Function at 0x11c2ac30
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11ca8aa1
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x120]
test esi, esi
push edi
jne 0x11c2ac62
or eax, 0xffffffff
jmp 0x11c2cc00
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2aca4
mov eax, dword [esp + 0x120]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2aca4
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x70]
call fcn.11c3db60
mov edi, dword [esp + 0x128]
xor ebx, ebx
xor ebp, ebp
cmp word [esi], 0x17
mov dword [esp + 0x110], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x28], ebx
jne 0x11c2ad9c
push edi
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.11c7d3f0
add esp, 0xc
mov eax, dword [0x11cd69b8]
mov byte [esp + 0x110], 1
test eax, eax
je 0x11c2ad1a
mov edx, dword [esp + 0x10]
push 0x1c
push edi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x18
lea ebp, [esi + 8]
push ebp
call fcn.11c2a2f0
add esp, 4
test al, al
jne 0x11c2ad3b
push ebp
call fcn.11c2a350
add esp, 4
test al, al
je 0x11c2aea3
cmp edi, 0x1c
jne 0x11c2aea3
mov ecx, dword [0x11cd69b8]
mov ebx, dword [esi + 0x14]
mov ax, word [esi + 2]
mov dword [esp + 0x3c], ebx
test ecx, ecx
mov dword [esp + 0x34], eax
je 0x11c2ad7f
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x14
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
call fcn.11c43e60
mov ebp, dword [esp + 0x34]
mov eax, dword [0x11cd69b8]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11c2adeb
mov ax, word [esi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 4]
and eax, 0xffff
push eax
push ecx
call edi
movsx edx, word [esi]
push eax
push edx
call edi
push eax
mov eax, dword [esp + 0x12c]
push eax
push 0x181
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x20
cmp word [esi], 2
je 0x11c2b0b2
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2b0b2
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x6c]
test eax, eax
jne 0x11c2af65
call fcn.11c3dc20
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x2c], ebp
call fcn.11c3d740
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebp
je 0x11c2af17
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x128]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x124]
push edx
mov edx, dword [esp + 0x124]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x38]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11c2b077
mov ecx, 0x11cd0cf0
call fcn.11c1a9a0
test eax, eax
jne 0x11c2aec3
mov ecx, 0x11cd0cf0
call fcn.11c1a9e0
test eax, eax
je 0x11c2ad87
push 0
call fcn.11c33ab0
add esp, 4
test eax, eax
je 0x11c2ad87
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x10]
mov byte [esp + 0x110], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11c43e60
lea ecx, [esp + 0x6c]
mov dword [esp + 0x110], 0xffffffff
call fcn.11c3db90
or eax, 0xffffffff
jmp 0x11c2cc00
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11c2b077
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x124]
mov eax, dword [esp + 0x120]
push ecx
push edx
push eax
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2b077
jmp 0x11c2b06e
call fcn.11c3dc20
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x2c]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x2c], ebp
call fcn.11c3d740
mov eax, dword [esp + 0x3c]
add esp, 0x10
cmp eax, ebp
je 0x11c2b00d
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x138]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x134]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x38]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11c2b077
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11c2b077
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2b077
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2cbe7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x128]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x18
jmp 0x11c2cbe7
call fcn.11c330c0
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x46], ecx
lea edi, [esp + 0x96]
mov dword [esp + 0x4a], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x4e], ecx
mov word [esp + 0x44], ax
mov word [esp + 0x52], cx
mov ecx, 6
mov word [esp + 0x94], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2b120
mov edx, dword [esi]
mov dword [esp + 0x44], edx
mov eax, dword [esi + 4]
mov dword [esp + 0x48], eax
mov ebp, dword [esp + 0x46]
mov ecx, dword [esi + 8]
mov ebx, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x34], ebp
mov edx, dword [esi + 0xc]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x50], edx
jmp 0x11c2b12e
mov ecx, 7
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b168
push ebp
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11c154f0
add esp, 0x18
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x60]
push ecx
push edx
mov dword [esp + 0x68], 0
call fcn.11c2aaf0
mov dword [esp + 0x1c], eax
mov eax, dword [0x11cd69b8]
add esp, 8
test eax, eax
je 0x11c2b1b4
push ebp
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x14
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xe4]
mov dword [esp + 0xe0], edx
