sub_outside():
	KERNEL32.GetCurrentProcessId
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetProcessHeap
	KERNEL32.GetTickCount
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetVersion
	KERNEL32.GlobalFindAtomA
	KERNEL32.GetCurrentThreadId
	KERNEL32.GlobalDeleteAtom

sub_406E2B(0136):
	KERNEL32.GetVersion
	KERNEL32.GetProcessHeap
	USER32.GetForegroundWindow
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetTickCount
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId

	"value"
	"name"
	"o€p*"
	"AcBLs"
	"J$xE+?"
	"9EBƒ#"
	"^85/4=|"
	" w*UN@"
	"Ñ ¬¤£½ªÀ«¢¿ ²ÈµÓÍ"
	"Ñ«¿¬ ¨²ÈµÀ«¢¿ ²ÈµÓÍ"
	"ƒ;AKuX"
	"‘"
	" E~^W"
	"u;D "
	"=="
	"T6Rr"
	",F`>a"
	"MI ~j"
	"‚SAg0"
	"ÍÈµ×"
	"×"
	"Í"
	"S ht|"
	"ÃŠ‚‚ŠˆÃ"
	"ÃŠ‚‚ŠˆÃŒ‰šŒŸˆ"
	"W ^ƒ"
	"d:x`n"

sub_4028A6(0275):
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetVersion
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetTickCount

sub_40A766(03fc):
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetSystemDirectoryA
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle
	KERNEL32.GlobalAddAtomA
	KERNEL32.GetVersion
	KERNEL32.GetVersionExA
	KERNEL32.GetTickCount
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetCurrentThreadId
	KERNEL32.CopyFileA
	KERNEL32.WinExec
	KERNEL32.ExitProcess
	KERNEL32.GetWindowsDirectoryA
	USER32.LoadCursorA
	USER32.LoadIconA
	GDI32.GetStockObject
	USER32.RegisterClassA
	KERNEL32.GetCurrentProcessId
	USER32.CreateWindowExA
	KERNEL32.CreateMutexA
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	KERNEL32.CreateThread
	USER32.SetTimer
	USER32.TranslateMessage
	USER32.DispatchMessageA
	USER32.GetMessageA

	"qk  "
	"ÈÃÌÏÁÈÉÞË"
	"C:\\WINDOWS\\System32"
	"3hAy"
	"KKQHOOK"
	"Software\\Microsoft\\Windows"
	"<8B=tf€"
	"_r&‚nx"
	"C:\\WINDOWS\\System32"
	"KKQHOOK"
	"Software\\Microsoft\\Windows"
	"kkq32.dll"
	"C:\\WINDOWS\\System32"
	"dnkkq.dll"
	"C:\\WINDOWS\\System32"
	"datkkq32.dll"
	"C:\\WINDOWS\\System32"
	"KKQHOOK"
	"KKQHOOK"
	"KKQHOOK"
	"KKQHOOK_28"
	"ÆÈßÃÈÁžŸƒÉÁÁ"
	"|vCXS"
	" w bqy "
	"W!aS@"
	"l:K VM~"
	"Sc g"
	"3Sd_"
	"^+k!~T"

sub_40494F(078e):
	"PMAAL"

sub_4024C1(07e2):
	KERNEL32.GetTickCount
	KERNEL32.GetCurrentProcessId

sub_401D14(0c98):
	KERNEL32.GetTickCount
	KERNEL32.GetVersion
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId

	"l2r-6;."
	"F 5 0z"

sub_4040AA(0e15):
	KERNEL32.IsDebuggerPresent
	ADVAPI32.RegSetValueExA
	KERNEL32.GetProcessHeap
	ADVAPI32.RegCloseKey

sub_4053A1(0f85):
	KERNEL32.GetVersion
	KERNEL32.GetProcessHeap
	WININET.FindFirstUrlCacheEntryA
	KERNEL32.GetTickCount
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId
	WININET.FindNextUrlCacheEntryA
	KERNEL32.GetCurrentThreadId

