Function at 0x11d4c730
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11dcdec1
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
push edi
mov edi, dword [esp + 0x130]
test ebp, ebp
je 0x11d4e71a
test edi, edi
jle 0x11d4e71a
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4c7af
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4c7af
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x70]
call fcn.11d60a80
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
xor ebx, ebx
cmp word [ebp], 0x17
mov dword [esp + 0x118], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x28], ebx
jne 0x11d4c8a7
push edi
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.11da24b0
add esp, 0xc
mov eax, dword [0x11dfc748]
mov byte [esp + 0x118], 1
test eax, eax
je 0x11d4c823
mov edx, dword [esp + 0x10]
push 0x1c
push edi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x18
lea esi, [ebp + 8]
push esi
call fcn.11d4bdf0
add esp, 4
test al, al
jne 0x11d4c844
push esi
call fcn.11d4be50
add esp, 4
test al, al
je 0x11d4c9ac
cmp edi, 0x1c
jne 0x11d4c9ac
mov ecx, dword [0x11dfc748]
mov ebx, dword [ebp + 0x14]
mov ax, word [ebp + 2]
mov dword [esp + 0x44], ebx
test ecx, ecx
mov dword [esp + 0x2c], eax
je 0x11d4c888
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x14
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
call fcn.11d66d80
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11dfc748]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11d4c8f3
mov ax, word [ebp + 2]
push eax
call esi
mov ecx, dword [ebp + 4]
and eax, 0xffff
push eax
push ecx
call edi
movsx edx, word [ebp]
push eax
push edx
call edi
push eax
mov eax, dword [esp + 0x134]
push eax
push 0x187
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x20
cmp word [ebp], 2
je 0x11d4cbbb
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4cbbb
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x6c]
test eax, eax
jne 0x11d4ca6e
call fcn.11d60b40
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
call fcn.11d60660
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d4ca20
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x130]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x12c]
push edx
mov edx, dword [esp + 0x12c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11d4cb80
mov ecx, 0x11df69e0
call fcn.11d3a9b0
test eax, eax
jne 0x11d4c9cc
mov ecx, 0x11df69e0
call fcn.11d3a9f0
test eax, eax
je 0x11d4c890
push 0
call fcn.11d567a0
add esp, 4
test eax, eax
je 0x11d4c890
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11d66d80
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d60ab0
or eax, 0xffffffff
jmp 0x11d4e816
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11d4cb80
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push ecx
push edx
push eax
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4cb80
jmp 0x11d4cb77
call fcn.11d60b40
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
call fcn.11d60660
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d4cb16
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11d4cb80
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11d4cb80
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4cb80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e6fc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x130]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x18
jmp 0x11d4e6fc
call fcn.11d55d10
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x4a], ecx
lea edi, [esp + 0x96]
mov dword [esp + 0x4e], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x52], ecx
mov word [esp + 0x48], ax
mov word [esp + 0x56], cx
mov ecx, 6
mov word [esp + 0x94], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4cc2a
mov edx, dword [ebp]
mov dword [esp + 0x48], edx
mov eax, dword [ebp + 4]
mov dword [esp + 0x4c], eax
mov ebx, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ecx
mov edx, dword [ebp + 0xc]
mov ebp, dword [esp + 0x4a]
mov dword [esp + 0x54], edx
mov dword [esp + 0x2c], ebp
jmp 0x11d4cc44
mov ecx, 7
mov esi, ebp
mov ebp, dword [esp + 0x2c]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4cc7a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x130]
push eax
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11d354f0
add esp, 0x18
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0x68]
push ecx
push edx
mov dword [esp + 0x70], 0
call fcn.11d4c5f0
mov dword [esp + 0x1c], eax
mov eax, dword [0x11dfc748]
add esp, 8
test eax, eax
je 0x11d4ccc2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x14
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], edx
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11df6c08
call fcn.11d47520
mov dword [esp + 0x18], eax
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4cd27
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x1c]
push eax
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11d354f0
add esp, 0x14
mov eax, dword [0x11df6e54]
mov dword [esp + 0x30], 0
test eax, eax
jne 0x11d4cd4a
mov eax, dword [0x11df6e44]
