Function at 0x11d7e600
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11e15fb3
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x12c]
xor ebx, ebx
cmp edi, ebx
je 0x11d808c3
cmp esi, ebx
jle 0x11d808c3
cmp dword [0x11e4b918], ebx
je 0x11d7e680
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
cmp eax, ebx
je 0x11d7e680
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x70]
call fcn.11d95860
xor ebp, ebp
cmp word [edi], 0x17
mov dword [esp + 0x118], ebx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x38], ebx
jne 0x11d7e76f
push esi
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.11dea2b0
add esp, 0xc
mov eax, dword [0x11e4b918]
mov byte [esp + 0x118], 1
test eax, eax
je 0x11d7e6ed
mov edx, dword [esp + 0x10]
push 0x1c
push esi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
lea esi, [edi + 8]
push esi
call fcn.11d7dcc0
add esp, 4
test al, al
jne 0x11d7e70e
push esi
call fcn.11d7dd20
add esp, 4
test al, al
je 0x11d7e877
cmp dword [esp + 0x130], 0x1c
jne 0x11d7e877
mov eax, dword [0x11e4b918]
mov ebx, dword [edi + 0x14]
mov bp, word [edi + 2]
mov dword [esp + 0x20], ebx
test eax, eax
mov dword [esp + 0x34], ebp
je 0x11d7e756
push ebp
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x14
mov dword [esp + 0x38], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
call fcn.11d9bb60
mov eax, dword [0x11e4b918]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11d7e7be
mov ax, word [edi + 2]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [edi + 4]
and eax, 0xffff
push eax
push ecx
call esi
movsx edx, word [edi]
push eax
push edx
call esi
push eax
mov eax, dword [esp + 0x134]
push eax
push 0x189
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x20
cmp word [edi], 2
je 0x11d7ea72
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d7ea72
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x6c]
test eax, eax
jne 0x11d7e932
call fcn.11d95920
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
call fcn.11d95440
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebp
je 0x11d7e8eb
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
jmp 0x11d7ea3e
mov ecx, 0x11e459b0
call fcn.11d6b8c0
test eax, eax
jne 0x11d7e897
mov ecx, 0x11e459b0
call fcn.11d6b900
test eax, eax
je 0x11d7e75e
push 0
call fcn.11d88b50
add esp, 4
test eax, eax
je 0x11d7e75e
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11d9bb60
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d95890
or eax, 0xffffffff
jmp 0x11d809b9
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d7ea3e
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x128]
push edx
push edi
push eax
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d7ea3e
jmp 0x11d7ea35
call fcn.11d95920
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
xor ebp, ebp
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebp
call fcn.11d95440
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebp
je 0x11d7e9db
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x140]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x138]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
jmp 0x11d7ea3e
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d7ea3e
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x134]
push edx
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d7ea3e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d808a5
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [edi]
push ecx
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
jmp 0x11d808a5
call fcn.11d88100
xor eax, eax
xor edx, edx
mov dword [esp + 0x56], eax
mov ecx, 6
mov dword [esp + 0x5a], eax
lea edi, [esp + 0x96]
mov dword [esp + 0x5e], eax
mov word [esp + 0x94], dx
mov word [esp + 0x62], ax
mov dword [esp + 0x30], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x38]
mov word [esp + 0x54], dx
cmp eax, edx
jne 0x11d7eae5
mov ecx, dword [esp + 0x12c]
mov eax, dword [ecx]
mov dword [esp + 0x54], eax
mov ebx, dword [ecx + 4]
mov dword [esp + 0x58], ebx
mov ebp, dword [esp + 0x56]
mov eax, dword [ecx + 8]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x5c], eax
mov dword [esp + 0x20], ebx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x60], ecx
jmp 0x11d7eafc
mov esi, dword [esp + 0x12c]
mov ecx, 7
lea edi, [esp + 0x94]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
cmp dword [0x11e4b918], edx
je 0x11d7eb39
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x130]
push edx
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11d65710
add esp, 0x18
jmp 0x11d7eb3f
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x128]
lea eax, [esp + 0x64]
push eax
push ecx
mov dword [esp + 0x6c], 0
call fcn.11d7e4c0
mov dword [esp + 0x1c], eax
mov eax, dword [0x11e4b918]
add esp, 8
test eax, eax
je 0x11d7eb87
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x14
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], edx
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x1c], edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e45c78
call fcn.11d793f0
mov dword [esp + 0x28], eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7ebec
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x2c]
push edx
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11d65710
add esp, 0x14
mov eax, dword [0x11e45ee4]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
mov dword [esp + 0x3c], 0
jne 0x11d7ec15
mov eax, dword [0x11e45ed4]
test eax, eax
jne 0x11d7ec15
mov eax, dword [0x11e45ee8]
test eax, eax
je 0x11d7ec52
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45b00
call fcn.11d71cb0
test eax, eax
je 0x11d7ec52
