Function at 0x11d5d7b0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11df5123
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x12c]
xor ebx, ebx
cmp edi, ebx
je 0x11d5fa73
cmp esi, ebx
jle 0x11d5fa73
cmp dword [0x11e297e0], ebx
je 0x11d5d830
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
cmp eax, ebx
je 0x11d5d830
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x70]
call fcn.11d74ae0
xor ebp, ebp
cmp word [edi], 0x17
mov dword [esp + 0x118], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x38], ebx
jne 0x11d5d91f
push esi
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.11dc9100
add esp, 0xc
mov eax, dword [0x11e297e0]
mov byte [esp + 0x118], 1
test eax, eax
je 0x11d5d89d
mov edx, dword [esp + 0x10]
push 0x1c
push esi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
lea esi, [edi + 8]
push esi
call fcn.11d5ce70
add esp, 4
test al, al
jne 0x11d5d8be
push esi
call fcn.11d5ced0
add esp, 4
test al, al
je 0x11d5da27
cmp dword [esp + 0x130], 0x1c
jne 0x11d5da27
mov eax, dword [0x11e297e0]
mov ebx, dword [edi + 0x14]
mov bp, word [edi + 2]
mov dword [esp + 0x20], ebx
test eax, eax
mov dword [esp + 0x34], ebp
je 0x11d5d906
push ebp
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x14
mov dword [esp + 0x38], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
call fcn.11d7ade0
mov eax, dword [0x11e297e0]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11d5d96e
mov ax, word [edi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [edi + 4]
and eax, 0xffff
push eax
push ecx
call esi
movsx edx, word [edi]
push eax
push edx
call esi
push eax
mov eax, dword [esp + 0x134]
push eax
push 0x189
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x20
cmp word [edi], 2
je 0x11d5dc22
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5dc22
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x6c]
test eax, eax
jne 0x11d5dae2
call fcn.11d74ba0
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebp
je 0x11d5da9b
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
jmp 0x11d5dbee
mov ecx, 0x11e23898
call fcn.11d4aa70
test eax, eax
jne 0x11d5da47
mov ecx, 0x11e23898
call fcn.11d4aab0
test eax, eax
je 0x11d5d90e
push 0
call fcn.11d67dd0
add esp, 4
test eax, eax
je 0x11d5d90e
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11d7ade0
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d74b10
or eax, 0xffffffff
jmp 0x11d5fb69
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d5dbee
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x128]
push edx
push edi
push eax
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5dbee
jmp 0x11d5dbe5
call fcn.11d74ba0
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebp
je 0x11d5db8b
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x140]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x138]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
jmp 0x11d5dbee
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d5dbee
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x134]
push edx
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5dbee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5fa55
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
jmp 0x11d5fa55
call fcn.11d67380
xor eax, eax
xor edx, edx
mov dword [esp + 0x56], eax
mov ecx, 6
mov dword [esp + 0x5a], eax
lea edi, [esp + 0x96]
mov dword [esp + 0x5e], eax
mov word [esp + 0x94], dx
mov word [esp + 0x62], ax
mov dword [esp + 0x30], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x38]
mov word [esp + 0x54], dx
cmp eax, edx
jne 0x11d5dc95
mov ecx, dword [esp + 0x12c]
mov eax, dword [ecx]
mov dword [esp + 0x54], eax
mov ebx, dword [ecx + 4]
mov dword [esp + 0x58], ebx
mov ebp, dword [esp + 0x56]
mov eax, dword [ecx + 8]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x20], ebx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x60], ecx
jmp 0x11d5dcac
mov esi, dword [esp + 0x12c]
mov ecx, 7
lea edi, [esp + 0x94]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
cmp dword [0x11e297e0], edx
je 0x11d5dce9
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x130]
push edx
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11d455b0
add esp, 0x18
jmp 0x11d5dcef
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x128]
lea eax, [esp + 0x64]
push eax
push ecx
mov dword [esp + 0x6c], 0
call fcn.11d5d670
mov dword [esp + 0x1c], eax
mov eax, dword [0x11e297e0]
add esp, 8
test eax, eax
je 0x11d5dd37
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x14
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], edx
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x1c], edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e23b60
call fcn.11d585a0
mov dword [esp + 0x28], eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5dd9c
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x2c]
push edx
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11d455b0
add esp, 0x14
mov eax, dword [0x11e23dac]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
mov dword [esp + 0x3c], 0
jne 0x11d5ddc5
mov eax, dword [0x11e23d9c]
test eax, eax
jne 0x11d5ddc5
mov eax, dword [0x11e23db0]
test eax, eax
je 0x11d5de02
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e239e8
call fcn.11d50e60
test eax, eax
je 0x11d5de02
