Function at 0x11c9bfd0
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11d1bbe1
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
mov edi, dword [esp + 0x128]
test ebp, ebp
je 0x11c9df89
test edi, edi
jle 0x11c9df89
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c04f
mov eax, dword [esp + 0x120]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9c04f
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x6c]
call fcn.11cb0040
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
xor ebx, ebx
cmp word [ebp], 0x17
mov dword [esp + 0x110], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x24], ebx
jne 0x11c9c147
push edi
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.11cf02c0
add esp, 0xc
mov eax, dword [0x11d49ee0]
mov byte [esp + 0x110], 1
test eax, eax
je 0x11c9c0c3
mov edx, dword [esp + 0x10]
push 0x1c
push edi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x18
lea esi, [ebp + 8]
push esi
call fcn.11c9b690
add esp, 4
test al, al
jne 0x11c9c0e4
push esi
call fcn.11c9b6f0
add esp, 4
test al, al
je 0x11c9c24c
cmp edi, 0x1c
jne 0x11c9c24c
mov ecx, dword [0x11d49ee0]
mov ebx, dword [ebp + 0x14]
mov ax, word [ebp + 2]
mov dword [esp + 0x40], ebx
test ecx, ecx
mov dword [esp + 0x34], eax
je 0x11c9c128
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x14
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
call fcn.11cb6340
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11d49ee0]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11c9c193
mov ax, word [ebp + 2]
push eax
call esi
mov ecx, dword [ebp + 4]
and eax, 0xffff
push eax
push ecx
call edi
movsx edx, word [ebp]
push eax
push edx
call edi
push eax
mov eax, dword [esp + 0x12c]
push eax
push 0x187
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x20
cmp word [ebp], 2
je 0x11c9c45b
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9c45b
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x68]
test eax, eax
jne 0x11c9c30e
call fcn.11cb0100
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebp
call fcn.11cafc20
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebp
je 0x11c9c2c0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x128]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x124]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11c9c420
mov ecx, 0x11d441b0
call fcn.11c8a9b0
test eax, eax
jne 0x11c9c26c
mov ecx, 0x11d441b0
call fcn.11c8a9f0
test eax, eax
je 0x11c9c130
push 0
call fcn.11ca5f20
add esp, 4
test eax, eax
je 0x11c9c130
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11cb6340
lea ecx, [esp + 0x68]
mov dword [esp + 0x110], 0xffffffff
call fcn.11cb0070
or eax, 0xffffffff
jmp 0x11c9e085
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11c9c420
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push ecx
push edx
push eax
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c9c420
jmp 0x11c9c417
call fcn.11cb0100
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x30], ebp
call fcn.11cafc20
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebp
je 0x11c9c3b6
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x138]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x134]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11c9c420
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11c9c420
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c9c420
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9df6b
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x128]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x18
jmp 0x11c9df6b
call fcn.11ca5490
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x4e], ecx
lea edi, [esp + 0x96]
mov dword [esp + 0x52], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x56], ecx
mov word [esp + 0x4c], ax
mov word [esp + 0x5a], cx
mov ecx, 6
mov word [esp + 0x94], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9c4ca
mov edx, dword [ebp]
mov dword [esp + 0x4c], edx
mov eax, dword [ebp + 4]
mov dword [esp + 0x50], eax
mov ebx, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x54], ecx
mov edx, dword [ebp + 0xc]
mov ebp, dword [esp + 0x4e]
mov dword [esp + 0x58], edx
mov dword [esp + 0x34], ebp
jmp 0x11c9c4e4
mov ecx, 7
mov esi, ebp
mov ebp, dword [esp + 0x34]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c51a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11c854f0
add esp, 0x18
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x5c]
push ecx
push edx
mov dword [esp + 0x64], 0
call fcn.11c9be90
mov dword [esp + 0x1c], eax
mov eax, dword [0x11d49ee0]
add esp, 8
test eax, eax
je 0x11c9c562
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x14
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xe4]
mov dword [esp + 0xe0], edx
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11d443a8
call fcn.11c96dc0
mov dword [esp + 0x18], eax
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c5c7
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x1c]
push eax
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11c854f0
add esp, 0x14
mov eax, dword [0x11d445f4]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x11c9c5ea
mov eax, dword [0x11d445e4]
test eax, eax
jne 0x11c9c5ea
mov eax, dword [0x11d445f8]
test eax, eax
je 0x11c9c62f