mov eax, dword [0x11e4b918]
mov dword [esp + 0x3c], 1
test eax, eax
je 0x11d7ec52
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e45ef0]
mov dword [esp + 0xc4], 0
test eax, eax
mov dword [esp + 0xc0], 8
je 0x11d7ef87
lea eax, [esp + 0xc0]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45ce8
mov edx, dword [esp + 0x13c]
push edx
call fcn.11d79df0
test eax, eax
je 0x11d7ecf8
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7ecc9
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d65710
add esp, 0x14
mov eax, dword [esp + 0x124]
mov ecx, 0x274d
or esi, 0xffffffff
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
lea ecx, [esp + 0x6c]
mov dword [eax + 0x14], esi
mov dword [esp + 0x118], esi
call fcn.11d95890
mov eax, esi
jmp 0x11d809b9
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x11d7ed13
mov dword [esp + 0x30], 1
mov dword [esp + 0x68], 5
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d7ed38
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7ed38
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11d65710
add esp, 0xc
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11d7f689
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x128]
push edx
push eax
push 0x1008
push 0xffff
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7edbf
mov edx, dword [esp + 0x10]
push edx
push ebp
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x130]
push ebx
push eax
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11d7f910
mov eax, dword [0x11e45ef0]
test eax, eax
jne 0x11d7f734
mov eax, dword [0x11e459b4]
test eax, eax
jne 0x11d7edf2
mov eax, dword [0x11e459ec]
test eax, eax
je 0x11d7ee63
mov eax, dword [0x11e45ed8]
test eax, eax
je 0x11d7ee63
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45be0
call fcn.11d73900
test eax, eax
je 0x11d7ee63
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d7ee27
push ebx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
je 0x11d7ee63
mov dword [esp + 0x18], 1
call fcn.11d8c820
mov eax, dword [0x11e4b918]
mov dword [esp + 0x44], 1
test eax, eax
je 0x11d7ee63
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d65710
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45ab8
call fcn.11d6fee0
push str.127.0.0.1
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d7f87a
push ebx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d7f87a
mov eax, dword [0x11e459ec]
test eax, eax
je 0x11d7f4e9
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d7eecf
mov eax, dword [0x11e45ed0]
test eax, eax
jne 0x11d7f4e0
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7eef3
mov ecx, dword [0x11e459b4]
push ecx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e459b4]
test eax, eax
jne 0x11d7ef27
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d7ef1e
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d7f81a
mov eax, dword [0x11e459b4]
test eax, eax
je 0x11d7ef5b
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d7ef5b
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d7ef5b
push ebp
call esi
push eax
mov ecx, 0x11e45cd8
call fcn.11d79b90
test eax, eax
jne 0x11d7f84a
mov eax, dword [0x11e45ed4]
test eax, eax
je 0x11d7f4fc
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d7f4fc
jmp 0x11d7f4f2
mov eax, dword [0x11e45ee4]
test eax, eax
je 0x11d7f3f4
mov eax, dword [0x11e459b4]
test eax, eax
mov eax, dword [0x11e45cc8]
je 0x11d7f1e8
mov ecx, eax
and ecx, 1
cmp cl, 1
je 0x11d7f1e8
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d7f150
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d7f150
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
test eax, eax
jne 0x11d7f150
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d7f150
push ebx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d7f150
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d7f150
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f0ae
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7f0ae
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7f0ae
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
mov esi, dword [esp + 0x124]
push ebx
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x10], 0x274d
call dword [sym.imp.WS2_32.dll_ntohl]
lea edx, [esp + 0x1c]
push eax
push edx
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x28]
mov byte [esp + 0x11c], 2
call fcn.11d9b3c0
mov ebp, dword [eax]
mov eax, dword [esp + 0x34]
push 0
push eax
mov byte [esp + 0x120], 3
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 2
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 2
call fcn.11d9bb60
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d9bb60
jmp 0x11d808a5
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7ed13
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7ed13
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7ed13
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
jmp 0x11d7ed13
mov ecx, dword [0x11e459ec]
test ecx, ecx
je 0x11d7f25a
and eax, 1
cmp al, 1
je 0x11d7f25a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d7ed13
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d7ed1b
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f241
push 0x232
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x10
push 1
call fcn.11d652d0
add esp, 4
mov dword [0x11e45ed8], eax
call fcn.11d8c820
jmp 0x11d7ed38
mov eax, dword [0x11e45ccc]
test eax, eax
je 0x11d7f3b0
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d7f3a3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d7f3a3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45c78
call fcn.11d78530
test eax, eax
jne 0x11d7f3a3
