Function at 0x11c2cdd0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11ca8ae6
push eax
mov dword fs:[0], esp
sub esp, 0xcc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xf4]
xor ebp, ebp
cmp edi, ebp
je 0x11c2d9e4
mov eax, dword [0x11cd69b8]
cmp eax, ebp
je 0x11c2ce1d
push str.New_connecttion_come_connectEx___
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x54]
call fcn.11c3db60
mov esi, dword [esp + 0xf8]
lea eax, [esp + 0x14]
push esi
push edi
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0xf4], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
call fcn.11c2cc20
add esp, 0x10
cmp eax, ebp
mov dword [esp + 0x44], ebp
jne 0x11c2cfa4
lea ecx, [esp + 0x50]
call fcn.11c3dc20
mov esi, dword [esp + 0xec]
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x1c], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x50], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x3c]
lea eax, [esp + 0x1c]
push edx
push eax
push ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebp
call fcn.11c3d740
mov eax, dword [esp + 0x48]
add esp, 0x10
cmp eax, ebp
je 0x11c2cf0e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x108]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x104]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0x100]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11c2cf71
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11c2cf71
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x108]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
push edx
mov edx, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x100]
push ecx
mov ecx, dword [esp + 0xfc]
push edx
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2cf71
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11cd69b8], ebp
je 0x11c2e503
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d__connectEx_
push str.connectExFunc
push 4
call fcn.11c154f0
add esp, 0x18
jmp 0x11c2e503
call fcn.11c330c0
push esi
mov dword [esp + 0x20], ebp
call fcn.11c54150
mov ecx, esi
mov esi, edi
mov dword [esp + 0x24], eax
mov edi, eax
mov eax, ecx
mov edx, dword [esp + 0xf4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x60]
mov dword [esp + 0x60], ebp
push ecx
push edx
call fcn.11c2aaf0
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov dword [esp + 0x34], eax
mov eax, dword [0x11cd69b8]
add esp, 0xc
cmp eax, ebp
je 0x11c2d01d
mov eax, dword [esp + 0x14]
push eax
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.TMAILHOOK::IP:_0x_lx__Port:__d_connectEx_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x14
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xb8]
mov dword [esp + 0xb4], ebp
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x50], ebp
call ebx
push eax
mov ecx, 0x11cd0ee8
call fcn.11c26d50
mov edi, eax
mov eax, dword [0x11cd10cc]
cmp eax, ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebp
jne 0x11c2d07b
cmp dword [0x11cd10bc], ebp
jne 0x11c2d07b
cmp dword [0x11cd10d0], ebp
je 0x11c2d0c0
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11cd0e10
call fcn.11c200a0
test eax, eax
je 0x11c2d0c0
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x2c], 1
cmp eax, ebp
je 0x11c2d0c0
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11c154f0
add esp, 0x10
cmp dword [0x11cd10d8], ebp
je 0x11c2d138
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
push ecx
mov dword [esp + 0x34], ebp
call esi
push eax
mov edx, dword [esp + 0x20]
push edx
call ebx
push eax
mov ecx, 0x11cd0f58
mov eax, dword [esp + 0x104]
push eax
call fcn.11c27750
test eax, eax
je 0x11c2d571
cmp dword [0x11cd69b8], ebp
je 0x11c2d9bb
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.CCallback::connectEx_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2d9bb
cmp dword [0x11cd10cc], ebp
je 0x11c2d4a2
mov eax, dword [0x11cd0cf4]
cmp eax, ebp
mov eax, dword [0x11cd0f38]
je 0x11c2d339
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x11c2d339
cmp edi, ebp
jne 0x11c2d294
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2d294
mov ecx, dword [esp + 0x14]
push ecx
call esi
push eax
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
