Function at 0x11d5fd40
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11df51a8
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
mov esi, dword [esp + 0xfc]
push edi
mov edi, dword [esp + 0xfc]
xor ebp, ebp
cmp edi, ebp
je 0x11d618c2
cmp esi, ebp
jle 0x11d618c2
mov eax, dword [0x11e297e0]
cmp eax, ebp
je 0x11d5fd9c
push str.New_connecttion_come_connectEx___
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x54]
call fcn.11d74ae0
push esi
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.11d5fb90
add esp, 0x10
cmp eax, ebp
mov dword [esp + 0x48], ebp
jne 0x11d5ff1c
lea ecx, [esp + 0x50]
call fcn.11d74ba0
mov esi, dword [esp + 0xf4]
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x20], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x11d5fe86
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x108]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d5fee9
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d5fee9
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x110]
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x104]
push edx
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d5fee9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e297e0], ebp
je 0x11d618a4
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d455b0
add esp, 0x18
jmp 0x11d618a4
call fcn.11d67380
push esi
mov dword [esp + 0x2c], ebp
call fcn.11d8efa0
add esp, 4
cmp eax, ebp
mov dword [esp + 0x20], eax
jne 0x11d6007d
lea ecx, [esp + 0x50]
call fcn.11d74ba0
mov esi, dword [esp + 0xf4]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x20], ebp
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x11d5ffe7
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x108]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
xor ebp, ebp
jmp 0x11d6004a
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d6004a
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x104]
push ecx
push edx
push edi
push eax
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d6004a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e297e0], ebp
je 0x11d618a4
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
xor ecx, ecx
mov cx, word [edi]
push ecx
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d455b0
add esp, 0x18
jmp 0x11d618a4
mov ecx, dword [esp + 0x100]
mov esi, edi
mov edi, dword [esp + 0x20]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x60]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x64], ebp
push ecx
call fcn.11d5d670
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
mov dword [esp + 0x3c], eax
mov eax, dword [0x11e297e0]
add esp, 8
cmp eax, ebp
je 0x11d600ea
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.TMAILHOOK::IP:_0x_lx__Port:__d_connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x14
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc0]
mov dword [esp + 0xbc], ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], ebp
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d585a0
mov esi, eax
mov eax, dword [0x11e23dac]
cmp eax, ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], ebp
jne 0x11d60148
cmp dword [0x11e23d9c], ebp
jne 0x11d60148
cmp dword [0x11e23db0], ebp
je 0x11d6018d
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e239e8
call fcn.11d50e60
test eax, eax
je 0x11d6018d
mov eax, dword [0x11e297e0]
mov dword [esp + 0x3c], 1
cmp eax, ebp
je 0x11d6018d
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e23db8]
mov dword [esp + 0xa8], ebp
cmp eax, ebp
mov dword [esp + 0xa4], 8
je 0x11d60239
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x28]
push ecx
push edx
push ebp
push eax
call ebx
push eax
mov ecx, dword [esp + 0x20]
push ecx
call edi
push eax
mov ecx, 0x11e23bd0
mov edx, dword [esp + 0x10c]
push edx
call fcn.11d58fa0
test eax, eax
je 0x11d60217
cmp dword [0x11e297e0], ebp
je 0x11d60c0e
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.CCallback::connectEx_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d455b0
add esp, 0x14
jmp 0x11d60c0e
cmp dword [esp + 0xa8], ebp
je 0x11d607c4
mov dword [esp + 0x28], 1
mov dword [esp + 0x48], 5
jmp 0x11d607c4
cmp dword [0x11e23dac], ebp
je 0x11d606f5
mov eax, dword [0x11e2389c]
cmp eax, ebp
mov eax, dword [0x11e23bb0]
je 0x11d604d7
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d604d7
cmp esi, ebp
jne 0x11d60432
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d60432
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
