sub_outside(): KERNEL32.GetSystemDirectoryA ADVAPI32.RegOpenKeyExA KERNEL32.GetTempPathA MSVCRT.__set_app_type MSVCRT.__p__fmode MSVCRT.__p__commode MSVCRT.__setusermatherr MSVCRT._initterm MSVCRT.__getmainargs KERNEL32.GetStartupInfoA MSVCRT.exit MSVCRT._XcptFilter MSVCRT._exit MSVCRT._acmdln KERNEL32.GetModuleHandleA KERNEL32.RaiseException KERNEL32.GetProcAddress KERNEL32.GetTickCount USER32.PostMessageA KERNEL32.CreateFileA KERNEL32.GetFileSize KERNEL32.CreateFileMappingA KERNEL32.MapViewOfFile KERNEL32.GetModuleFileNameA KERNEL32.GetTempFileNameA KERNEL32.WriteFile KERNEL32.CloseHandle GDI32.AddFontResourceA KERNEL32.DeleteFileA KERNEL32.SetFilePointer KERNEL32.ReadFile KERNEL32.GetSystemTimeAsFileTime KERNEL32.GetFileTime USER32.CharUpperBuffA KERNEL32.VirtualFree KERNEL32.FlushFileBuffers KERNEL32.LoadLibraryA KERNEL32.GetPrivateProfileSectionA |
sub_41CD74(0126): NTDLL.RtlLeaveCriticalSection |
sub_41363F(0126): NTDLL.RtlLeaveCriticalSection |
sub_415848(0126): NTDLL.RtlLeaveCriticalSection |
sub_410000(026c): NTDLL.RtlEnterCriticalSection |
sub_4014F0(0515): MSVCRT.wcscpy KERNEL32.lstrlen KERNEL32.MultiByteToWideChar WS2_32.WSCInstallProvider |
sub_41FEC6(0697): "invalid distance code" "invalid literal/length code" |
sub_41CBF6(094c): KERNEL32.GetModuleHandleA "CoCreateInstance" |
sub_41E42A(09b4): NTDLL.RtlLeaveCriticalSection |
sub_42031E(0a00): "unknown compression method" "invalid window size" "incorrect header check" "incorrect data check" "need dictionary" |
sub_41E77F(13df): KERNEL32.CreateFileMappingA |
sub_41E7BB(13df): KERNEL32.CreateFileMappingW |
sub_41BEBA(1432): NTDLL.RtlGetLastWin32Error KERNEL32.FormatMessageA USER32.wsprintfA "windows error %s\n at %s(%d)\n" |
sub_414315(1523): NTDLL.RtlLeaveCriticalSection |
sub_41015E(1575): GDI32.GetObjectA USER32.BeginPaint GDI32.CreateCompatibleDC GDI32.SelectObject GDI32.BitBlt GDI32.DeleteDC USER32.EndPaint USER32.DefWindowProcA |
sub_402640(1a17): "\\" |
sub_41F8F5(1ac2): "invalid literal/length code" "invalid distance code" |
sub_41DC8D(1e47): KERNEL32.MultiByteToWideChar |
sub_41DD77(209f): KERNEL32.LockFile |
sub_413809(23e1): NTDLL.RtlLeaveCriticalSection |
sub_414C5A(266f): KERNEL32.GetSystemTimeAsFileTime KERNEL32.SetFilePointer KERNEL32.ReadFile |
sub_41E45A(2788): KERNEL32.FreeLibrary |
sub_41DDB3(2b19): KERNEL32.UnlockFile |
sub_41845F(2b28): NTDLL.RtlLeaveCriticalSection |
sub_41BACD(2bf6): NTDLL.RtlFreeHeap |
sub_41E836(2d0a): KERNEL32.UnmapViewOfFile |
sub_41E6B0(2d0a): KERNEL32.CloseHandle |
sub_41DC35(2d0a): KERNEL32.FindClose |
