Resolves all the NetWalker ransomware imports and shows the actual function names when they are called

netwalker_import_resolver.py

import zlib
import idc
import idautils
import idaapi

RESOLVE_IMPORTS = 0x00C512A6
GET_IMPORT_TABLE = 0x00C52400

rainbow_table = {}
imports = []

def generate_rainbow_table():
    with open('imports.txt', 'r') as f:
        functions = reduce(lambda x, y: x + y, [line.split(', ') for line in f.readlines()])

        for function in functions:
            rainbow_table[zlib.crc32(function) & 0xffffffff] = function

def generate_imports_list():
    func = idaapi.get_func(RESOLVE_IMPORTS)

    ea = RESOLVE_IMPORTS
    end = func.endEA

    latest_values = [0, 0]

    while ea < end:
        m = idc.print_insn_mnem(ea)

        if m == 'push':
            op_type = idc.get_operand_type(ea, 0)

            if op_type == o_imm:
                latest_values[0] = latest_values[1]
                latest_values[1] = idc.get_operand_value(ea, 0) & 0xffffffff

        if m == 'mov':
            op_0_type = idc.get_operand_type(ea, 0)
            op_1_val = idc.print_operand(ea, 1)

            if op_0_type == o_displ and op_1_val == 'eax':
                offset = idc.get_operand_value(ea, 0)

                try:
                    imports.append({
                        'offset': offset,
                        'function': rainbow_table[latest_values[0]]
                    })
                except:
                    pass

        ea = idc.next_head(ea, end)

def get_import(offset):
    try:
        return [import_ for import_ in imports if import_['offset'] == offset][0]['function']
    except:
        return ''

def update_imports():
    get_import_table_ea = idc.get_name_ea_simple('get_import_table')
    xrefs = idautils.CodeRefsTo(get_import_table_ea, 0)

    for ea in xrefs:
        offset = 0
        register = None

        while True:
            m = idc.print_insn_mnem(ea)

            if m == 'mov':
                op_0_type = idc.get_operand_type(ea, 0)

                op_1_type = idc.get_operand_type(ea, 1)
                op_1_raw = idc.print_operand(ea, 1)

                if op_0_type == o_reg and op_1_type == o_displ and 'eax' in op_1_raw:
                    register = idc.get_operand_value(ea, 0)
                    offset = idc.get_operand_value(ea, 1)

            if m == 'call':
                op_type = idc.get_operand_type(ea, 0)
                op_val = idc.get_operand_value(ea, 0)

                if op_type == o_reg and op_val == register:
                    idc.set_cmt(ea, get_import(offset), 0)

                    break

            ea = idc.next_head(ea)

def main():
    generate_rainbow_table()

    generate_imports_list()
    update_imports()

if __name__ == '__main__':
    main()