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11d442d0
call fcn.11c900b0
test eax, eax
je 0x11c9c635
mov eax, dword [0x11d49ee0]
mov dword [esp + 0x38], 1
test eax, eax
je 0x11c9c635
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11c854f0
add esp, 0x10
jmp 0x11c9c635
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11d44600]
test eax, eax
je 0x11c9c6b8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push ebp
mov dword [esp + 0x40], 0
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d44418
mov eax, dword [esp + 0x134]
push eax
call fcn.11c977c0
test eax, eax
je 0x11c9c877
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c69b
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11c854f0
add esp, 0x14
mov eax, dword [esp + 0x11c]
or esi, 0xffffffff
mov ecx, 0x274d
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
jmp 0x11c9cf7d
mov eax, dword [0x11d445f4]
test eax, eax
je 0x11c9cc4a
mov eax, dword [0x11d441b4]
test eax, eax
mov eax, dword [0x11d443f8]
je 0x11c9caeb
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x11c9caeb
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9c7f0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
jne 0x11c9c7f0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d443a8
call fcn.11c95f00
test eax, eax
jne 0x11c9c7f0
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c9c7f0
push ebx
call edi
push eax
call fcn.11ca5570
add esp, 4
test eax, eax
jne 0x11c9c7f0
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11c9c7f0
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9cf69
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9cf69
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d443a8
call fcn.11c95f00
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9cf69
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9cf69
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c877
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9c877
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d443a8
call fcn.11c95f00
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9c877
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c854f0
add esp, 0x14
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11c9c89c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c89c
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11c854f0
add esp, 0xc
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11c9cedf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x120]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x44], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9c923
mov eax, dword [esp + 0x10]
push eax
push ebp
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x124]
push eax
push ebx
push ecx
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11c9d172
mov eax, dword [0x11d44600]
test eax, eax
jne 0x11c9cf94
mov eax, dword [0x11d441b4]
test eax, eax
jne 0x11c9c956
mov eax, dword [0x11d441ec]
test eax, eax
je 0x11c9c9c7
mov eax, dword [0x11d445e8]
test eax, eax
je 0x11c9c9c7
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d44310
call fcn.11c91350
test eax, eax
je 0x11c9c9c7
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c9c98b
push ebx
call edi
push eax
call fcn.11ca5570
add esp, 4
test eax, eax
je 0x11c9c9c7
mov dword [esp + 0x2c], 1
call fcn.11ca9a30
mov eax, dword [0x11d49ee0]
mov dword [esp + 0x20], 1
test eax, eax
je 0x11c9c9c7
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11c854f0
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d44288
call fcn.11c8e8c0
push str.127.0.0.1
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c9d0da
push ebx
call edi
push eax
call fcn.11ca5570
add esp, 4
test eax, eax
jne 0x11c9d0da
mov eax, dword [0x11d441ec]
test eax, eax
je 0x11c9cd3f
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11ca4530
add esp, 4
test eax, eax
je 0x11c9ca33
mov eax, dword [0x11d445e0]
test eax, eax
jne 0x11c9cd36
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9ca57
mov edx, dword [0x11d441b4]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11d2e2f8
push 1
call fcn.11c854f0
add esp, 0x10
mov eax, dword [0x11d441b4]
test eax, eax
jne 0x11c9ca8b
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
jne 0x11c9ca82
mov eax, dword [esp + 0x38]
test eax, eax
je 0x11c9d07a
mov eax, dword [0x11d441b4]
test eax, eax
je 0x11c9cabf
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
jne 0x11c9cabf
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11c9cabf
push ebp
call esi
push eax
mov ecx, 0x11d44408
call fcn.11c97560
test eax, eax
jne 0x11c9d0aa
mov eax, dword [0x11d445e4]
test eax, eax
je 0x11c9cd52
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
je 0x11c9cd52
jmp 0x11c9cd48
mov ecx, dword [0x11d441ec]
test ecx, ecx
je 0x11c9cb5d
and eax, 1
cmp al, 1
je 0x11c9cb5d
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
je 0x11c9c877
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9c87f
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9cb44
push 0x222
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11c854f0
add esp, 0x10
push 1
call fcn.11c850b0
add esp, 4
mov dword [0x11d445e8], eax
call fcn.11ca9a30
jmp 0x11c9c89c
mov eax, dword [0x11d443fc]
test eax, eax
je 0x11c9cc06
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9cbf9
