Function at 0x11d80b90
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11e16038
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
mov esi, dword [esp + 0xfc]
push edi
mov edi, dword [esp + 0xfc]
xor ebp, ebp
cmp edi, ebp
je 0x11d82712
cmp esi, ebp
jle 0x11d82712
mov eax, dword [0x11e4b918]
cmp eax, ebp
je 0x11d80bec
push str.New_connecttion_come_connectEx___
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x54]
call fcn.11d95860
push esi
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.11d809e0
add esp, 0x10
cmp eax, ebp
mov dword [esp + 0x48], ebp
jne 0x11d80d6c
lea ecx, [esp + 0x50]
call fcn.11d95920
mov esi, dword [esp + 0xf4]
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x20], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebp
call fcn.11d95440
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x11d80cd6
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x108]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d80d39
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d80d39
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x110]
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x104]
push edx
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d80d39
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e4b918], ebp
je 0x11d826f4
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d65710
add esp, 0x18
jmp 0x11d826f4
call fcn.11d88100
push esi
mov dword [esp + 0x2c], ebp
call fcn.11db0150
add esp, 4
cmp eax, ebp
mov dword [esp + 0x20], eax
jne 0x11d80ecd
lea ecx, [esp + 0x50]
call fcn.11d95920
mov esi, dword [esp + 0xf4]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x20], ebp
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebp
call fcn.11d95440
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x11d80e37
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x108]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
xor ebp, ebp
jmp 0x11d80e9a
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d80e9a
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x104]
push ecx
push edx
push edi
push eax
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d80e9a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e4b918], ebp
je 0x11d826f4
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
xor ecx, ecx
mov cx, word [edi]
push ecx
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d65710
add esp, 0x18
jmp 0x11d826f4
mov ecx, dword [esp + 0x100]
mov esi, edi
mov edi, dword [esp + 0x20]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x60]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x64], ebp
push ecx
call fcn.11d7e4c0
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
mov dword [esp + 0x3c], eax
mov eax, dword [0x11e4b918]
add esp, 8
cmp eax, ebp
je 0x11d80f3a
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.TMAILHOOK::IP:_0x_lx__Port:__d_connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x14
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xc0]
mov dword [esp + 0xbc], ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0x60], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x28], ebp
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d793f0
mov esi, eax
mov eax, dword [0x11e45ee4]
cmp eax, ebp
mov dword [esp + 0x30], esi
mov dword [esp + 0x3c], ebp
jne 0x11d80f98
cmp dword [0x11e45ed4], ebp
jne 0x11d80f98
cmp dword [0x11e45ee8], ebp
je 0x11d80fdd
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e45b00
call fcn.11d71cb0
test eax, eax
je 0x11d80fdd
mov eax, dword [0x11e4b918]
mov dword [esp + 0x3c], 1
cmp eax, ebp
je 0x11d80fdd
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e45ef0]
mov dword [esp + 0xa8], ebp
cmp eax, ebp
mov dword [esp + 0xa4], 8
je 0x11d81089
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x28]
push ecx
push edx
push ebp
push eax
call ebx
push eax
mov ecx, dword [esp + 0x20]
push ecx
call edi
push eax
mov ecx, 0x11e45ce8
mov edx, dword [esp + 0x10c]
push edx
call fcn.11d79df0
test eax, eax
je 0x11d81067
cmp dword [0x11e4b918], ebp
je 0x11d81a5e
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.CCallback::connectEx_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d65710
add esp, 0x14
jmp 0x11d81a5e
cmp dword [esp + 0xa8], ebp
je 0x11d81614
mov dword [esp + 0x28], 1
mov dword [esp + 0x48], 5
jmp 0x11d81614
cmp dword [0x11e45ee4], ebp
je 0x11d81545
mov eax, dword [0x11e459b4]
cmp eax, ebp
mov eax, dword [0x11e45cc8]
je 0x11d81327
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d81327
cmp esi, ebp
jne 0x11d81282
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d81282