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d7f3a3
push ebx
call edi
push eax
call fcn.11d881e0
add esp, 4
test eax, eax
jne 0x11d7f3a3
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d7f3a3
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f301
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
mov esi, dword [esp + 0x124]
push ebx
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x10], 0x274d
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x28]
mov byte [esp + 0x11c], 4
call fcn.11d9b3c0
mov edx, dword [esp + 0x34]
mov ebp, dword [eax]
push 0
push edx
mov byte [esp + 0x120], 5
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 0
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x24]
mov byte [esp + 0x118], 4
call fcn.11d9bb60
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d9bb60
jmp 0x11d808a5
mov eax, dword [0x11e45ccc]
test eax, eax
jne 0x11d7ed13
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d7ed38
mov eax, dword [0x11e4b918]
mov dword [esp + 0x28], 0
test eax, eax
je 0x11d7ed38
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11d65710
add esp, 0x14
jmp 0x11d7ed38
mov eax, dword [0x11e45ed4]
test eax, eax
je 0x11d7ed13
mov eax, dword [0x11e459b4]
test eax, eax
mov eax, dword [0x11e45cc8]
je 0x11d7f41d
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x11d7ed13
mov ecx, dword [0x11e459ec]
test ecx, ecx
je 0x11d7f48f
and eax, 1
cmp al, 1
je 0x11d7f48f
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d7ed13
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d7ed1b
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f476
push 0x26e
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
push 1
call fcn.11d652d0
add esp, 4
mov dword [0x11e45ed8], eax
call fcn.11d8c820
jmp 0x11d7ed38
mov eax, dword [0x11e45ccc]
test eax, eax
jne 0x11d7ed13
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d7ed38
mov eax, dword [0x11e4b918]
mov dword [esp + 0x28], 0
test eax, eax
je 0x11d7ed38
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
jmp 0x11d7ed38
mov eax, dword [0x11e459ec]
test eax, eax
jne 0x11d7f4fc
mov eax, dword [0x11e45ed4]
test eax, eax
je 0x11d7f4fc
mov dword [0x11e45edc], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d7f589
mov eax, dword [0x11e45ed0]
test eax, eax
je 0x11d7f589
call fcn.11d7e2c0
mov ecx, dword [esp + 0x38]
push eax
test ecx, ecx
jne 0x11d7f53d
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x56], ax
mov dword [esp + 0x58], edx
jmp 0x11d7f556
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
mov eax, 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x68], eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f986
push str.connectFunc_SMTP_Redirect
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0xc
jmp 0x11d7f910
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d7f604
mov eax, dword [0x11e45ed4]
test eax, eax
je 0x11d7f910
mov eax, dword [0x11e45ee4]
test eax, eax
je 0x11d7f5c1
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d7d0
test eax, eax
je 0x11d7f910
mov ecx, 0x11e459b0
call fcn.11d6b8c0
test eax, eax
jne 0x11d7f604
mov ecx, 0x11e459b0
call fcn.11d6b900
test eax, eax
jne 0x11d7f604
mov eax, dword [0x11e459ec]
test eax, eax
je 0x11d7f910
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
je 0x11d7f910
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f621
push str.connectFunc_SafeGW_Redirect
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d7f656
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x56], ax
mov eax, 1
mov dword [esp + 0x58], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0xfc], eax
jmp 0x11d7f986
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0xfc], eax
jmp 0x11d7f986
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f6df
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x20]
call fcn.11d9b3c0
mov edi, eax
mov byte [esp + 0x118], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [edi]
push eax
push edx
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
lea ecx, [esp + 0x1c]
mov byte [esp + 0x118], 0
call fcn.11d9bb60
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11e45ed4]
test eax, eax
jne 0x11d7f709
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x11d7f709
mov eax, dword [0x11e45ef0]
test eax, eax
je 0x11d7f986
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d7f986
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
call fcn.11d95890
mov eax, esi
jmp 0x11d809b9
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d87450
add esp, 4
test eax, eax
je 0x11d7f7b0
mov eax, dword [0x11e45ed0]
test eax, eax
je 0x11d7f7b0
call fcn.11d7e2c0
mov ecx, dword [esp + 0x38]
push eax
test ecx, ecx
jne 0x11d7f785
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
mov eax, 1
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], eax
jmp 0x11d7f986
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x30], eax
jmp 0x11d7f986
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d7f918
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d7f7ec
mov edx, dword [esp + 0x64]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
jmp 0x11d7f910
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
jmp 0x11d7f910
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f910
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x14
jmp 0x11d7f910
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f910
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11e2d404
push 1
call fcn.11d65710
add esp, 0x14
jmp 0x11d7f910
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f897
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