test eax, eax
jne 0x11d4cd4a
mov eax, dword [0x11df6e58]
test eax, eax
je 0x11d4cd8f
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6b30
call fcn.11d407c0
test eax, eax
je 0x11d4cd95
mov eax, dword [0x11dfc748]
mov dword [esp + 0x30], 1
test eax, eax
je 0x11d4cd95
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d354f0
add esp, 0x10
jmp 0x11d4cd95
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11df6e60]
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc0], 8
je 0x11d4d0b6
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6c78
mov eax, dword [esp + 0x13c]
push eax
call fcn.11d47f20
test eax, eax
je 0x11d4ce27
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4ce0a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d354f0
add esp, 0x14
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
mov ecx, 0x274d
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
jmp 0x11d4d706
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x11d4ce42
mov dword [esp + 0x20], 1
mov dword [esp + 0x64], 5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4ce67
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4ce67
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11d354f0
add esp, 0xc
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11d4d668
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x128]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x48], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4ceee
mov eax, dword [esp + 0x10]
push eax
push ebp
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x12c]
push eax
push ebx
push ecx
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11d4d8fb
mov eax, dword [0x11df6e60]
test eax, eax
jne 0x11d4d71d
mov eax, dword [0x11df69e4]
test eax, eax
jne 0x11d4cf21
mov eax, dword [0x11df6a1c]
test eax, eax
je 0x11d4cf92
mov eax, dword [0x11df6e48]
test eax, eax
je 0x11d4cf92
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6b70
call fcn.11d41a60
test eax, eax
je 0x11d4cf92
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4cf56
push ebx
call edi
push eax
call fcn.11d55df0
add esp, 4
test eax, eax
je 0x11d4cf92
mov dword [esp + 0x24], 1
call fcn.11d5a470
mov eax, dword [0x11dfc748]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11d4cf92
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d354f0
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6ae8
call fcn.11d3efd0
push str.127.0.0.1
mov dword [esp + 0x44], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d863
push ebx
call edi
push eax
call fcn.11d55df0
add esp, 4
test eax, eax
jne 0x11d4d863
mov eax, dword [0x11df6a1c]
test eax, eax
je 0x11d4d4c8
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54db0
add esp, 4
test eax, eax
je 0x11d4cffe
mov eax, dword [0x11df6e40]
test eax, eax
jne 0x11d4d4bf
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d022
mov edx, dword [0x11df69e4]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11de02f8
push 1
call fcn.11d354f0
add esp, 0x10
mov eax, dword [0x11df69e4]
test eax, eax
jne 0x11d4d056
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
jne 0x11d4d04d
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4d803
mov eax, dword [0x11df69e4]
test eax, eax
je 0x11d4d08a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
jne 0x11d4d08a
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d08a
push ebp
call esi
push eax
mov ecx, 0x11df6c68
call fcn.11d47cc0
test eax, eax
jne 0x11d4d833
mov eax, dword [0x11df6e44]
test eax, eax
je 0x11d4d4db
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
je 0x11d4d4db
jmp 0x11d4d4d1
cmp dword [0x11df6e54], ecx
je 0x11d4d3dd
mov eax, dword [0x11df69e4]
cmp eax, ecx
mov eax, dword [0x11df6c58]
je 0x11d4d283
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d4d283
cmp dword [esp + 0x18], ecx
jne 0x11d4d1eb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
jne 0x11d4d1eb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6c08
call fcn.11d46660
test eax, eax
jne 0x11d4d1eb
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d1eb
push ebx
call edi
push eax
call fcn.11d55df0
add esp, 4
test eax, eax
jne 0x11d4d1eb
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d1eb
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d6f2
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4d6f2
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6c08
call fcn.11d46660
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4d6f2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4d6f2
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4ce42
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4ce42
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6c08
call fcn.11d46660
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4ce42
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4ce42
cmp dword [0x11df6a1c], ecx
je 0x11d4d2f3
and eax, 1
cmp al, 1
je 0x11d4d2f3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
je 0x11d4ce42
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4ce4a
