10001090 >/$ 55 PUSH EBP 10001091 |. 8BEC MOV EBP,ESP 10001093 |. 83C4 F4 ADD ESP,-0C 10001096 |. 60 PUSHAD 10001097 |. C745 F8 400000>MOV DWORD PTR SS:[EBP-8],40 1000109E |. 33C0 XOR EAX,EAX 100010A0 |. 8845 FF MOV BYTE PTR SS:[EBP-1],AL 100010A3 |. 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 100010A6 |. 8BFE MOV EDI,ESI 100010A8 |. 83C7 09 ADD EDI,9 100010AB |. 8906 MOV DWORD PTR DS:[ESI],EAX 100010AD |. 8946 04 MOV DWORD PTR DS:[ESI+4],EAX 100010B0 |. EB 05 JMP SHORT rosecryp.100010B7 100010B2 |> 884430 08 /MOV BYTE PTR DS:[EAX+ESI+8],AL 100010B6 |. 40 |INC EAX 100010B7 |> 3D 00010000 CMP EAX,100 100010BC |.^75 F4 \JNZ SHORT rosecryp.100010B2 100010BE |. 33DB XOR EBX,EBX 100010C0 |. EB 46 JMP SHORT rosecryp.10001108 100010C2 |> 33C9 /XOR ECX,ECX 100010C4 |. 49 |DEC ECX 100010C5 |> 8A1439 |/MOV DL,BYTE PTR DS:[ECX+EDI] 100010C8 |. 8855 F7 ||MOV BYTE PTR SS:[EBP-9],DL 100010CB |. 8B45 0C ||MOV EAX,DWORD PTR SS:[EBP+C] 100010CE |. 03C3 ||ADD EAX,EBX 100010D0 |. 43 ||INC EBX 100010D1 |. 0FB610 ||MOVZX EDX,BYTE PTR DS:[EAX] 100010D4 |. 0255 F7 ||ADD DL,BYTE PTR SS:[EBP-9] 100010D7 |. 0255 FF ||ADD DL,BYTE PTR SS:[EBP-1] 100010DA |. 81E2 FF000000 ||AND EDX,0FF 100010E0 |. 8855 FF ||MOV BYTE PTR SS:[EBP-1],DL 100010E3 |. 8A4432 08 ||MOV AL,BYTE PTR DS:[EDX+ESI+8] 100010E7 |. 50 ||PUSH EAX 100010E8 |. 8A45 F7 ||MOV AL,BYTE PTR SS:[EBP-9] 100010EB |. 884432 08 ||MOV BYTE PTR DS:[EDX+ESI+8],AL 100010EF |. 58 ||POP EAX 100010F0 |. 880439 ||MOV BYTE PTR DS:[ECX+EDI],AL 100010F3 |. 8B45 10 ||MOV EAX,DWORD PTR SS:[EBP+10] 100010F6 |. 3BD8 ||CMP EBX,EAX 100010F8 |. 72 02 ||JB SHORT rosecryp.100010FC 100010FA |. 33DB ||XOR EBX,EBX 100010FC |> 41 ||INC ECX 100010FD |. 83F9 03 ||CMP ECX,3 10001100 |.^75 C3 |\JNZ SHORT rosecryp.100010C5 10001102 |. 83C7 04 |ADD EDI,4 10001105 |. FF4D F8 |DEC DWORD PTR SS:[EBP-8] 10001108 |> 837D F8 00 CMP DWORD PTR SS:[EBP-8],0 1000110C |.^75 B4 \JNZ SHORT rosecryp.100010C2 1000110E |. 61 POPAD 1000110F |. C9 LEAVE 10001110 \. C2 0C00 RETN 0C 10001113 >/$ 55 PUSH EBP 10001114 |. 8BEC MOV EBP,ESP 10001116 |. 81C4 F0FDFFFF ADD ESP,-210 1000111C |. 60 PUSHAD 1000111D |. 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] 10001120 |. 0BF6 OR ESI,ESI 10001122 |. 75 06 JNZ SHORT rosecryp.1000112A 10001124 |. 8D35 21300010 LEA ESI,DWORD PTR DS:[10003021] 1000112A |> 6A 00 PUSH 0 ; /hTemplateFile = NULL 1000112C |. 