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
test eax, eax
jne 0x11d81282
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d81282
push ecx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d81282
cmp dword [esp + 0x3c], ebp
jne 0x11d81282
cmp dword [0x11e4b918], ebp
je 0x11d811d8
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
cmp eax, ebp
je 0x11d811d8
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
cmp eax, ebp
je 0x11d811d8
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
mov esi, dword [esp + 0xf4]
mov ecx, dword [esp + 0x10]
mov eax, 0x274d
push ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x18]
push eax
push edx
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x28]
mov byte [esp + 0xf0], 1
call fcn.11d9b3c0
mov ebp, dword [eax]
mov eax, dword [esp + 0x14]
push 0
push eax
mov byte [esp + 0xf4], 2
call ebx
push eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 2
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x24]
mov byte [esp + 0xec], 1
call fcn.11d9bb60
lea ecx, [esp + 0x18]
mov byte [esp + 0xec], 0
call fcn.11d9bb60
jmp 0x11d826f4
cmp dword [0x11e4b918], ebp
je 0x11d81614
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
cmp eax, ebp
je 0x11d81614
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
cmp eax, ebp
je 0x11d81614
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
jmp 0x11d8160a
cmp dword [0x11e459ec], ebp
je 0x11d8139a
and eax, 1
cmp al, 1
je 0x11d8139a
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d81614
cmp esi, ebp
jne 0x11d81614
cmp dword [0x11e4b918], ebp
je 0x11d81381
push 0x5b9
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
push 1
call fcn.11d652d0
add esp, 4
mov dword [0x11e45ed8], eax
call fcn.11d8c820
jmp 0x11d81614
cmp dword [0x11e45ccc], ebp
je 0x11d8150b
cmp esi, ebp
jne 0x11d814ff
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d814ff
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
test eax, eax
jne 0x11d814ff
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d814ff
push ecx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d814ff
cmp dword [esp + 0x3c], ebp
jne 0x11d814ff
cmp dword [0x11e4b918], ebp
je 0x11d81455
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
mov esi, dword [esp + 0xf4]
mov ecx, dword [esp + 0x10]
mov eax, 0x274d
push ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x18]
push eax
push edx
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x28]
mov byte [esp + 0xf0], 3
call fcn.11d9b3c0
mov ebp, dword [eax]
mov eax, dword [esp + 0x14]
push 0
push eax
mov byte [esp + 0xf4], 4
call ebx
push eax
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 0
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x24]
mov byte [esp + 0xec], 3
call fcn.11d9bb60
lea ecx, [esp + 0x18]
mov byte [esp + 0xec], 0
call fcn.11d9bb60
jmp 0x11d826f4
cmp dword [0x11e45ccc], ebp
jne 0x11d81614
cmp esi, ebp
je 0x11d81614
mov eax, dword [0x11e4b918]
mov dword [esp + 0x30], ebp
cmp eax, ebp
je 0x11d81614
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
jmp 0x11d8160a
cmp dword [0x11e45ed4], ebp
je 0x11d81614
mov eax, dword [0x11e459b4]
cmp eax, ebp
mov eax, dword [0x11e45cc8]
je 0x11d8156d
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x11d81614
cmp dword [0x11e459ec], ebp
je 0x11d815d5
and eax, 1
cmp al, 1
je 0x11d815d5
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d81614
cmp esi, ebp
jne 0x11d81614
cmp dword [0x11e4b918], ebp
je 0x11d815bf
push 0x5f5
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
push 1
call fcn.11d652d0
add esp, 4
mov dword [0x11e45ed8], eax
call fcn.11d8c820
jmp 0x11d81614
cmp dword [0x11e45ccc], ebp
jne 0x11d81614
cmp esi, ebp
je 0x11d81614
mov eax, dword [0x11e4b918]
mov dword [esp + 0x30], ebp
cmp eax, ebp
je 0x11d81614
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push ebp
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, dword [sym.imp.WS2_32.dll_htons]
cmp eax, ebp
je 0x11d819eb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0xf8]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [0x11e4b918], ebp
je 0x11d816a3
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x100]
push edx
push eax
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x1c
cmp dword [esp + 0x1c], 1
jne 0x11d81c26
cmp dword [0x11e45ef0], ebp
jne 0x11d81a8e
cmp dword [0x11e459b4], ebp
jne 0x11d816da
cmp dword [0x11e459ec], ebp
je 0x11d8175f
cmp dword [0x11e45ed8], ebp
je 0x11d8175f
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e45be0
call fcn.11d73900
test eax, eax
je 0x11d8175f
