sub_outside():
	WS2_32.send
	KERNEL32.Sleep
	KERNEL32.InterlockedIncrement
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread
	KERNEL32.GetModuleHandleA
	WS2_32.WSAStartup
	KERNEL32.GetCommandLineA
	MSVCRT.strstr
	KERNEL32.DeleteFileA
	KERNEL32.GetTickCount
	MSVCRT.srand
	KERNEL32.CreateMutexA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.ExitProcess
	ADVAPI32.AbortSystemShutdownA
	WS2_32.htons

sub_4015E0(0059):
	WS2_32.socket
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.CreateEventA
	KERNEL32.CreateThread
	KERNEL32.CloseHandle
	KERNEL32.WaitForSingleObject

sub_402090(0770):
	MSVCRT.strstr
	KERNEL32.lstrlen
	KERNEL32.lstrcpyn
	USER32.wsprintfA
	WS2_32.send

	"PING"
	"PONG%s\r\n"

sub_402510(158f):
	KERNEL32.GetSystemTime
	MSVCRT.srand
	MSVCRT.rand
	KERNEL32.GetTickCount

sub_4011D0(15b9):
	ADVAPI32.CryptDestroyKey
	ADVAPI32.CryptReleaseContext

sub_403540(2b5c):
	KERNEL32.GetModuleFileNameA
	KERNEL32.lstrcmpi

	"WinUpdate"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
	"1"
	"Server"
	"Software\\Microsoft\\Wireless"
	"Server"
	"Software\\Microsoft\\Wireless"
	"Server"
	"Software\\Microsoft\\Wireless"

sub_402480(2bc9):
	KERNEL32.lstrlen
	USER32.wsprintfA
	KERNEL32.Sleep
	WS2_32.send

	"PRIVMSG %s	%s\r\n"

sub_402790(3d03):
	WININET.InternetOpenA
	KERNEL32.GetSystemDirectoryA
	KERNEL32.lstrcat
	KERNEL32.lstrlen
	KERNEL32.CreateFileA
	WININET.InternetOpenUrlA
	KERNEL32.CloseHandle
	WININET.InternetReadFile
	KERNEL32.WriteFile

	"Mozilla/4.0 (compatible; MSIE	6.0; Wind"...
	"\\"
	".exe"

sub_402B30(420a):
	MSVCRT.rand

sub_402120(4537):
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlen
	WS2_32.send
	WS2_32.recv
	MSVCRT.strstr
	KERNEL32.lstrcpyn

	"JOIN	%s\r\n"
	"451"
	"PING"

sub_403370(4c6f):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_401C90(50da):
	MSVCRT.strchr

	"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
	"abcdefghijklmnopqrstuvwxyz"

sub_4022A0(54c9):
	KERNEL32.GetTickCount
	WS2_32.select
	WS2_32.closesocket
	WS2_32.recv
	KERNEL32.Sleep
	MSVCRT.rand
	KERNEL32.lstrlen

	"hi :)"
	"hehe"
	"cool!"
	"yo!"

sub_402230(6885):
	MSVCRT.rand
	USER32.wsprintfA
	KERNEL32.lstrlen
	WS2_32.send
	WS2_32.closesocket

	"QUIT	%s\r\n"

sub_403640(6922):
	KERNEL32.VirtualAlloc

sub_403660(6e9f):
	KERNEL32.VirtualFree

sub_402C20(6f7a):
	WS2_32.gethostname
	WS2_32.WSAGetLastError
	WS2_32.gethostbyname

sub_402CF0(709f):
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateFileA
	KERNEL32.ExitThread
	KERNEL32.GetFileSize
	KERNEL32.ReadFile
	KERNEL32.CloseHandle
	WS2_32.socket
	MSVCRT.rand
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept

sub_403460(75a6):
	KERNEL32.DeleteFileA
	KERNEL32.GetSystemDirectoryA
	MSVCRT.rand
	KERNEL32.lstrcat
	KERNEL32.CopyFileA
	KERNEL32.lstrlen
	KERNEL32.CloseHandle
	KERNEL32.WinExec
	KERNEL32.Sleep
	KERNEL32.ExitProcess