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d2da
push 0x228
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11d354f0
add esp, 0x10
push 1
call fcn.11d350b0
add esp, 4
mov dword [0x11df6e48], eax
call fcn.11d5a470
jmp 0x11d4ce67
cmp dword [0x11df6c5c], ecx
je 0x11d4d38c
cmp dword [esp + 0x18], ecx
jne 0x11d4d38c
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
je 0x11d4d38c
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6c08
call fcn.11d46660
test eax, eax
jne 0x11d4d38c
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d38c
push ebx
call edi
push eax
call fcn.11d55df0
add esp, 4
test eax, eax
jne 0x11d4d38c
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d38c
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d6f2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4d6f2
mov eax, dword [0x11df6c5c]
test eax, eax
jne 0x11d4ce42
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4ce67
mov eax, dword [0x11dfc748]
mov dword [esp + 0x18], 0
test eax, eax
je 0x11d4ce67
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4ce67
cmp dword [0x11df6e44], ecx
je 0x11d4ce42
mov eax, dword [0x11df69e4]
cmp eax, ecx
mov eax, dword [0x11df6c58]
je 0x11d4d405
mov edx, eax
and edx, 1
cmp dl, 1
jne 0x11d4ce42
cmp dword [0x11df6a1c], ecx
je 0x11d4d475
and eax, 1
cmp al, 1
je 0x11d4d475
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
je 0x11d4ce42
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4ce4a
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d45c
push 0x25c
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
push 1
call fcn.11d350b0
add esp, 4
mov dword [0x11df6e48], eax
call fcn.11d5a470
jmp 0x11d4ce67
cmp dword [0x11df6c5c], ecx
jne 0x11d4ce42
cmp dword [esp + 0x18], ecx
je 0x11d4ce67
mov eax, dword [0x11dfc748]
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x11d4ce67
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4ce67
mov eax, dword [0x11df6a1c]
test eax, eax
jne 0x11d4d4db
mov eax, dword [0x11df6e44]
test eax, eax
je 0x11d4d4db
mov dword [0x11df6e4c], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54db0
add esp, 4
test eax, eax
je 0x11d4d568
mov eax, dword [0x11df6e40]
test eax, eax
je 0x11d4d568
call fcn.11d4c3f0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11d4d51c
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4a], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
jmp 0x11d4d535
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d971
push str.connectFunc_SMTP_Redirect
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0xc
jmp 0x11d4d8fb
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d5e3
mov eax, dword [0x11df6e44]
test eax, eax
je 0x11d4d8fb
mov eax, dword [0x11df6e54]
test eax, eax
je 0x11d4d5a0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c8c0
test eax, eax
je 0x11d4d8fb
mov ecx, 0x11df69e0
call fcn.11d3a9b0
test eax, eax
jne 0x11d4d5e3
mov ecx, 0x11df69e0
call fcn.11d3a9f0
test eax, eax
jne 0x11d4d5e3
mov eax, dword [0x11df6a1c]
test eax, eax
je 0x11d4d8fb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
je 0x11d4d8fb
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d600
push str.connectFunc_SafeGW_Redirect
push 0x11de02f8
push 1
call fcn.11d354f0
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4d635
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4a], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0xfc], eax
jmp 0x11d4d971
mov ecx, dword [esp + 0x68]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0xfc], eax
jmp 0x11d4d971
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d6c8
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x3c]
call fcn.11d665e0
mov esi, eax
mov byte [esp + 0x118], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push eax
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x14
lea ecx, [esp + 0x38]
mov byte [esp + 0x118], 0
call fcn.11d66d80
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov ebp, dword [esp + 0x2c]
mov eax, dword [0x11df6e44]
test eax, eax
jne 0x11d4d6f2
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d6f2
mov eax, dword [0x11df6e60]
test eax, eax
je 0x11d4d971
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4d971
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], esi
call fcn.11d60ab0
mov eax, esi
jmp 0x11d4e816
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54db0
add esp, 4
test eax, eax
je 0x11d4d799
mov eax, dword [0x11df6e40]
test eax, eax
je 0x11d4d799
call fcn.11d4c3f0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11d4d76e
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov eax, 1
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x20], eax
jmp 0x11d4d971
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x20], eax
jmp 0x11d4d971
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4d903
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4d7d5
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov dword [esp + 0x4c], ecx
jmp 0x11d4d8fb
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
jmp 0x11d4d8fb
