I downloaded wannacry sample here: https://github.com/fadyosman/WannaCrySample/releases. Don't forget to enter password for archive.
I figured out how most of the binary works, except the very last part in WinMain located at 401FE7. I have the problem with reversing where if-block starts at 004020FE, there's a lot of gibberish code following. Wannacry calls the function at 4020F5 which loads ADVAPI32.dll and KERNEL32.dll and gets function handles. Instruction at 402112 calls the function which prepares the decryption key to be used further. Before it wannacry unpacks an archive with several files. 40212D calls function which decrypts t.wnry and stores contents somewhere in process space. This is all I know for sure except unnecessary details. So I have a few questions:
- When program calls 4012FD function at 402104, what does this function do? The main body doesn't have meaningful code. There are several functions nested in it which call InitializeCriticalSection().
- There are 2 functions located at 4021BD and 402924. The first one calls another functions with arguments referring to functions like VirtualAlloc, VirtualFree, LoadLibrary, etc. 402924 just contains some magic code. I realize this is where wannacry launcher transmits execution to another process, I just want to know the mechanism how it does in general.
- Btw wannacry loads several functions from KERNEL32.dll which it already had, why does it load them again?