68 80000000 PUSH 80 ; |Attributes = NORMAL 10001131 |. 6A 03 PUSH 3 ; |Mode = OPEN_EXISTING 10001133 |. 6A 00 PUSH 0 ; |pSecurity = NULL 10001135 |. 6A 00 PUSH 0 ; |ShareMode = 0 10001137 |. 68 00000080 PUSH 80000000 ; |Access = GENERIC_READ 1000113C |. 56 PUSH ESI ; |FileName 1000113D |. E8 40010000 CALL ; \CreateFileA 10001142 |. 83F8 FF CMP EAX,-1 10001145 |. 75 07 JNZ SHORT rosecryp.1000114E 10001147 |. 61 POPAD 10001148 |. 33C0 XOR EAX,EAX 1000114A |. C9 LEAVE 1000114B |. C2 0800 RETN 8 1000114E |> 8985 FCFDFFFF MOV DWORD PTR SS:[EBP-204],EAX 10001154 |. 6A 02 PUSH 2 ; /Origin = FILE_END 10001156 |. 6A 00 PUSH 0 ; |pOffsetHi = NULL 10001158 |. 68 00FEFFFF PUSH -200 ; |OffsetLo = FFFFFE00 (-512.) 1000115D |. 50 PUSH EAX ; |hFile 1000115E |. E8 43010000 CALL ; \SetFilePointer 10001163 |. 6A 00 PUSH 0 ; /pOverlapped = NULL 10001165 |. 8D85 F8FDFFFF LEA EAX,DWORD PTR SS:[EBP-208] ; | 1000116B |. 50 PUSH EAX ; |pBytesRead 1000116C |. 68 00020000 PUSH 200 ; |BytesToRead = 200 (512.) 10001171 |. 8D85 00FEFFFF LEA EAX,DWORD PTR SS:[EBP-200] ; | 10001177 |. 50 PUSH EAX ; |Buffer 10001178 |. FFB5 FCFDFFFF PUSH DWORD PTR SS:[EBP-204] ; |hFile 1000117E |. E8 1D010000 CALL ; \ReadFile 10001183 |. 81BD F8FDFFFF >CMP DWORD PTR SS:[EBP-208],200 1000118D |. 74 07 JE SHORT rosecryp.10001196 1000118F |. 61 POPAD 10001190 |. 33C0 XOR EAX,EAX 10001192 |. C9 LEAVE 10001193 |. C2 0800 RETN 8 10001196 |> 8D8D 0FFEFFFF LEA ECX,DWORD PTR SS:[EBP-1F1] 1000119C |. 0FB609 MOVZX ECX,BYTE PTR DS:[ECX] 1000119F |. 888D F7FDFFFF MOV BYTE PTR SS:[EBP-209],CL 100011A5 |. E8 E4000000 CALL ; [GetProcessHeap 100011AA |. 51 PUSH ECX ; /HeapSize 100011AB |. 6A 00 PUSH 0 ; |Flags = 0 100011AD |. 50 PUSH EAX ; |hHeap 100011AE |. E8 E1000000 CALL ; \HeapAlloc 100011B3 |. 8D7D 8A LEA EDI,DWORD PTR SS:[EBP-76] 100011B6 |. 8D35 0F300010 LEA ESI,DWORD PTR DS:[1000300F] 100011BC |. 33C9 XOR ECX,ECX 100011BE |. EB 0C JMP SHORT rosecryp.100011CC 100011C0 |> 8A1E /MOV BL,BYTE PTR DS:[ESI] 100011C2 |. 8A17 |MOV DL,BYTE PTR DS:[EDI] 100011C4 |. 32DA |XOR BL,DL 100011C6 |. 881C01 |MOV BYTE PTR DS:[ECX+EAX],BL 100011C9 |. 46 |INC ESI 100011CA |. 47 |INC EDI 100011CB |. 41 |INC ECX 100011CC |> 3A8D F7FDFFFF CMP CL,BYTE PTR SS:[EBP-209] 100011D2 |.^72 EC \JB SHORT rosecryp.100011C0 100011D4 |. C60401 00 MOV BYTE PTR DS:[ECX+EAX],0 100011D8 |. 