	"W _07ye"

sub_404878(14fd):
	KERNEL32.GetVersion

	"af"

sub_4085D0(1db6):
	KERNEL32.GetProcessHeap
	KERNEL32.GetVersion
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.GetCurrentProcessId
	KERNEL32.CloseHandle
	KERNEL32.GetSystemDirectoryA
	KERNEL32.IsDebuggerPresent
	KERNEL32.DeleteFileA
	KERNEL32.WinExec
	KERNEL32.GetTickCount

	"c:\\boot.sys"
	"í»”«¥¬æ¸¡®"

sub_404194(1f68):
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetVersionExA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetProcessHeap
	KERNEL32.GetWindowsDirectoryA
	KERNEL32.GetTickCount
	KERNEL32.GetVersion
	KERNEL32.DeleteFileA
	KERNEL32.CreateFileA
	KERNEL32.GetCurrentThreadId
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.WinExec

	"%&nb.ya"
	"  $~@p"
	" p"
	" vK%;"
	"—ÁÂÂÝ §íÉÈÁˆÞ“ÃØÁ §íÄËÈÕÄÞÙˆÞÊÂÙÂÁ"...
	"ˆÞ‚îˆÞ"

sub_4036F2(239f):
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetCurrentProcessId
	KERNEL32.GlobalAddAtomA

sub_408BE4(35e3):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA
	KERNEL32.TerminateProcess
	KERNEL32.DeleteFileA

