sub_outside():
	KERNEL32.GetModuleHandleA
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess
	KERNEL32.Sleep
	WININET.InternetGetConnectedState

sub_30901F5B(09ff):
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_30902844(12a2):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_30901F0A(1a20):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_309027B6(2057):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_309016E7(23eb):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_30901736(2986):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_30901EF0(336c):
	KERNEL32.CreateThread

sub_309015C7(3495):
	KERNEL32.GetLocaleInfoA
	USER32.wsprintfA
	WININET.InternetOpenA
	WININET.InternetOpenUrlA
	WININET.InternetReadFile
	WININET.InternetCloseHandle

	"dfashnzdsdl"
	"http://%s/index.php?id=%s&scn=%d&inf=%d"...
	"http://%s"
	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...

sub_30902C07(3cd5):
	KERNEL32.VirtualAlloc

sub_3090169C(4457):
	MSVCRT.rand
	KERNEL32.Sleep

sub_30901D20(4891):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.GetCurrentProcess

	"advapi32"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"SeDebugPrivilege"

sub_30901316(48f8):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_3090216F(52a4):
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.memset
	MSVCRT.rand
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_309011A0(531a):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcatA
	KERNEL32.lstrlenA
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...

sub_30902006(53a4):
	KERNEL32.OpenEventA
	KERNEL32.SetEvent

sub_3090235D(6681):
	KERNEL32.CreateEventA
	KERNEL32.LoadLibraryA
	ADVAPI32.AbortSystemShutdownA
	KERNEL32.Sleep

	"u15x"
	"u10x"
	"u8"
	"u9"
	"u10"
	"u11"
	"u12"
	"u13"
	"u14"
	"ws2_32"
	"wininet"
	"msvcrt"
	"advapi32"
	"user32"
	"uterm15"

sub_30901752(7512):
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	ADVAPI32.CryptDestroyHash

sub_309027EB(75ba):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_3090252C(7a74):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_3090294F(7c2b):
	"Windows	Security Manager"
	"Disk Defragmenter"
	"System Restore Service"
	"Bot Loader"
	"WinUpdate"
	"Windows	Update Service"
	"avserve.exe"
	"avserve2.exeUpdate Service"
	"MS Config v13"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901DA8(7e12):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	USER32.FindWindowA
	USER32.GetForegroundWindow
	USER32.GetWindowThreadProcessId
	KERNEL32.OpenProcess
	KERNEL32.WriteProcessMemory
	KERNEL32.CloseHandle

	"kernel32"
	"VirtualAllocEx"
	"CreateRemoteThread"
	"uterm15"

sub_30901FF0(81da):
	WININET.InternetGetConnectedState

sub_30902349(82c5):
	KERNEL32.WaitForSingleObject

sub_30902020(85d4):
	MSVCRT.rand

sub_30902897(87a6):
	KERNEL32.lstrlenA
	KERNEL32.CreateToolhelp32Snapshot
	MSVCRT.memset
	KERNEL32.Process32First
	MSVCRT.strstr
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.Process32Next

sub_309024C8(8a02):
	MSVCRT.rand
	KERNEL32.Sleep

sub_30902036(9441):
	WS2_32.recv
	MSVCRT.strstr
	WS2_32.send
	USER32.wsprintfA
	MSVCRT.strlen
	KERNEL32.Sleep
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread

	"GET"
	"HTTP/1.1 200 OK\r\nContent-Type: applicat"...
	"Content-Length: %u\r\n\r\n"
	"HTTP/1.1 200 OK\r\n\r\n\r\n"

sub_30902AC9(99c3):
	KERNEL32.GetModuleFileNameA
	MSVCRT.rand
	KERNEL32.lstrlenA
	KERNEL32.lstrcpyA
	KERNEL32.lstrcmpiA

	"Software\\Microsoft\\Wireless"
	"ID"
	"dfashnzdsdl"
	"ID"
	"dfashnzdsdl"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Client"
	"Client"

sub_30909A71(a2a5):
	KERNEL32.lstrcatA

sub_3090267B(a67f):
	WS2_32.inet_ntoa
	KERNEL32.lstrcpyA
	USER32.wsprintfA
	KERNEL32.lstrlenA

	"http://%s:%d/x.exe"

sub_30901EE1(a71a):
	KERNEL32.CreateMutexA

sub_30902C1B(a71a):
	KERNEL32.VirtualFree

sub_309017B9(abb0):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpynA
	USER32.wsprintfA
	MSVCRT.memcpy
	MSVCRT.strlen
	MSVCRT.memset
	WS2_32.ntohs
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlenA
	WS2_32.shutdown
	WS2_32.closesocket

sub_30901FB1(b95f):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_30901EB3(bc62):
	KERNEL32.GetTickCount
	MSVCRT.srand

sub_309029FD(d968):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcatA
	KERNEL32.CopyFileA
	KERNEL32.lstrlenA
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901422(df51):
	MSVCRT.strstr
	KERNEL32.lstrlenA
	MSVCRT.strchr

	"zer0"

sub_30909891(e0e7):
	KERNEL32.LoadLibraryA

sub_30901F2B(e56c):
	MSVCRT.rand

sub_309022B3(e965):
	WS2_32.WSAStartup

sub_309025B4(ed82):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep
	KERNEL32.ExitThread