mov eax, dword [0x11e297e0]
mov dword [esp + 0x3c], 1
test eax, eax
je 0x11d5de02
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e23db8]
mov dword [esp + 0xc4], 0
test eax, eax
mov dword [esp + 0xc0], 8
je 0x11d5e137
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23bd0
mov edx, dword [esp + 0x13c]
push edx
call fcn.11d58fa0
test eax, eax
je 0x11d5dea8
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5de79
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d455b0
add esp, 0x14
mov eax, dword [esp + 0x124]
mov ecx, 0x274d
or esi, 0xffffffff
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
lea ecx, [esp + 0x6c]
mov dword [eax + 0x14], esi
mov dword [esp + 0x118], esi
call fcn.11d74b10
mov eax, esi
jmp 0x11d5fb69
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x11d5dec3
mov dword [esp + 0x30], 1
mov dword [esp + 0x68], 5
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d5dee8
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5dee8
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11d455b0
add esp, 0xc
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11d5e839
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x128]
push edx
push eax
push 0x1008
push 0xffff
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5df6f
mov edx, dword [esp + 0x10]
push edx
push ebp
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x130]
push ebx
push eax
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11d5eac0
mov eax, dword [0x11e23db8]
test eax, eax
jne 0x11d5e8e4
mov eax, dword [0x11e2389c]
test eax, eax
jne 0x11d5dfa2
mov eax, dword [0x11e238d4]
test eax, eax
je 0x11d5e013
mov eax, dword [0x11e23da0]
test eax, eax
je 0x11d5e013
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23ac8
call fcn.11d52ab0
test eax, eax
je 0x11d5e013
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d5dfd7
push ebx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
je 0x11d5e013
mov dword [esp + 0x18], 1
call fcn.11d6baa0
mov eax, dword [0x11e297e0]
mov dword [esp + 0x44], 1
test eax, eax
je 0x11d5e013
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d455b0
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e239a0
call fcn.11d4f090
push str.127.0.0.1
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d5ea2a
push ebx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d5ea2a
mov eax, dword [0x11e238d4]
test eax, eax
je 0x11d5e699
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d5e07f
mov eax, dword [0x11e23d98]
test eax, eax
jne 0x11d5e690
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e0a3
mov ecx, dword [0x11e2389c]
push ecx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e2389c]
test eax, eax
jne 0x11d5e0d7
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d5e0ce
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d5e9ca
mov eax, dword [0x11e2389c]
test eax, eax
je 0x11d5e10b
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d5e10b
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d5e10b
push ebp
call esi
push eax
mov ecx, 0x11e23bc0
call fcn.11d58d40
test eax, eax
jne 0x11d5e9fa
mov eax, dword [0x11e23d9c]
test eax, eax
je 0x11d5e6ac
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d5e6ac
jmp 0x11d5e6a2
mov eax, dword [0x11e23dac]
test eax, eax
je 0x11d5e5a4
mov eax, dword [0x11e2389c]
test eax, eax
mov eax, dword [0x11e23bb0]
je 0x11d5e398
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x11d5e398
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5e300
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d5e300
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
test eax, eax
jne 0x11d5e300
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d5e300
push ebx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d5e300
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d5e300
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e25e
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5e25e
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5e25e
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
mov esi, dword [esp + 0x124]
push ebx
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x10], 0x274d
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x28]
mov byte [esp + 0x11c], 2
call fcn.11d7a640
mov ebp, dword [eax]
mov eax, dword [esp + 0x34]
push 0
push eax
mov byte [esp + 0x120], 3
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 2
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 2
call fcn.11d7ade0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d7ade0
jmp 0x11d5fa55
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5dec3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5dec3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5dec3
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
jmp 0x11d5dec3
mov ecx, dword [0x11e238d4]
test ecx, ecx
je 0x11d5e40a
and eax, 1
cmp al, 1
je 0x11d5e40a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d5dec3
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5decb
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e3f1
push 0x232
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x10
push 1
call fcn.11d45170
add esp, 4
mov dword [0x11e23da0], eax
call fcn.11d6baa0
jmp 0x11d5dee8
mov eax, dword [0x11e23bb4]
test eax, eax