	".htm"
	"<iframe	src=http://kavkazcenter.c"...
	"Path"
	"Software\\Microsoft\\IE Setup\\Setup"
	"\\Iexplore.exe "
</font></pre></td></tr><tr id="sub_401B9A"><td><pre><a name="sub_401B9A"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_401B9A"><font size=+2>sub_401B9A</a>(3ff5)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.IsDebuggerPresent
	KERNEL32.lstrlen
	KERNEL32.GetVersion</font>
<font color=brown>
	"rr/+Q€"
</font></pre></td></tr><tr id="sub_401A36"><td><pre><a name="sub_401A36"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_401A36"><font size=+2>sub_401A36</a>(40f6)</font>:<font color=darkgreen>
	KERNEL32.CreateFileA
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetFileSize
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LocalAlloc
	KERNEL32.IsDebuggerPresent
	KERNEL32.ReadFile
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_40457C"><td><pre><a name="sub_40457C"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40457C"><font size=+2>sub_40457C</a>(4111)</font>:<font color=darkgreen>
	USER32.CreateDesktopA</font>
<font color=brown></font></pre></td></tr><tr id="sub_4069E2"><td><pre><a name="sub_4069E2"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4069E2"><font size=+2>sub_4069E2</a>(4242)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetProcessHeap
	KERNEL32.GetVersion
	KERNEL32.GetCurrentThreadId</font>
<font color=brown>
	"{9BA05972-F6A8-11CF-A442-00A0C90A8F39}"
</font></pre></td></tr><tr id="sub_405527"><td><pre><a name="sub_405527"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_405527"><font size=+2>sub_405527</a>(450b)</font>:<font color=darkgreen>
	KERNEL32.lstrlen
	KERNEL32.LocalAlloc
	KERNEL32.GetCurrentThreadId</font>
<font color=brown>
	"#Xa/I"
	"\t_\tO\tO"
</font></pre></td></tr><tr id="sub_4062CD"><td><pre><a name="sub_4062CD"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4062CD"><font size=+2>sub_4062CD</a>(453a)</font>:<font color=darkgreen>
	KERNEL32.InterlockedIncrement
	KERNEL32.LocalFree
	KERNEL32.ExpandEnvironmentStringsA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId
	KERNEL32.IsDebuggerPresent
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	USER32.FindWindowA
	KERNEL32.Sleep
	KERNEL32.GetVersion
	USER32.GetWindowTextA
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetTickCount
	KERNEL32.CopyFileA
	KERNEL32.DeleteFileA
	KERNEL32.lstrlen
	KERNEL32.TerminateProcess</font>
<font color=brown>
	"&JV_"
	"|MXD"
	"C€Yc_"
	"eij^MAI"
	"X-okRecv11"
	"Ik"
	"<HTML><!--"
	"<HTML><!--"
	"<HTML><!--"
</font></pre></td></tr><tr id="sub_408189"><td><pre><a name="sub_408189"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_408189"><font size=+2>sub_408189</a>(454e)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetVersion
	KERNEL32.GetCurrentThreadId
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_40B01B"><td><pre><a name="sub_40B01B"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40B01B"><font size=+2>sub_40B01B</a>(481e)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlGetLastWin32Error
	USER32.SetFocus
	KERNEL32.GetProcessHeap
	USER32.CallWindowProcA</font>
<font color=brown></font></pre></td></tr><tr id="sub_404D25"><td><pre><a name="sub_404D25"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404D25"><font size=+2>sub_404D25</a>(484d)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_404586"><td><pre><a name="sub_404586"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404586"><font size=+2>sub_404586</a>(4b88)</font>:<font color=darkgreen>
	USER32.SetThreadDesktop
	KERNEL32.GetVersion</font>
<font color=brown>
	" K0i=J "
</font></pre></td></tr><tr id="sub_404D49"><td><pre><a name="sub_404D49"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404D49"><font size=+2>sub_404D49</a>(4d24)</font>:<font color=darkgreen>
	KERNEL32.GetProcessHeap</font>
<font color=brown>
	"04 kU"
</font></pre></td></tr><tr id="sub_402A4D"><td><pre><a name="sub_402A4D"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_402A4D"><font size=+2>sub_402A4D</a>(4f3b)</font>:<font color=darkgreen>
	KERNEL32.GetVersion
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetProcessHeap
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.GetTickCount
	KERNEL32.IsBadReadPtr
	KERNEL32.GlobalMemoryStatus
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetModuleHandleA
	NTDLL.RtlZeroMemory
	KERNEL32.VirtualQuery
	KERNEL32.GetCurrentThreadId
	KERNEL32.IsBadWritePtr</font>
<font color=brown>
	"tz|&>T6"
	"lJ0YrFP"
	"kernel32.dll"
	"LVDW.X"
</font></pre></td></tr><tr id="sub_404527"><td><pre><a name="sub_404527"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404527"><font size=+2>sub_404527</a>(538c)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetCurrentThreadId
	USER32.GetThreadDesktop
	KERNEL32.GetTickCount</font>
<font color=brown>
	"blind_user"
</font></pre></td></tr><tr id="sub_404663"><td><pre><a name="sub_404663"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404663"><font size=+2>sub_404663</a>(551c)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetProcessHeap
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId</font>
<font color=brown>
	"unG9	Q"
</font></pre></td></tr><tr id="sub_404A38"><td><pre><a name="sub_404A38"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404A38"><font size=+2>sub_404A38</a>(5736)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"AARL"
</font></pre></td></tr><tr id="sub_404FEF"><td><pre><a name="sub_404FEF"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404FEF"><font size=+2>sub_404FEF</a>(65f4)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	ADVAPI32.GetSidIdentifierAuthority
	ADVAPI32.GetSidSubAuthorityCount
	KERNEL32.GetCurrentThreadId
	KERNEL32.IsDebuggerPresent
	USER32.wsprintfA
	KERNEL32.GetProcessHeap
	ADVAPI32.GetSidSubAuthority</font>
<font color=brown>
	":U*~"
</font></pre></td></tr><tr id="sub_404B85"><td><pre><a name="sub_404B85"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404B85"><font size=+2>sub_404B85</a>(67bf)</font>:<font color=darkgreen>
	KERNEL32.GetProcessHeap
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId</font>
<font color=brown>
	"C6k|P=9"
</font></pre></td></tr><tr id="sub_40107A"><td><pre><a name="sub_40107A"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40107A"><font size=+2>sub_40107A</a>(6c44)</font>:<font color=darkgreen>
	NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_4052EF"><td><pre><a name="sub_4052EF"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4052EF"><font size=+2>sub_4052EF</a>(763e)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_4045B7"><td><pre><a name="sub_4045B7"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4045B7"><font size=+2>sub_4045B7</a>(7677)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId</font>
<font color=brown>
	"blind_user"
</font></pre></td></tr><tr id="sub_408E89"><td><pre><a name="sub_408E89"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_408E89"><font size=+2>sub_408E89</a>(7861)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetTickCount
	USER32.ShowWindow
	USER32.GetWindowRect
	USER32.CreateWindowExA
	KERNEL32.GetCurrentThreadId
	GDI32.CreateFontA
	KERNEL32.IsDebuggerPresent
	USER32.SendMessageA
	KERNEL32.GetVersion
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetProcessHeap
	USER32.GetWindowLongA
	USER32.SetWindowLongA
	USER32.SetFocus</font>
<font color=brown>
	"éÂÎâÏÇÈÎÙ"
	"èÕÝÁÂßÈß"
	"KKQHOOK"
	"§ìØÙÅÂßÄ×ÌÙÄÂÃëÌÄÁÈÉƒ"
	"xOLa%"
	"6S7+P"
	"ˆƒŸØ"
	"ŸˆƒŸØ"
	"èÕÝÄßÌÙÄÂÃÉÌÙÈ"
	"A&y I"
	" d‚yTB"
</font></pre></td></tr><tr id="sub_40223C"><td><pre><a name="sub_40223C"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40223C"><font size=+2>sub_40223C</a>(7e51)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"ntdll.dll"
	"€_utc*2"
	"RtlInitUnicodeString"
	"NtUnmapViewOfSection"
	"NtMapViewOfSection"
	"RtlNtStatusToDosError"
</font></pre></td></tr><tr id="sub_407F67"><td><pre><a name="sub_407F67"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_407F67"><font size=+2>sub_407F67</a>(80de)</font>:<font color=darkgreen>
	KERNEL32.GetVersion
	NTDLL.RtlGetLastWin32Error
	KERNEL32.IsDebuggerPresent</font>
<font color=brown></font></pre></td></tr><tr id="sub_406987"><td><pre><a name="sub_406987"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_406987"><font size=+2>sub_406987</a>(83d9)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId</font>