test eax, eax
jne 0x11c2d294
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11c2d294
push ecx
call ebx
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2d294
cmp dword [esp + 0x2c], ebp
jne 0x11c2d294
cmp dword [0x11cd69b8], ebp
je 0x11c2d9bb
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
cmp eax, ebp
je 0x11c2d9bb
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
cmp eax, ebp
je 0x11c2d9bb
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2d9bb
cmp dword [0x11cd69b8], ebp
je 0x11c2d571
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
cmp eax, ebp
je 0x11c2d571
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
cmp eax, ebp
je 0x11c2d571
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
jmp 0x11c2d567
cmp dword [0x11cd0d2c], ebp
je 0x11c2d3ac
and eax, 1
cmp al, 1
je 0x11c2d3ac
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2d571
cmp edi, ebp
jne 0x11c2d571
cmp dword [0x11cd69b8], ebp
je 0x11c2d393
push 0x55c
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
push 1
call fcn.11c150b0
add esp, 4
mov dword [0x11cd10c0], eax
call fcn.11c37560
jmp 0x11c2d571
cmp dword [0x11cd0f3c], ebp
je 0x11c2d468
cmp edi, ebp
jne 0x11c2d45c
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2d45c
mov ecx, dword [esp + 0x14]
push ecx
call esi
push eax
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
test eax, eax
jne 0x11c2d45c
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11c2d45c
push ecx
call ebx
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2d45c
cmp dword [esp + 0x2c], ebp
jne 0x11c2d45c
cmp dword [0x11cd69b8], ebp
je 0x11c2d9bb
mov eax, dword [esp + 0x14]
push eax
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2d9bb
cmp dword [0x11cd0f3c], ebp
jne 0x11c2d571
cmp edi, ebp
je 0x11c2d571
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x34], ebp
cmp eax, ebp
je 0x11c2d571
mov edx, dword [esp + 0x14]
push edx
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x14]
push eax
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
jmp 0x11c2d567
cmp dword [0x11cd10bc], ebp
je 0x11c2d571
mov eax, dword [0x11cd0cf4]
cmp eax, ebp
mov eax, dword [0x11cd0f38]
je 0x11c2d4ca
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x11c2d571
cmp dword [0x11cd0d2c], ebp
je 0x11c2d532
and eax, 1
cmp al, 1
je 0x11c2d532
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2d571
cmp edi, ebp
jne 0x11c2d571
cmp dword [0x11cd69b8], ebp
je 0x11c2d51c
push 0x590
push str.CCallback::connectExCallback:_line__lu__SetEncryption_
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
push 1
call fcn.11c150b0
add esp, 4
mov dword [0x11cd10c0], eax
call fcn.11c37560
jmp 0x11c2d571
cmp dword [0x11cd0f3c], ebp
jne 0x11c2d571
cmp edi, ebp
je 0x11c2d571
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x34], ebp
cmp eax, ebp
je 0x11c2d571
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push ebp
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, dword [sym.imp.WS2_32.dll_htons]
cmp eax, ebp
je 0x11c2d948
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0xf0]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x38], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp dword [0x11cd69b8], ebp
je 0x11c2d600
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0xf8]
push edx
push eax
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x1c
cmp dword [esp + 0x18], 1
jne 0x11c2db83
cmp dword [0x11cd10d8], ebp
jne 0x11c2d9eb
cmp dword [0x11cd0cf4], ebp
jne 0x11c2d637
cmp dword [0x11cd0d2c], ebp
je 0x11c2d6bc
cmp dword [0x11cd10c0], ebp
je 0x11c2d6bc
mov ecx, dword [esp + 0x14]
push ecx
call esi
push eax
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov ecx, 0x11cd0e50
call fcn.11c21330
test eax, eax
je 0x11c2d6bc
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11c2d678
push ecx
call ebx
push eax
call fcn.11c33170
add esp, 4
test eax, eax
je 0x11c2d6bc
mov dword [esp + 0x4c], 1
call fcn.11c37560
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11c2d6bc
mov eax, dword [esp + 0x14]
push eax
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11c154f0
add esp, 0x14
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0dc8