test eax, eax
jne 0x11d60432
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d60432
push ecx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d60432
cmp dword [esp + 0x3c], ebp
jne 0x11d60432
cmp dword [0x11e297e0], ebp
je 0x11d60388
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
cmp eax, ebp
je 0x11d60388
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
cmp eax, ebp
je 0x11d60388
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
mov esi, dword [esp + 0xf4]
mov ecx, dword [esp + 0x10]
mov eax, 0x274d
push ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x18]
push eax
push edx
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x28]
mov byte [esp + 0xf0], 1
call fcn.11d7a640
mov ebp, dword [eax]
mov eax, dword [esp + 0x14]
push 0
push eax
mov byte [esp + 0xf4], 2
call ebx
push eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 2
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x24]
mov byte [esp + 0xec], 1
call fcn.11d7ade0
lea ecx, [esp + 0x18]
mov byte [esp + 0xec], 0
call fcn.11d7ade0
jmp 0x11d618a4
cmp dword [0x11e297e0], ebp
je 0x11d607c4
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
cmp eax, ebp
je 0x11d607c4
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
cmp eax, ebp
je 0x11d607c4
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
jmp 0x11d607ba
cmp dword [0x11e238d4], ebp
je 0x11d6054a
and eax, 1
cmp al, 1
je 0x11d6054a
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d607c4
cmp esi, ebp
jne 0x11d607c4
cmp dword [0x11e297e0], ebp
je 0x11d60531
push 0x5b9
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
push 1
call fcn.11d45170
add esp, 4
mov dword [0x11e23da0], eax
call fcn.11d6baa0
jmp 0x11d607c4
cmp dword [0x11e23bb4], ebp
je 0x11d606bb
cmp esi, ebp
jne 0x11d606af
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d606af
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e23b60
call fcn.11d576e0
test eax, eax
jne 0x11d606af
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d606af
push ecx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d606af
cmp dword [esp + 0x3c], ebp
jne 0x11d606af
cmp dword [0x11e297e0], ebp
je 0x11d60605
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d455b0
add esp, 0x14
mov esi, dword [esp + 0xf4]
mov ecx, dword [esp + 0x10]
mov eax, 0x274d
push ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x18]
push eax
push edx
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x28]
mov byte [esp + 0xf0], 3
call fcn.11d7a640
mov ebp, dword [eax]
mov eax, dword [esp + 0x14]
push 0
push eax
mov byte [esp + 0xf4], 4
call ebx
push eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 0
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x24]
mov byte [esp + 0xec], 3
call fcn.11d7ade0
lea ecx, [esp + 0x18]
mov byte [esp + 0xec], 0
call fcn.11d7ade0
jmp 0x11d618a4
cmp dword [0x11e23bb4], ebp
jne 0x11d607c4
cmp esi, ebp
je 0x11d607c4
mov eax, dword [0x11e297e0]
mov dword [esp + 0x30], ebp
cmp eax, ebp
je 0x11d607c4
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
jmp 0x11d607ba
cmp dword [0x11e23d9c], ebp
je 0x11d607c4
mov eax, dword [0x11e2389c]
cmp eax, ebp
mov eax, dword [0x11e23bb0]
je 0x11d6071d
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x11d607c4
cmp dword [0x11e238d4], ebp
je 0x11d60785
and eax, 1
cmp al, 1
je 0x11d60785
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d607c4
cmp esi, ebp
jne 0x11d607c4
cmp dword [0x11e297e0], ebp
je 0x11d6076f
push 0x5f5
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
push 1
call fcn.11d45170
add esp, 4
mov dword [0x11e23da0], eax
call fcn.11d6baa0
jmp 0x11d607c4
cmp dword [0x11e23bb4], ebp
jne 0x11d607c4
cmp esi, ebp
je 0x11d607c4
mov eax, dword [0x11e297e0]
mov dword [esp + 0x30], ebp
cmp eax, ebp
je 0x11d607c4
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push ebp
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, dword [sym.imp.WS2_32.dll_htons]
cmp eax, ebp
je 0x11d60b9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0xf8]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [0x11e297e0], ebp
je 0x11d60853
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x100]
push edx
push eax
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x1c
cmp dword [esp + 0x1c], 1
jne 0x11d60dd6
cmp dword [0x11e23db8], ebp
jne 0x11d60c3e
cmp dword [0x11e2389c], ebp
jne 0x11d6088a
cmp dword [0x11e238d4], ebp
je 0x11d6090f
cmp dword [0x11e23da0], ebp
je 0x11d6090f