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d8171b
push ecx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
je 0x11d8175f
mov dword [esp + 0x24], 1
call fcn.11d8c820
mov eax, dword [0x11e4b918]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11d8175f
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d65710
add esp, 0x14
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e45ab8
call fcn.11d6fee0
push str.127.0.0.1
mov dword [esp + 0x60], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11d81b8e
push ecx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d81b8e
cmp dword [0x11e459ec], ebp
je 0x11d818a2
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d817d9
cmp dword [0x11e45ed0], ebp
jne 0x11d8189a
cmp dword [0x11e4b918], ebp
je 0x11d817fc
mov edx, dword [0x11e459b4]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._connectEx__r_n
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x10
cmp dword [0x11e459b4], ebp
jne 0x11d81834
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, dword [esp + 0x14]
push ecx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d8182c
cmp dword [esp + 0x3c], ebp
je 0x11d81b20
cmp dword [0x11e459b4], ebp
je 0x11d81872
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d81872
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11e45cd8
call fcn.11d79b90
test eax, eax
je 0x11d81872
cmp dword [esp + 0x3c], ebp
je 0x11d81b57
cmp dword [0x11e45ed4], ebp
je 0x11d818b4
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d818b4
jmp 0x11d818aa
cmp dword [0x11e459ec], ebp
jne 0x11d818b4
cmp dword [0x11e45ed4], ebp
je 0x11d818b4
mov dword [0x11e45edc], 1
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d8192a
cmp dword [0x11e45ed0], ebp
je 0x11d8192a
call fcn.11d7e2c0
push eax
call esi
push eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11d80b40
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
cmp dword [0x11e4b918], ebp
je 0x11d81c85
push str.connectFunc_SMTP_Redirect
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0xc
jmp 0x11d81c26
cmp dword [esp + 0x3c], ebp
jne 0x11d819b4
cmp dword [0x11e45ed4], ebp
je 0x11d81c26
cmp dword [0x11e45ee4], ebp
je 0x11d8196a
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov eax, dword [esp + 0x14]
push eax
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d7d0
test eax, eax
je 0x11d81c26
mov ecx, 0x11e459b0
call fcn.11d6b8c0
test eax, eax
jne 0x11d819b4
mov ecx, 0x11e459b0
call fcn.11d6b900
test eax, eax
jne 0x11d819b4
cmp dword [0x11e459ec], ebp
je 0x11d81c26
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov edx, dword [esp + 0x14]
push edx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d81c26
mov eax, dword [esp + 0x60]
push eax
call esi
push eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11d80b40
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0xd0], eax
jmp 0x11d81c85
cmp dword [0x11e4b918], ebp
je 0x11d81a3a
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x30]
call fcn.11d9b3c0
mov esi, eax
mov byte [esp + 0xec], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
push eax
push ecx
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_connectEx__r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
lea ecx, [esp + 0x2c]
mov byte [esp + 0xec], 0
call fcn.11d9bb60
cmp dword [0x11e45ed4], ebp
jne 0x11d81a5e
cmp dword [esp + 0x3c], ebp
jne 0x11d81a5e
cmp dword [0x11e45ef0], ebp
je 0x11d81c85
cmp dword [esp + 0x28], ebp
je 0x11d81c85
mov ecx, dword [esp + 0xf4]
mov eax, 0x274d
mov dword [esp + 0xec], 0xffffffff
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11d95890
xor eax, eax
jmp 0x11d82846
mov edx, dword [esp + 0x14]
push edx
call ebx
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d81ae4
cmp dword [0x11e45ed0], ebp
je 0x11d81ae4
call fcn.11d7e2c0
push eax
call esi
push eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call fcn.11d80b40
mov eax, 1
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x48], eax
jmp 0x11d81c85
cmp dword [esp + 0x28], ebp
je 0x11d81c2c
mov eax, dword [esp + 0x60]
push eax
call esi
push eax
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11d80b40
add esp, 0x10
mov dword [esp + 0xd0], 1
jmp 0x11d81c26
cmp dword [0x11e4b918], ebp
je 0x11d81c26
mov ecx, dword [esp + 0x14]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.it_is_not_in_the_blacklist__d___d_connectEx_
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x14
jmp 0x11d81c26
cmp dword [0x11e4b918], ebp
je 0x11d81c26
mov eax, dword [esp + 0x14]
push eax
call ebx
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x14
jmp 0x11d81c26