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
je 0x11c9cbf9
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d443a8
call fcn.11c95f00
test eax, eax
jne 0x11c9cbf9
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c9cbf9
push ebx
call edi
push eax
call fcn.11ca5570
add esp, 4
test eax, eax
jne 0x11c9cbf9
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11c9cbf9
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9cf69
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9cf69
mov eax, dword [0x11d443fc]
test eax, eax
jne 0x11c9c877
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11c9c89c
mov eax, dword [0x11d49ee0]
mov dword [esp + 0x18], 0
test eax, eax
je 0x11c9c89c
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9c89c
mov eax, dword [0x11d445e4]
test eax, eax
je 0x11c9c877
mov eax, dword [0x11d441b4]
test eax, eax
mov eax, dword [0x11d443f8]
je 0x11c9cc73
mov edx, eax
and edx, 1
cmp dl, 1
jne 0x11c9c877
mov ecx, dword [0x11d441ec]
test ecx, ecx
je 0x11c9cce5
and eax, 1
cmp al, 1
je 0x11c9cce5
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
je 0x11c9c877
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9c87f
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9cccc
push 0x256
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
push 1
call fcn.11c850b0
add esp, 4
mov dword [0x11d445e8], eax
call fcn.11ca9a30
jmp 0x11c9c89c
mov eax, dword [0x11d443fc]
test eax, eax
jne 0x11c9c877
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11c9c89c
mov eax, dword [0x11d49ee0]
mov dword [esp + 0x18], 0
test eax, eax
je 0x11c9c89c
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9c89c
mov eax, dword [0x11d441ec]
test eax, eax
jne 0x11c9cd52
mov eax, dword [0x11d445e4]
test eax, eax
je 0x11c9cd52
mov dword [0x11d445ec], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11ca4530
add esp, 4
test eax, eax
je 0x11c9cddf
mov eax, dword [0x11d445e0]
test eax, eax
je 0x11c9cddf
call fcn.11c9bc90
mov ecx, dword [esp + 0x24]
push eax
test ecx, ecx
jne 0x11c9cd93
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4e], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], eax
jmp 0x11c9cdac
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
mov eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x74], eax
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d1e8
push str.connectFunc_SMTP_Redirect
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0xc
jmp 0x11c9d172
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11c9ce5a
mov eax, dword [0x11d445e4]
test eax, eax
je 0x11c9d172
mov eax, dword [0x11d445f4]
test eax, eax
je 0x11c9ce17
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c3f0
test eax, eax
je 0x11c9d172
mov ecx, 0x11d441b0
call fcn.11c8a9b0
test eax, eax
jne 0x11c9ce5a
mov ecx, 0x11d441b0
call fcn.11c8a9f0
test eax, eax
jne 0x11c9ce5a
mov eax, dword [0x11d441ec]
test eax, eax
je 0x11c9d172
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
je 0x11c9d172
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9ce77
push str.connectFunc_SafeGW_Redirect
push 0x11d2e2f8
push 1
call fcn.11c854f0
add esp, 0xc
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9ceac
mov edx, dword [esp + 0x5c]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4e], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], eax
mov eax, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0xf4], eax
jmp 0x11c9d1e8
mov ecx, dword [esp + 0x5c]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0xf4], eax
jmp 0x11c9d1e8
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9cf3f
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x40]
call fcn.11cb5ba0
mov esi, eax
mov byte [esp + 0x110], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push eax
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x14
lea ecx, [esp + 0x3c]
mov byte [esp + 0x110], 0
call fcn.11cb6340
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov ebp, dword [esp + 0x34]
mov eax, dword [0x11d445e4]
test eax, eax
jne 0x11c9cf69
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11c9cf69
mov eax, dword [0x11d44600]
test eax, eax
je 0x11c9d1e8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11c9d1e8
mov eax, dword [esp + 0x11c]
or esi, 0xffffffff
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
lea ecx, [esp + 0x68]
mov dword [esp + 0x110], esi
call fcn.11cb0070
mov eax, esi
jmp 0x11c9e085
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11ca4530
add esp, 4
test eax, eax
je 0x11c9d010
mov eax, dword [0x11d445e0]
test eax, eax
je 0x11c9d010
call fcn.11c9bc90
mov ecx, dword [esp + 0x24]
push eax
test ecx, ecx
jne 0x11c9cfe5
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4e], ax
mov eax, 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x28], eax
jmp 0x11c9d1e8
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x28], eax
jmp 0x11c9d1e8
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11c9d17a
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9d04c
mov eax, dword [esp + 0x5c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xf4], 1
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4e], ax
mov dword [esp + 0x50], ecx
jmp 0x11c9d172
mov edx, dword [esp + 0x5c]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xf4], 1
