sub_outside():
	MSVCRT.rand
	KERNEL32.lstrcat
	KERNEL32.Sleep
	KERNEL32.lstrlen
	KERNEL32.lstrcpy
	KERNEL32.GetModuleHandleA
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess

sub_31302B15(09ff):
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_313033C3(12a2):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_31302AC4(1a20):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_313034CE(1eff):
	"Windows	Security Manager"
	"System Service Manager"
	"System Restore Service"
	"Bot Loader"
	"WinUpdate"
	"Windows	Update Service"
	"avserve.exe"
	"avserve2.exe"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_31303335(2057):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_31302AAA(336c):
	KERNEL32.CreateThread

sub_31303717(3cd5):
	KERNEL32.VirtualAlloc

sub_31302F28(4795):
	MSVCRT.strlen

sub_31301B98(4891):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.GetCurrentProcess

	"advapi32"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"SeDebugPrivilege"

sub_31301D2B(48f8):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_31302B6B(518e):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_31302C49(52a4):
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.memset
	MSVCRT.rand
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_3130263B(531a):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcat
	KERNEL32.lstrlen
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
	"\\"
	".exe"

sub_31303575(5b4e):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcat
	KERNEL32.CopyFileA
	KERNEL32.lstrlen
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	".exe"
	"\\"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_3130235D(6253):
	KERNEL32.lstrlen
	USER32.wsprintfA
	KERNEL32.Sleep
	WS2_32.send

	"PRIVMSG %s	%s\r\n"

sub_31302BFB(649d):
	WS2_32.send
	KERNEL32.Sleep
	KERNEL32.InterlockedIncrement
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_3130336A(75ba):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_313021F7(7aa2):
	MSVCRT.rand
	USER32.wsprintfA
	KERNEL32.lstrlen
	WS2_32.send
	WS2_32.closesocket

	"QUIT	%s\r\n"

sub_313014C6(7ddc):
	KERNEL32.SetEvent
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_31301C20(7e12):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	USER32.FindWindowA
	USER32.GetForegroundWindow
	USER32.GetWindowThreadProcessId
	KERNEL32.OpenProcess
	KERNEL32.WriteProcessMemory
	KERNEL32.CloseHandle

	"kernel32"
	"VirtualAllocEx"
	"CreateRemoteThread"
	"uterm_9"

sub_31301341(81ab):
	KERNEL32.GetSystemDirectoryA
	KERNEL32.SetCurrentDirectoryA
	KERNEL32.lstrcpyn
	KERNEL32.CreateFileA
	WS2_32.send
	WS2_32.recv
	KERNEL32.WriteFile
	KERNEL32.CloseHandle

sub_31302BE5(81da):
	WININET.InternetGetConnectedState

sub_31302E23(82c5):
	KERNEL32.WaitForSingleObject

sub_31301228(8398):
	KERNEL32.GetSystemTime
	KERNEL32.SystemTimeToFileTime
	WS2_32.recv
	MSVCRT.memcpy
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CryptDestroyHash
	MSVCRT.rand
	WS2_32.send

sub_31303256(85d9):
	KERNEL32.Sleep
	WININET.InternetGetConnectedState
	WS2_32.htons
	MSVCRT.memcpy

sub_31303416(87a6):
	KERNEL32.lstrlen
	KERNEL32.CreateToolhelp32Snapshot
	MSVCRT.memset
	KERNEL32.Process32First
	MSVCRT.strstr
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.Process32Next

sub_3130120D(9445):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_31302A9B(a71a):
	KERNEL32.CreateMutexA

sub_3130372B(a71a):
	KERNEL32.VirtualFree

sub_31302E37(a827):
	KERNEL32.CreateEventA
	KERNEL32.Sleep
	ADVAPI32.AbortSystemShutdownA
	KERNEL32.TerminateThread
	KERNEL32.CloseHandle

	"u9x"
	"u6"
	"u7"
	"u9"
	"uterm_9"

sub_31301631(abb0):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpyn
	USER32.wsprintfA
	MSVCRT.memcpy
	MSVCRT.strlen
	MSVCRT.memset
	WS2_32.htons
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlen
	WS2_32.shutdown
	WS2_32.closesocket

sub_31302260(b3a1):
	KERNEL32.GetTickCount
	WS2_32.select
	WS2_32.recv
	KERNEL32.Sleep
	WS2_32.closesocket

sub_31302BA6(b95f):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_31302A6D(bc62):
	KERNEL32.GetTickCount
	MSVCRT.srand

sub_31301E2A(bca3):
	KERNEL32.lstrcpyn

sub_313020A2(bf8d):
	MSVCRT.strstr
	KERNEL32.lstrlen
	KERNEL32.lstrcpyn
	USER32.wsprintfA
	WS2_32.send

	"PING"
	"PONG%s\r\n"

sub_31303641(c316):
	KERNEL32.GetModuleFileNameA
	KERNEL32.lstrcmpi

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Client"
	"Software\\Microsoft\\Wireless"
	"Client"
	"Software\\Microsoft\\Wireless"

sub_31302755(d1b4):
	MSVCRT.strstr
	KERNEL32.GetTickCount
	USER32.wsprintfA
	KERNEL32.lstrlen
	MSVCRT.strchr
	KERNEL32.lstrcmp
	KERNEL32.lstrcpy
	MSVCRT.atoi
	MSVCRT.rand
	KERNEL32.lstrcat

	"-1,%d"
	"e"
	"|"
	"i"
	"%d,%d,9%s,%d"
	"q"
	"JOIN"

sub_313011B9(d285):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_31302125(d435):
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlen
	WS2_32.send
	WS2_32.recv
	MSVCRT.strstr
	KERNEL32.lstrcpyn

	"JOIN	%s\r\n"
	"451"
	"PING"

sub_31303196(d615):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_313030B2(db21):
	MSVCRT.rand
	KERNEL32.Sleep

sub_31303112(db96):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_31301E60(e24b):
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlen
	WS2_32.send
	MSVCRT.strstr
	WS2_32.closesocket

	"PASS	%s\r\n"
	"NICK	%s\r\n"
	"already"
	"NICK	%s\r\n"
	"USER	%s 8 * :%s\r\n"

sub_31301562(e562):
	WS2_32.socket
	MSVCRT.memset
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.CreateEventA
	KERNEL32.CreateThread
	KERNEL32.CloseHandle
	KERNEL32.WaitForSingleObject

sub_31302AE5(e56c):
	MSVCRT.rand

sub_313023D4(e63f):
	KERNEL32.GetSystemTime
	MSVCRT.srand
	MSVCRT.rand

sub_31302D8D(e965):
	WS2_32.WSAStartup

sub_313011A0(fa42):
	KERNEL32.lstrcpy

	"cont"

sub_31302F59(fda7):
	MSVCRT.rand
	MSVCRT._mbscpy
	WS2_32.socket
	WS2_32.htonl
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.Sleep
	WS2_32.recv
	WS2_32.closesocket
	MSVCRT._mbscat
	MSVCRT.strlen
	WS2_32.send

	" : USERID : UNIX : "
	"\r\n"