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e23ac8
call fcn.11d52ab0
test eax, eax
je 0x11d6090f
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d608cb
push ecx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
je 0x11d6090f
mov dword [esp + 0x24], 1
call fcn.11d6baa0
mov eax, dword [0x11e297e0]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11d6090f
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d455b0
add esp, 0x14
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e239a0
call fcn.11d4f090
push str.127.0.0.1
mov dword [esp + 0x60], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d60d3e
push ecx
call edi
push eax
call fcn.11d67460
add esp, 4
test eax, eax
jne 0x11d60d3e
cmp dword [0x11e238d4], ebp
je 0x11d60a52
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d60989
cmp dword [0x11e23d98], ebp
jne 0x11d60a4a
cmp dword [0x11e297e0], ebp
je 0x11d609ac
mov edx, dword [0x11e2389c]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._connectEx__r_n
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x10
cmp dword [0x11e2389c], ebp
jne 0x11d609e4
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d609dc
cmp dword [esp + 0x3c], ebp
je 0x11d60cd0
cmp dword [0x11e2389c], ebp
je 0x11d60a22
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d60a22
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11e23bc0
call fcn.11d58d40
test eax, eax
je 0x11d60a22
cmp dword [esp + 0x3c], ebp
je 0x11d60d07
cmp dword [0x11e23d9c], ebp
je 0x11d60a64
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d60a64
jmp 0x11d60a5a
cmp dword [0x11e238d4], ebp
jne 0x11d60a64
cmp dword [0x11e23d9c], ebp
je 0x11d60a64
mov dword [0x11e23da4], 1
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d60ada
cmp dword [0x11e23d98], ebp
je 0x11d60ada
call fcn.11d5d470
push eax
call esi
push eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11d5fcf0
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
cmp dword [0x11e297e0], ebp
je 0x11d60e35
push str.connectFunc_SMTP_Redirect
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0xc
jmp 0x11d60dd6
cmp dword [esp + 0x3c], ebp
jne 0x11d60b64
cmp dword [0x11e23d9c], ebp
je 0x11d60dd6
cmp dword [0x11e23dac], ebp
je 0x11d60b1a
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c980
test eax, eax
je 0x11d60dd6
mov ecx, 0x11e23898
call fcn.11d4aa70
test eax, eax
jne 0x11d60b64
mov ecx, 0x11e23898
call fcn.11d4aab0
test eax, eax
jne 0x11d60b64
cmp dword [0x11e238d4], ebp
je 0x11d60dd6
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
je 0x11d60dd6
mov eax, dword [esp + 0x60]
push eax
call esi
push eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11d5fcf0
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0xd0], eax
jmp 0x11d60e35
cmp dword [0x11e297e0], ebp
je 0x11d60bea
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x30]
call fcn.11d7a640
mov esi, eax
mov byte [esp + 0xec], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push ecx
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_connectEx__r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0xec], 0
call fcn.11d7ade0
cmp dword [0x11e23d9c], ebp
jne 0x11d60c0e
cmp dword [esp + 0x3c], ebp
jne 0x11d60c0e
cmp dword [0x11e23db8], ebp
je 0x11d60e35
cmp dword [esp + 0x28], ebp
je 0x11d60e35
mov ecx, dword [esp + 0xf4]
mov eax, 0x274d
mov dword [esp + 0xec], 0xffffffff
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11d74b10
xor eax, eax
jmp 0x11d619f6
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
call fcn.11d66420
add esp, 4
test eax, eax
je 0x11d60c94
cmp dword [0x11e23d98], ebp
je 0x11d60c94
call fcn.11d5d470
push eax
call esi
push eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call fcn.11d5fcf0
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
jmp 0x11d60e35
cmp dword [esp + 0x28], ebp
je 0x11d60ddc
mov eax, dword [esp + 0x60]
push eax
call esi
push eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11d5fcf0
add esp, 0x10
mov dword [esp + 0xd0], 1
jmp 0x11d60dd6
cmp dword [0x11e297e0], ebp
je 0x11d60dd6
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.it_is_not_in_the_blacklist__d___d_connectEx_
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x14
jmp 0x11d60dd6
cmp dword [0x11e297e0], ebp
je 0x11d60dd6
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11e0b3a8
push 1
call fcn.11d455b0
add esp, 0x14
jmp 0x11d60dd6
cmp dword [0x11e297e0], ebp
je 0x11d60d5a
