the last byte of API/library call instructions is always 0x0A
It's because calls needs to have method (ref) as a parameter and methods are defined in the table that has an id of 0x0A.
Having bytes of the call like this 280600000A let's go one by one.
0x28 - is the value for opcode 'call' and it takes one operand.
the rest of the opcode is the metadata ...
Nobody is going to publish their source code for active ransomware, there are various reasons for that:
Its a business and the author makes money from it, and by giving away the source code there is a competitor. Of course that is not wanted
It is possible that someone will find weaknesses, obviously that is possible for binaries aswell but usually it's ...