sub_outside():
	KERNEL32.GetModuleHandleA
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess
	KERNEL32.Sleep
	WININET.InternetGetConnectedState

sub_30901F5B(09ff):
	MSVCRT.memset
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_30902881(12a2):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_30901F0A(1a20):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_309027F3(2057):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_30902505(2344):
	MSVCRT.rand
	KERNEL32.Sleep

sub_309016E7(23eb):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_30901736(2986):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_30902036(3338):
	WS2_32.recv
	MSVCRT.strstr
	WS2_32.send
	USER32.wsprintfA
	MSVCRT.strlen
	KERNEL32.Sleep
	KERNEL32.InterlockedIncrement
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread

	"GET"
	".exe"
	"HTTP/1.1 200 OK\r\nContent-Type: applicat"...
	"Content-Length: %u\r\n\r\n"
	"HTTP/1.1 200 OK\r\n\r\n\r\n"

sub_30901EF0(336c):
	KERNEL32.CreateThread

sub_309015C7(3495):
	KERNEL32.GetLocaleInfoA
	USER32.wsprintfA
	WININET.InternetOpenA
	WININET.InternetOpenUrlA
	WININET.InternetReadFile
	WININET.InternetCloseHandle

	"skzqjahfychzdvh"
	"http://%s/index.php?id=%s&scn=%d&inf=%d"...
	"http://%s"
	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...

sub_30902C44(3cd5):
	KERNEL32.VirtualAlloc

sub_3090169C(4457):
	MSVCRT.rand
	KERNEL32.Sleep

sub_30901D20(4891):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.GetCurrentProcess

	"advapi32"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"SeDebugPrivilege"

sub_30901316(48f8):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_3090217C(52a4):
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.memset
	MSVCRT.rand
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_309011A0(531a):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcat
	KERNEL32.lstrlen
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
	"\\"
	".exe"

sub_30902006(53a4):
	KERNEL32.OpenEventA
	KERNEL32.SetEvent

sub_30901752(7512):
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	ADVAPI32.CryptDestroyHash

sub_30902828(75ba):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_30902569(7a74):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_3090298C(7c2b):
	"Windows	Security Manager"
	"Disk Defragmenter"
	"System Restore Service"
	"Bot Loader"
	"WinUpdate"
	"Windows	Update Service"
	"avserve.exe"
	"avserve2.exeUpdate Service"
	"MS Config v13"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901DA8(7e12):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	USER32.FindWindowA
	USER32.GetForegroundWindow
	USER32.GetWindowThreadProcessId
	KERNEL32.OpenProcess
	KERNEL32.WriteProcessMemory
	KERNEL32.CloseHandle

	"kernel32"
	"VirtualAllocEx"
	"CreateRemoteThread"
	"uterm16"

sub_30901FF0(81da):
	WININET.InternetGetConnectedState

sub_30902356(82c5):
	KERNEL32.WaitForSingleObject

sub_30902020(85d4):
	MSVCRT.rand

sub_309028D4(87a6):
	KERNEL32.lstrlen
	KERNEL32.CreateToolhelp32Snapshot
	MSVCRT.memset
	KERNEL32.Process32First
	MSVCRT.strstr
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.Process32Next

sub_30902B06(99c3):
	KERNEL32.GetModuleFileNameA
	MSVCRT.rand
	KERNEL32.lstrlen
	KERNEL32.lstrcpy
	KERNEL32.lstrcmpi

	"Software\\Microsoft\\Wireless"
	"ID"
	"skzqjahfychzdvh"
	"ID"
	"skzqjahfychzdvh"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Client"
	"Client"

sub_309026B8(a67f):
	WS2_32.inet_ntoa
	KERNEL32.lstrcpy
	USER32.wsprintfA
	KERNEL32.lstrlen

	"http://%s:%d/x.exe"

sub_30901EE1(a71a):
	KERNEL32.CreateMutexA

sub_30902C58(a71a):
	KERNEL32.VirtualFree

sub_309017B9(abb0):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpyn
	USER32.wsprintfA
	MSVCRT.memcpy
	MSVCRT.strlen
	MSVCRT.memset
	WS2_32.htons
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlen
	WS2_32.shutdown
	WS2_32.closesocket

sub_30901FB1(b95f):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_30901EB3(bc62):
	KERNEL32.GetTickCount
	MSVCRT.srand

sub_30902A3A(da9a):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcat
	KERNEL32.CopyFileA
	KERNEL32.lstrlen
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	".exe"
	"\\"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_30901422(df51):
	MSVCRT.strstr
	KERNEL32.lstrlen
	MSVCRT.strchr

	"zer0"

sub_30901F2B(e56c):
	MSVCRT.rand

sub_309022C0(e965):
	WS2_32.WSAStartup

sub_309025F1(ed82):
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_3090236A(fc0b):
	KERNEL32.CreateEventA
	KERNEL32.LoadLibraryA
	ADVAPI32.AbortSystemShutdownA
	KERNEL32.Sleep

	"u16x"
	"u10x"
	"u8"
	"u9"
	"u10"
	"u11"
	"u12"
	"u13"
	"u14"
	"u15"
	"u16"
	"ws2_32"
	"wininet"
	"msvcrt"
	"advapi32"
	"user32"
	"uterm16"