cmp dword [0x11e4b918], ebp
je 0x11d81baa
push str.It_is_local_connecttion__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
call fcn.11d88840
test eax, eax
jne 0x11d81bfd
cmp dword [0x11e4b918], ebp
je 0x11d81bcf
push str.Disable_Local_connecttion______connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
mov eax, dword [0x11e45ed4]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11d81c05
cmp dword [0x11e459b4], ebp
je 0x11d81c05
mov edx, dword [0x11e45cc8]
and edx, 1
cmp dl, 1
je 0x11d81c05
call fcn.11d8c820
jmp 0x11d81c05
mov dword [esp + 0x5c], 1
cmp dword [0x11e4b918], ebp
je 0x11d81c26
mov eax, dword [esp + 0x10]
push eax
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
cmp dword [esp + 0x28], ebp
jne 0x11d81c85
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push ecx
push edx
push eax
mov dword [esp + 0x28], ebp
call ebx
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call edi
push eax
call fcn.11d85340
add esp, 0x10
test eax, eax
je 0x11d81c85
mov eax, dword [esp + 0x1c]
cmp ax, bp
je 0x11d81c85
push eax
mov dword [esp + 0x2c], 1
call esi
push eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11d80b40
add esp, 0x10
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0xb0], edx
lea eax, [esp + 0xac]
xor esi, esi
mov dword [esp + 0xb4], edx
push eax
push ecx
xor ebp, ebp
xor edi, edi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xc0], edx
call ebx
push eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e45528
call fcn.11d62820
test eax, eax
je 0x11d81d6f
mov eax, dword [esp + 0xac]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, eax
mov eax, dword [esp + 0xb4]
cmp eax, 0xffffffff
je 0x11d81cfe
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, eax
jmp 0x11d81d02
mov esi, dword [esp + 0x14]
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d81d49
push esi
call ebx
and eax, 0xffff
push eax
push edi
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
and eax, 0xffff
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectExFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d65710
add esp, 0x1c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d81d58
mov ebp, 1
jmp 0x11d81d6f
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x20]
push esi
push edi
push eax
push ecx
call fcn.11d80b40
add esp, 0x10
mov edx, dword [esp + 0xf8]
mov ecx, 0x11e45888
push edx
call fcn.11d6a250
mov ecx, 0x11e45938
mov eax, dword [esp + 0xf8]
push eax
call fcn.11d69730
test eax, eax
je 0x11d81ea1
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d81dc0
mov ecx, dword [esp + 0xf8]
push ecx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov dword [esp + 0x28], 0
mov ecx, 0x11e45888
call fcn.11d6a570
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d81def
push str.before_ConnectEx
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.11d95920
mov esi, dword [esp + 0xf4]
lea edx, [esp + 0x4c]
lea eax, [esp + 0x18]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebp, dword [esi + 0x20]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x30]
push eax
xor ebx, ebx
push ecx
push edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x5c], ebx
call fcn.11d95440
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x11d823cf
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebx, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x10c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x40]
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], eax
xor ebx, ebx
jmp 0x11d82436
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d81dc8
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d81eca
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_connectEx__r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0xc
mov ax, word [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov word [esp + 0x74], 2
mov dword [esp + 0x76], edx
mov word [esp + 0x76], ax
mov dword [esp + 0x7a], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7e], edx
test ebp, ebp
mov word [esp + 0x82], dx
je 0x11d81f06
mov word [esp + 0x76], si
mov dword [esp + 0x78], edi
mov eax, dword [esp + 0xf8]
lea edx, [esp + 0x74]
push edx
push eax
mov ecx, 0x11e45900
call fcn.11d69d90
mov dword [esp + 0xbc], 0x35026200
mov word [esp + 0xc0], 0x10
mov word [esp + 0xc2], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xc4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc8], eax
push ecx
mov dword [esp + 0xd0], 1
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xd8], eax
push edx
call ebx
mov word [esp + 0xde], ax
mov ax, word [esp + 0x48]
mov word [esp + 0xe0], ax