je 0x11d5e560
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5e553
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d5e553
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
test eax, eax
jne 0x11d5e553
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d5e553
push ebx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d5e553
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d5e553
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e4b1
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
mov esi, dword [esp + 0x124]
push ebx
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x10], 0x274d
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x28]
mov byte [esp + 0x11c], 4
call fcn.11d7a640
mov edx, dword [esp + 0x34]
mov ebp, dword [eax]
push 0
push edx
mov byte [esp + 0x120], 5
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 0
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 4
call fcn.11d7ade0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d7ade0
jmp 0x11d5fa55
mov eax, dword [0x11e23bb4]
test eax, eax
jne 0x11d5dec3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d5dee8
mov eax, dword [0x11e297e0]
mov dword [esp + 0x28], 0
test eax, eax
je 0x11d5dee8
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
jmp 0x11d5dee8
mov eax, dword [0x11e23d9c]
test eax, eax
je 0x11d5dec3
mov eax, dword [0x11e2389c]
test eax, eax
mov eax, dword [0x11e23bb0]
je 0x11d5e5cd
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x11d5dec3
mov ecx, dword [0x11e238d4]
test ecx, ecx
je 0x11d5e63f
and eax, 1
cmp al, 1
je 0x11d5e63f
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d5dec3
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5decb
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e626
push 0x26e
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
push 1
call fcn.11d45170
add esp, 4
mov dword [0x11e23da0], eax
call fcn.11d6baa0
jmp 0x11d5dee8
mov eax, dword [0x11e23bb4]
test eax, eax
jne 0x11d5dec3
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d5dee8
mov eax, dword [0x11e297e0]
mov dword [esp + 0x28], 0
test eax, eax
je 0x11d5dee8
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
jmp 0x11d5dee8
mov eax, dword [0x11e238d4]
test eax, eax
jne 0x11d5e6ac
mov eax, dword [0x11e23d9c]
test eax, eax
je 0x11d5e6ac
mov dword [0x11e23da4], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d5e739
mov eax, dword [0x11e23d98]
test eax, eax
je 0x11d5e739
call fcn.11d5d470
mov ecx, dword [esp + 0x38]
push eax
test ecx, ecx
jne 0x11d5e6ed
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x56], ax
mov dword [esp + 0x58], edx
jmp 0x11d5e706
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
mov eax, 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x68], eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5eb36
push str.connectFunc_SMTP_Redirect
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0xc
jmp 0x11d5eac0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d5e7b4
mov eax, dword [0x11e23d9c]
test eax, eax
je 0x11d5eac0
mov eax, dword [0x11e23dac]
test eax, eax
je 0x11d5e771
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c980
test eax, eax
je 0x11d5eac0
mov ecx, 0x11e23898
call fcn.11d4aa70
test eax, eax
jne 0x11d5e7b4
mov ecx, 0x11e23898
call fcn.11d4aab0
test eax, eax
jne 0x11d5e7b4
mov eax, dword [0x11e238d4]
test eax, eax
je 0x11d5eac0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d5eac0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e7d1
push str.connectFunc_SafeGW_Redirect
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5e806
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x56], ax
mov eax, 1
mov dword [esp + 0x58], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0xfc], eax
jmp 0x11d5eb36
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0xfc], eax
jmp 0x11d5eb36
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5e88f
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x20]
call fcn.11d7a640
mov edi, eax
mov byte [esp + 0x118], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
push eax
push edx
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d7ade0
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11e23d9c]
test eax, eax
jne 0x11d5e8b9
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d5e8b9
mov eax, dword [0x11e23db8]
test eax, eax
je 0x11d5eb36
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d5eb36
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
call fcn.11d74b10
mov eax, esi
jmp 0x11d5fb69
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d5e960
mov eax, dword [0x11e23d98]
test eax, eax
je 0x11d5e960
call fcn.11d5d470
mov ecx, dword [esp + 0x38]
push eax
test ecx, ecx
jne 0x11d5e935
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
mov eax, 1
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], eax
jmp 0x11d5eb36
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], eax
jmp 0x11d5eb36
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d5eac8
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5e99c
mov edx, dword [esp + 0x64]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
jmp 0x11d5eac0
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
jmp 0x11d5eac0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5eac0
