sub_outside():
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket
	WSOCK32.recv
	NTDLL.RtlFreeHeap
	NTDLL.RtlReAllocateHeap
	KERNEL32.GetModuleHandleA
	KERNEL32.GetCommandLineA
	KERNEL32.GetStartupInfoA
	KERNEL32.ExitProcess
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSection

sub_405915(0054):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_41CDB8(0126):
	KERNEL32.SetUnhandledExceptionFilter

sub_410086(0178):
	WININET.InternetGetConnectedStateExA

	"[NETINFO]: [Type]: %s	(%s). [IP Address"...

sub_41C9FD(029e):
	KERNEL32.GetModuleFileNameA

	"Unknown security	failure	detected!"
	"A security error of unknown cause has b"...
	"Buffer overrun detected!"
	"A buffer overrun has been detected whic"...
	""
	"..."
	"\n\n"
	"Microsoft Visual C++ Runtime Library"

sub_40E219(044f):
	WS2_32.WSAStartup
	KERNEL32.SetConsoleCtrlHandler
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSACleanup
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WSOCK32.setsockopt
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.accept
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"[RLOGIND]: Error: WSAStartup(): <%d>."
	"[RLOGIND]: Failed to install control-C "...
	"[RLOGIND]: Ready and waiting for incomi"...
	"[RLOGIND]: Client connection from IP:	%"...
	"[RLOGIND]: Failed to start client threa"...
	"[RLOGIND]: Error: server failed, return"...

sub_41CDA5(088b):
	KERNEL32.SetUnhandledExceptionFilter

sub_41BFAD(09aa):
	KERNEL32.CreateFileA
	KERNEL32.GetFileType
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

sub_40F8FA(0d23):
	WS2_32.select
	WSOCK32.recv
	WS2_32.send
	WS2_32.closesocket
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.connect
	KERNEL32.ExitThread

	"[SOCKS4]: Authentication failed. Remote"...
	"[SOCKS4]: Error: Failed to open socket("...
	"[SOCKS4]: Error: Failed to connect to	t"...

sub_410A22(0f1a):
	WS2_32.socket
	KERNEL32.Sleep
	WS2_32.WSAGetLastError
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.select
	WSOCK32.recvfrom
	WS2_32.inet_ntoa
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread

	"octet"
	"[TFTP]: Error: socket() failed, returne"...
	"[TFTP]: Failed to open file: %s."
	"[TFTP]: File transfer	started	to IP: %s"...
	"[TFTP]: File not found: %s (%s)."
	"[TFTP]: File transfer	complete to IP:	%"...

sub_40FB2A(0f67):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.closesocket
	KERNEL32.ExitThread

	"[SOCKS4]: Server started on: %s:%d."
	"[SOCKS4]: Client connection from IP: %s"...
	"[SOCKS4]: Failed to start client thread"...
	"[SOCKS4]: Failed to start server on Por"...

sub_4073FB(1017):
	KERNEL32.ExitThread

	"[PROC]: Listing processes:"
	"[PROC]: Process list completed."
	"[PROC]: Process list failed."

sub_41B81F(10cf):
	NTDLL.RtlLeaveCriticalSection

sub_40DDC6(10e2):
	KERNEL32.SearchPathA
	KERNEL32.CreatePipe
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error

	"cmd.exe"
	"[CMD]: Remote	Command	Prompt"
	"[CMD]: Failed	to start IO thread, error"...

sub_416D74(128c):
	KERNEL32.VirtualAlloc

sub_419BC9(1387):
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error

sub_40DB6D(1793):
	KERNEL32.WriteFile

sub_41A5BE(179c):
	KERNEL32.GetStartupInfoA
	KERNEL32.GetFileType
	KERNEL32.GetStdHandle
	KERNEL32.SetHandleCount

sub_4134AF(1ade):
	KERNEL32.GetFileAttributesA
	NTDLL.RtlGetLastWin32Error

sub_401F06(1ce6):
	WININET.InternetOpenUrlA
	KERNEL32.CreateFileA
	KERNEL32.GetTickCount
	WININET.InternetReadFile
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	WININET.InternetCloseHandle
	KERNEL32.ExitThread

	"[DOWNLOAD]: Couldn't open file: %s."
	"[DOWNLOAD]: File download: %s	(%dKB tra"...
	"[DOWNLOAD]: Update: %s (%dKB transferre"...
	"[DOWNLOAD]: Filesize is incorrect: (%d "...
	"[DOWNLOAD]: Downloaded %.1f KB to %s @ "...
	"[DOWNLOAD]: Openning:	%s %s."
	" "
	"[DOWNLOAD]: Application succesfully exe"...
	"[DOWNLOAD]: Execution	failed:	Error exe"...
	"[DOWNLOAD]: Downloaded %.1fKB	to %s @	%"...
	"[DOWNLOAD]: Update failed: Error execut"...
	"[DOWNLOAD]: Bad URL, or DNS Error: %s."