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d8fb
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11de02f8
push 1
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4d8fb
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d8fb
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11de02f8
push 1
call fcn.11d354f0
add esp, 0x14
jmp 0x11d4d8fb
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d880
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0xc
call fcn.11d56450
test eax, eax
jne 0x11d4d8d5
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d8a6
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0xc
mov eax, dword [0x11df6e44]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11d4d8dd
mov eax, dword [0x11df69e4]
test eax, eax
je 0x11d4d8dd
mov ecx, dword [0x11df6c58]
and ecx, 1
cmp cl, 1
je 0x11d4d8dd
call fcn.11d5a470
jmp 0x11d4d8dd
mov dword [esp + 0x40], 1
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4d8fb
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11d4d971
lea edx, [esp + 0x64]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11d52ed0
add esp, 0x10
test eax, eax
je 0x11d4d971
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11d4d971
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], 1
test ecx, ecx
push eax
jne 0x11d4d958
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov dword [esp + 0x4c], ecx
jmp 0x11d4d971
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
xor eax, eax
lea ecx, [esp + 0xd8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
push ecx
mov dword [esp + 0xe4], eax
push ebp
mov dword [esp + 0xec], eax
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df6590
call fcn.11d32600
test eax, eax
je 0x11d4da6b
mov edx, dword [esp + 0xd8]
push edx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe0]
cmp eax, 0xffffffff
je 0x11d4d9e6
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11d4d9e8
mov edi, ebp
mov eax, dword [0x11dfc748]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11d4da2f
push edi
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d354f0
add esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4da41
mov dword [esp + 0x34], 1
jmp 0x11d4da6b
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4da58
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], di
mov dword [esp + 0x4c], ecx
jmp 0x11d4da6b
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], edx
mov eax, dword [esp + 0x128]
mov ecx, 0x11df68f0
push eax
call fcn.11d395c0
mov ecx, 0x11df68f0
call fcn.11d398e0
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11d4da9a
lea edi, [esp + 0x48]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4dabf
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4dac6
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11d354f0
add esp, 0xc
mov eax, dword [0x11dfc748]
test eax, eax
mov ebp, dword [esp + 0x120]
je 0x11d4dae4
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov eax, dword [0x11dfc748]
test ebp, ebp
jne 0x11d4de4a
test eax, eax
je 0x11d4db2e
mov cx, word [edi + 2]
push ecx
call esi
mov edx, dword [edi + 4]
and eax, 0xffff
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x130]
push eax
push 0x3a9
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x1c
lea ecx, [esp + 0x6c]
call fcn.11d60b40
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x38]
push eax
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x40]
push ecx
push edx
push ebp
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x48], ebx
call fcn.11d60660
mov eax, dword [esp + 0x68]
add esp, 0x10
cmp eax, ebx
je 0x11d4dbbd
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebx, ebx
jmp 0x11d4dc00
mov ebp, dword [esi + 0x18]
cmp ebp, ebx
je 0x11d4dc00
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x128]
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4dc00
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d60b20
cmp dword [0x11dfc748], ebx
je 0x11d4dc3d
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3b7
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x20
cmp dword [0x11df6e60], ebx
jne 0x11d4e195
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4e195
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4dd30
push 0x3bf
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4dd30
mov ecx, dword [0x11df6e54]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4dd30
mov edx, dword [esp + 0x40]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4dd30
mov eax, dword [0x11df712c]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4dd30
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ebx, dword [esp + 0x48]
push ebx
call ebp
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0x10
jmp 0x11d4dd3e
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x2c]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4dd6c
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d4ddfe
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4ddfe
mov eax, dword [0x11df6e54]
test eax, eax
je 0x11d4ddc9