<font color=brown></font></pre></td></tr><tr id="sub_405F79"><td><pre><a name="sub_405F79"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_405F79"><font size=+2>sub_405F79</a>(86b0)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetTickCount
	KERNEL32.GetVersion
	KERNEL32.IsDebuggerPresent</font>
<font color=brown>
	" * 7YNJ"
	"n^C[_IbI[|^COI__"
	"cowt9N"
	"k@CNM@y_I^cJJ@EBI"
</font></pre></td></tr><tr id="sub_40C434"><td><pre><a name="sub_40C434"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40C434"><font size=+2>sub_40C434</a>(8c45)</font>:<font color=darkgreen>
	KERNEL32.GetCommandLineA
	KERNEL32.GetModuleHandleA</font>
<font color=brown></font></pre></td></tr><tr id="sub_4014BD"><td><pre><a name="sub_4014BD"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4014BD"><font size=+2>sub_4014BD</a>(8cf4)</font>:<font color=darkgreen>
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey</font>
<font color=brown>
	"m i5"
	"4%ec"
	"xU t"
</font></pre></td></tr><tr id="sub_4087C3"><td><pre><a name="sub_4087C3"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4087C3"><font size=+2>sub_4087C3</a>(91d5)</font>:<font color=darkgreen>
	KERNEL32.VirtualAlloc</font>
<font color=brown></font></pre></td></tr><tr id="sub_4022CC"><td><pre><a name="sub_4022CC"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4022CC"><font size=+2>sub_4022CC</a>(91e2)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetProcessHeap
	ADVAPI32.GetSecurityInfo
	KERNEL32.GetVersion
	ADVAPI32.SetEntriesInAclA
	ADVAPI32.SetSecurityInfo
	KERNEL32.CloseHandle</font>
<font color=brown>
	"hgtr"
	"\\device\\physicalmemory"
	"Q!okgOJ"
	"Xƒhyb.‚"
	"CURRENT_USER"
</font></pre></td></tr><tr id="sub_40518F"><td><pre><a name="sub_40518F"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40518F"><font size=+2>sub_40518F</a>(9c96)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	ADVAPI32.OpenProcessToken
	KERNEL32.CloseHandle
	KERNEL32.LocalAlloc
	ADVAPI32.GetTokenInformation
	KERNEL32.LocalFree</font>
<font color=brown></font></pre></td></tr><tr id="sub_40B143"><td><pre><a name="sub_40B143"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40B143"><font size=+2>sub_40B143</a>(9cf6)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentThreadId
	USER32.GetWindowRect
	USER32.MoveWindow
	KERNEL32.GetTickCount
	USER32.PostQuitMessage
	USER32.DestroyWindow
	KERNEL32.GetVersion
	GDI32.SetTextColor
	GDI32.SetBkColor
	GDI32.CreateBrushIndirect
	USER32.GetWindowTextA
	USER32.MessageBoxA
	USER32.SetFocus
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetProcessHeap
	KERNEL32.IsDebuggerPresent
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	USER32.ShowWindow
	USER32.DefWindowProcA</font>
<font color=brown>
	" 9'O1"
	"éÂÎâÏÇÈÎÙ"
	"èÕÝÁÂßÈß"
	"ev# "
	"‚8+8	0k"
	"ˆÞ"
	"A?5m"
	"ˆÞˆÞ"
	"ˆÞ€ˆÞ"
	"ˆÞˆÞ"
	" §"
	"ShzQ"
	""
</font></pre></td></tr><tr id="sub_40801C"><td><pre><a name="sub_40801C"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40801C"><font size=+2>sub_40801C</a>(a0e6)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	KERNEL32.CreateThread
	KERNEL32.CloseHandle</font>
<font color=brown>
	"2 U	 "
</font></pre></td></tr><tr id="sub_405601"><td><pre><a name="sub_405601"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_405601"><font size=+2>sub_405601</a>(a961)</font>:<font color=darkgreen>
	KERNEL32.LocalFree
	KERNEL32.lstrlen
	KERNEL32.LocalAlloc
	KERNEL32.GetTempPathA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetTickCount
	KERNEL32.GetProcessHeap
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetVersion
	KERNEL32.GetCurrentThreadId
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle</font>
<font color=brown>
	"mk,qe9"
	"K &,"
	"\t_\tO\tO"
	"cc‚ j8"
	"tRƒnn"
	"hZ.*~b!"
	"Axq@;mI"
</font></pre></td></tr><tr id="sub_403610"><td><pre><a name="sub_403610"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_403610"><font size=+2>sub_403610</a>(a9c7)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetVersion</font>
