#include <windows.h>
#include <stdio.h>

/**
*  by aaSSfxxx
*  Usage: pwnz-istealer.exe c:\path\to\executable
*  Works with Windows, Linux & MacOS under Wine
**/

//Prototypes
void unxor(char* chr);
char* locate_str(char *data);

int main(int argc, char** argv)
{
    int exe_ptr = 0;
    char *cfg;

    printf("iStealer extractor by aaSSfxxx\r\n");
    printf("This tool is provided to detect and get data from an iStealer spywares.\r\n");
    printf("This program is under BeerWare licence.\r\n");
    //If no executable, exiting.
    if(argc == 1)
    {
        printf(" Executable path needed ! Exiting.\r\n");
        return 0;
    }

    //Loads executable in memory
    printf(" [+] Loading executable\r\n");
    exe_ptr = (int)LoadLibrary(argv[1]);
    if(exe_ptr == 0) {
        printf(" [-] Load failed, aborting.\r\n");
        return 0;
    }

    //Check if executable is istealer (weak checking)
    printf(" [+] Checking if executable is a iStealer stub... \r\n");
    if(memchr((void*)exe_ptr, 0x454d5201, 0x40000) == NULL) {
        printf (" [-] Not an iStealer program (maybe encrypted?)\r\n");
        return 0;
    }

    //Okay, do it!
    //Extracting resources
    int hRes = (int)FindResource((HMODULE)exe_ptr, "#1", RT_RCDATA);
    if (hRes == 0)
    {
        printf(" [-] Unable to extract resource!\r\n");
        return 0;
    }
    cfg = (char*)LoadResource((HMODULE)exe_ptr, (HANDLE)hRes);
    printf(" [+] Encrypted host is %s \r\n",locate_str(cfg));

    unxor(locate_str(cfg));
    printf(" [+] Decrypted host is %s \r\n",locate_str(cfg));
}

char* locate_str(char *data)
{
    int i;
    for(i=0;i<40;i++)
    {
        if(data[i] != 0 && data[i]!=1)
            return data + i;
    }
    return data;
}

void unxor(char* chr)
{
    unsigned long i;
    for (i=0; i<strlen(chr); i++)
        chr[i] ^= (char)((i % 5) + 1);
}