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x30], edx
call esi
push eax
mov ecx, 0x11cd0ee8
call fcn.11c26d50
mov edi, eax
mov eax, dword [0x11cd69b8]
test eax, eax
mov dword [esp + 0x20], edi
je 0x11c2b215
push ebx
call esi
push eax
push edi
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11c154f0
add esp, 0x14
mov eax, dword [0x11cd10cc]
mov dword [esp + 0x30], 0
test eax, eax
jne 0x11c2b238
mov eax, dword [0x11cd10bc]
test eax, eax
jne 0x11c2b238
mov eax, dword [0x11cd10d0]
test eax, eax
je 0x11c2b281
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push ebp
call esi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11cd0e10
call fcn.11c200a0
test eax, eax
je 0x11c2b287
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x30], 1
test eax, eax
je 0x11c2b287
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11c154f0
add esp, 0x10
jmp 0x11c2b287
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11cd10d8]
test eax, eax
je 0x11c2b31b
lea eax, [esp + 0x38]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push ebp
mov dword [esp + 0x48], 0
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0f58
mov edx, dword [esp + 0x134]
push edx
call fcn.11c27750
test eax, eax
je 0x11c2b99a
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b2f7
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11c154f0
add esp, 0x14
mov eax, dword [esp + 0x11c]
or esi, 0xffffffff
mov ecx, 0x274d
mov dword [esp + 0x110], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
jmp 0x11c2cbf5
mov eax, dword [0x11cd10cc]
test eax, eax
je 0x11c2b668
mov eax, dword [0x11cd0cf4]
test eax, eax
mov eax, dword [0x11cd0f38]
je 0x11c2b4f7
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x11c2b4f7
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2b459
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2b45f
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
test eax, eax
jne 0x11c2b45f
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c2b45f
push ebx
call edi
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2b45f
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11c2b45f
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bbfb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2bbfb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2bbfb
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2bbfb
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b99a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2b99a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2b99a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2b99a
mov ecx, dword [0x11cd0d2c]
test ecx, ecx
je 0x11c2b56f
and eax, 1
cmp al, 1
je 0x11c2b56f
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2b99a
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2b9a6
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b556
push 0x21c
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x10
push 1
call fcn.11c150b0
add esp, 4
mov dword [0x11cd10c0], eax
call fcn.11c37560
jmp 0x11c2b750
mov eax, dword [0x11cd0f3c]
test eax, eax
je 0x11c2b611
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2b611
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2b617
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0ee8
call fcn.11c25e90
test eax, eax
jne 0x11c2b617
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c2b617
push ebx
call edi
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2b617
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11c2b617
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bbfb
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2bbfb
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11cd0f3c]
test eax, eax
jne 0x11c2b99a
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11c2b750
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x20], 0
test eax, eax
je 0x11c2b750
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2b750
mov eax, dword [0x11cd10bc]
test eax, eax
je 0x11c2b994
mov eax, dword [0x11cd0cf4]
test eax, eax
mov eax, dword [0x11cd0f38]
je 0x11c2b691
mov edx, eax
and edx, 1
cmp dl, 1
jne 0x11c2b994
mov ecx, dword [0x11cd0d2c]
test ecx, ecx
je 0x11c2b706
and eax, 1
cmp al, 1
je 0x11c2b706
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2b99a
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2b9a6
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b6f0
push 0x250
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
push 1
call fcn.11c150b0
add esp, 4
mov dword [0x11cd10c0], eax
call fcn.11c37560
jmp 0x11c2b750
mov eax, dword [0x11cd0f3c]
test eax, eax
jne 0x11c2b994
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11c2b74a
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x20], 0
test eax, eax
je 0x11c2b74a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11c2bb75
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x120]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x4c], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b7d7
mov eax, dword [esp + 0x10]
push eax
push ebp
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x124]
