STAGE 5: DYNAMIC DEBUGGING & REVERSING

x32dbg Dynamic Debugger Engine

Interactive single-step debugging, live register and memory dump inspection, breakpoint control, and real-time binary patching (NOPing anti-debug checks & inverting conditional branches).

Status:PAUSED (EIP: 0x00408100)

Breakpoints: 1 active

Address

Opcodes

Mnemonic

Operands

Comments & States

0x00408100
55
push
ebp
; Save EBP
0x00408101
89 E5
mov
ebp, esp
; Init frame
0x00408103
83 EC 28
sub
esp, 0x28
; Local stack alloc
0x00408106
68 80 92 40 00
push
offset szKillswitchUrl
; Push domain URL
0x0040810B
E8 40 12 00 00
call
InternetOpenUrlA
; Probe killswitch
0x00408110
85 C0
test
eax, eax
; Check return code
0x00408112
75 32
jnz
0x00408146
; Jump if domain exists
0x00408114
68 A0 94 40 00
push
offset szMutexName
; Push mutex name
0x00408119
6A 00
push
0
; bInitialOwner = 0
0x0040811B
E8 22 14 00 00
call
CreateMutexA
; Mutex check
0x00408120
68 C0 96 40 00
push
offset szCmdShadowWipe
; 'vssadmin wipe'
0x00408125
E8 88 15 00 00
call
WinExec
; Wipe shadow copies
0x0040812A
E8 50 17 00 00
call
StartEncryptionThreads
; Launch ransomware payload

Dump 1 - Virtual Memory Window (0x00408100 - 0x00408150)

PAGE_EXECUTE_READ

0x0040810055 89 E5 83 EC 28 68 80 92 40 00 E8 40 12 00 00|U..ì(h..@..@....|

0x0040811085 C0 75 32 68 A0 94 40 00 6A 00 E8 22 14 00 00|.Àu2h..@.j.."...|

0x0040812068 C0 96 40 00 6A 00 E8 88 15 00 00 E8 10 16 00|h..@.j..........|

0x0040813000 E8 50 17 00 00 89 EC 5D C3 6A 00 E8 B0 18 00|..P...ì]Ãj..°..|

0x0040814000 00 00 00 00 00 6A 00 E8 4A 19 00 00 C3 90 90|......j..J...Ã..|

Live CPU Registers

FPU / SSE Idle

EAX
0x00000000
EBX
0x00400000
ECX
0x0019FE20
EDX
0x7FFE0300
ESI
0x00408100
EDI
0x00000001
EBP
0x0019FE58
ESP
0x0019FE30
EIP
0x00408100

EFLAGS Condition Bits

Debugger Event Stream

Debugger attached to process PID 3412 (WannaCry.exe)

Loaded symbols: ntdll.dll, kernel32.dll, wininet.dll

Entry breakpoint hit at 0x00408100