<font color=brown></font></pre></td></tr><tr id="sub_404098"><td><pre><a name="sub_404098"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404098"><font size=+2>sub_404098</a>(aa74)</font>:<font color=darkgreen>
	ADVAPI32.RegCreateKeyExA
	KERNEL32.GetVersion</font>
<font color=brown></font></pre></td></tr><tr id="sub_4015EB"><td><pre><a name="sub_4015EB"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4015EB"><font size=+2>sub_4015EB</a>(aae1)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetCurrentThreadId
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetVersion</font>
<font color=brown>
	"D GU"
</font></pre></td></tr><tr id="sub_406A9A"><td><pre><a name="sub_406A9A"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_406A9A"><font size=+2>sub_406A9A</a>(ab51)</font>:<font color=darkgreen>
	KERNEL32.GetProcessHeap
	USER32.GetWindowTextA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetTickCount</font>
<font color=brown>
	":40?"
	"‡£©¸¥¹¥¬¾êƒ¤¾¯¸¤¯¾ê²º¦¥¸¯¸"
	"N DLYO"
	"T2vxO"
	"W'WAVƒ`"
</font></pre></td></tr><tr id="sub_40692E"><td><pre><a name="sub_40692E"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40692E"><font size=+2>sub_40692E</a>(ae77)</font>:<font color=darkgreen>
	KERNEL32.lstrlenW
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_40A704"><td><pre><a name="sub_40A704"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40A704"><font size=+2>sub_40A704</a>(af8e)</font>:<font color=darkgreen>
	KERNEL32.OpenMutexA
	KERNEL32.GetTickCount
	KERNEL32.CloseHandle
	KERNEL32.GetCurrentThreadId</font>
<font color=brown>
	"KKQHOOK_28"
</font></pre></td></tr><tr id="sub_401334"><td><pre><a name="sub_401334"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_401334"><font size=+2>sub_401334</a>(b20b)</font>:<font color=darkgreen>
	KERNEL32.GetProcessHeap
	KERNEL32.GetCurrentThreadId
	KERNEL32.CreateFileA
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	" vK%;"
	"Byxy"
</font></pre></td></tr><tr id="sub_402572"><td><pre><a name="sub_402572"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_402572"><font size=+2>sub_402572</a>(b495)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetTickCount</font>
<font color=brown>
	"A^9S"
</font></pre></td></tr><tr id="sub_4088D5"><td><pre><a name="sub_4088D5"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4088D5"><font size=+2>sub_4088D5</a>(b745)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlZeroMemory
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetTickCount
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetVersion</font>
<font color=brown></font></pre></td></tr><tr id="sub_401806"><td><pre><a name="sub_401806"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_401806"><font size=+2>sub_401806</a>(bc0d)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetTickCount
	KERNEL32.GetVersion
	KERNEL32.GetProcessHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_4034D8"><td><pre><a name="sub_4034D8"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4034D8"><font size=+2>sub_4034D8</a>(c5cf)</font>:<font color=darkgreen>
	KERNEL32.GetProcessHeap
	KERNEL32.GetTickCount
	KERNEL32.GlobalFindAtomA
	KERNEL32.GlobalDeleteAtom</font>
<font color=brown>
	"R6"
</font></pre></td></tr><tr id="sub_404DE5"><td><pre><a name="sub_404DE5"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_404DE5"><font size=+2>sub_404DE5</a>(c8e0)</font>:<font color=brown>
	"‚PA1"
	"@0Y "
	"af"
</font></pre></td></tr><tr id="sub_4037EF"><td><pre><a name="sub_4037EF"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4037EF"><font size=+2>sub_4037EF</a>(d54c)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentProcessId
	KERNEL32.GlobalAddAtomA</font>
<font color=brown>
	"$"
</font></pre></td></tr><tr id="sub_403C5F"><td><pre><a name="sub_403C5F"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_403C5F"><font size=+2>sub_403C5F</a>(d953)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetVersion
	KERNEL32.GetProcessHeap
	KERNEL32.GetCurrentThreadId
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetTickCount</font>
<font color=brown>
	"N4/u"
	"v e~m"
	"k&PYESN"
	"aJ"
	"C:\\WINDOWS\\System32"