push eax
push ebx
push ecx
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11c2bdf9
mov eax, dword [0x11cd10d8]
test eax, eax
jne 0x11c2bc1b
mov eax, dword [0x11cd0cf4]
test eax, eax
jne 0x11c2b80a
mov eax, dword [0x11cd0d2c]
test eax, eax
je 0x11c2b87b
mov eax, dword [0x11cd10c0]
test eax, eax
je 0x11c2b87b
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0e50
call fcn.11c21330
test eax, eax
je 0x11c2b87b
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c2b83f
push ebx
call edi
push eax
call fcn.11c33170
add esp, 4
test eax, eax
je 0x11c2b87b
mov dword [esp + 0x2c], 1
call fcn.11c37560
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11c2b87b
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11c154f0
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0dc8
call fcn.11c1e8b0
push str.127.0.0.1
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11c2bd61
push ebx
call edi
push eax
call fcn.11c33170
add esp, 4
test eax, eax
jne 0x11c2bd61
mov eax, dword [0x11cd0d2c]
test eax, eax
je 0x11c2b9d5
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2b8e7
mov eax, dword [0x11cd10b8]
test eax, eax
jne 0x11c2b9cc
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b90b
mov edx, dword [0x11cd0cf4]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x10
mov eax, dword [0x11cd0cf4]
test eax, eax
jne 0x11c2b93f
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2b936
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11c2bd01
mov eax, dword [0x11cd0cf4]
test eax, eax
je 0x11c2b973
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2b973
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11c2b973
push ebp
call esi
push eax
mov ecx, 0x11cd0f48
call fcn.11c274f0
test eax, eax
jne 0x11c2bd31
mov eax, dword [0x11cd10bc]
test eax, eax
je 0x11c2b9e8
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2b9e8
jmp 0x11c2b9de
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11c2b750
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2b750
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11c154f0
add esp, 0xc
jmp 0x11c2b750
mov eax, dword [0x11cd0d2c]
test eax, eax
jne 0x11c2b9e8
mov eax, dword [0x11cd10bc]
test eax, eax
je 0x11c2b9e8
mov dword [0x11cd10c4], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2ba75
mov eax, dword [0x11cd10b8]
test eax, eax
je 0x11c2ba75
call fcn.11c2a8f0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11c2ba29
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x46], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
jmp 0x11c2ba42
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x68], eax
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2be6f
push str.connectFunc_SMTP_Redirect
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0xc
jmp 0x11c2bdf9
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11c2baf0
mov eax, dword [0x11cd10bc]
test eax, eax
je 0x11c2bdf9
mov eax, dword [0x11cd10cc]
test eax, eax
je 0x11c2baad
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c3e0
test eax, eax
je 0x11c2bdf9
mov ecx, 0x11cd0cf0
call fcn.11c1a9a0
test eax, eax
jne 0x11c2baf0
mov ecx, 0x11cd0cf0
call fcn.11c1a9e0
test eax, eax
jne 0x11c2baf0
mov eax, dword [0x11cd0d2c]
test eax, eax
je 0x11c2bdf9
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
je 0x11c2bdf9
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bb0d
push str.connectFunc_SafeGW_Redirect
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2bb42
mov edx, dword [esp + 0x60]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x46], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0xf4], eax
jmp 0x11c2be6f
mov ecx, dword [esp + 0x60]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xf4], eax
jmp 0x11c2be6f
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bbd1
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x44]
call fcn.11c436c0
mov esi, eax
mov byte [esp + 0x110], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push eax
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
lea ecx, [esp + 0x40]
mov byte [esp + 0x110], 0
call fcn.11c43e60
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11cd10bc]
test eax, eax
jne 0x11c2bbfb
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11c2bbfb
mov eax, dword [0x11cd10d8]
test eax, eax
je 0x11c2be6f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11c2be6f
mov eax, dword [esp + 0x11c]
or esi, 0xffffffff
mov dword [esp + 0x110], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
jmp 0x11c2cbf5
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11c32160
add esp, 4
test eax, eax
je 0x11c2bc97
mov eax, dword [0x11cd10b8]
test eax, eax
je 0x11c2bc97
call fcn.11c2a8f0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11c2bc6c
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x46], ax
mov eax, 1
mov dword [esp + 0x48], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x24], eax
jmp 0x11c2be6f
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x24], eax
jmp 0x11c2be6f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11c2be01