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x11d4ddbc
mov eax, dword [0x11df712c]
test eax, eax
je 0x11d4ddbc
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
jne 0x11d4ddbc
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4ddfe
mov eax, dword [0x11df6e54]
test eax, eax
jne 0x11d4e195
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [0x11df6e44]
jne 0x11d4ddea
test eax, eax
je 0x11d4ddea
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x11d4ddea
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11d4ddfe
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11d4e195
test eax, eax
je 0x11d4e195
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4de1b
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x12c]
push eax
mov eax, dword [esp + 0x138]
push ecx
lea ecx, [esp + 0x54]
push eax
push ecx
push edx
call fcn.11d588d0
add esp, 0x18
jmp 0x11d4e195
test eax, eax
je 0x11d4de67
push 0x3d3
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
lea ecx, [esp + 0x6c]
call fcn.11d60b40
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x58]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x64], eax
xor eax, eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
push ecx
push ebp
call fcn.11d60660
mov eax, dword [esp + 0x48]
add esp, 0x10
test eax, eax
je 0x11d4df18
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x58]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11d4df7b
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d4df7b
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x134]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4df7b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d60b20
mov eax, dword [0x11df6e60]
test eax, eax
jne 0x11d4e195
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4e195
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e070
push 0x3de
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4e070
mov ecx, dword [0x11df6e54]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4e070
mov edx, dword [esp + 0x40]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4e070
mov eax, dword [0x11df712c]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d354f0
mov eax, dword [0x11dfc748]
add esp, 0x10
test eax, eax
je 0x11d4e070
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0x10
jmp 0x11d4e07a
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x2c]
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e0a8
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d4e12e
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4e12e
mov eax, dword [0x11df6e54]
test eax, eax
je 0x11d4e101
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x11d4e0f4
mov eax, dword [0x11df712c]
test eax, eax
je 0x11d4e0f4
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df6a18
call fcn.11d3c3b0
test eax, eax
jne 0x11d4e0f4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4e12e
mov eax, dword [0x11df6e54]
test eax, eax
jne 0x11d4e195
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [0x11df6e44]
jne 0x11d4e122
test eax, eax
je 0x11d4e122
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x11d4e122
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11d4e12e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11d4e195
test eax, eax
je 0x11d4e195
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e14b
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d354f0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x13c]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x144]
push ecx
mov ecx, dword [esp + 0x144]
push edx
push eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x64]
push ecx
push edx
push eax
call fcn.11d59720
add esp, 0x28
mov ecx, 0x11df68f0
call fcn.11d39a10
mov ebx, dword [esp + 0x128]
mov ecx, 0x11df69a0
push ebx
call fcn.11d38c40
test eax, eax
je 0x11d4e1e0
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e1d3
push ebx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov dword [esp + 0x20], 0
jmp 0x11d4e660
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4e659
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e209
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0xc
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11d4e254
mov edx, dword [esp + 0x12c]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11d4e26d
mov dx, word [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], eax
mov edi, dword [esp + 0x34]
test edi, edi
je 0x11d4e287
mov cx, word [esp + 0x10]
mov edx, dword [esp + 0x14]
mov word [esp + 0x7a], cx
mov dword [esp + 0x7c], edx
lea eax, [esp + 0x78]
mov ecx, 0x11df6968
push eax
push ebx
call fcn.11d39100
mov dword [esp + 0xe8], 0x35026200
mov word [esp + 0xec], 0x10
mov word [esp + 0xee], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x44]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], 1
call ebx
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x104], eax
push edx
call ebp
mov word [esp + 0x10a], ax
mov ax, word [esp + 0x64]
mov word [esp + 0x10c], ax
call fcn.11da03a0
test edi, edi
mov word [esp + 0x10e], ax