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
jmp 0x11c9d172
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d172
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11d2e2f8
push 1
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9d172
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d172
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11d2e2f8
push 1
call fcn.11c854f0
add esp, 0x14
jmp 0x11c9d172
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d0f7
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0xc
call fcn.11ca5bd0
test eax, eax
jne 0x11c9d14c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d11d
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0xc
mov eax, dword [0x11d445e4]
mov dword [esp + 0x20], 1
test eax, eax
je 0x11c9d154
mov eax, dword [0x11d441b4]
test eax, eax
je 0x11c9d154
mov ecx, dword [0x11d443f8]
and ecx, 1
cmp cl, 1
je 0x11c9d154
call fcn.11ca9a30
jmp 0x11c9d154
mov dword [esp + 0x1c], 1
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d172
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c9d1e8
lea edx, [esp + 0x74]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11ca26e0
add esp, 0x10
test eax, eax
je 0x11c9d1e8
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11c9d1e8
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], 1
test ecx, ecx
push eax
jne 0x11c9d1cf
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4e], ax
mov dword [esp + 0x50], ecx
jmp 0x11c9d1e8
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
xor eax, eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
push ecx
mov dword [esp + 0xdc], eax
push ebp
mov dword [esp + 0xe4], eax
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11d43d60
call fcn.11c82600
test eax, eax
je 0x11c9d2e2
mov edx, dword [esp + 0xd0]
push edx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xd8]
cmp eax, 0xffffffff
je 0x11c9d25d
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11c9d25f
mov edi, ebp
mov eax, dword [0x11d49ee0]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11c9d2a6
push edi
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11c854f0
add esp, 0x1c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11c9d2b8
mov dword [esp + 0x30], 1
jmp 0x11c9d2e2
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9d2cf
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4e], di
mov dword [esp + 0x50], ecx
jmp 0x11c9d2e2
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], edx
mov eax, dword [esp + 0x120]
mov ecx, 0x11d440c0
push eax
call fcn.11c895c0
mov ecx, 0x11d440c0
call fcn.11c898e0
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11c9d311
lea edi, [esp + 0x4c]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11c9d336
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d33d
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11c854f0
add esp, 0xc
mov eax, dword [0x11d49ee0]
test eax, eax
mov ebp, dword [esp + 0x118]
je 0x11c9d35b
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
mov eax, dword [0x11d49ee0]
test ebp, ebp
jne 0x11c9d6c1
test eax, eax
je 0x11c9d3a5
mov cx, word [edi + 2]
push ecx
call esi
mov edx, dword [edi + 4]
and eax, 0xffff
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x128]
push eax
push 0x3a3
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x1c
lea ecx, [esp + 0x68]
call fcn.11cb0100
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0x3c]
push eax
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x48]
push ecx
push edx
push ebp
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x4c], ebx
call fcn.11cafc20
mov eax, dword [esp + 0x58]
add esp, 0x10
cmp eax, ebx
je 0x11c9d434
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x128]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x120]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebx, ebx
jmp 0x11c9d477
mov ebp, dword [esi + 0x18]
cmp ebp, ebx
je 0x11c9d477
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c9d477
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x68]
call fcn.11cb00e0
cmp dword [0x11d49ee0], ebx
je 0x11c9d4b4
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3b1
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x20
cmp dword [0x11d44600], ebx
jne 0x11c9da0c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9da0c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d5a7
push 0x3b9
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d5a7
mov ecx, dword [0x11d445f4]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d5a7
mov edx, dword [esp + 0x1c]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d5a7
mov eax, dword [0x11d448c4]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d5a7
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ebx, dword [esp + 0x44]
push ebx
call ebp
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0x10
jmp 0x11c9d5b5
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x40]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d5e3
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11c9d675
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9d675
mov eax, dword [0x11d445f4]
test eax, eax
je 0x11c9d640
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x11c9d633
mov eax, dword [0x11d448c4]