	".exe"
	"\\"
	"WinUpdate"
	"SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...

sub_402C70(81da):
	WININET.InternetGetConnectedState

sub_401150(91be):
	KERNEL32.lstrcpy

	"cont"

sub_402BE0(92b0):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_401DD0(97e3):
	KERNEL32.lstrcpyn

sub_401340(9b58):
	KERNEL32.GetSystemDirectoryA
	KERNEL32.SetCurrentDirectoryA
	KERNEL32.lstrcpyn
	KERNEL32.CreateFileA
	WS2_32.send
	WS2_32.recv
	KERNEL32.WriteFile
	KERNEL32.CloseHandle

sub_4031F0(9e74):
	KERNEL32.GetTickCount
	MSVCRT.srand
	MSVCRT.rand
	KERNEL32.InterlockedIncrement
	KERNEL32.Sleep

sub_4028D0(a8c1):
	MSVCRT.strstr
	KERNEL32.lstrlen
	MSVCRT.strchr
	KERNEL32.lstrcmp
	KERNEL32.GetTickCount
	KERNEL32.lstrcpy
	KERNEL32.lstrcat
	USER32.wsprintfA
	KERNEL32.ExitProcess

	"e"
	"|"
	"-1"
	"i"
	"%d,%d,5"
	"q"
	"JOIN"

sub_402590(ab94):
	KERNEL32.GetTickCount
	MSVCRT.srand
	MSVCRT.rand
	KERNEL32.Sleep
	KERNEL32.lstrcpy
	KERNEL32.lstrlen

	"q"

sub_4033F0(b427):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey

sub_402F80(b761):
	KERNEL32.GetTickCount
	MSVCRT.srand
	MSVCRT.rand
	WS2_32.socket
	WS2_32.htonl
	WS2_32.htons
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	KERNEL32.Sleep
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.send

	" : USERID : UNIX : "
	"\r\n"

sub_403330(bd03):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

sub_402B70(bd0b):
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle

sub_402B00(c7c9):
	KERNEL32.CreateThread
	KERNEL32.CloseHandle

sub_403190(d075):
	MSVCRT.rand
	KERNEL32.Sleep

sub_4016E0(d83c):
	WS2_32.socket
	WS2_32.inet_ntoa
	KERNEL32.lstrcpyn
	USER32.wsprintfA
	WS2_32.htons
	WS2_32.connect
	KERNEL32.Sleep
	WS2_32.send
	WS2_32.recv
	KERNEL32.lstrlen
	WS2_32.shutdown
	WS2_32.closesocket

sub_401E10(ddfc):
	WS2_32.socket
	WS2_32.htons
	WS2_32.connect
	WS2_32.recv
	USER32.wsprintfA
	KERNEL32.Sleep
	KERNEL32.lstrlen
	WS2_32.send
	MSVCRT.strstr
	WS2_32.closesocket

	"PASS	%s\r\n"
	"NICK	%s\r\n"
	"already"
	"NICK	%s\r\n"
	"already"
	"USER	%s 8 * :%s\r\n"

sub_4011F0(e3ae):
	KERNEL32.GetSystemTime
	KERNEL32.SystemTimeToFileTime
	WS2_32.recv
	ADVAPI32.CryptCreateHash
	ADVAPI32.CryptHashData
	ADVAPI32.CryptVerifySignatureA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CryptDestroyHash
	KERNEL32.GetTickCount
	MSVCRT.srand
	MSVCRT.rand
	WS2_32.send

sub_401170(e564):
	ADVAPI32.CryptAcquireContextA
	ADVAPI32.CryptImportKey

sub_402459(faad):
	WS2_32.closesocket

sub_401520(fc76):
	KERNEL32.SetEvent
	WS2_32.recv
	WS2_32.shutdown
	WS2_32.closesocket
	KERNEL32.ExitThread