call fcn.11d88840
test eax, eax
jne 0x11d7f8ea
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f8bd
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0xc
mov eax, dword [0x11e45ed4]
mov dword [esp + 0x44], 1
test eax, eax
je 0x11d7f8f2
mov eax, dword [0x11e459b4]
test eax, eax
je 0x11d7f8f2
mov eax, dword [0x11e45cc8]
and eax, 1
cmp al, 1
je 0x11d7f8f2
call fcn.11d8c820
jmp 0x11d7f8f2
mov dword [esp + 0x2c], 1
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7f910
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d7f986
lea ecx, [esp + 0x68]
lea edx, [esp + 0x10]
push ecx
push edx
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11d85340
add esp, 0x10
test eax, eax
je 0x11d7f986
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11d7f986
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x30], 1
test ecx, ecx
push eax
jne 0x11d7f96d
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x58], eax
jmp 0x11d7f986
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], edx
lea eax, [esp + 0xd8]
mov dword [esp + 0xe0], edx
push eax
push ebp
mov dword [esp + 0xec], edx
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11e45528
call fcn.11d62820
test eax, eax
je 0x11d7fa82
mov ecx, dword [esp + 0xd8]
push ecx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe0]
cmp eax, 0xffffffff
je 0x11d7f9fd
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11d7f9ff
mov edi, ebp
mov eax, dword [0x11e4b918]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11d7fa46
push edi
call esi
and eax, 0xffff
mov edx, dword [esp + 0x14]
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d65710
add esp, 0x1c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d7fa58
mov dword [esp + 0x24], 1
jmp 0x11d7fa82
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d7fa6f
mov eax, dword [esp + 0x14]
mov word [esp + 0x56], di
mov dword [esp + 0x58], eax
jmp 0x11d7fa82
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], ecx
mov edx, dword [esp + 0x128]
mov ecx, 0x11e45888
push edx
call fcn.11d6a250
mov ecx, 0x11e45888
call fcn.11d6a570
mov eax, dword [esp + 0x38]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11d7fab1
lea edi, [esp + 0x54]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x11d7fad6
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7fadd
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11d65710
add esp, 0xc
mov eax, dword [0x11e4b918]
test eax, eax
mov ebp, dword [esp + 0x120]
je 0x11d7fafb
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov eax, dword [0x11e4b918]
test ebp, ebp
jne 0x11d7fe5e
test eax, eax
je 0x11d7fb45
mov ax, word [edi + 2]
push eax
call esi
mov ecx, dword [edi + 4]
and eax, 0xffff
push eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov edx, dword [esp + 0x130]
push edx
push 0x3bb
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x1c
lea ecx, [esp + 0x6c]
call fcn.11d95920
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x40]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebp
call fcn.11d95440
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
je 0x11d7fbda
mov edx, dword [esi + 0xc]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x40]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
mov dword [esi + 0xc], edx
jmp 0x11d7fc1d
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d7fc1d
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x128]
push eax
push edi
push ecx
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d7fc1d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d95900
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7fc5b
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3c9
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x20
mov eax, dword [0x11e45ef0]
test eax, eax
jne 0x11d801a9
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d801a9
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7fd48
push 0x3d1
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11e2d404
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7fd48
mov edx, dword [0x11e45ee4]
push edx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7fd48
mov eax, dword [esp + 0x2c]
push eax
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7fd48
mov ecx, dword [0x11e461bc]
push ecx
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d7fd48
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0x10
jmp 0x11d7fd52
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7fd80
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0x14
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d7fe12
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d7fe12
mov eax, dword [0x11e45ee4]
test eax, eax
je 0x11d7fddd
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11d7fdd0
mov eax, dword [0x11e461bc]
test eax, eax
je 0x11d7fdd0
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d7fdd0
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d7fe12
mov eax, dword [0x11e45ee4]
test eax, eax
jne 0x11d801a9
mov eax, dword [esp + 0x30]
test eax, eax
mov eax, dword [0x11e45ed4]
jne 0x11d7fdfe
test eax, eax
je 0x11d7fdfe
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x11d7fdfe
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d7fe12
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x11d801a9
test eax, eax
je 0x11d801a9
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d7fe2f
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x12c]
push eax
mov eax, dword [esp + 0x138]
push ecx
lea ecx, [esp + 0x60]
push eax
push ecx
push edx
call fcn.11d8ac80
add esp, 0x18
jmp 0x11d801a9
test eax, eax