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x14
jmp 0x11d5eac0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5eac0
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x14
jmp 0x11d5eac0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5ea47
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
call fcn.11d67ac0
test eax, eax
jne 0x11d5ea9a
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5ea6d
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
mov eax, dword [0x11e23d9c]
mov dword [esp + 0x44], 1
test eax, eax
je 0x11d5eaa2
mov eax, dword [0x11e2389c]
test eax, eax
je 0x11d5eaa2
mov eax, dword [0x11e23bb0]
and eax, 1
cmp al, 1
je 0x11d5eaa2
call fcn.11d6baa0
jmp 0x11d5eaa2
mov dword [esp + 0x2c], 1
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5eac0
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d5eb36
lea ecx, [esp + 0x68]
lea edx, [esp + 0x10]
push ecx
push edx
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11d644f0
add esp, 0x10
test eax, eax
je 0x11d5eb36
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11d5eb36
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 1
test ecx, ecx
push eax
jne 0x11d5eb1d
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
jmp 0x11d5eb36
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edx
lea eax, [esp + 0xd8]
mov dword [esp + 0xe0], edx
push eax
push ebp
mov dword [esp + 0xec], edx
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e23448
call fcn.11d426c0
test eax, eax
je 0x11d5ec32
mov ecx, dword [esp + 0xd8]
push ecx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe0]
cmp eax, 0xffffffff
je 0x11d5ebad
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11d5ebaf
mov edi, ebp
mov eax, dword [0x11e297e0]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11d5ebf6
push edi
call esi
and eax, 0xffff
mov edx, dword [esp + 0x14]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d455b0
add esp, 0x1c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d5ec08
mov dword [esp + 0x24], 1
jmp 0x11d5ec32
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5ec1f
mov eax, dword [esp + 0x14]
mov word [esp + 0x56], di
mov dword [esp + 0x58], eax
jmp 0x11d5ec32
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], ecx
mov edx, dword [esp + 0x128]
mov ecx, 0x11e237a8
push edx
call fcn.11d49680
mov ecx, 0x11e237a8
call fcn.11d499a0
mov eax, dword [esp + 0x38]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11d5ec61
lea edi, [esp + 0x54]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d5ec86
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5ec8d
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11d455b0
add esp, 0xc
mov eax, dword [0x11e297e0]
test eax, eax
mov ebp, dword [esp + 0x120]
je 0x11d5ecab
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e297e0]
test ebp, ebp
jne 0x11d5f00e
test eax, eax
je 0x11d5ecf5
mov ax, word [edi + 2]
push eax
call esi
mov ecx, dword [edi + 4]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x130]
push edx
push 0x3bb
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x1c
lea ecx, [esp + 0x6c]
call fcn.11d74ba0
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x40]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebp
call fcn.11d746c0
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
je 0x11d5ed8a
mov edx, dword [esi + 0xc]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
jmp 0x11d5edcd
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d5edcd
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x128]
push eax
push edi
push ecx
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5edcd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d74b80
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5ee0b
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3c9
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x20
mov eax, dword [0x11e23db8]
test eax, eax
jne 0x11d5f359
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5f359
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5eef8
push 0x3d1
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5eef8
mov edx, dword [0x11e23dac]
push edx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5eef8
mov eax, dword [esp + 0x2c]
push eax
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5eef8
mov ecx, dword [0x11e24084]
push ecx
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5eef8
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0x10
jmp 0x11d5ef02
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5ef30
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0x14
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d5efc2
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5efc2
mov eax, dword [0x11e23dac]
test eax, eax
je 0x11d5ef8d
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11d5ef80
mov eax, dword [0x11e24084]
test eax, eax
je 0x11d5ef80
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d5ef80
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d5efc2
mov eax, dword [0x11e23dac]
test eax, eax
jne 0x11d5f359
mov eax, dword [esp + 0x30]
test eax, eax
mov eax, dword [0x11e23d9c]
jne 0x11d5efae
test eax, eax
je 0x11d5efae
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x11d5efae
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d5efc2
