rendered paste body10001027 >/$ 55 PUSH EBP
10001028 |. 8BEC MOV EBP,ESP
1000102A |. 83C4 FC ADD ESP,-4
1000102D |. 60 PUSHAD
1000102E |. 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
10001031 |. 0FB706 MOVZX EAX,WORD PTR DS:[ESI]
10001034 |. 83E8 02 SUB EAX,2
10001037 |. 66:8945 FE MOV WORD PTR SS:[EBP-2],AX
1000103B |. 83C6 02 ADD ESI,2
1000103E |. 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C]
10001041 |. EB 41 JMP SHORT rosecryp.10001084
10001043 |> 8B07 /MOV EAX,DWORD PTR DS:[EDI]
10001045 |. 8B5F 04 |MOV EBX,DWORD PTR DS:[EDI+4]
10001048 |. 40 |INC EAX
10001049 |. 25 FF000000 |AND EAX,0FF
1000104E |. 0FB64C38 08 |MOVZX ECX,BYTE PTR DS:[EAX+EDI+8]
10001053 |. 03D9 |ADD EBX,ECX
10001055 |. 81E3 FF000000 |AND EBX,0FF
1000105B |. 0FB6543B 08 |MOVZX EDX,BYTE PTR DS:[EBX+EDI+8]
10001060 |. 8907 |MOV DWORD PTR DS:[EDI],EAX
10001062 |. 895F 04 |MOV DWORD PTR DS:[EDI+4],EBX
10001065 |. 884C3B 08 |MOV BYTE PTR DS:[EBX+EDI+8],CL
10001069 |. 885438 08 |MOV BYTE PTR DS:[EAX+EDI+8],DL
1000106D |. 03D1 |ADD EDX,ECX
1000106F |. 81E2 FF000000 |AND EDX,0FF
10001075 |. 8A443A 08 |MOV AL,BYTE PTR DS:[EDX+EDI+8]
10001079 |. 8A1E |MOV BL,BYTE PTR DS:[ESI]
1000107B |. 32C3 |XOR AL,BL
1000107D |. 8806 |MOV BYTE PTR DS:[ESI],AL
1000107F |. 46 |INC ESI
10001080 |. 66:FF4D FE |DEC WORD PTR SS:[EBP-2]
10001084 |> 66:837D FE 00 CMP WORD PTR SS:[EBP-2],0
10001089 |.^75 B8 \JNZ SHORT rosecryp.10001043
1000108B |. 61 POPAD
1000108C |. C9 LEAVE
1000108D \. C2 0800 RETN 8
10001090 >/$ 55 PUSH EBP
10001091 |. 8BEC MOV EBP,ESP
10001093 |. 83C4 F4 ADD ESP,-0C
10001096 |. 60 PUSHAD
10001097 |. C745 F8 400000>MOV DWORD PTR SS:[EBP-8],40
1000109E |. 33C0 XOR EAX,EAX
100010A0 |. 8845 FF MOV BYTE PTR SS:[EBP-1],AL
100010A3 |. 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
100010A6 |. 8BFE MOV EDI,ESI
100010A8 |. 83C7 09 ADD EDI,9
100010AB |. 8906 MOV DWORD PTR DS:[ESI],EAX
100010AD |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX
100010B0 |. EB 05 JMP SHORT rosecryp.100010B7
100010B2 |> 884430 08 /MOV BYTE PTR DS:[EAX+ESI+8],AL
100010B6 |. 40 |INC EAX
100010B7 |> 3D 00010000 CMP EAX,100
100010BC |.^75 F4 \JNZ SHORT rosecryp.100010B2
100010BE |. 33DB XOR EBX,EBX
100010C0 |. EB 46 JMP SHORT rosecryp.10001108
100010C2 |> 33C9 /XOR ECX,ECX
100010C4 |. 49 |DEC ECX
100010C5 |> 8A1439 |/MOV DL,BYTE PTR DS:[ECX+EDI]
100010C8 |. 8855 F7 ||MOV BYTE PTR SS:[EBP-9],DL
100010CB |. 8B45 0C ||MOV EAX,DWORD PTR SS:[EBP+C]
100010CE |. 03C3 ||ADD EAX,EBX
100010D0 |. 43 ||INC EBX
100010D1 |. 0FB610 ||MOVZX EDX,BYTE PTR DS:[EAX]
100010D4 |. 0255 F7 ||ADD DL,BYTE PTR SS:[EBP-9]
100010D7 |. 0255 FF ||ADD DL,BYTE PTR SS:[EBP-1]
100010DA |. 81E2 FF000000 ||AND EDX,0FF
100010E0 |. 8855 FF ||MOV BYTE PTR SS:[EBP-1],DL
100010E3 |. 8A4432 08 ||MOV AL,BYTE PTR DS:[EDX+ESI+8]
100010E7 |. 50 ||PUSH EAX
100010E8 |. 8A45 F7 ||MOV AL,BYTE PTR SS:[EBP-9]
100010EB |. 884432 08 ||MOV BYTE PTR DS:[EDX+ESI+8],AL
