sub_outside():
	KERNEL32.GetModuleHandleA
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess
	KERNEL32.Sleep
	WININET.InternetGetConnectedState

sub_30902536(036c):
	MSVCRT.rand
	KERNEL32.Sleep

sub_30901F74(09ff):
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_309028B2(12a2):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_3090201F(1716):
	KERNEL32.OpenEventA
	KERNEL32.SetEvent

sub_30901F23(1a20):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_30902824(2057):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_30901700(23eb):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_3090174F(2986):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_3090204F(3338):
	WS2_32.recv
	MSVCRT.strstr
	WS2_32.send
	USER32.wsprintfA
	MSVCRT.strlen
	KERNEL32.Sleep
	KERNEL32.InterlockedIncrement
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread

	"GET"
	"HTTP/1.1 200 OK\r\nContent-Type: applicat"...
	"Content-Length: %u\r\n\r\n"
	"HTTP/1.1 200 OK\r\n\r\n\r\n"

sub_30901F09(336c):
	KERNEL32.CreateThread

sub_309015C7(3495):
	KERNEL32.GetLocaleInfoA
	USER32.wsprintfA
	WININET.InternetOpenA
	WININET.InternetOpenUrlA
	WININET.InternetReadFile
	WININET.InternetCloseHandle

	"http://%s/index.php?id=%s&scn=%d&inf=%d"...
	"http://%s"
	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...

sub_30902C75(3cd5):
	KERNEL32.VirtualAlloc

sub_30901D39(4891):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.GetCurrentProcess

	"advapi32"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"SeDebugPrivilege"

sub_30901316(48f8):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_30902195(52a4):
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.memset
	MSVCRT.rand
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_309011A0(531a):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcatA
	KERNEL32.lstrlenA
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...

sub_3090176B(7512):
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	ADVAPI32.CryptDestroyHash

sub_30902859(75ba):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_3090259A(7a74):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_309029BD(7c2b):
	"Windows	Security Manager"
	"Disk Defragmenter"
	"System Restore Service"
	"Bot Loader"
	"WinUpdate"
	"Windows	Update Service"
	"avserve.exe"
	"avserve2.exeUpdate Service"
	"MS Config v13"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901DC1(7e12):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	USER32.FindWindowA
	USER32.GetForegroundWindow
	USER32.GetWindowThreadProcessId
	KERNEL32.OpenProcess
	KERNEL32.WriteProcessMemory
	KERNEL32.CloseHandle

	"kernel32"
	"VirtualAllocEx"
	"CreateRemoteThread"
	"uterm17"

sub_30902009(81da):
	WININET.InternetGetConnectedState

sub_3090236F(82c5):
	KERNEL32.WaitForSingleObject

sub_30902039(85d4):
	MSVCRT.rand

sub_30902905(87a6):
	KERNEL32.lstrlenA
	KERNEL32.CreateToolhelp32Snapshot
	MSVCRT.memset
	KERNEL32.Process32First
	MSVCRT.strstr
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.Process32Next

sub_30902B37(99c3):
	KERNEL32.GetModuleFileNameA
	MSVCRT.rand
	KERNEL32.lstrlenA
	KERNEL32.lstrcpyA
	KERNEL32.lstrcmpiA

	"Software\\Microsoft\\Wireless"
	"ID"
	"fgnsdrjyrsert"
	"ID"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Client"
	"Client"

sub_309026E9(a67f):
	WS2_32.inet_ntoa
	KERNEL32.lstrcpyA
	USER32.wsprintfA
	KERNEL32.lstrlenA

	"http://%s:%d/x.exe"

sub_30901EFA(a71a):
	KERNEL32.CreateMutexA

sub_30902C89(a71a):
	KERNEL32.VirtualFree

sub_309017D2(abb0):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpynA
	USER32.wsprintfA
	MSVCRT.memcpy
	MSVCRT.strlen
	MSVCRT.memset
	WS2_32.ntohs
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlenA
	WS2_32.shutdown
	WS2_32.closesocket

sub_30901FCA(b95f):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_30901ECC(bc62):
	KERNEL32.GetTickCount
	MSVCRT.srand

sub_3090169C(ce9e):
	MSVCRT.rand
	KERNEL32.Sleep
	KERNEL32.InterlockedExchange

sub_30901422(df51):
	MSVCRT.strstr
	KERNEL32.lstrlenA
	MSVCRT.strchr

	"zer0"

sub_30902A6B(e208):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcatA
	KERNEL32.CopyFileA
	KERNEL32.lstrlenA
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901F44(e56c):
	MSVCRT.rand

sub_309022D9(e965):
	WS2_32.WSAStartup

sub_30902383(ed4e):
	KERNEL32.CreateEventA
	KERNEL32.LoadLibraryA
	ADVAPI32.AbortSystemShutdownA
	KERNEL32.Sleep

	"u17x"
	"u10x"
	"u8"
	"u9"
	"u10"
	"u11"
	"u12"
	"u13"
	"u14"
	"u15"
	"u16"
	"u17"
	"ws2_32"
	"wininet"
	"msvcrt"
	"advapi32"
	"user32"
	"uterm17"

sub_30902622(ed82):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep
	KERNEL32.ExitThread