50 PUSH EAX 100011D9 |. 50 PUSH EAX 100011DA |. E8 60000000 CALL rosecryp.1000123F 100011DF |. 8985 F0FDFFFF MOV DWORD PTR SS:[EBP-210],EAX 100011E5 |. 59 POP ECX 100011E6 |. E8 A3000000 CALL ; [GetProcessHeap 100011EB |. 51 PUSH ECX ; /pMemory 100011EC |. 6A 00 PUSH 0 ; |Flags = 0 100011EE |. 50 PUSH EAX ; |hHeap 100011EF |. E8 A6000000 CALL ; \HeapFree 100011F4 |. 8DB5 87FEFFFF LEA ESI,DWORD PTR SS:[EBP-179] 100011FA |. 8D3D 00300010 LEA EDI,DWORD PTR DS:[10003000] 10001200 |. 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 10001203 |. 33C9 XOR ECX,ECX 10001205 |. 33D2 XOR EDX,EDX 10001207 |. EB 15 JMP SHORT rosecryp.1000121E 10001209 |> 0FB61E /MOVZX EBX,BYTE PTR DS:[ESI] 1000120C |. 321C3A |XOR BL,BYTE PTR DS:[EDX+EDI] 1000120F |. 8818 |MOV BYTE PTR DS:[EAX],BL 10001211 |. 40 |INC EAX 10001212 |. 41 |INC ECX 10001213 |. 46 |INC ESI 10001214 |. 83FA 0E |CMP EDX,0E 10001217 |. 75 04 |JNZ SHORT rosecryp.1000121D 10001219 |. 33D2 |XOR EDX,EDX 1000121B |. EB 01 |JMP SHORT rosecryp.1000121E 1000121D |> 42 |INC EDX 1000121E |> 3B8D F0FDFFFF CMP ECX,DWORD PTR SS:[EBP-210] 10001224 |.^72 E3 \JB SHORT rosecryp.10001209 10001226 |. C600 00 MOV BYTE PTR DS:[EAX],0 10001229 |. FFB5 FCFDFFFF PUSH DWORD PTR SS:[EBP-204] ; /hObject 1000122F |. E8 48000000 CALL ; \CloseHandle 10001234 |. 61 POPAD 10001235 |. 8B85 F0FDFFFF MOV EAX,DWORD PTR SS:[EBP-210] 1000123B |. C9 LEAVE 1000123C \. C2 0800 RETN 8 1000123F /$ 55 PUSH EBP 10001240 |. 8BEC MOV EBP,ESP 10001242 |. 33C0 XOR EAX,EAX 10001244 |. BA 01000000 MOV EDX,1 10001249 |. 8BDA MOV EBX,EDX 1000124B |. 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8] 1000124E |. 803E 00 CMP BYTE PTR DS:[ESI],0 10001251 |. 75 06 JNZ SHORT rosecryp.10001259 10001253 |. 33C0 XOR EAX,EAX 10001255 |. C9 LEAVE 10001256 |. C2 0400 RETN 4 10001259 |> 0FB64F 01 /MOVZX ECX,BYTE PTR DS:[EDI+1] 1000125D |. 0BC9 |OR ECX,ECX 1000125F |. 74 04 |JE SHORT rosecryp.10001265 10001261 |. 47 |INC EDI 10001262 |. 43 |INC EBX 10001263 |.^EB F4 \JMP SHORT rosecryp.10001259 10001265 |> 0FB60F MOVZX ECX,BYTE PTR DS:[EDI] 10001268 |. 83E9 30 SUB ECX,30 1000126B |. 0FAFCA IMUL ECX,EDX 1000126E |. 6BD2 0A IMUL EDX,EDX,0A 10001271 |. 03C1 ADD EAX,ECX 10001273 |. 4F DEC EDI 10001274 |. 4B DEC EBX 10001275 |.^75 EE JNZ SHORT rosecryp.10001265 10001277 |. C9 LEAVE 10001278 \. C2 0400 RETN 4