100010EF |. 58 ||POP EAX
100010F0 |. 880439 ||MOV BYTE PTR DS:[ECX+EDI],AL
100010F3 |. 8B45 10 ||MOV EAX,DWORD PTR SS:[EBP+10]
100010F6 |. 3BD8 ||CMP EBX,EAX
100010F8 |. 72 02 ||JB SHORT rosecryp.100010FC
100010FA |. 33DB ||XOR EBX,EBX
100010FC |> 41 ||INC ECX
100010FD |. 83F9 03 ||CMP ECX,3
10001100 |.^75 C3 |\JNZ SHORT rosecryp.100010C5
10001102 |. 83C7 04 |ADD EDI,4
10001105 |. FF4D F8 |DEC DWORD PTR SS:[EBP-8]
10001108 |> 837D F8 00 CMP DWORD PTR SS:[EBP-8],0
1000110C |.^75 B4 \JNZ SHORT rosecryp.100010C2
1000110E |. 61 POPAD
1000110F |. C9 LEAVE
10001110 \. C2 0C00 RETN 0C
10001113 >/$ 55 PUSH EBP
10001114 |. 8BEC MOV EBP,ESP
10001116 |. 81C4 F0FDFFFF ADD ESP,-210
1000111C |. 60 PUSHAD
1000111D |. 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
10001120 |. 0BF6 OR ESI,ESI
10001122 |. 75 06 JNZ SHORT rosecryp.1000112A
10001124 |. 8D35 21300010 LEA ESI,DWORD PTR DS:[10003021]
1000112A |> 6A 00 PUSH 0 ; /hTemplateFile = NULL
1000112C |. 68 80000000 PUSH 80 ; |Attributes = NORMAL
10001131 |. 6A 03 PUSH 3 ; |Mode = OPEN_EXISTING
10001133 |. 6A 00 PUSH 0 ; |pSecurity = NULL
10001135 |. 6A 00 PUSH 0 ; |ShareMode = 0
10001137 |. 68 00000080 PUSH 80000000 ; |Access = GENERIC_READ
1000113C |. 56 PUSH ESI ; |FileName
1000113D |. E8 40010000 CALL <JMP.&kernel32.CreateFileA> ; \CreateFileA
10001142 |. 83F8 FF CMP EAX,-1
10001145 |. 75 07 JNZ SHORT rosecryp.1000114E
10001147 |. 61 POPAD
10001148 |. 33C0 XOR EAX,EAX
1000114A |. C9 LEAVE
1000114B |. C2 0800 RETN 8
1000114E |> 8985 FCFDFFFF MOV DWORD PTR SS:[EBP-204],EAX
10001154 |. 6A 02 PUSH 2 ; /Origin = FILE_END
10001156 |. 6A 00 PUSH 0 ; |pOffsetHi = NULL
10001158 |. 68 00FEFFFF PUSH -200 ; |OffsetLo = FFFFFE00 (-512.)
1000115D |. 50 PUSH EAX ; |hFile
1000115E |. E8 43010000 CALL <JMP.&kernel32.SetFilePointer> ; \SetFilePointer
10001163 |. 6A 00 PUSH 0 ; /pOverlapped = NULL
10001165 |. 8D85 F8FDFFFF LEA EAX,DWORD PTR SS:[EBP-208] ; |
1000116B |. 50 PUSH EAX ; |pBytesRead
1000116C |. 68 00020000 PUSH 200 ; |BytesToRead = 200 (512.)
10001171 |. 8D85 00FEFFFF LEA EAX,DWORD PTR SS:[EBP-200] ; |
10001177 |. 50 PUSH EAX ; |Buffer
10001178 |. FFB5 FCFDFFFF PUSH DWORD PTR SS:[EBP-204] ; |hFile
1000117E |. E8 1D010000 CALL <JMP.&kernel32.ReadFile> ; \ReadFile
10001183 |. 81BD F8FDFFFF >CMP DWORD PTR SS:[EBP-208],200
1000118D |. 74 07 JE SHORT rosecryp.10001196
1000118F |. 61 POPAD
10001190 |. 33C0 XOR EAX,EAX
10001192 |. C9 LEAVE
10001193 |. C2 0800 RETN 8
10001196 |> 8D8D 0FFEFFFF LEA ECX,DWORD PTR SS:[EBP-1F1]
1000119C |. 0FB609 MOVZX ECX,BYTE PTR DS:[ECX]
1000119F |. 888D F7FDFFFF MOV BYTE PTR SS:[EBP-209],CL
100011A5 |. E8 E4000000 CALL <JMP.&kernel32.GetProcessHeap> ; [GetProcessHeap
100011AA |. 51 PUSH ECX ; /HeapSize
100011AB |. 6A 00 PUSH 0 ; |Flags = 0
100011AD |. 50 PUSH EAX ; |hHeap
100011AE |. E8 E1000000 CALL <JMP.&kernel32.HeapAlloc> ; \HeapAlloc
100011B3 |. 8D7D 8A LEA EDI,DWORD PTR SS:[EBP-76]