push str.It_is_local_connecttion__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
call fcn.11d67ac0
test eax, eax
jne 0x11d60dad
cmp dword [0x11e297e0], ebp
je 0x11d60d7f
push str.Disable_Local_connecttion______connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
mov eax, dword [0x11e23d9c]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11d60db5
cmp dword [0x11e2389c], ebp
je 0x11d60db5
mov edx, dword [0x11e23bb0]
and edx, 1
cmp dl, 1
je 0x11d60db5
call fcn.11d6baa0
jmp 0x11d60db5
mov dword [esp + 0x5c], 1
cmp dword [0x11e297e0], ebp
je 0x11d60dd6
mov eax, dword [esp + 0x10]
push eax
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
cmp dword [esp + 0x28], ebp
jne 0x11d60e35
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x28], ebp
call ebx
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call edi
push eax
call fcn.11d644f0
add esp, 0x10
test eax, eax
je 0x11d60e35
mov eax, dword [esp + 0x1c]
cmp ax, bp
je 0x11d60e35
push eax
mov dword [esp + 0x2c], 1
call esi
push eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11d5fcf0
add esp, 0x10
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0xb0], edx
lea eax, [esp + 0xac]
xor esi, esi
mov dword [esp + 0xb4], edx
push eax
push ecx
xor ebp, ebp
xor edi, edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xc0], edx
call ebx
push eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e23448
call fcn.11d426c0
test eax, eax
je 0x11d60f1f
mov eax, dword [esp + 0xac]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, eax
mov eax, dword [esp + 0xb4]
cmp eax, 0xffffffff
je 0x11d60eae
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, eax
jmp 0x11d60eb2
mov esi, dword [esp + 0x14]
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d60ef9
push esi
call ebx
and eax, 0xffff
push eax
push edi
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectExFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d455b0
add esp, 0x1c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d60f08
mov ebp, 1
jmp 0x11d60f1f
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x20]
push esi
push edi
push eax
push ecx
call fcn.11d5fcf0
add esp, 0x10
mov edx, dword [esp + 0xf8]
mov ecx, 0x11e237a8
push edx
call fcn.11d49680
mov ecx, 0x11e23858
mov eax, dword [esp + 0xf8]
push eax
call fcn.11d48d00
test eax, eax
je 0x11d61051
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d60f70
mov ecx, dword [esp + 0xf8]
push ecx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov dword [esp + 0x28], 0
mov ecx, 0x11e237a8
call fcn.11d499a0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d60f9f
push str.before_ConnectEx
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.11d74ba0
mov esi, dword [esp + 0xf4]
lea edx, [esp + 0x4c]
lea eax, [esp + 0x18]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebp, dword [esi + 0x20]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x30]
push eax
xor ebx, ebx
push ecx
push edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x5c], ebx
call fcn.11d746c0
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x11d6157f
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x10c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x40]
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], eax
xor ebx, ebx
jmp 0x11d615e6
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d60f78
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d6107a
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_connectEx__r_n
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0xc
mov ax, word [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov word [esp + 0x74], 2
mov dword [esp + 0x76], edx
mov word [esp + 0x76], ax
mov dword [esp + 0x7a], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7e], edx
test ebp, ebp
mov word [esp + 0x82], dx
je 0x11d610b6
mov word [esp + 0x76], si
mov dword [esp + 0x78], edi
mov eax, dword [esp + 0xf8]
lea edx, [esp + 0x74]
push edx
push eax
mov ecx, 0x11e23820
call fcn.11d491c0
mov dword [esp + 0xbc], 0x35026200
mov word [esp + 0xc0], 0x10
mov word [esp + 0xc2], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc8], eax
push ecx
mov dword [esp + 0xd0], 1
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xd8], eax
push edx
call ebx
mov word [esp + 0xde], ax
mov ax, word [esp + 0x48]
mov word [esp + 0xe0], ax
call fcn.11db73e0
test ebp, ebp
mov word [esp + 0xe2], ax
je 0x11d61169
push edi
call dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov dword [esp + 0xdc], eax