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x11d5f359
test eax, eax
je 0x11d5f359
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5efdf
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x12c]
push eax
mov eax, dword [esp + 0x138]
push ecx
lea ecx, [esp + 0x60]
push eax
push ecx
push edx
call fcn.11d69f00
add esp, 0x18
jmp 0x11d5f359
test eax, eax
je 0x11d5f02b
push 0x3e5
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
lea ecx, [esp + 0x6c]
call fcn.11d74ba0
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x44]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebp
call fcn.11d746c0
mov eax, dword [esp + 0x50]
add esp, 0x10
test eax, eax
je 0x11d5f0dc
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11d5f13f
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d5f13f
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x134]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5f13f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d74b80
mov eax, dword [0x11e23db8]
test eax, eax
jne 0x11d5f359
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d5f359
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f234
push 0x3f0
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5f234
mov ecx, dword [0x11e23dac]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5f234
mov edx, dword [esp + 0x2c]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5f234
mov eax, dword [0x11e24084]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d5f234
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0x10
jmp 0x11d5f23e
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f26c
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0x14
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d5f2f2
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d5f2f2
mov eax, dword [0x11e23dac]
test eax, eax
je 0x11d5f2c5
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11d5f2b8
mov eax, dword [0x11e24084]
test eax, eax
je 0x11d5f2b8
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d5f2b8
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d5f2f2
mov eax, dword [0x11e23dac]
test eax, eax
jne 0x11d5f359
mov eax, dword [esp + 0x30]
test eax, eax
mov eax, dword [0x11e23d9c]
jne 0x11d5f2e6
test eax, eax
je 0x11d5f2e6
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x11d5f2e6
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d5f2f2
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x11d5f359
test eax, eax
je 0x11d5f359
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f30f
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d455b0
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x13c]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x144]
push ecx
mov ecx, dword [esp + 0x144]
push edx
push eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x70]
push ecx
push edx
push eax
call fcn.11d6ad50
add esp, 0x28
mov ecx, 0x11e237a8
call fcn.11d49ad0
mov edi, dword [esp + 0x128]
mov ecx, 0x11e23858
push edi
call fcn.11d48d00
test eax, eax
je 0x11d5f3f7
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f397
push edi
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov dword [esp + 0x30], 0
mov eax, dword [0x11e23dac]
test eax, eax
jne 0x11d5f9af
mov eax, dword [0x11e2389c]
test eax, eax
mov eax, dword [0x11e23bb0]
je 0x11d5f3cc
mov ecx, eax
mov dword [esp + 0x18], 1
and ecx, 1
cmp cl, 1
jne 0x11d5f3d4
mov dword [esp + 0x18], 0
mov ecx, dword [0x11e238d4]
test ecx, ecx
je 0x11d5f8c5
and eax, 1
cmp al, 1
je 0x11d5f8c5
mov ebp, 1
jmp 0x11d5f8c7
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d5f39f
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f41c
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0xc
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11d5f467
mov edx, dword [esp + 0x12c]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11d5f47c
mov dx, word [esp + 0x34]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], ebx
mov edi, dword [esp + 0x24]
test edi, edi
je 0x11d5f496
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x7a], ax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x78]
push edx
push eax
mov ecx, 0x11e23820
call fcn.11d491c0
mov dword [esp + 0xe8], 0x35026200
mov word [esp + 0xec], 0x10
mov word [esp + 0xee], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push ebx
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], 1
call ebp
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x104], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov dx, word [esp + 0x68]
mov word [esp + 0x10a], ax
mov word [esp + 0x10c], dx
call fcn.11db73e0
test edi, edi
mov word [esp + 0x10e], ax
je 0x11d5f553
mov eax, dword [esp + 0x14]
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x104], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x10a], ax
mov eax, dword [esp + 0x120]
xor edi, edi
cmp eax, edi
je 0x11d5f568
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x11e297e0], edi
je 0x11d5f58b
push 0x28
push 0x447
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
mov dword [esp + 0x20], 0xa
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d5f5b1
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11e237a8
call fcn.11d499a0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f5e2