100011B6 |. 8D35 0F300010 LEA ESI,DWORD PTR DS:[1000300F]
100011BC |. 33C9 XOR ECX,ECX
100011BE |. EB 0C JMP SHORT rosecryp.100011CC
100011C0 |> 8A1E /MOV BL,BYTE PTR DS:[ESI]
100011C2 |. 8A17 |MOV DL,BYTE PTR DS:[EDI]
100011C4 |. 32DA |XOR BL,DL
100011C6 |. 881C01 |MOV BYTE PTR DS:[ECX+EAX],BL
100011C9 |. 46 |INC ESI
100011CA |. 47 |INC EDI
100011CB |. 41 |INC ECX
100011CC |> 3A8D F7FDFFFF CMP CL,BYTE PTR SS:[EBP-209]
100011D2 |.^72 EC \JB SHORT rosecryp.100011C0
100011D4 |. C60401 00 MOV BYTE PTR DS:[ECX+EAX],0
100011D8 |. 50 PUSH EAX
100011D9 |. 50 PUSH EAX
100011DA |. E8 60000000 CALL rosecryp.1000123F
100011DF |. 8985 F0FDFFFF MOV DWORD PTR SS:[EBP-210],EAX
100011E5 |. 59 POP ECX
100011E6 |. E8 A3000000 CALL <JMP.&kernel32.GetProcessHeap> ; [GetProcessHeap
100011EB |. 51 PUSH ECX ; /pMemory
100011EC |. 6A 00 PUSH 0 ; |Flags = 0
100011EE |. 50 PUSH EAX ; |hHeap
100011EF |. E8 A6000000 CALL <JMP.&kernel32.HeapFree> ; \HeapFree
100011F4 |. 8DB5 87FEFFFF LEA ESI,DWORD PTR SS:[EBP-179]
100011FA |. 8D3D 00300010 LEA EDI,DWORD PTR DS:[10003000]
10001200 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
10001203 |. 33C9 XOR ECX,ECX
10001205 |. 33D2 XOR EDX,EDX
10001207 |. EB 15 JMP SHORT rosecryp.1000121E
10001209 |> 0FB61E /MOVZX EBX,BYTE PTR DS:[ESI]
1000120C |. 321C3A |XOR BL,BYTE PTR DS:[EDX+EDI]
1000120F |. 8818 |MOV BYTE PTR DS:[EAX],BL
10001211 |. 40 |INC EAX
10001212 |. 41 |INC ECX
10001213 |. 46 |INC ESI
10001214 |. 83FA 0E |CMP EDX,0E
10001217 |. 75 04 |JNZ SHORT rosecryp.1000121D
10001219 |. 33D2 |XOR EDX,EDX
1000121B |. EB 01 |JMP SHORT rosecryp.1000121E
1000121D |> 42 |INC EDX
1000121E |> 3B8D F0FDFFFF CMP ECX,DWORD PTR SS:[EBP-210]
10001224 |.^72 E3 \JB SHORT rosecryp.10001209
10001226 |. C600 00 MOV BYTE PTR DS:[EAX],0
10001229 |. FFB5 FCFDFFFF PUSH DWORD PTR SS:[EBP-204] ; /hObject
1000122F |. E8 48000000 CALL <JMP.&kernel32.CloseHandle> ; \CloseHandle
10001234 |. 61 POPAD
10001235 |. 8B85 F0FDFFFF MOV EAX,DWORD PTR SS:[EBP-210]
1000123B |. C9 LEAVE
1000123C \. C2 0800 RETN 8
1000123F /$ 55 PUSH EBP
10001240 |. 8BEC MOV EBP,ESP
10001242 |. 33C0 XOR EAX,EAX
10001244 |. BA 01000000 MOV EDX,1
10001249 |. 8BDA MOV EBX,EDX
1000124B |. 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
1000124E |. 803E 00 CMP BYTE PTR DS:[ESI],0
10001251 |. 75 06 JNZ SHORT rosecryp.10001259
10001253 |. 33C0 XOR EAX,EAX
10001255 |. C9 LEAVE
10001256 |. C2 0400 RETN 4
10001259 |> 0FB64F 01 /MOVZX ECX,BYTE PTR DS:[EDI+1]
1000125D |. 0BC9 |OR ECX,ECX
1000125F |. 74 04 |JE SHORT rosecryp.10001265
10001261 |. 47 |INC EDI
10001262 |. 43 |INC EBX
10001263 |.^EB F4 \JMP SHORT rosecryp.10001259
10001265 |> 0FB60F MOVZX ECX,BYTE PTR DS:[EDI]
10001268 |. 83E9 30 SUB ECX,30
1000126B |. 0FAFCA IMUL ECX,EDX
1000126E |. 6BD2 0A IMUL EDX,EDX,0A
10001271 |. 03C1 ADD EAX,ECX
10001273 |. 4F DEC EDI
10001274 |. 4B DEC EBX
10001275 |.^75 EE JNZ SHORT rosecryp.10001265
10001277 |. C9 LEAVE
10001278 \. C2 0400 RETN 4