call ebx
mov word [esp + 0xde], ax
mov ecx, dword [esp + 0x108]
lea ebx, [ecx + 0x28]
push ebx
call fcn.11d8efa0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x11d611c4
mov edx, dword [esp + 0xf8]
push ebp
push edx
mov ecx, 0x11e23408
call fcn.11d41d20
mov ecx, 0xa
lea esi, [esp + 0xbc]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x108]
mov esi, dword [esp + 0x104]
mov eax, ecx
lea edi, [ebp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11e237a8
mov dword [esp + 0x34], 0
call fcn.11d499a0
lea ecx, [esp + 0x50]
call fcn.11d74ba0
mov esi, dword [esp + 0xf4]
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x64], ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x44], edx
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push edi
call fcn.11d746c0
mov eax, dword [esp + 0x5c]
add esp, 0x10
test eax, eax
je 0x11d6137c
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebp
push edx
mov edx, dword [esp + 0x10c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
mov ebp, dword [esp + 0xf8]
lea ecx, [esp + 0x50]
call fcn.11d74b80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x11e297e0]
test ecx, ecx
je 0x11d612b5
push eax
push str.redirect_ConnectEx_09_dwLastError___d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d61348
mov ecx, dword [esp + 0x108]
push ecx
push str.redirect_ConnectEx_10_dwSendDataLength___d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d61348
mov eax, dword [esi + 0x14]
push eax
push str.redirect_ConnectEx_11_pContext__GetReturn_____d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x10
test eax, eax
je 0x11d61348
mov edx, dword [esp + 0x34]
push 0x28
push edx
push str.redirect_ConnectEx_12_dwBytesSentNew___d_sizeof_HOOKINFO____d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
mov eax, dword [0x11e297e0]
add esp, 0x14
test eax, eax
je 0x11d61348
mov eax, dword [esp + 0x110]
push eax
push str.redirect_ConnectEx_12_lpOverlapped___d
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x10
mov ecx, 0x11e237a8
call fcn.11d49ad0
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x11d613f2
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x11d613f2
mov ecx, dword [esp + 0x34]
cmp ecx, 0x28
jb 0x11d613df
add ecx, 0xffffffd8
mov dword [eax], ecx
jmp 0x11d613f2
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11d61280
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push edx
push eax
push ebp
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d61287
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
jmp 0x11d61287
mov dword [eax], 0
mov dword [esi + 0x14], 0
push ebp
jmp 0x11d6189a
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d6140f
push str.redirect_ConnectEx_13
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], eax
mov word [esp + 0x84], ax
mov dword [esp + 0x86], edx
mov dword [esp + 0x70], ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x8a], edx
lea ecx, [esp + 0x84]
push eax
mov dword [esp + 0x92], edx
mov edi, 0x10
push ecx
push ebp
mov word [esp + 0x9e], dx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x11d61491
mov edx, dword [esp + 0x88]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x86]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x72], ax
jmp 0x11d614b5
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d614d2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d_connectEx_
push 0x11e0b3a8
push 4
call fcn.11d455b0
add esp, 0x10
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d614d2
push str.redirect_ConnectEx_14
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x96], ecx
lea eax, [esp + 0x94]
mov dword [esp + 0x9a], ecx
push edx
mov dword [esp + 0xa2], ecx
push eax
push ebp
mov word [esp + 0xa0], 0
mov word [esp + 0xae], cx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d6153f
mov ecx, dword [esp + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x96]
mov dword [esp + 0x68], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x70], ax
cmp ebx, 0xffffffff
je 0x11d61559
cmp edi, 0xffffffff
je 0x11d61559
lea eax, [esp + 0x68]
mov ecx, 0x11e23858
push eax
push ebp
call fcn.11d48ad0
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d61746
push str.redirect_ConnectEx_15
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
jmp 0x11d61746
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x11d615e6