sub_41BC28(2fab): NTDLL.RtlEnterCriticalSection KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA USER32.wsprintfA KERNEL32.CreateFileA KERNEL32.SetFilePointer KERNEL32.WriteFile NTDLL.RtlLeaveCriticalSection "-up.txt" "-up1.txt" |
sub_414710(3247): NTDLL.RtlLeaveCriticalSection |
sub_418E90(328c): KERNEL32.VirtualProtect |
sub_401630(3a34): ADVAPI32.RegCreateKeyExA MSVCRT.wcscpy MSVCRT.wcscat KERNEL32.lstrlen KERNEL32.MultiByteToWideChar WS2_32.WSCInstallProvider |
sub_41734E(3ef8): KERNEL32.CloseHandle |
sub_41D332(43d7): KERNEL32.SetUnhandledExceptionFilter |
sub_41839F(47d8): NTDLL.RtlEnterCriticalSection KERNEL32.FlushInstructionCache |
sub_41CD16(4ab4): NTDLL.RtlEnterCriticalSection "ADVAPI32.DLL" "RegQueryValueA" |
sub_41E119(4c13): NTDLL.RtlGetLastWin32Error NTDLL.RtlRestoreLastWin32Error |
sub_41E552(4db0): "RemoveFontResourceA" |
sub_41E519(4db0): "AddFontResourceA" |
sub_4017D0(4df8): ADVAPI32.RegOpenKeyExA ADVAPI32.RegCreateKeyExA WS2_32.WSCEnumProtocols "SOFTWARE\\WinSock2\\Buibert" "SOFTWARE\\WinSock2\\Buibert" |
sub_41C5E3(4e17): KERNEL32.VirtualQuery USER32.wsprintfA "!broken!" "0x%08x:[unknown]:unknown" "0x%08x:[%s]:(%03x:%08x)" "!broken!0x%08x:" |
sub_411310(4f7a): KERNEL32.GetModuleHandleA KERNEL32.LocalAlloc KERNEL32.RaiseException KERNEL32.LocalFree KERNEL32.GetProcAddress KERNEL32.FlushInstructionCache KERNEL32.InitializeCriticalSection "BARIER" "kernel32.dll" "FlushInstructionCache" "GetCurrentProcess" |
sub_410A10(547a): KERNEL32.LCMapStringW KERNEL32.LCMapStringA KERNEL32.MultiByteToWideChar KERNEL32.WideCharToMultiByte |
sub_413056(579e): NTDLL.RtlEnterCriticalSection |
sub_41BAF1(5c73): USER32.ChangeDisplaySettingsA USER32.MessageBoxA KERNEL32.GetCurrentProcess KERNEL32.TerminateProcess |
sub_41E911(5d3c): "_lopen" |
sub_41E58B(60d0): KERNEL32.CreateFileA |
sub_41BA4A(61ea): NTDLL.RtlAllocateHeap |
sub_4022F0(62ac): KERNEL32.Sleep " njosphlbmombiifgomrkdmdfgr" "ended in " " hsebnfmsqijorfjooonckehpdp" "1992 " " nrlqomhqibqjsqderqpkghlrk" "Laboratory " " gobmccpsmrmggcomcenldrg" "personnel " "sporder.dll" "rsvp32_2.dll" "DLL" "DLL" "rsvp32_2.dll" |
sub_41543F(6567): NTDLL.RtlLeaveCriticalSection |
sub_41E7F7(65b5): KERNEL32.MapViewOfFile |
sub_41BF54(664d): KERNEL32.LocalFree |
sub_41E85D(66b9): "OpenFile" |
sub_414344(66cd): KERNEL32.CreateFileA KERNEL32.SetFilePointer |
sub_41DDE5(66db): KERNEL32.GetFileAttributesA |
sub_41E6D7(66f1): KERNEL32.ReadFile KERNEL32.SetEvent |
sub_41CA0F(69b1): KERNEL32.GetProcAddress "DllGetClassObject" |
sub_41CE67(6b20): KERNEL32.GetModuleHandleA "CoCreateInstanceEx" |
sub_41C106(6dca): KERNEL32.GetCurrentProcessId "MBX@" ".###" |
sub_41E33E(70d7): KERNEL32.lstrcmpi KERNEL32.GetProcAddress NTDLL.RtlEnterCriticalSection "DllGetClassObject" |
sub_41C7DF(71de): KERNEL32.GetModuleFileNameA |