test eax, eax
je 0x11c9d633
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
jne 0x11c9d633
mov eax, dword [esp + 0x38]
test eax, eax
je 0x11c9d675
mov eax, dword [0x11d445f4]
test eax, eax
jne 0x11c9da0c
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [0x11d445e4]
jne 0x11c9d661
test eax, eax
je 0x11c9d661
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x11c9d661
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x11c9d675
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x11c9da0c
test eax, eax
je 0x11c9da0c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d692
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x124]
push eax
mov eax, dword [esp + 0x130]
push ecx
lea ecx, [esp + 0x58]
push eax
push ecx
push edx
call fcn.11ca7e90
add esp, 0x18
jmp 0x11c9da0c
test eax, eax
je 0x11c9d6de
push 0x3cd
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
lea ecx, [esp + 0x68]
call fcn.11cb0100
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x48]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x64], eax
xor eax, eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x48]
push eax
push ecx
push ebp
call fcn.11cafc20
mov eax, dword [esp + 0x4c]
add esp, 0x10
test eax, eax
je 0x11c9d78f
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x138]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x130]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11c9d7f2
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11c9d7f2
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x12c]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c9d7f2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x68]
call fcn.11cb00e0
mov eax, dword [0x11d44600]
test eax, eax
jne 0x11c9da0c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c9da0c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d8e7
push 0x3d8
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d8e7
mov ecx, dword [0x11d445f4]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d8e7
mov edx, dword [esp + 0x1c]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d8e7
mov eax, dword [0x11d448c4]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11c854f0
mov eax, dword [0x11d49ee0]
add esp, 0x10
test eax, eax
je 0x11c9d8e7
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0x10
jmp 0x11c9d8f1
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d91f
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11c9d9a5
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c9d9a5
mov eax, dword [0x11d445f4]
test eax, eax
je 0x11c9d978
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x11c9d96b
mov eax, dword [0x11d448c4]
test eax, eax
je 0x11c9d96b
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11d441e8
call fcn.11c8c050
test eax, eax
jne 0x11c9d96b
mov eax, dword [esp + 0x38]
test eax, eax
je 0x11c9d9a5
mov eax, dword [0x11d445f4]
test eax, eax
jne 0x11c9da0c
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [0x11d445e4]
jne 0x11c9d999
test eax, eax
je 0x11c9d999
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x11c9d999
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x11c9d9a5
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x11c9da0c
test eax, eax
je 0x11c9da0c
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9d9c2
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11c854f0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x134]
push eax
mov eax, dword [esp + 0x140]
push ecx
mov ecx, dword [esp + 0x140]
push eax
mov eax, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
push eax
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x68]
push ecx
push edx
push eax
call fcn.11ca8ce0
add esp, 0x28
mov ecx, 0x11d440c0
call fcn.11c89a10
mov ebx, dword [esp + 0x120]
mov ecx, 0x11d44170
push ebx
call fcn.11c88c40
test eax, eax
je 0x11c9da57
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9da4a
push ebx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
mov dword [esp + 0x28], 0
jmp 0x11c9decc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11c9decc
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9da80
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0xc
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11c9dacb
mov edx, dword [esp + 0x124]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11c9dae4
mov dx, word [esp + 0x34]
mov eax, dword [esp + 0x40]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], eax
mov edi, dword [esp + 0x30]
test edi, edi
je 0x11c9dafe
mov cx, word [esp + 0x10]
mov edx, dword [esp + 0x14]
mov word [esp + 0x7a], cx
mov dword [esp + 0x7c], edx
lea eax, [esp + 0x78]
mov ecx, 0x11d44138
push eax
push ebx
call fcn.11c89100
mov dword [esp + 0xe0], 0x35026200
mov word [esp + 0xe4], 0x10
mov word [esp + 0xe6], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xe8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x40]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], 1
call ebp
mov edx, dword [esp + 0x34]
mov dword [esp + 0xfc], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x102], ax
mov ax, word [esp + 0x74]
mov word [esp + 0x104], ax
call fcn.11cee1b0
test edi, edi
mov word [esp + 0x106], ax
je 0x11c9dbb8
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x10]
