ((v96 << 6) | (v96 >> 26)); v98 = v91 + v131 + (v95 ^ (v97 | ~v93)) - 30611744; v99 = v97 + ((v98 << 10) | (v98 >> 22)); v100 = v93 + v122 + (v97 ^ (v99 | ~v95)) - 1560198380; v101 = v99 + ((v100 << 15) | (v100 >> 17)); v102 = v95 + v129 + (v99 ^ (v101 | ~v97)) + 1309151649; v103 = v101 + ((v102 >> 11) | (v102 << 21)); v104 = v97 + v120 + (v101 ^ (v103 | ~v99)) - 145523070; v105 = v103 + ((v104 << 6) | (v104 >> 26)); v106 = v99 + v127 + (v103 ^ (v105 | ~v101)) - 1120210379; v107 = v105 + ((v106 << 10) | (v106 >> 22)); v108 = v101 + v118 + (v105 ^ (v107 | ~v103)) + 718787259; v109 = v107 + ((v108 << 15) | (v108 >> 17)); v110 = v109 + *(_DWORD *)(v2 + 8); v111 = v103 + v125 + (v107 ^ (v109 | ~v105)) - 343485551; v112 = v105 + *(_DWORD *)v2; v113 = v109 + ((v111 >> 11) | (v111 << 21)); v114 = v107 + *(_DWORD *)(v2 + 12); *(_DWORD *)(v2 + 4) += v113; *(_DWORD *)v2 = v112; *(_DWORD *)(v2 + 8) = v110; *(_DWORD *)(v2 + 12) = v114; return sub_401E10(&v116, 0, 64); }
标签：
原文地址：http://www.cnblogs.com/dacainiao/p/5537356.html
