Static analysis: function map
Image base 0x140000000. Names are Ghidra defaults; roles were established in this case.
API call sites per behaviour: 09-api-behaviour-map.md.
The full function list is in artifacts/ghidra/function_list.txt.
| Address | Role |
|---|---|
0x1400855b8 |
PE entry (CRT) |
0x14004ca40 |
main: logging, CLI parse, drive list, pre-encryption steps, crypto init, thread pools, timing |
0x14004c6f0 |
spdlog file_logger set-up (Log-….txt) |
0x140053d70 |
argh-style argv parser |
0x1400766e0 |
drive enumeration (first five drives only) |
0x140042c50 |
target classifier: local disk / network disk / network path / not allowed |
0x140041fc0 |
share-file reader |
0x14006ecf0 |
adds .akira / .arika to the skip set |
0x140070c30 |
protected-PID snapshot (WTSEnumerateProcessesW) |
0x140071d80, 0x140071620 |
shadow-copy command decode; WMI Win32_Process.Create executor |
0x140070e30 |
Restart Manager unlock / force shutdown |
0x1400737d0, 0x140073950 |
thread-pool creation; root-folder queue (dynamic gate) |
0x1400b5fb0, 0x1400b81d0 |
folder-parser coroutines (exclusions, note drop, mode flags, enqueue) |
0x140042420 |
ransom-note writer |
0x140074480 |
enqueue a per-file encryption task |
0x1400ae840 |
per-file coroutine: open, cipher init, journal, mode dispatch, footer, rename |
0x1400adb00 |
.arika journal creation (532-byte header) |
0x1400b23a0 / 0x1400b3580 / 0x1400b4780 |
Full / Spot / Part encryption loops |
0x1400b5a20 |
512-byte footer writer |
0x140036740 |
per-file key generation and RSA wrap of the 91-byte blob |
0x14007b1f0 |
per-value Yarrow-256 instance seeded from QPC |
0x1400822c0 |
Yarrow seed routine (seed-string breakpoint in the dynamic runs) |
0x14007b0b0, 0x14007c570, 0x14007beb0 |
ChaCha init / key setup / 8-round block function |
0x14007b4e0, 0x14007c690, 0x14007c9c0, 0x14007c8a0 |
KCipher-2 init / key schedule / update / keystream XOR |
0x14007ba90, 0x140081ac0, 0x14007b8d0 |
RSA public-key import (DER) and PKCS#1 v1.5 encrypt |
0x14007bbe0 |
RSA context’s own QPC-seeded Yarrow (padding) |
0x140078dd4, 0x140078df0 |
QueryPerformanceCounter / QueryPerformanceFrequency wrappers (steady clock); the QPC wrapper is called by FUN_14007b1f0, FUN_14007bbe0, FUN_1400ae840 and main |
0x1400407e0, 0x1400405b0 |
asio overlapped ReadFile / WriteFile wrappers (in-place encryption I/O) |
0x1400385d0, 0x140038900, 0x140038e60 |
asio IOCP scheduler (CreateIoCompletionPort, Get/PostQueuedCompletionStatus) |
0x140036580 |
asio win_thread::join (the only TerminateThread call; library code) |
0x1400789d8, 0x140078998, 0x140078a4c |
STL std::filesystem directory-iterator helpers (FindFirstFileExW / FindNextFileW) |
0x14003f880 |
async read helper (conditional read-offset breakpoint, run 2) |
0x1400397a0 |
async write-at-offset helper (footer-write breakpoint, run 2) |
0x140003680, 0x140034500, 0x1400018a0, 0x140001ac0 |
static initializers: DB-extension, VM-extension, folder and extension sets |