call fcn.11c1e8b0
push str.127.0.0.1
mov dword [esp + 0x4c], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x11c2daeb
push ecx
call ebx
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2daeb
cmp dword [0x11cd0d2c], ebp
je 0x11c2d7ff
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2d736
cmp dword [0x11cd10b8], ebp
jne 0x11c2d7f7
cmp dword [0x11cd69b8], ebp
je 0x11c2d759
mov edx, dword [0x11cd0cf4]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._connectEx__r_n
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x10
cmp dword [0x11cd0cf4], ebp
jne 0x11c2d791
mov eax, dword [esp + 0x14]
push eax
call esi
push eax
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2d789
cmp dword [esp + 0x2c], ebp
je 0x11c2da7d
cmp dword [0x11cd0cf4], ebp
je 0x11c2d7cf
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2d7cf
mov ecx, dword [esp + 0x14]
push ecx
call esi
push eax
mov ecx, 0x11cd0f48
call fcn.11c274f0
test eax, eax
je 0x11c2d7cf
cmp dword [esp + 0x2c], ebp
je 0x11c2dab4
cmp dword [0x11cd10bc], ebp
je 0x11c2d811
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2d811
jmp 0x11c2d807
cmp dword [0x11cd0d2c], ebp
jne 0x11c2d811
cmp dword [0x11cd10bc], ebp
je 0x11c2d811
mov dword [0x11cd10c4], 1
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2d887
cmp dword [0x11cd10b8], ebp
je 0x11c2d887
call fcn.11c2a8f0
push eax
call edi
push eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11c2cd80
mov eax, 1
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x44], eax
cmp dword [0x11cd69b8], ebp
je 0x11c2dbe2
push str.connectFunc_SMTP_Redirect
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0xc
jmp 0x11c2db83
cmp dword [esp + 0x2c], ebp
jne 0x11c2d911
cmp dword [0x11cd10bc], ebp
je 0x11c2db83
cmp dword [0x11cd10cc], ebp
je 0x11c2d8c7
mov edx, dword [esp + 0x14]
push edx
call esi
push eax
mov eax, dword [esp + 0x14]
push eax
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c3e0
test eax, eax
je 0x11c2db83
mov ecx, 0x11cd0cf0
call fcn.11c1a9a0
test eax, eax
jne 0x11c2d911
mov ecx, 0x11cd0cf0
call fcn.11c1a9e0
test eax, eax
jne 0x11c2d911
cmp dword [0x11cd0d2c], ebp
je 0x11c2db83
mov ecx, dword [esp + 0x14]
push ecx
call esi
push eax
mov edx, dword [esp + 0x14]
push edx
call ebx
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2db83
mov eax, dword [esp + 0x5c]
push eax
call edi
push eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xfc]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11c2cd80
mov eax, 1
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc8], eax
jmp 0x11c2dbe2
cmp dword [0x11cd69b8], ebp
je 0x11c2d997
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x34]
call fcn.11c436c0
mov edi, eax
mov byte [esp + 0xe4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
push eax
push ecx
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_connectEx__r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
lea ecx, [esp + 0x30]
mov byte [esp + 0xe4], 0
call fcn.11c43e60
cmp dword [0x11cd10bc], ebp
jne 0x11c2d9bb
cmp dword [esp + 0x2c], ebp
jne 0x11c2d9bb
cmp dword [0x11cd10d8], ebp
je 0x11c2dbe2
cmp dword [esp + 0x1c], ebp
je 0x11c2dbe2
mov ecx, dword [esp + 0xec]
mov eax, 0x274d
mov dword [esp + 0xe4], 0xffffffff
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11c3db90
xor eax, eax
jmp 0x11c2e51c
mov edx, dword [esp + 0x14]
push edx
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2da41
cmp dword [0x11cd10b8], ebp
je 0x11c2da41
call fcn.11c2a8f0
push eax
call edi
push eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call fcn.11c2cd80
mov eax, 1
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x44], eax
jmp 0x11c2dbe2
cmp dword [esp + 0x1c], ebp
je 0x11c2db89
mov eax, dword [esp + 0x5c]
push eax
call edi
push eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xfc]
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
call fcn.11c2cd80
add esp, 0x10
mov dword [esp + 0xc8], 1
jmp 0x11c2db83
cmp dword [0x11cd69b8], ebp
je 0x11c2db83
mov ecx, dword [esp + 0x14]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x10]
push eax
push edx