call fcn.11dd8590
test ebp, ebp
mov word [esp + 0xe2], ax
je 0x11d81fb9
push edi
call dword [sym.imp.WS2_32.dll_ntohl]
push esi
mov dword [esp + 0xdc], eax
call ebx
mov word [esp + 0xde], ax
mov ecx, dword [esp + 0x108]
lea ebx, [ecx + 0x28]
push ebx
call fcn.11db0150
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x11d82014
mov edx, dword [esp + 0xf8]
push ebp
push edx
mov ecx, 0x11e454e8
call fcn.11d61e80
mov ecx, 0xa
lea esi, [esp + 0xbc]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x108]
mov esi, dword [esp + 0x104]
mov eax, ecx
lea edi, [ebp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11e45888
mov dword [esp + 0x34], 0
call fcn.11d6a570
lea ecx, [esp + 0x50]
call fcn.11d95920
mov esi, dword [esp + 0xf4]
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x64], ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x44], edx
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
push edi
call fcn.11d95440
mov eax, dword [esp + 0x5c]
add esp, 0x10
test eax, eax
je 0x11d821cc
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x110]
mov dword [esi + 0x24], ecx
lea ecx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebp
push edx
mov edx, dword [esp + 0x10c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
mov ebp, dword [esp + 0xf8]
lea ecx, [esp + 0x50]
call fcn.11d95900
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x11e4b918]
test ecx, ecx
je 0x11d82105
push eax
push str.redirect_ConnectEx_09_dwLastError___d
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d82198
mov ecx, dword [esp + 0x108]
push ecx
push str.redirect_ConnectEx_10_dwSendDataLength___d
push str.TMailHook_DBG
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d82198
mov eax, dword [esi + 0x14]
push eax
push str.redirect_ConnectEx_11_pContext__GetReturn_____d
push str.TMailHook_DBG
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d82198
mov edx, dword [esp + 0x34]
push 0x28
push edx
push str.redirect_ConnectEx_12_dwBytesSentNew___d_sizeof_HOOKINFO____d
push str.TMailHook_DBG
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x14
test eax, eax
je 0x11d82198
mov eax, dword [esp + 0x110]
push eax
push str.redirect_ConnectEx_12_lpOverlapped___d
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x10
mov ecx, 0x11e45888
call fcn.11d6a6a0
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x11d82242
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x11d82242
mov ecx, dword [esp + 0x34]
cmp ecx, 0x28
jb 0x11d8222f
add ecx, 0xffffffd8
mov dword [eax], ecx
jmp 0x11d82242
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11d820d0
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x34]
mov eax, dword [esp + 0x110]
mov edx, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push edx
push eax
push ebp
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d820d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
jmp 0x11d820d7
mov dword [eax], 0
mov dword [esi + 0x14], 0
push ebp
jmp 0x11d826ea
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d8225f
push str.redirect_ConnectEx_13
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], eax
mov word [esp + 0x84], ax
mov dword [esp + 0x86], edx
mov dword [esp + 0x70], ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x8a], edx
lea ecx, [esp + 0x84]
push eax
mov dword [esp + 0x92], edx
mov edi, 0x10
push ecx
push ebp
mov word [esp + 0x9e], dx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x11d822e1
mov edx, dword [esp + 0x88]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x86]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x72], ax
jmp 0x11d82305
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d82322
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d_connectEx_
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d82322
push str.redirect_ConnectEx_14
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x96], ecx
lea eax, [esp + 0x94]
mov dword [esp + 0x9a], ecx
push edx
mov dword [esp + 0xa2], ecx
push eax
push ebp
mov word [esp + 0xa0], 0
mov word [esp + 0xae], cx
mov dword [esp + 0x28], edi
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d8238f
mov ecx, dword [esp + 0x98]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x96]
mov dword [esp + 0x68], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x70], ax
cmp ebx, 0xffffffff
je 0x11d823a9
cmp edi, 0xffffffff
je 0x11d823a9
lea eax, [esp + 0x68]
mov ecx, 0x11e45938
push eax
push ebp
call fcn.11d69420
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d82596
push str.redirect_ConnectEx_15
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