</font></pre></td></tr><tr id="sub_402465"><td><pre><a name="sub_402465"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_402465"><font size=+2>sub_402465</a>(e147)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetTickCount
	KERNEL32.GetCurrentThreadId</font>
<font color=brown></font></pre></td></tr><tr id="sub_4039D6"><td><pre><a name="sub_4039D6"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4039D6"><font size=+2>sub_4039D6</a>(ea2f)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetVolumeInformationA
	KERNEL32.GetVersion</font>
<font color=brown>
	" K0i=J "
	"ª¿·×"
</font></pre></td></tr><tr id="sub_408DEF"><td><pre><a name="sub_408DEF"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_408DEF"><font size=+2>sub_408DEF</a>(ebe6)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	USER32.GetWindow
	USER32.GetClassNameA</font>
<font color=brown></font></pre></td></tr><tr id="sub_403AA3"><td><pre><a name="sub_403AA3"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_403AA3"><font size=+2>sub_403AA3</a>(ec2f)</font>:<font color=darkgreen>
	KERNEL32.GetCurrentProcessId
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleFileNameA
	KERNEL32.WinExec</font>
<font color=brown>
	"kg7x_"
	"oW"
	"C:\\WINDOWS\\System32"
	"|+V|;R"
</font></pre></td></tr><tr id="sub_4087F1"><td><pre><a name="sub_4087F1"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_4087F1"><font size=+2>sub_4087F1</a>(ed79)</font>:<font color=darkgreen>
	KERNEL32.VirtualFree
	KERNEL32.GetCurrentThreadId</font>
<font color=brown></font></pre></td></tr><tr id="sub_408A95"><td><pre><a name="sub_408A95"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_408A95"><font size=+2>sub_408A95</a>(f43a)</font>:<font color=darkgreen>
	KERNEL32.IsDebuggerPresent
	KERNEL32.GetTickCount
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
	"jWOu	J?"
</font></pre></td></tr><tr id="sub_40404B"><td><pre><a name="sub_40404B"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40404B"><font size=+2>sub_40404B</a>(f508)</font>:<font color=brown>
	" US6€rH"
</font></pre></td></tr><tr id="sub_403449"><td><pre><a name="sub_403449"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_403449"><font size=+2>sub_403449</a>(f5e8)</font>:<font color=darkgreen>
	KERNEL32.GetVersion
	KERNEL32.GlobalAddAtomA</font>
<font color=brown>
	" OQD"
</font></pre></td></tr><tr id="sub_403383"><td><pre><a name="sub_403383"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_403383"><font size=+2>sub_403383</a>(f6b7)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetCurrentProcessId</font>
<font color=brown></font></pre></td></tr><tr id="sub_40847D"><td><pre><a name="sub_40847D"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_40847D"><font size=+2>sub_40847D</a>(f80f)</font>:<font color=darkgreen>
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetTickCount
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.SetFileTime
	KERNEL32.CloseHandle</font>
<font color=brown>
	"M‚wp"
</font></pre></td></tr><tr id="sub_409847"><td><pre><a name="sub_409847"></a><a href="5a0ec6ef259796feb166cc67e65a50a8_unpacked.asm.html#sub_409847"><font size=+2>sub_409847</a>(fc7b)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	KERNEL32.GetCurrentProcessId
	KERNEL32.GetProcessHeap
	KERNEL32.GetVersion
	KERNEL32.DeleteFileA
	KERNEL32.GetCurrentThreadId
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CloseHandle
	KERNEL32.IsDebuggerPresent
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetWindowsDirectoryA
	KERNEL32.WinExec
	KERNEL32.LocalFree</font>
<font color=brown>
	"xe#xW7"
	"s* ztw"
	" MC_O9"
	"C:\\WINDOWS\\System32"
	"v?Z,P"
	"ÅÙÙÝ—‚‚ˆÞ"
	"‚"
	"‚ÚÎÈÞÆƒÝÅÝ"
	"ÄËÎ"
	"9y|'&"
	"Rl J"
	"’ÄËÎˆØ"
	"Me0/€&P"
	"Ü"
	"KKQHOOK"
	" @_a&P1"
	"ÄËÎ"
	"L LE"
	"*8bd3"
	"WX$Q"
	"ÚÝÞÙ"
	"yX>c	,"
	"!ddJrm*"
	"ofstkkq"
	"Software\\Microsoft\\Windows"
	"Ü"
	"KKQHOOK"
	"ofstkkq"
	"Software\\Microsoft\\Windows"
	" P'y&n"
	"ofstkkqc"
	"Software\\Microsoft\\Windows"
	"7 EmEn;"
	"C:\\WINDOWS\\System32"
	"Ü"
	"KKQHOOK"
	"sx"
	"ofstkkqc"
	"Software\\Microsoft\\Windows"
	"’ÉÀÝŸ"
	"Ü"
	"KKQHOOK"
	"—ˆŸØ"
	"ˆÞ‚îˆÞ"
	"ÚØÝÉ"
	"C:\\WINDOWS\\System32"
	"ÕÉŸ"
	"Ü"
	"ÃÈÚÛÈß"
</font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html>