push str.it_is_not_in_the_blacklist__d___d_connectEx_
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2db83
cmp dword [0x11cd69b8], ebp
je 0x11c2db83
mov eax, dword [esp + 0x14]
push eax
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x10]
push eax
push ecx
push str.connectExFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2db83
cmp dword [0x11cd69b8], ebp
je 0x11c2db07
push str.It_is_local_connecttion__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
call fcn.11c33760
test eax, eax
jne 0x11c2db5a
cmp dword [0x11cd69b8], ebp
je 0x11c2db2c
push str.Disable_Local_connecttion______connectEx_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
mov eax, dword [0x11cd10bc]
mov dword [esp + 0x38], 1
cmp eax, ebp
je 0x11c2db62
cmp dword [0x11cd0cf4], ebp
je 0x11c2db62
mov edx, dword [0x11cd0f38]
and edx, 1
cmp dl, 1
je 0x11c2db62
call fcn.11c37560
jmp 0x11c2db62
mov dword [esp + 0x48], 1
cmp dword [0x11cd69b8], ebp
je 0x11c2db83
mov eax, dword [esp + 0x10]
push eax
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
cmp dword [esp + 0x1c], ebp
jne 0x11c2dbe2
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
mov dword [esp + 0x24], ebp
call esi
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call ebx
push eax
call fcn.11c304e0
add esp, 0x10
test eax, eax
je 0x11c2dbe2
mov eax, dword [esp + 0x18]
cmp ax, bp
je 0x11c2dbe2
push eax
mov dword [esp + 0x20], 1
call edi
push eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.11c2cd80
add esp, 0x10
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0xa8], edx
lea eax, [esp + 0xa4]
xor edi, edi
mov dword [esp + 0xac], edx
push eax
push ecx
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0xac], edi
mov dword [esp + 0xb8], edx
call esi
push eax
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11cd08a0
call fcn.11c12600
test eax, eax
je 0x11c2dccc
mov eax, dword [esp + 0xa4]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, eax
mov eax, dword [esp + 0xac]
cmp eax, 0xffffffff
je 0x11c2dc5b
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11c2dc5f
mov edi, dword [esp + 0x14]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2dca6
push edi
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, dword [esp + 0x1c]
push ecx
call esi
and eax, 0xffff
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectExFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11c154f0
add esp, 0x1c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x11c2dcb5
mov ebp, 1
jmp 0x11c2dccc
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0x20]
push edi
push ebx
push eax
push ecx
call fcn.11c2cd80
add esp, 0x10
mov edx, dword [esp + 0xf0]
mov ecx, 0x11cd0c00
push edx
call fcn.11c195c0
mov ecx, 0x11cd0cb0
mov eax, dword [esp + 0xf0]
push eax
call fcn.11c18c40
test eax, eax
je 0x11c2ddfe
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2dd1d
mov ecx, dword [esp + 0xf0]
push ecx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov dword [esp + 0x1c], 0
mov ecx, 0x11cd0c00
call fcn.11c198e0
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2dd4c
push str.before_ConnectEx
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
lea ecx, [esp + 0x50]
call fcn.11c3dc20
mov esi, dword [esp + 0xec]
lea edx, [esp + 0x3c]
lea eax, [esp + 0x24]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebp, dword [esi + 0x20]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x34]
push eax
xor ebx, ebx
push ecx
push edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x4c], ebx
call fcn.11c3d740
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebx
je 0x11c2e32e
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x108]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x104]
push edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x104]
mov ebx, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x104]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x104]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x40]
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], eax
xor ebx, ebx
jmp 0x11c2e395
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x11c2dd25
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2de27