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x108]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d615e6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11d74b80
cmp dword [0x11e297e0], ebx
je 0x11d6160b
push str.after_connectEx
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0xc
mov ecx, 0x11e237a8
call fcn.11d49ad0
cmp dword [0x11e23dac], ebx
jne 0x11d61746
mov eax, dword [0x11e2389c]
test eax, eax
mov eax, dword [0x11e23bb0]
je 0x11d61640
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d61640
mov ebp, 1
jmp 0x11d61642
xor ebp, ebp
mov ecx, dword [0x11e238d4]
test ecx, ecx
je 0x11d6165a
and eax, 1
cmp al, 1
je 0x11d6165a
mov ebx, 1
jmp 0x11d6165c
xor ebx, ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
mov edi, eax
mov eax, dword [0x11e297e0]
test eax, eax
je 0x11d616a0
push edi
push ebx
push ebp
push str.after_connectEx_add_health_log__bForce__d___bSmart__d__bVisitProIP__d_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
test ebp, ebp
jne 0x11d61746
test ebx, ebx
jne 0x11d61746
test edi, edi
je 0x11d61746
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push edx
call ebx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.11db9ba0
add esp, 8
mov edi, dword [eax]
push 0x11e23dbc
lea ecx, [esp + 0x44]
mov byte [esp + 0xf0], 6
call fcn.11d7a640
mov ecx, dword [esp + 0x14]
mov ebp, dword [eax]
push 0
push ecx
mov byte [esp + 0xf4], 7
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x18]
push edx
call ebx
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
push eax
push edi
push 0
push ebp
mov ecx, 0x11e284e0
call fcn.11d718a0
lea ecx, [esp + 0x40]
mov byte [esp + 0xec], 6
call fcn.11d7ade0
lea ecx, [esp + 0x44]
mov byte [esp + 0xec], 0
call fcn.11d7ade0
mov eax, dword [0x11e23db8]
test eax, eax
jne 0x11d61818
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d617e5
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d617e5
mov eax, dword [0x11e23dac]
test eax, eax
je 0x11d617b8
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x11d617af
mov eax, dword [0x11e24084]
test eax, eax
je 0x11d617af
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e238d0
call fcn.11d4c470
test eax, eax
jne 0x11d617af
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d617e5
mov eax, dword [0x11e23dac]
test eax, eax
jne 0x11d6180f
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [0x11e23d9c]
jne 0x11d617d9
test eax, eax
je 0x11d617d9
mov ecx, dword [esp + 0x5c]
test ecx, ecx
jne 0x11d617d9
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d617e5
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x11d6180f
test eax, eax
je 0x11d6180f
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0xfc]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push edx
call fcn.11d69f00
add esp, 0x18
mov eax, dword [0x11e23db8]
test eax, eax
je 0x11d61853
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x40]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x50], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e23bd0
mov eax, dword [esp + 0x10c]
push eax
call fcn.11d58fa0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.11d8efae
mov eax, dword [0x11e297e0]
add esp, 4
test eax, eax
je 0x11d61892
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x100]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d455b0
add esp, 0x18
mov ecx, dword [esp + 0xf8]
push ecx
mov ecx, 0x11e237a8
call fcn.11d497b0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x50]
mov dword [esp + 0xec], 0xffffffff
call fcn.11d74b10
mov eax, esi
jmp 0x11d619f6
mov esi, dword [esp + 0xf4]
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x1c], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x48], edx
mov dword [esp + 0x68], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ebp
call fcn.11d746c0
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d61966
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x108]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x64]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d619c9
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d619c9
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x104]
push eax
push ecx
push edi
push edx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d619c9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e297e0], ebp
je 0x11d619f3
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_..._addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d455b0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret 0x20