sub_41441F(72be): NTDLL.RtlEnterCriticalSection KERNEL32.SetFilePointer NTDLL.RtlRestoreLastWin32Error |
sub_41C87E(7308): "-- backtrace --" " %s" " %s" " ... opss, broken by SEH" "--stack--" "0x%08x: 0x%08x 0x%08x 0x%08x 0x%08x" " ... opss, broken by SEH" |
sub_41AB84(75a3): KERNEL32.GetModuleHandleA KERNEL32.WriteProcessMemory KERNEL32.GetCurrentProcessId USER32.wsprintfA "MBX@%X@*.###" "kernel32.dll" "GetTempPathA" "SetCurrentDirectoryA" "GetCurrentDirectoryA" "FindFirstFileA" "DeleteFileA" "FindClose" "GetExitCodeProcess" "WaitForSingleObject" "ExitProcess" "OpenProcess" "Sleep" "CloseHandle" |
sub_41491F(75cf): NTDLL.RtlLeaveCriticalSection |
sub_413CC7(760a): NTDLL.RtlLeaveCriticalSection KERNEL32.CloseHandle |
sub_420A87(76fe): "oversubscribed distance tree" "incomplete distance tree" "empty distance tree with lengths" "oversubscribed literal/length tree" "incomplete literal/length tree" |
sub_41DEE0(77d9): KERNEL32.GetFileSize |
sub_413272(794a): NTDLL.RtlEnterCriticalSection KERNEL32.GetFullPathNameA USER32.CharUpperBuffA NTDLL.RtlRestoreLastWin32Error |
sub_414214(7988): NTDLL.RtlEnterCriticalSection KERNEL32.CreateFileA |
sub_41D96A(7ad9): KERNEL32.FindFirstFileA |
sub_420681(7b22): "oversubscribed dynamic bit lengths tree"... "incomplete dynamic bit lengths tree" |
sub_41DE13(7be1): KERNEL32.WideCharToMultiByte KERNEL32.GetFileAttributesW |
sub_419529(7cb5): NTDLL.RtlEnterCriticalSection NTDLL.RtlLeaveCriticalSection |
sub_411DF0(7dab): KERNEL32.GetModuleHandleA KERNEL32.RaiseException KERNEL32.InitializeCriticalSection "kernel32.dll" |
sub_41CDFA(7e34): USER32.wsprintfA "CLSID\\{%08x-%04x-%04x-%02x%02x-%02x%02x"... |
sub_410060(808e): NTDLL.RtlLeaveCriticalSection |
sub_401FA0(80fc): "r" |
sub_410D4F(81be): KERNEL32.GetStringTypeW KERNEL32.GetStringTypeA KERNEL32.MultiByteToWideChar |
sub_414856(81d2): NTDLL.RtlEnterCriticalSection KERNEL32.GetFileInformationByHandle |
sub_41E9EC(824c): "_lread" |
sub_41D2C9(862e): KERNEL32.GetModuleHandleA KERNEL32.LoadLibraryA KERNEL32.GetProcAddress |
sub_41DAE0(8869): KERNEL32.WideCharToMultiByte KERNEL32.MultiByteToWideChar "FindFirstFileExW" |
sub_4103E8(8af0): NTDLL.RtlUnwind |
sub_412300(8cb2): KERNEL32.GetModuleHandleA KERNEL32.RaiseException KERNEL32.GetProcAddress KERNEL32.LoadLibraryA "kernel32.dll" "CloseHandle" "CreateFileA" "CreateFileW" "CreateFileMappingA" "CreateFileMappingW" "CreateProcessA" "DebugBreak" "DeleteFileA" "EnterCriticalSection" "ExitProcess" "FindClose" "FindFirstFileA" "FlushFileBuffers" "FormatMessageA" "FreeLibrary" "GetCurrentProcess" "GetCurrentProcessId" "GetEnvironmentVariableA" "GetExitCodeProcess" "GetFileAttributesA" "GetFileAttributesW" "GetFileInformationByHandle" "GetFileSize" "GetFileTime" "GetFullPathNameA" "GetFullPathNameW" "GetLastError" "GetModuleFileNameA" "GetModuleHandleA" "GetPrivateProfileIntA" "GetPrivateProfileSectionNamesA" "GetPrivateProfileStringA" "GetProcAddress" "GetSystemTimeAsFileTime" "GetTempFileNameA" "GetTempPathA" "GetTickCount" "HeapAlloc" "HeapFree" "HeapCreate" "InitializeCriticalSection" "DeleteCriticalSection" "LeaveCriticalSection" "LoadLibraryA" "LoadLibraryExA" "LocalAlloc" "LocalFree" "LockFile" "MultiByteToWideChar" "OpenProcess" "RaiseException" "ReadFile" "SetEnvironmentVariableA" "SetEvent" "SetFilePointer" "SetLastError" "SetUnhandledExceptionFilter" "Sleep" "TerminateProcess" "UnlockFile" "UnmapViewOfFile" "VirtualAlloc" "VirtualFree" "VirtualProtect" "VirtualQuery" "WaitForSingleObject" "WideCharToMultiByte" "WriteFile" "lstrcmpiA" "user32.dll" "ChangeDisplaySettingsA" "CharUpperBuffA" "LoadImageA" "MessageBoxA" "wsprintfA" "wvsprintfA" "gdi32.dll" "AddFontResourceA" "CreateCompatibleDC" "CreateDIBSection" "DeleteDC" "RemoveFontResourceA" "BeginPaint" "EndPaint" "GetObjectA" "SelectObject" "DeleteObject" "BitBlt" "GetWindowThreadProcessId" "SetActiveWindow" "SetForegroundWindow" "RegisterClassExA" "GetSystemMetrics" "CreateWindowExA" "GetMessageA" "TranslateMessage" "DispatchMessageA" "EnumWindows" "DefWindowProcA" "PostMessageA" "CreateThread" |
sub_415175(906d): NTDLL.RtlEnterCriticalSection KERNEL32.ReadFile |
sub_41553D(9137): NTDLL.RtlEnterCriticalSection KERNEL32.GetFullPathNameA USER32.CharUpperBuffA |
sub_41C317(9341): USER32.ChangeDisplaySettingsA USER32.MessageBoxA "__SEH__ 0x%x at 0x%x" "CS :0x%08X SS :0x%08X DS :0x%08X" "ES :0x%08X FS :0x%08X GS :0x%08X" "EAX:0x%08X EDX:0x%08X ECX:0x%08X" "ESP:0x%08X EBP:0x%08X EIP:0x%08X" "ESI:0x%08X EDI:0x%08X" "ASSERTION FAILED" "HAS NO ACCESS TO EXECUTABLE" "EXECUTABLE IS NOT NT IMAGE" "DYNAMIC LIBRARY IS NOT NT IMAGE" "EXECUTABLE CORRUPTED" "PATH IS VERY LONG" "COULD NOT OPEN BOXFILE" "READ BOXFILE ERROR" "BOXFILE CORRUPTED" "FEATURE IS NOT IMPLEMENTED" "OUT OF MEMORY" "WRAPPERS TABLE BROKEN" "VIRTUALPROTECT BROKEN" "COULD NOT CREATE HEAP" "HEAP CORRUPTED" "DLL CORRUPTED" "INVALID COMPRESSION/ENCRYPTION ALGORITH"... "PACKED DLL OR BOXFILE CORRUPTED" "HOOKING DLL ERROR" "GetModuleName ERROR" "BAD FUULNAME" "INVALID DLL RELOCATION" |
sub_413D44(93a5): NTDLL.RtlEnterCriticalSection GDI32.RemoveFontResourceA KERNEL32.DeleteFileA NTDLL.RtlLeaveCriticalSection |
sub_41E952(96c9): "_lclose" |
sub_41D40A(98ab): KERNEL32.InitializeCriticalSection KERNEL32.GetModuleHandleA |
sub_414641(9a10): NTDLL.RtlLeaveCriticalSection |
sub_41BE16(9a73): USER32.wvsprintfA USER32.wsprintfA "\r\n" |
