part of StealRAT's source code