jmp 0x11d82596
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x11d82436
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x108]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d82436
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11d95900
cmp dword [0x11e4b918], ebx
je 0x11d8245b
push str.after_connectEx
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
mov ecx, 0x11e45888
call fcn.11d6a6a0
cmp dword [0x11e45ee4], ebx
jne 0x11d82596
mov eax, dword [0x11e459b4]
test eax, eax
mov eax, dword [0x11e45cc8]
je 0x11d82490
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d82490
mov ebp, 1
jmp 0x11d82492
xor ebp, ebp
mov ecx, dword [0x11e459ec]
test ecx, ecx
je 0x11d824aa
and eax, 1
cmp al, 1
je 0x11d824aa
mov ebx, 1
jmp 0x11d824ac
xor ebx, ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
mov edi, eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d824f0
push edi
push ebx
push ebp
push str.after_connectEx_add_health_log__bForce__d___bSmart__d__bVisitProIP__d_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
test ebp, ebp
jne 0x11d82596
test ebx, ebx
jne 0x11d82596
test edi, edi
je 0x11d82596
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push edx
call ebx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x44]
mov byte [esp + 0xf0], 6
call fcn.11d9b3c0
mov ecx, dword [esp + 0x14]
mov ebp, dword [eax]
push 0
push ecx
mov byte [esp + 0xf4], 7
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x18]
push edx
call ebx
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 0
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x40]
mov byte [esp + 0xec], 6
call fcn.11d9bb60
lea ecx, [esp + 0x44]
mov byte [esp + 0xec], 0
call fcn.11d9bb60
mov eax, dword [0x11e45ef0]
test eax, eax
jne 0x11d82668
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d82635
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d82635
mov eax, dword [0x11e45ee4]
test eax, eax
je 0x11d82608
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x11d825ff
mov eax, dword [0x11e461bc]
test eax, eax
je 0x11d825ff
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d825ff
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d82635
mov eax, dword [0x11e45ee4]
test eax, eax
jne 0x11d8265f
mov eax, dword [esp + 0x28]
test eax, eax
mov eax, dword [0x11e45ed4]
jne 0x11d82629
test eax, eax
je 0x11d82629
mov ecx, dword [esp + 0x5c]
test ecx, ecx
jne 0x11d82629
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d82635
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x11d8265f
test eax, eax
je 0x11d8265f
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0xfc]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push edx
call fcn.11d8ac80
add esp, 0x18
mov eax, dword [0x11e45ef0]
test eax, eax
je 0x11d826a3
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x40]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x50], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e45ce8
mov eax, dword [esp + 0x10c]
push eax
call fcn.11d79df0
mov ecx, dword [esp + 0x20]
push ecx
call fcn.11db015e
mov eax, dword [0x11e4b918]
add esp, 4
test eax, eax
je 0x11d826e2
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x100]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
mov ecx, dword [esp + 0xf8]
push ecx
mov ecx, 0x11e45888
call fcn.11d6a380
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x50]
mov dword [esp + 0xec], 0xffffffff
call fcn.11d95890
mov eax, esi
jmp 0x11d82846
mov esi, dword [esp + 0xf4]
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x1c], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x48], edx
mov dword [esp + 0x68], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ebp
call fcn.11d95440
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d827b6
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x110]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x108]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x64]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d82819
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d82819
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
push eax
mov eax, dword [esp + 0x108]
push ecx
mov ecx, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0x104]
push eax
push ecx
push edi
push edx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d82819
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e4b918], ebp
je 0x11d82843
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_..._addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11d65710
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret 0x20