sub_outside():
	MSVCRT.rand
	KERNEL32.lstrcatA
	KERNEL32.Sleep
	KERNEL32.lstrlenA
	KERNEL32.lstrcpyA
	KERNEL32.GetModuleHandleA
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess

sub_31102B40(09ff):
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_3110345A(12a2):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_31102AEF(1a20):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_31103565(1eff):
	"Windows	Security Manager"
	"Disk Defragmenter"
	"System Restore Service"
	"Bot Loader"
	"WinUpdate"
	"Windows	Update Service"
	"avserve.exe"
	"avserve2.exeUpdate Service"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_311033CC(2057):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_3110360C(30d8):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcatA
	KERNEL32.CopyFileA
	KERNEL32.lstrlenA
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	".exe"
	"\\"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_31102AD5(336c):
	KERNEL32.CreateThread

sub_311037AE(3cd5):
	KERNEL32.VirtualAlloc

sub_31102F9C(4795):
	MSVCRT.strlen

sub_31101BB8(4891):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.GetCurrentProcess

	"advapi32"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"SeDebugPrivilege"

sub_31101D4B(48f8):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_31102B96(518e):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_31102C74(52a4):
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.memset
	MSVCRT.rand
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_31102663(531a):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcatA
	KERNEL32.lstrlenA
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
	"\\"
	".exe"

sub_3110238E(6253):
	KERNEL32.lstrlenA
	USER32.wsprintfA
	KERNEL32.Sleep
	WS2_32.send

	"PRIVMSG %s	%s\r\n"

sub_31102C26(649d):
	WS2_32.send
	KERNEL32.Sleep
	KERNEL32.InterlockedIncrement
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_31103401(75ba):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_3110318A(7a74):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_31102217(7aa2):
	MSVCRT.rand
	USER32.wsprintfA
	KERNEL32.lstrlenA
	WS2_32.send
	WS2_32.closesocket

	"QUIT	%s\r\n"

sub_311014E6(7ddc):
	KERNEL32.SetEvent
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_31101C40(7e12):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	USER32.FindWindowA
	USER32.GetForegroundWindow
	USER32.GetWindowThreadProcessId
	KERNEL32.OpenProcess
	KERNEL32.WriteProcessMemory
	KERNEL32.CloseHandle

	"kernel32"
	"VirtualAllocEx"
	"CreateRemoteThread"
	"uterm11"

sub_31101361(81ab):
	KERNEL32.GetSystemDirectoryA
	KERNEL32.SetCurrentDirectoryA
	KERNEL32.lstrcpynA
	KERNEL32.CreateFileA
	WS2_32.send
	WS2_32.recv
	KERNEL32.WriteFile
	KERNEL32.CloseHandle

sub_31102C10(81da):
	WININET.InternetGetConnectedState

sub_31102E4E(82c5):
	KERNEL32.WaitForSingleObject

sub_31101248(8398):
	KERNEL32.GetSystemTime
	KERNEL32.SystemTimeToFileTime
	WS2_32.recv
	MSVCRT.memcpy
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CryptDestroyHash
	MSVCRT.rand
	WS2_32.send

sub_311034AD(87a6):
	KERNEL32.lstrlenA
	KERNEL32.CreateToolhelp32Snapshot
	MSVCRT.memset
	KERNEL32.Process32First
	MSVCRT.strstr
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.Process32Next

sub_3110122D(9445):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_3110277D(97b3):
	MSVCRT.strstr
	KERNEL32.GetTickCount
	USER32.wsprintfA
	KERNEL32.lstrlenA
	MSVCRT.strchr
	KERNEL32.lstrcmpA
	KERNEL32.lstrcpyA
	MSVCRT.atoi
	MSVCRT.rand
	KERNEL32.lstrcatA

	"-1,%d"
	"e"
	"|"
	"i"
	"%d,%d,11%s,%d"
	"q"
	"JOIN"

sub_311032D9(99bb):
	KERNEL32.Sleep
	WININET.InternetGetConnectedState
	WS2_32.ntohs
	MSVCRT.memcpy

sub_31102AC6(a71a):
	KERNEL32.CreateMutexA

sub_311037C2(a71a):
	KERNEL32.VirtualFree

sub_31101651(abb0):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpynA
	USER32.wsprintfA
	MSVCRT.memcpy
	MSVCRT.strlen
	MSVCRT.memset
	WS2_32.ntohs
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlenA
	WS2_32.shutdown
	WS2_32.closesocket

sub_31102BD1(b95f):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_31102A98(bc62):
	KERNEL32.GetTickCount
	MSVCRT.srand

sub_31101E4A(bca3):
	KERNEL32.lstrcpynA

sub_311020C2(bf8d):
	MSVCRT.strstr
	KERNEL32.lstrlenA
	KERNEL32.lstrcpynA
	USER32.wsprintfA
	WS2_32.send

	"PING"
	"PONG%s\r\n"

sub_311036D8(c316):
	KERNEL32.GetModuleFileNameA
	KERNEL32.lstrcmpiA

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Client"
	"Software\\Microsoft\\Wireless"
	"Client"
	"Software\\Microsoft\\Wireless"

sub_311011D9(d285):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_31102145(d435):
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlenA
	WS2_32.send
	WS2_32.recv
	MSVCRT.strstr
	KERNEL32.lstrcpynA

	"JOIN	%s\r\n"
	"451"
	"PING"

sub_31101E80(e24b):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.recv
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlenA
	WS2_32.send
	MSVCRT.strstr
	WS2_32.closesocket

	"PASS	%s\r\n"
	"NICK	%s\r\n"
	"already"
	"NICK	%s\r\n"
	"USER	%s 8 * :%s\r\n"

sub_31101582(e562):
	WS2_32.socket
	MSVCRT.memset
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.CreateEventA
	KERNEL32.CreateThread
	KERNEL32.CloseHandle
	KERNEL32.WaitForSingleObject

sub_31102B10(e56c):
	MSVCRT.rand

sub_31103126(e58e):
	MSVCRT.rand
	KERNEL32.Sleep

sub_31102405(e63f):
	KERNEL32.GetSystemTime
	MSVCRT.srand
	MSVCRT.rand

sub_31102E62(e669):
	KERNEL32.CreateEventA
	KERNEL32.OpenEventA
	KERNEL32.SetEvent
	KERNEL32.LoadLibraryA
	KERNEL32.Sleep
	ADVAPI32.AbortSystemShutdownA

	"u11x"
	"u10x"
	"u8"
	"u9"
	"u10"
	"ws2_32"
	"wininet"
	"msvcrt"
	"advapi32"
	"user32"
	"uterm11"

sub_31102DB8(e965):
	WS2_32.WSAStartup

sub_31103212(ed82):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_31102280(f228):
	KERNEL32.GetTickCount
	WS2_32.select
	KERNEL32.ExitThread
	WS2_32.recv
	KERNEL32.Sleep
	WS2_32.closesocket

sub_311011C0(fa42):
	KERNEL32.lstrcpyA

	"cont"

sub_31102FCD(fda7):
	MSVCRT.rand
	MSVCRT.strcpy
	WS2_32.socket
	WS2_32.ntohl
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.Sleep
	WS2_32.recv
	WS2_32.closesocket
	MSVCRT.strcat
	MSVCRT.strlen
	WS2_32.send

	" : USERID : UNIX : "
	"\r\n"