sub_41945D(219a):
	KERNEL32.GetOEMCP
	KERNEL32.GetACP

sub_416CBD(2299):
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	NTDLL.RtlFreeHeap

sub_416932(2585):
	NTDLL.RtlAllocateHeap

sub_40F1E4(27f8):
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile
	WSOCK32.recv

sub_40DF75(292d):
	WSOCK32.recv

	"[RLOGIND]: Protocol string too long."

sub_415456(2998):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlSetLastWin32Error

sub_411B71(2afc):
	WS2_32.ntohs
	WS2_32.send
	WSOCK32.recv
	KERNEL32.Sleep

	"\\\\%s\\ipc$"

sub_40E83D(2cf0):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

	"[SCAN]: IP: %s Port: %d is open."

sub_41A3FA(2d8c):
	KERNEL32.GetModuleFileNameA

sub_402717(306a):
	KERNEL32.GetLogicalDriveStringsA

	"A:\\"

sub_417536(327f):
	KERNEL32.ReadFile
	NTDLL.RtlGetLastWin32Error

sub_403B4C(32b7):
	KERNEL32.GetFileAttributesA
	WS2_32.closesocket
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

	"\\%s"
	"%s"
	"%s%s"
	"\n"
	"*"
	"[HTTPD]: Worker thread of server thread"...
	"[HTTPD]: Failed to start worker thread,"...

sub_4038B7(3320):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	WSOCK32.recv
	WS2_32.closesocket
	WS2_32.WSACleanup

	"%s %s	HTTP/1.1\nReferer: %s\nHost: %s\nCon"...

sub_405C4B(3362):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_40DBAB(33d0):
	KERNEL32.Sleep
	WS2_32.send

	"PRIVMSG %s	:%s\r"
	"%s"

sub_4154C7(33dc):
	KERNEL32.TlsAlloc
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId

sub_40E4F3(3683):
	KERNEL32.GetTickCount

sub_406702(37b9):
	"[NET]: %s: Error with	share: '%s'. %s"
	"[NET]: %s share:	'%s'."
	"[NET]: %s: No	share specified."

sub_417CF5(3814):
	NTDLL.RtlEnterCriticalSection

sub_41B7AC(39d2):
	NTDLL.RtlEnterCriticalSection

sub_40FE1F(3acf):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"95"
	"NT"
	"98"
	"2K"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...

sub_401BBB(3b21):
	"-[Alias List]-"
	"%d. %s = %s"

sub_41AE30(3bbd):
	KERNEL32.VirtualQuery
	KERNEL32.GetSystemInfo
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualProtect

sub_41D75B(3cd4):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	USER32.GetProcessWindowStation
	USER32.GetUserObjectInformationA
	USER32.GetActiveWindow
	USER32.GetLastActivePopup
	USER32.MessageBoxA

	"user32.dll"
	"MessageBoxA"
	"GetActiveWindow"
	"GetLastActivePopup"
	"GetUserObjectInformationA"
	"GetProcessWindowStation"

sub_4190C6(3ffc):
	KERNEL32.GetCPInfo

sub_40F3F5(409e):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	WS2_32.closesocket

	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: WaitForMultipleObjects error"...

sub_41ACDB(414a):
	KERNEL32.MultiByteToWideChar

sub_41B670(428c):
	KERNEL32.SetStdHandle

sub_41A7BC(430b):
	KERNEL32.WriteFile
	NTDLL.RtlGetLastWin32Error

sub_40779B(44de):
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.ntohs

	"[MAIN]: Connected to %s."

sub_41827C(4634):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress

	"KERNEL32"
	"IsProcessorFeaturePresent"

sub_41CB90(47fe):
	KERNEL32.GetCPInfo
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_40DFC0(4a84):
	"[RLOGIND]: Login rejected, Remote user:"...

sub_406CD9(4c4d):
	IPHLPAPI.IcmpCreateFile
	WS2_32.inet_addr
	WS2_32.gethostbyname
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle
	KERNEL32.ExitThread

	"[PING]: Error	sending	pings to %s."
	"[PING]: Finished sending pings to %s."

sub_4010CA(4eaf):
	WS2_32.inet_ntoa

	"[SCAN]: Current IP: %s."
	"[SCAN]: Scan not active."