je 0x11d4e33f
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x104], eax
push edx
call ebp
mov word [esp + 0x10a], ax
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d4e352
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e376
push 0x28
push 0x435
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x14
xor ebp, ebp
mov dword [esp + 0x24], 0xa
xor ebx, ebx
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d4e398
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11df68f0
call fcn.11d398e0
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e3c5
push ebx
push 0x449
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x14
mov eax, dword [esp + 0x128]
mov ecx, 0x28
sub ecx, ebp
push 0
lea edx, [esp + ebp + 0xec]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e40b
push edi
push ebx
push 0x44d
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x18
mov ecx, 0x11df68f0
call fcn.11d39a10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11d4e482
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11d4e438
call edi
cmp eax, 0x2749
jne 0x11d4e48b
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e458
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x120]
add ecx, 3
test eax, eax
mov dword [esp + 0x24], ecx
jne 0x11d4e476
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x64
jl 0x11d4e382
jmp 0x11d4e4dd
add ebp, edi
cmp ebp, 0x28
jae 0x11d4e4dd
jmp 0x11d4e458
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e4ab
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov ecx, dword [esp + 0x128]
or edi, 0xffffffff
push ecx
mov ecx, 0x11df68f0
mov dword [esi + 0x14], edi
call fcn.11d396f0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], edi
call fcn.11d60ab0
mov eax, esi
jmp 0x11d4e816
cmp ebx, 0x64
jne 0x11d4e506
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e506
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
mov edi, dword [esp + 0x128]
xor edx, edx
xor eax, eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0xb2], eax
mov dword [esp + 0x90], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb6], eax
lea edx, [esp + 0xb0]
push ecx
xor ebx, ebx
mov dword [esp + 0xbe], eax
push edx
push edi
mov dword [esp + 0x94], ebx
mov word [esp + 0xbc], bx
mov word [esp + 0xca], ax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11d4e59d
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xb2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11d4e5c0
cmp dword [0x11dfc748], ebx
je 0x11d4e5c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11de02f8
push 4
call fcn.11d354f0
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0xca], edx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xce], edx
push eax
mov dword [esp + 0xd6], edx
push ecx
push edi
mov word [esp + 0xd4], bx
mov word [esp + 0xe2], dx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d4e635
mov edx, dword [esp + 0xcc]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xca]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
cmp ebp, 0xffffffff
je 0x11d4e659
cmp edi, 0xffffffff
je 0x11d4e659
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0x88]
push ecx
push edx
mov ecx, 0x11df69a0
call fcn.11d38a10
mov ebx, dword [esp + 0x128]
mov eax, dword [0x11df6e60]
test eax, eax
je 0x11d4e69d
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x60]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x70], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
mov ecx, 0x11df6c78
call fcn.11d47f20
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e6cf
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x134]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x18
push ebx
mov ecx, 0x11df68f0
call fcn.11d396f0
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e6fc
mov eax, dword [esi + 0x14]
push eax
push ebx
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11d354f0
add esp, 0x14
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d60ab0
mov eax, esi
jmp 0x11d4e816
mov esi, dword [esp + 0x124]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x5c], edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
push edi
call fcn.11d60660
mov eax, dword [esp + 0x44]
add esp, 0x10
test eax, eax
je 0x11d4e7a4
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x12c]
push ecx
mov ecx, dword [esp + 0x12c]
push edx
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov ebp, dword [esp + 0x12c]
mov edx, dword [esp + 0x5c]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edx
jmp 0x11d4e7e7
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11d4e7e7
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x128]
push ecx
push ebp
push edx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4e7e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11dfc748]
test eax, eax
je 0x11d4e813
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [ebp]
push ecx
push edx
push str.TMAILHOOK::connectFunc_...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d354f0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10c
ret 0x24