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2bcd3
mov eax, dword [esp + 0x60]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xf4], 1
mov ecx, dword [esp + 0x14]
mov word [esp + 0x46], ax
mov dword [esp + 0x48], ecx
jmp 0x11c2bdf9
mov edx, dword [esp + 0x60]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xf4], 1
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
jmp 0x11c2bdf9
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bdf9
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2bdf9
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bdf9
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11cbb2e8
push 1
call fcn.11c154f0
add esp, 0x14
jmp 0x11c2bdf9
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bd7e
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
call fcn.11c33760
test eax, eax
jne 0x11c2bdd3
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bda4
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0xc
mov eax, dword [0x11cd10bc]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11c2bddb
mov eax, dword [0x11cd0cf4]
test eax, eax
je 0x11c2bddb
mov ecx, dword [0x11cd0f38]
and ecx, 1
cmp cl, 1
je 0x11c2bddb
call fcn.11c37560
jmp 0x11c2bddb
mov dword [esp + 0x18], 1
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bdf9
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11c2be6f
lea edx, [esp + 0x68]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11c304e0
add esp, 0x10
test eax, eax
je 0x11c2be6f
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11c2be6f
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], 1
test ecx, ecx
push eax
jne 0x11c2be56
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x46], ax
mov dword [esp + 0x48], ecx
jmp 0x11c2be6f
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
xor eax, eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
push ecx
mov dword [esp + 0xdc], eax
push ebp
mov dword [esp + 0xe4], eax
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11cd08a0
call fcn.11c12600
test eax, eax
je 0x11c2bf69
mov edx, dword [esp + 0xd0]
push edx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xd8]
cmp eax, 0xffffffff
je 0x11c2bee4
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11c2bee6
mov edi, ebp
mov eax, dword [0x11cd69b8]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11c2bf2d
push edi
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11c154f0
add esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11c2bf3f
mov dword [esp + 0x38], 1
jmp 0x11c2bf69
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2bf56
mov ecx, dword [esp + 0x14]
mov word [esp + 0x46], di
mov dword [esp + 0x48], ecx
jmp 0x11c2bf69
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], edx
mov eax, dword [esp + 0x120]
mov ecx, 0x11cd0c00
push eax
call fcn.11c195c0
mov ecx, 0x11cd0c00
call fcn.11c198e0
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11c2bf98
lea edi, [esp + 0x44]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11c2bfbd
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2bfc4
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11c154f0
add esp, 0xc
mov eax, dword [0x11cd69b8]
test eax, eax
mov ebp, dword [esp + 0x118]
je 0x11c2bfe2
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov eax, dword [0x11cd69b8]
test ebp, ebp
jne 0x11c2c348
test eax, eax
je 0x11c2c02c
mov cx, word [edi + 2]
push ecx
call esi
mov edx, dword [edi + 4]
and eax, 0xffff
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x128]
push eax
push 0x39d
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x1c
lea ecx, [esp + 0x6c]
call fcn.11c3dc20
mov esi, dword [esp + 0x11c]
lea eax, [esp + 0x40]
push eax
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x68], edx
lea ecx, [esp + 0x58]
lea edx, [esp + 0x5c]
push ecx
push edx
push ebp
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x50], ebx
call fcn.11c3d740
mov eax, dword [esp + 0x64]
add esp, 0x10
cmp eax, ebx
je 0x11c2c0bb
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x40]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x128]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x120]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x64]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebx, ebx
jmp 0x11c2c0fe
mov ebp, dword [esi + 0x18]
cmp ebp, ebx
je 0x11c2c0fe
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2c0fe
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11c3dc00
cmp dword [0x11cd69b8], ebx
je 0x11c2c13b
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3ab
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x20
cmp dword [0x11cd10d8], ebx
jne 0x11c2c693
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2c693
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c22e
push 0x3b3
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c22e
mov ecx, dword [0x11cd10cc]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c22e
mov edx, dword [esp + 0x18]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c22e
mov eax, dword [0x11cd139c]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c22e