sub_40F2F9(4ec3):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle

	"[RLOGIND]: Failed to create shell stdou"...
	"[RLOGIND]: Failed to create shell stdin"...
	"[RLOGIND]: Failed to execute shell."

sub_4166A2(4f5e):
	NTDLL.RtlEnterCriticalSection

sub_4166F4(4f5e):
	NTDLL.RtlLeaveCriticalSection

sub_41B6EC(52a1):
	KERNEL32.SetStdHandle

sub_405F05(52c8):
	KERNEL32.MultiByteToWideChar

sub_41CB47(5463):
	KERNEL32.GetLocaleInfoA

sub_4074C6(55bf):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_41AA7A(5651):
	KERNEL32.WideCharToMultiByte

sub_41CEA6(573a):
	KERNEL32.RaiseException

sub_41677E(5769):
	KERNEL32.HeapCreate
	KERNEL32.HeapDestroy

sub_41AB01(58c9):
	NTDLL.RtlAllocateHeap

sub_40169B(5974):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"[SCAN]: IP: %s:%d, Scan thread: %d, Sub"...
	"[SCAN]: IP: %s, Port %d is open."
	"webdav"

sub_40F023(5a9c):
	KERNEL32.ExitThread

sub_401000(5b0f):
	"[SCAN]: Exploit Statistics:"
	" %s:	%d,"
	" Total: %d in %s."

sub_4024F5(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_402A8B(5bb5):
	KERNEL32.GetModuleFileNameA
	KERNEL32.Sleep

sub_416818(5be9):
	NTDLL.RtlDeleteCriticalSection

sub_41CDE1(5cb8):
	KERNEL32.IsBadWritePtr

sub_41CDC5(5cb8):
	KERNEL32.IsBadReadPtr

sub_40E495(5cfa):
	KERNEL32.GetTickCount

	"%s"
	"%s%i"

sub_406E62(610b):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.ntohs
	WS2_32.sendto
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"[UDP]: Error sending pings to	%s."
	"[UDP]: Finished sending packets to %s."

sub_40468E(61d5):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.GetDiskFreeSpaceExA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LoadLibraryA
	WININET.InternetOpenA

	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"

sub_4067C0(634c):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"[NET]: Share list error: %s <%ld>"
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_419FFA(63d5):
	KERNEL32.UnhandledExceptionFilter

sub_40253D(63f7):
	"%sKB"
	"failed"

sub_41A49C(6487):
	KERNEL32.GetEnvironmentStringsW
	NTDLL.RtlGetLastWin32Error
	KERNEL32.WideCharToMultiByte
	KERNEL32.FreeEnvironmentStringsW
	KERNEL32.GetEnvironmentStringsA
	KERNEL32.FreeEnvironmentStringsA

sub_40F005(655e):
	KERNEL32.Sleep

sub_40751F(68d7):
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WSOCK32.recv

	"PASS	%s\r\n"
	" :"
	"|"
	"|"

sub_4037B8(6b20):
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.WSAGetLastError
	KERNEL32.CloseHandle

sub_4018D1(6c06):
	WS2_32.inet_addr
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

	"[SCAN]: Failed to initialize critical	s"...
	"[SCAN]: %s:%d, Scan thread: %d, Sub-thr"...
	"[SCAN]: Failed to start worker thread, "...
	"[SCAN]: Finished at %s:%d after %d minu"...

sub_413820(6ea5):
	KERNEL32.GetSystemTimeAsFileTime

sub_4015FE(6ee1):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_41D96E(71c7):
	KERNEL32.SetEndOfFile
	NTDLL.RtlGetLastWin32Error

sub_4182E4(72cc):
	KERNEL32.LCMapStringW
	NTDLL.RtlGetLastWin32Error
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte
	KERNEL32.LCMapStringA

sub_402658(72d0):
	"failed"
	"[MAIN]: %s Drive (%s): Failed	to stat, "...
	"[MAIN]: %s Drive (%s): %s total, %s fre"...

sub_4133A6(736f):
	NTDLL.RtlAllocateHeap

sub_414004(7559):
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error

sub_4169A5(76df):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_40FD69(775b):
	KERNEL32.Sleep

sub_4039DE(7899):
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

	"text/html"
	"application/octet-stream"
	"ddd, dd	MMM yyyy"
	"HH:mm:ss"
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...

sub_405F46(7c92):
	KERNEL32.WideCharToMultiByte

sub_4030C4(7ca6):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep
	KERNEL32.FindClose

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n