mov dword [esp + 0xfc], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x102], ax
mov eax, dword [esp + 0x118]
test eax, eax
je 0x11c9dbcb
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dbef
push 0x28
push 0x42f
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x14
xor ebp, ebp
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x118]
test eax, eax
je 0x11c9dc13
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11d440c0
call fcn.11c898e0
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dc44
mov ecx, dword [esp + 0x1c]
push ecx
push 0x443
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x14
mov edx, 0x28
push 0
sub edx, ebp
lea eax, [esp + ebp + 0xe4]
push edx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dc87
mov ecx, dword [esp + 0x1c]
push edi
push ecx
push 0x447
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x18
mov ecx, 0x11d440c0
call fcn.11c89a10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11c9dd06
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11c9dcb4
call edi
cmp eax, 0x2749
jne 0x11c9dd0f
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dcd4
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x118]
add ecx, 3
test eax, eax
mov dword [esp + 0x2c], ecx
jne 0x11c9dcf2
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 0x64
mov dword [esp + 0x1c], eax
jl 0x11c9dbfd
jmp 0x11c9dd5a
add ebp, edi
cmp ebp, 0x28
jae 0x11c9dd5a
jmp 0x11c9dcd4
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dd2f
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
or edi, 0xffffffff
push ebx
mov ecx, 0x11d440c0
mov dword [esi + 0x14], edi
call fcn.11c896f0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x68]
mov dword [esp + 0x110], edi
call fcn.11cb0070
mov eax, esi
jmp 0x11c9e085
cmp dword [esp + 0x1c], 0x64
jne 0x11c9dd85
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9dd85
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
xor edx, edx
xor eax, eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0xc2], eax
mov dword [esp + 0x90], edx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc6], eax
lea edx, [esp + 0xc0]
push ecx
xor edi, edi
mov dword [esp + 0xce], eax
push edx
push ebx
mov dword [esp + 0x94], edi
mov word [esp + 0xcc], di
mov word [esp + 0xda], ax
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11c9de15
mov eax, dword [esp + 0xc4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xc2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11c9de38
cmp dword [0x11d49ee0], edi
je 0x11c9de38
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11d2e2f8
push 4
call fcn.11c854f0
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x20]
mov dword [esp + 0xb2], edx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb6], edx
push eax
mov dword [esp + 0xbe], edx
push ecx
push ebx
mov word [esp + 0xbc], 0
mov word [esp + 0xca], dx
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11c9deaf
mov edx, dword [esp + 0xb4]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xb2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
cmp ebp, 0xffffffff
je 0x11c9decc
cmp edi, 0xffffffff
je 0x11c9decc
lea ecx, [esp + 0x88]
push ecx
push ebx
mov ecx, 0x11d44170
call fcn.11c88a10
mov eax, dword [0x11d44600]
xor edi, edi
cmp eax, edi
je 0x11c9df0e
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x60]
lea eax, [esp + 0x64]
push edx
push eax
push 1
push ecx
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x50]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
mov ecx, 0x11d44418
call fcn.11c977c0
cmp dword [0x11d49ee0], edi
je 0x11c9df3f
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x12c]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x18
push ebx
mov ecx, 0x11d440c0
call fcn.11c896f0
cmp dword [0x11d49ee0], edi
je 0x11c9df6b
mov eax, dword [esi + 0x14]
push eax
push ebx
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11c854f0
add esp, 0x14
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x68]
mov dword [esp + 0x110], 0xffffffff
call fcn.11cb0070
mov eax, esi
jmp 0x11c9e085
mov esi, dword [esp + 0x11c]
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], eax
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x48], edx
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
push edi
call fcn.11cafc20
mov eax, dword [esp + 0x40]
add esp, 0x10
test eax, eax
je 0x11c9e013
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x128]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x124]
push ecx
mov ecx, dword [esp + 0x124]
push edx
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov ebp, dword [esp + 0x124]
mov edx, dword [esp + 0x48]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edx
jmp 0x11c9e056
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11c9e056
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x120]
push ecx
push ebp
push edx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c9e056
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11d49ee0]
test eax, eax
je 0x11c9e082
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [ebp]
push ecx
push edx
push str.TMAILHOOK::connectFunc_...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11c854f0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x108]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret 0x24