DECOMPILER & IR STUDIOGHIDRA P-CODE ENGINE v11.1AST RECONSTRUCTION

Tri-Pane Synchronized C Decompiler & P-Code Micro-IR

Synchronized 3-way bytecode analysis: Machine Disassembly (x86/x64), Ghidra P-Code Intermediate Representation, and Reconstructed C Pseudocode.

Target Routine: BOOL __cdecl CheckKillswitchAndExecute(LPCSTR szUrl, LPCSTR szMutex)

Pane 1: Assembly (x86/x64)

28 instructions

0x0040810055pushebp
0x0040810189 E5movebp, esp
0x0040810383 EC 20subesp, 0x20
0x0040810690nop
0x004081078B 45 08moveax, [ebp+0x8]
0x0040810A6A 00push0
0x0040810C6A 00push0
0x0040810E50pusheax
0x0040810F6A 00push0
0x00408111E8 52 1A 00 00callInternetOpenUrlA
0x0040811689 45 FCmov[ebp-0x4], eax
0x0040811985 C0testeax, eax
0x0040811B74 0Fjz0x0040812C
0x0040811D8B 4D FCmovecx, [ebp-0x4]
0x0040812051pushecx
0x00408121E8 64 1A 00 00callInternetCloseHandle
0x0040812631 C0xoreax, eax
0x0040812889 ECmovesp, ebp
0x0040812A5Dpopebp
0x0040812BC3ret
0x0040812C68 A0 94 40 00pushoffset szMutex
0x004081316A 00push0
0x004081336A 00push0
0x00408135E8 B2 1B 00 00callCreateMutexA
0x0040813AE8 00 12 00 00callStartEncryptionEngine
0x0040813FB8 01 00 00 00moveax, 1
0x00408144C9leave
0x00408145C3ret

Pane 2: Ghidra P-Code IR

Micro-Ops

0x00408100STORE(ram, ESP - 4, 4), (register, EBP, 4)
> Pushes 32-bit EBP onto stack memory
0x00408101COPY(register, EBP, 4) =(register, ESP, 4)
> Copies current stack top into base pointer
0x00408103INT_SUB(register, ESP, 4) =(register, ESP, 4), (const, 0x20, 4)
> Decrements ESP by 32 bytes for stack variables
0x00408106INT_ADD(unique, 0x10, 4) =(const, 0, 4), (const, 0, 4)
> Opaque NOP operation (Dead Code eliminated)
0x00408107LOAD(unique, 0x20, 4) =(ram, EBP + 0x8, 4)
> Loads 32-bit pointer szUrl from stack arg
0x00408111CALLOTHER(register, EAX, 4) =InternetOpenUrlA, (unique, 0x20, 4), (const, 0, 4)
> Invokes WININET imported API probe
0x00408116STORE(ram, EBP - 0x4, 4), (register, EAX, 4)
> Saves return handle into local_4 (hUrl)
0x00408119INT_EQUAL(unique, 0x30, 1) =(register, EAX, 4), (const, 0x0, 4)
> Evaluates zero flag condition (hUrl == NULL)
0x0040811BCBRANCH(ram, 0x0040812C, 4), (unique, 0x30, 1)
> Conditional jump: branches to detonation if domain probe fails
0x00408121CALLOTHERInternetCloseHandle, (ram, EBP - 0x4, 4)
> Closes active HTTP session handle
0x00408126COPY(register, EAX, 4) =(const, 0x0, 4)
> Sets function return value to FALSE
0x0040812BRETURN(register, EAX, 4)
> Returns control to parent CRT harness
0x00408135CALLOTHER(register, EAX, 4) =CreateMutexA, (const, 0, 4), (const, 0, 4), (ram, szMutex, 4)
> Creates mutex to prevent duplicate infection
0x0040813ACALLStartEncryptionEngine
> Transfers execution to AES-128 cryptographic worker loop
0x0040813FCOPY(register, EAX, 4) =(const, 0x1, 4)
> Sets function return value to TRUE
0x00408145RETURN(register, EAX, 4)
> Returns TRUE to caller

Pane 3: Reconstructed C Pseudocode

AST Engine

01BOOL CheckKillswitchAndExecute(LPCSTR szUrl, LPCSTR szMutex) {
  HINTERNET hUrl = NULL;
  HANDLE hMutex = NULL;
  /* Junk anti-disassembly padding */
  __asm { nop }
  hUrl = InternetOpenUrlA(NULL, szUrl, NULL, 0, 0, 0);
  if (hUrl != NULL) {
      // Sinkhole / Live domain detected -> Neutralize payload
      InternetCloseHandle(hUrl);
      return FALSE;
  }
  // Killswitch query failed: Proceed with infection
  hMutex = CreateMutexA(NULL, FALSE, szMutex);
  StartEncryptionEngine();
  return TRUE;
16}

Variable Type Propagation & Stack Frame Symbols

Type Inference

Rename auto-generated decompilation symbols (e.g. local_4) to semantic malware reverse engineering descriptors. Edits reflect dynamically in Pane 3.

Symbol / Stack Offset	Raw Type	Inferred Type	Description
local_4 [EBP - 0x04]	undefined4	HINTERNET	Handle to remote HTTP request object
szUrl [EBP + 0x08]	char*	LPCSTR	Sinkhole domain URL pointer
szMutex [EBP + 0x0C]	char*	LPCSTR	Global named mutex string

AI Copilot Subroutine Reverse Engineering Analysis

LLM RE REASONING

Purpose & Objective:

Hardcoded Web Killswitch Check and Ransomware Detonation Gate

The subroutine attempts an HTTP GET connection to an unresolvable domain. If the domain responds (e.g., sinkholed by malware researchers), the malware immediately terminates execution without encrypting files. If the connection fails (normal uninfected network), it acquires an infection mutex and fires the multithreaded AES encryption pipeline.

Detected Anti-Analysis Evasions:

Sinkhole-sensitive logic (inversion of normal C2 behavior)
Global Named Mutex check to prevent self-collision
Direct WinInet API resolution

MITRE ATT&CK Mapping:

TA0005: Defense EvasionTA0011: Command & ControlTA0040: Impact

Dynamic Binary Patching Strategy:

Patch the JZ instruction at 0x0040811B with NOPs or invert to JNZ (75 0F) to force the binary to treat every network state as a sinkhole hit, halting detonation permanently.