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ebx, dword [esp + 0x40]
push ebx
call ebp
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0x10
jmp 0x11c2c23c
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c26a
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11c2c2fc
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2c2fc
mov eax, dword [0x11cd10cc]
test eax, eax
je 0x11c2c2c7
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c2c2ba
mov eax, dword [0x11cd139c]
test eax, eax
je 0x11c2c2ba
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2c2ba
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11c2c2fc
mov eax, dword [0x11cd10cc]
test eax, eax
jne 0x11c2c693
mov eax, dword [esp + 0x24]
test eax, eax
mov eax, dword [0x11cd10bc]
jne 0x11c2c2e8
test eax, eax
je 0x11c2c2e8
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x11c2c2e8
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11c2c2fc
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11c2c693
test eax, eax
je 0x11c2c693
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c319
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x124]
push eax
mov eax, dword [esp + 0x130]
push ecx
lea ecx, [esp + 0x50]
push eax
push ecx
push edx
call fcn.11c35a20
add esp, 0x18
jmp 0x11c2c693
test eax, eax
je 0x11c2c365
push 0x3c7
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
lea ecx, [esp + 0x6c]
call fcn.11c3dc20
mov esi, dword [esp + 0x11c]
lea edx, [esp + 0x54]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x68], eax
xor eax, eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x44]
lea ecx, [esp + 0x5c]
push eax
push ecx
push ebp
call fcn.11c3d740
mov eax, dword [esp + 0x50]
add esp, 0x10
test eax, eax
je 0x11c2c416
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x138]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x134]
push edx
mov edx, dword [esp + 0x134]
push ecx
mov ecx, dword [esp + 0x130]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x5c]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11c2c479
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11c2c479
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x134]
mov eax, dword [esp + 0x130]
push ecx
mov ecx, dword [esp + 0x130]
push edx
mov edx, dword [esp + 0x130]
push eax
mov eax, dword [esp + 0x12c]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11c2c479
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11c3dc00
mov eax, dword [0x11cd10d8]
test eax, eax
jne 0x11c2c693
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11c2c693
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c56e
push 0x3d2
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c56e
mov ecx, dword [0x11cd10cc]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c56e
mov edx, dword [esp + 0x18]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c56e
mov eax, dword [0x11cd139c]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11c154f0
mov eax, dword [0x11cd69b8]
add esp, 0x10
test eax, eax
je 0x11c2c56e
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0x10
jmp 0x11c2c578
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c5a6
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11c2c62c
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11c2c62c
mov eax, dword [0x11cd10cc]
test eax, eax
je 0x11c2c5ff
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11c2c5f2
mov eax, dword [0x11cd139c]
test eax, eax
je 0x11c2c5f2
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11cd0d28
call fcn.11c1c040
test eax, eax
jne 0x11c2c5f2
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11c2c62c
mov eax, dword [0x11cd10cc]
test eax, eax
jne 0x11c2c693
mov eax, dword [esp + 0x24]
test eax, eax
mov eax, dword [0x11cd10bc]
jne 0x11c2c620
test eax, eax
je 0x11c2c620
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x11c2c620
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11c2c62c
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11c2c693
test eax, eax
je 0x11c2c693
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c649
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11c154f0
add esp, 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x134]
push eax
mov eax, dword [esp + 0x140]
push ecx
mov ecx, dword [esp + 0x140]
push eax
mov eax, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
push eax
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x60]
push ecx
push edx
push eax
call fcn.11c36870
add esp, 0x28
mov ecx, 0x11cd0c00
call fcn.11c19a10
mov ebx, dword [esp + 0x120]
mov ecx, 0x11cd0cb0
push ebx
call fcn.11c18c40
test eax, eax
je 0x11c2c6de
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c6d1
push ebx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov dword [esp + 0x24], 0
jmp 0x11c2cb48
mov eax, dword [esp + 0x24]
test eax, eax
je 0x11c2cb48
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c707
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0xc
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11c2c752