mov eax, dword [esp + 0x2c]
push eax
push 0x45b
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x128]
mov ecx, 0x28
push 0
sub ecx, eax
lea edx, [esp + eax + 0xec]
push ecx
push edx
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f630
mov eax, dword [esp + 0x2c]
push edi
push eax
push 0x45f
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x18
mov ecx, 0x11e237a8
call fcn.11d49ad0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11d5f6af
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11d5f65d
call edi
cmp eax, 0x2749
jne 0x11d5f6c0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f67d
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
add ecx, 3
test eax, eax
mov dword [esp + 0x20], ecx
jne 0x11d5f69b
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 0x64
mov dword [esp + 0x2c], eax
jl 0x11d5f59b
jmp 0x11d5f70b
mov eax, dword [esp + 0x18]
add eax, edi
cmp eax, 0x28
mov dword [esp + 0x18], eax
jae 0x11d5f70b
jmp 0x11d5f67d
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f6e0
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
or edi, 0xffffffff
push ebp
mov ecx, 0x11e237a8
mov dword [esi + 0x14], edi
call fcn.11d497b0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], edi
call fcn.11d74b10
mov eax, esi
jmp 0x11d5fb69
cmp dword [esp + 0x2c], 0x64
jne 0x11d5f736
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f736
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xb2], edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0xb6], edx
mov dword [esp + 0x90], ecx
mov dword [esp + 0xba], edx
lea eax, [esp + 0x44]
mov word [esp + 0xbe], dx
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0xb0]
push eax
xor edi, edi
push ecx
push edx
mov dword [esp + 0x94], edi
mov word [esp + 0xbc], di
mov dword [esp + 0x50], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11d5f7cd
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xb2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11d5f7f0
cmp dword [0x11e297e0], edi
je 0x11d5f7f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getsockname_failed__errno:__d
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x44]
mov dword [esp + 0xca], edx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xce], edx
push eax
mov dword [esp + 0xd6], edx
push ecx
mov word [esp + 0xde], dx
mov edx, dword [esp + 0x130]
push edx
mov word [esp + 0xd4], 0
mov dword [esp + 0x50], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d5f870
mov eax, dword [esp + 0xcc]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xca]
mov dword [esp + 0x88], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
jmp 0x11d5f894
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f894
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
cmp ebp, 0xffffffff
je 0x11d5f9af
cmp edi, 0xffffffff
je 0x11d5f9af
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x88]
push edx
push eax
mov ecx, 0x11e23858
call fcn.11d48ad0
jmp 0x11d5f9af
xor ebp, ebp
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
mov edi, eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5f90b
mov eax, dword [esp + 0x18]
push edi
push ebp
push eax
push str.after_connectEx_add_health_log__bForce__d___bSmart__d__bVisitProIP__d_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d5f9af
test ebp, ebp
jne 0x11d5f9af
test edi, edi
je 0x11d5f9af
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x54]
mov byte [esp + 0x11c], 7
call fcn.11d7a640
mov edx, dword [esp + 0x34]
mov ebp, dword [eax]
push 0
push edx
mov byte [esp + 0x120], 8
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 0
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x50]
mov byte [esp + 0x118], 7
call fcn.11d7ade0
lea ecx, [esp + 0x48]
mov byte [esp + 0x118], 0
call fcn.11d7ade0
mov eax, dword [0x11e23db8]
test eax, eax
je 0x11d5f9ef
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x50]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x60], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e23bd0
mov edx, dword [esp + 0x13c]
push edx
call fcn.11d58fa0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5fa21
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x134]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
mov edi, dword [esp + 0x128]
mov ecx, 0x11e237a8
push edi
call fcn.11d497b0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d5fa55
mov eax, dword [esi + 0x14]
push eax
push edi
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11d455b0
add esp, 0x14
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d74b10
mov eax, esi
jmp 0x11d5fb69
mov esi, dword [esp + 0x124]
lea ecx, [esp + 0x40]
push ecx
xor ebp, ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x50], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d5faf9
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d5fb3c
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d5fb3c
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x128]
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5fb3c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e297e0], ebp
je 0x11d5fb66
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
xor ecx, ecx
push edx
mov cx, word [edi]
push eax
push ecx
push str.TMAILHOOK::connectFunc_...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10c
ret 0x24