sub_41D0A3(9c6a): "GetRecordInfoFromTypeInfo" |
sub_4029BE(9c9a): MSVCRT._controlfp |
sub_413838(9e78): NTDLL.RtlEnterCriticalSection KERNEL32.CloseHandle |
sub_41E184(9f79): KERNEL32.WideCharToMultiByte |
sub_415B59(a0dc): KERNEL32.lstrcmpi |
sub_41396C(a17e): NTDLL.RtlEnterCriticalSection |
sub_4136FE(a956): NTDLL.RtlEnterCriticalSection KERNEL32.FindFirstFileA KERNEL32.FindNextFileA |
sub_41DF52(ab2e): KERNEL32.GetPrivateProfileStringA |
sub_410216(ab4b): USER32.GetWindowThreadProcessId KERNEL32.GetCurrentProcessId USER32.SetActiveWindow USER32.SetForegroundWindow |
sub_41494E(abc7): NTDLL.RtlEnterCriticalSection |
sub_418B90(b00b): KERNEL32.RaiseException KERNEL32.GetModuleHandleA |
sub_41BA87(b0d3): KERNEL32.HeapCreate |
sub_41314B(b2d1): NTDLL.RtlLeaveCriticalSection |
sub_41E73B(b437): KERNEL32.SetFilePointer |
sub_410253(b625): GDI32.GetObjectA KERNEL32.GetModuleHandleA USER32.RegisterClassExA USER32.GetSystemMetrics USER32.CreateWindowExA USER32.GetMessageA USER32.TranslateMessage USER32.DispatchMessageA KERNEL32.Sleep USER32.DestroyWindow GDI32.DeleteObject USER32.EnumWindows "{CC7574E4-5E39-4700-B286-269A82DD8E95}" "{CC7574E4-5E39-4700-B286-269A82DD8E95}" |
sub_4184A0(b6e2): KERNEL32.GetModuleHandleA KERNEL32.GetProcAddress "The dynamic link library '%s' could not"... "EXECUTABLE" |
sub_419393(b6e5): KERNEL32.GetModuleFileNameA |
sub_41C307(b7ba): KERNEL32.SetUnhandledExceptionFilter |
sub_420D80(b7ba): ":API:NopeFunc" |
sub_41E28E(b851): KERNEL32.GetModuleHandleA KERNEL32.WideCharToMultiByte |
sub_41BF82(b9ee): KERNEL32.GetCurrentProcessId KERNEL32.GetTempPathA USER32.wsprintfA USER32.CharUpperBuffA "MBX@%X@%X@%X.###" "MBX@%X@%X.###" "MBX@%X@*.###" |
sub_41393D(ba80): NTDLL.RtlLeaveCriticalSection |
sub_41D6FE(bac7): NTDLL.RtlEnterCriticalSection KERNEL32.ExitProcess KERNEL32.GetCurrentProcess KERNEL32.TerminateProcess |
sub_41BB7C(bb4f): NTDLL.RtlEnterCriticalSection USER32.wsprintfA USER32.wvsprintfA "Error at %s:%d\n\nReason: " "\n" |
sub_41EF26(bbd9): "invalid block type" "invalid stored block lengths" "too many length or distance symbols" "invalid bit length repeat" |
sub_41DF18(bd10): KERNEL32.GetModuleFileNameA |
sub_416C60(be7d): KERNEL32.InitializeCriticalSection KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.GetFullPathNameA USER32.CharUpperBuffA KERNEL32.FindFirstFileA KERNEL32.lstrcmpi KERNEL32.FindNextFileA KERNEL32.FindClose |
sub_41D579(bfac): KERNEL32.GetModuleHandleA KERNEL32.LoadLibraryA KERNEL32.GetProcAddress "WriteFile" |
sub_41CF9E(c189): KERNEL32.GetModuleHandleA "CoGetClassObject" |
sub_41473F(c2b5): NTDLL.RtlEnterCriticalSection KERNEL32.CloseHandle NTDLL.RtlLeaveCriticalSection |