mov edx, dword [esp + 0x124]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11c2c76b
mov dx, word [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], eax
mov edi, dword [esp + 0x38]
test edi, edi
je 0x11c2c785
mov cx, word [esp + 0x10]
mov edx, dword [esp + 0x14]
mov word [esp + 0x7a], cx
mov dword [esp + 0x7c], edx
lea eax, [esp + 0x78]
mov ecx, 0x11cd0c78
push eax
push ebx
call fcn.11c19100
mov dword [esp + 0xe0], 0x35026200
mov word [esp + 0xe4], 0x10
mov word [esp + 0xe6], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xe8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x3c]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], 1
call ebp
mov edx, dword [esp + 0x34]
mov dword [esp + 0xfc], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x102], ax
mov ax, word [esp + 0x68]
mov word [esp + 0x104], ax
call fcn.11c7b2e0
test edi, edi
mov word [esp + 0x106], ax
je 0x11c2c83f
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov edx, dword [esp + 0x10]
mov dword [esp + 0xfc], eax
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x102], ax
mov eax, dword [esp + 0x118]
test eax, eax
je 0x11c2c852
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c876
push 0x28
push 0x429
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
xor ebp, ebp
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x118]
test eax, eax
je 0x11c2c89a
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11cd0c00
call fcn.11c198e0
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c8cb
mov ecx, dword [esp + 0x18]
push ecx
push 0x43d
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x14
mov edx, 0x28
push 0
sub edx, ebp
lea eax, [esp + ebp + 0xe4]
push edx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c90e
mov ecx, dword [esp + 0x18]
push edi
push ecx
push 0x441
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x18
mov ecx, 0x11cd0c00
call fcn.11c19a10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11c2c98d
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11c2c93b
call edi
cmp eax, 0x2749
jne 0x11c2c996
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c95b
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x118]
add ecx, 3
test eax, eax
mov dword [esp + 0x2c], ecx
jne 0x11c2c979
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x64
mov dword [esp + 0x18], eax
jl 0x11c2c884
jmp 0x11c2c9d6
add ebp, edi
cmp ebp, 0x28
jae 0x11c2c9d6
jmp 0x11c2c95b
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2c9b6
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
or edi, 0xffffffff
push ebx
mov ecx, 0x11cd0c00
mov dword [esi + 0x14], edi
call fcn.11c196f0
mov esi, dword [esi + 0x14]
mov dword [esp + 0x110], edi
jmp 0x11c2cbf5
cmp dword [esp + 0x18], 0x64
jne 0x11c2ca01
mov eax, dword [0x11cd69b8]
test eax, eax
je 0x11c2ca01
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
xor edx, edx
xor eax, eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0xb2], eax
mov dword [esp + 0x90], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb6], eax
lea edx, [esp + 0xb0]
push ecx
xor edi, edi
mov dword [esp + 0xbe], eax
push edx
push ebx
mov dword [esp + 0x94], edi
mov word [esp + 0xbc], di
mov word [esp + 0xca], ax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11c2ca91
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xb2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11c2cab4
cmp dword [0x11cd69b8], edi
je 0x11c2cab4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11cbb2e8
push 4
call fcn.11c154f0
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0xc2], edx
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc6], edx
push eax
mov dword [esp + 0xce], edx
push ecx
push ebx
mov word [esp + 0xcc], 0
mov word [esp + 0xda], dx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11c2cb2b
mov edx, dword [esp + 0xc4]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xc2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
cmp ebp, 0xffffffff
je 0x11c2cb48
cmp edi, 0xffffffff
je 0x11c2cb48
lea ecx, [esp + 0x88]
push ecx
push ebx
mov ecx, 0x11cd0cb0
call fcn.11c18a10
mov eax, dword [0x11cd10d8]
xor edi, edi
cmp eax, edi
je 0x11c2cb8a
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x64]
lea eax, [esp + 0x5c]
push edx
push eax
push 1
push ecx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x74], edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x4c]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
mov ecx, 0x11cd0f58
call fcn.11c27750
cmp dword [0x11cd69b8], edi
je 0x11c2cbbb
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x12c]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11c154f0
add esp, 0x18
push ebx
mov ecx, 0x11cd0c00
call fcn.11c196f0
cmp dword [0x11cd69b8], edi
je 0x11c2cbe7
mov eax, dword [esi + 0x14]
push eax
push ebx
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11c154f0
add esp, 0x14
mov esi, dword [esi + 0x14]
mov dword [esp + 0x110], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.11c3db90
mov eax, esi
mov ecx, dword [esp + 0x108]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x104
ret 0x24