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_connectEx__r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0xc
mov ax, word [esp + 0x14]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov word [esp + 0x70], 2
mov dword [esp + 0x72], edx
mov word [esp + 0x72], ax
mov dword [esp + 0x76], edx
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7a], edx
test ebp, ebp
mov word [esp + 0x7e], dx
je 0x11c2de60
mov word [esp + 0x72], di
mov dword [esp + 0x74], ebx
mov eax, dword [esp + 0xf0]
lea edx, [esp + 0x70]
push edx
push eax
mov ecx, 0x11cd0c78
call fcn.11c19100
mov dword [esp + 0xb4], 0x35026200
mov word [esp + 0xb8], 0x10
mov word [esp + 0xba], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xbc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc0], eax
push ecx
mov dword [esp + 0xc8], 1
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x14]
mov dword [esp + 0xd0], eax
push edx
call esi
mov word [esp + 0xd6], ax
mov ax, word [esp + 0x44]
mov word [esp + 0xd8], ax
call fcn.11c7b2e0
test ebp, ebp
mov word [esp + 0xda], ax
je 0x11c2df13
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov dword [esp + 0xd4], eax
call esi
mov word [esp + 0xd6], ax
mov ecx, dword [esp + 0x100]
lea ebx, [ecx + 0x28]
push ebx
call fcn.11c54150
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x11c2df3f
mov edx, dword [esp + 0xf0]
push ebp
push edx
mov ecx, 0x11cd0860
call fcn.11c11c60
mov ecx, 0xa
lea esi, [esp + 0xb4]
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x100]
mov esi, dword [esp + 0xfc]
mov eax, ecx
lea edi, [ebp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11cd0c00
mov dword [esp + 0x28], 0
call fcn.11c198e0
lea ecx, [esp + 0x50]
call fcn.11c3dc20
mov esi, dword [esp + 0xec]
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x90], ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x60], edx
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push edi
call fcn.11c3d740
mov eax, dword [esp + 0x4c]
add esp, 0x10
test eax, eax
je 0x11c2e12c
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x108]
mov dword [esi + 0x24], ecx
lea ecx, [esp + 0x28]
push edx
mov edx, dword [esp + 0xfc]
push ecx
mov ecx, dword [esp + 0x28]
push ebx
push ebp
push edx
mov edx, dword [esp + 0x104]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x40]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
mov ebp, dword [esp + 0xf0]
lea ecx, [esp + 0x50]
call fcn.11c3dc00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x11cd69b8]
test ecx, ecx
je 0x11c2e065
push eax
push str.redirect_ConnectEx_09_dwLastError___d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x10
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2e0f8
mov ecx, dword [esp + 0x100]
push ecx
push str.redirect_ConnectEx_10_dwSendDataLength___d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2e0f8
mov eax, dword [esi + 0x14]
push eax
push str.redirect_ConnectEx_11_pContext__GetReturn_____d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2e0f8
mov edx, dword [esp + 0x28]
push 0x28
push edx
push str.redirect_ConnectEx_12_dwBytesSentNew___d_sizeof_HOOKINFO____d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x14
test eax, eax
je 0x11c2e0f8
mov eax, dword [esp + 0x108]
push eax
push str.redirect_ConnectEx_12_lpOverlapped___d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x10
mov ecx, 0x11cd0c00
call fcn.11c19a10
mov eax, dword [esp + 0x104]
test eax, eax
je 0x11c2e1a1
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x11c2e1a1
mov ecx, dword [esp + 0x28]
cmp ecx, 0x28
jb 0x11c2e18f
add ecx, 0xffffffd8
mov dword [eax], ecx
jmp 0x11c2e1a1
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11c2e030
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x28]
mov eax, dword [esp + 0x108]
mov edx, dword [esp + 0xf8]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x100]
push edx
push eax
push ebp
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2e037
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
jmp 0x11c2e037
mov dword [eax], 0
mov dword [esi + 0x14], 0
jmp 0x11c2e4f8
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2e1be