sub_41E254(c5dd): KERNEL32.GetModuleHandleA |
sub_413FDF(ca5e): NTDLL.RtlEnterCriticalSection NTDLL.RtlRestoreLastWin32Error KERNEL32.VirtualAlloc KERNEL32.VirtualProtect NTDLL.RtlLeaveCriticalSection KERNEL32.VirtualFree |
sub_41BBE7(cadf): USER32.wvsprintfA "\n" |
sub_413EED(cc56): NTDLL.RtlEnterCriticalSection KERNEL32.VirtualFree NTDLL.RtlLeaveCriticalSection |
sub_41A8B3(cc84): KERNEL32.GetCurrentProcess KERNEL32.GetModuleHandleA KERNEL32.GetModuleFileNameA KERNEL32.CreateProcessA KERNEL32.GetCurrentProcessId KERNEL32.ResumeThread |
sub_41D85C(cc91): KERNEL32.WideCharToMultiByte KERNEL32.GetFullPathNameW "SearchPathW" |
sub_41922D(d153): "kernel32.dll" "GetCurrentProcessId" |
sub_4014A0(d3ce): "sporder.dll" "WSCWriteProviderOrder" |
sub_4149DF(d510): NTDLL.RtlLeaveCriticalSection |
sub_41D997(da5e): KERNEL32.WideCharToMultiByte KERNEL32.MultiByteToWideChar "FindFirstFileW" |
sub_41D7FD(da7c): KERNEL32.GetFullPathNameA "SearchPathA" |
sub_418780(db70): KERNEL32.GetModuleHandleA "EXECUTABLE" "imm32.dll" "imm32.dll" |
sub_410386(dd1b): KERNEL32.CreateThread KERNEL32.Sleep "_splashscreen.bmp" |
sub_41DFF8(df47): KERNEL32.GetPrivateProfileIntA |
sub_41D21A(e151): KERNEL32.MultiByteToWideChar "LoadTypeLib" "LoadRegTypeLib" |
sub_4182B0(e162): NTDLL.RtlEnterCriticalSection GDI32.RemoveFontResourceA KERNEL32.DeleteFileA |
sub_401D20(e2e7): KERNEL32.GetSystemDirectoryA |
sub_418371(e4fb): NTDLL.RtlLeaveCriticalSection |
sub_419995(e726): KERNEL32.GetModuleHandleA KERNEL32.LoadLibraryA KERNEL32.LoadLibraryExA NTDLL.RtlGetLastWin32Error NTDLL.RtlRestoreLastWin32Error KERNEL32.FreeLibrary KERNEL32.VirtualAlloc |
sub_41D112(e7c0): KERNEL32.MultiByteToWideChar "LoadTypeLib" "GetRecordInfoFromGuids" |
sub_41E4C5(edae): USER32.LoadImageA |
sub_413AB3(ee00): NTDLL.RtlLeaveCriticalSection |
sub_41E5D9(f1fb): KERNEL32.WideCharToMultiByte KERNEL32.CreateFileW |
sub_418F16(f350): GDI32.CreateCompatibleDC GDI32.CreateDIBSection GDI32.DeleteDC |
sub_41E9A7(f37f): "_llseek" |
sub_41DC5C(f597): KERNEL32.FindNextFileA |
sub_41DD46(f597): KERNEL32.GetFileInformationByHandle |
sub_41BA32(f66d): KERNEL32.RaiseException |
sub_41EA57(f6bf): KERNEL32.InitializeCriticalSection |
sub_4051B0(fa5d): MSVCRT._acmdln |
sub_41925C(fbe2): KERNEL32.GetModuleFileNameA KERNEL32.LoadLibraryA KERNEL32.GetModuleHandleA NTDLL.RtlGetLastWin32Error NTDLL.RtlRestoreLastWin32Error KERNEL32.FreeLibrary |
sub_41EB05(fc88): NTDLL.RtlDeleteCriticalSection |
sub_401FD0(fd62): KERNEL32.GetCurrentProcess ADVAPI32.OpenProcessToken "SeDebugPrivilege" |
sub_414670(fdde): NTDLL.RtlEnterCriticalSection |
sub_41E07F(fe18): KERNEL32.GetPrivateProfileSectionNamesA |