push str.redirect_ConnectEx_13
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x64], eax
mov word [esp + 0x94], ax
mov dword [esp + 0x96], edx
mov dword [esp + 0x6c], ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x9a], edx
lea ecx, [esp + 0x94]
push eax
mov dword [esp + 0xa2], edx
mov edi, 0x10
push ecx
push ebp
mov word [esp + 0xae], dx
mov dword [esp + 0x24], edi
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x11c2e240
mov edx, dword [esp + 0x98]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x96]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x6e], ax
jmp 0x11c2e264
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2e281
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d_connectEx_
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2e281
push str.redirect_ConnectEx_14
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
xor ecx, ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x82], ecx
lea eax, [esp + 0x80]
mov dword [esp + 0x86], ecx
push edx
mov dword [esp + 0x8e], ecx
push eax
push ebp
mov word [esp + 0x8c], 0
mov word [esp + 0x9a], cx
mov dword [esp + 0x24], edi
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11c2e2ee
mov ecx, dword [esp + 0x84]
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esp + 0x82]
mov dword [esp + 0x64], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x6c], ax
cmp ebx, 0xffffffff
je 0x11c2e308
cmp edi, 0xffffffff
je 0x11c2e308
lea eax, [esp + 0x64]
mov ecx, 0x11cd0cb0
push eax
push ebp
call fcn.11c18a10
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2e3cb
push str.redirect_ConnectEx_15
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
jmp 0x11c2e3cb
mov edi, dword [esi + 0x18]
cmp edi, ebx
je 0x11c2e395
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x108]
mov edx, dword [esp + 0x104]
mov eax, dword [esp + 0x100]
push ecx
mov ecx, dword [esp + 0x100]
push edx
mov edx, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x100]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2e395
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x50]
call fcn.11c3dc00
cmp dword [0x11cd69b8], ebx
je 0x11c2e3ba
push str.after_connectEx
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
mov ecx, 0x11cd0c00
call fcn.11c19a10
mov ebp, dword [esp + 0xf0]
mov eax, dword [0x11cd10d8]
xor edi, edi
cmp eax, edi
jne 0x11c2e482
cmp dword [esp + 0x4c], edi
jne 0x11c2e457
cmp dword [esp + 0x34], edi
jne 0x11c2e457
cmp dword [0x11cd10cc], edi
je 0x11c2e430
cmp dword [esp + 0x48], edi
jne 0x11c2e428
cmp dword [0x11cd139c], edi
je 0x11c2e428
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2e428
cmp dword [esp + 0x2c], edi
je 0x11c2e457
cmp dword [0x11cd10cc], edi
jne 0x11c2e47a
mov eax, dword [esp + 0x1c]
cmp eax, edi
mov eax, dword [0x11cd10bc]
jne 0x11c2e44d
cmp eax, edi
je 0x11c2e44d
cmp dword [esp + 0x48], edi
jne 0x11c2e44d
cmp dword [esp + 0x2c], edi
je 0x11c2e457
cmp dword [esp + 0x38], edi
je 0x11c2e47a
cmp eax, edi
je 0x11c2e47a
mov edx, dword [esp + 0x34]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
push eax
mov eax, dword [esp + 0x100]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push ebp
call fcn.11c35a20
add esp, 0x18
cmp dword [0x11cd10d8], edi
je 0x11c2e4b9
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x40]
lea eax, [esp + 0x60]
push edx
push eax
push 1
push ecx
mov dword [esp + 0x70], edi
mov dword [esp + 0x50], edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
mov ecx, 0x11cd0f58
call fcn.11c27750
mov eax, dword [esp + 0x20]
push eax
call fcn.11c5415e
mov eax, dword [0x11cd69b8]
add esp, 4
cmp eax, edi
je 0x11c2e4f8
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esp + 0xf4]
push eax
push ecx
xor ecx, ecx
mov cx, word [edx]
push ecx
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d__connectEx_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x18
push ebp
mov ecx, 0x11cd0c00
call fcn.11c196f0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x50]
mov dword [esp + 0xe4], 0xffffffff
call fcn.11c3db90
mov eax, esi
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd8
ret 0x20