je 0x11d7fe7b
push 0x3e5
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
lea ecx, [esp + 0x6c]
call fcn.11d95920
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x44]
lea ecx, [esp + 0x50]
push eax
push ecx
push ebp
call fcn.11d95440
mov eax, dword [esp + 0x50]
add esp, 0x10
test eax, eax
je 0x11d7ff2c
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11d7ff8f
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d7ff8f
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x134]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d7ff8f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d95900
mov eax, dword [0x11e45ef0]
test eax, eax
jne 0x11d801a9
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x11d801a9
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80084
push 0x3f0
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11e2d404
push 4
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d80084
mov ecx, dword [0x11e45ee4]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d80084
mov edx, dword [esp + 0x2c]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d80084
mov eax, dword [0x11e461bc]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d65710
mov eax, dword [0x11e4b918]
add esp, 0x10
test eax, eax
je 0x11d80084
mov edi, dword [esp + 0x34]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0x10
jmp 0x11d8008e
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x34]
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d800bc
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0x14
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d80142
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d80142
mov eax, dword [0x11e45ee4]
test eax, eax
je 0x11d80115
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x11d80108
mov eax, dword [0x11e461bc]
test eax, eax
je 0x11d80108
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
test eax, eax
jne 0x11d80108
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x11d80142
mov eax, dword [0x11e45ee4]
test eax, eax
jne 0x11d801a9
mov eax, dword [esp + 0x30]
test eax, eax
mov eax, dword [0x11e45ed4]
jne 0x11d80136
test eax, eax
je 0x11d80136
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x11d80136
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x11d80142
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x11d801a9
test eax, eax
je 0x11d801a9
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d8015f
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d65710
add esp, 0xc
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x13c]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x144]
push ecx
mov ecx, dword [esp + 0x144]
push edx
push eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x70]
push ecx
push edx
push eax
call fcn.11d8bad0
add esp, 0x28
mov ecx, 0x11e45888
call fcn.11d6a6a0
mov edi, dword [esp + 0x128]
mov ecx, 0x11e45938
push edi
call fcn.11d69730
test eax, eax
je 0x11d80247
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d801e7
push edi
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov dword [esp + 0x30], 0
mov eax, dword [0x11e45ee4]
test eax, eax
jne 0x11d807ff
mov eax, dword [0x11e459b4]
test eax, eax
mov eax, dword [0x11e45cc8]
je 0x11d8021c
mov ecx, eax
mov dword [esp + 0x18], 1
and ecx, 1
cmp cl, 1
jne 0x11d80224
mov dword [esp + 0x18], 0
mov ecx, dword [0x11e459ec]
test ecx, ecx
je 0x11d80715
and eax, 1
cmp al, 1
je 0x11d80715
mov ebp, 1
jmp 0x11d80717
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d801ef
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d8026c
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0xc
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11d802b7
mov edx, dword [esp + 0x12c]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11d802cc
mov dx, word [esp + 0x34]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], ebx
mov edi, dword [esp + 0x24]
test edi, edi
je 0x11d802e6
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x7a], ax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x78]
push edx
push eax
mov ecx, 0x11e45900
call fcn.11d69d90
mov dword [esp + 0xe8], 0x35026200
mov word [esp + 0xec], 0x10
mov word [esp + 0xee], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push ebx
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], 1
call ebp
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x104], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov dx, word [esp + 0x68]
mov word [esp + 0x10a], ax
mov word [esp + 0x10c], dx
call fcn.11dd8590
test edi, edi
mov word [esp + 0x10e], ax
je 0x11d803a3
mov eax, dword [esp + 0x14]
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x104], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x10a], ax
mov eax, dword [esp + 0x120]
xor edi, edi
cmp eax, edi
je 0x11d803b8
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x11e4b918], edi
je 0x11d803db
push 0x28
push 0x447
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
mov dword [esp + 0x20], 0xa
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d80401
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11e45888
call fcn.11d6a570
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80432
mov eax, dword [esp + 0x2c]
push eax
push 0x45b
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x14
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x128]
mov ecx, 0x28
push 0
sub ecx, eax
lea edx, [esp + eax + 0xec]
push ecx
push edx
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80480
mov eax, dword [esp + 0x2c]
push edi
push eax
push 0x45f
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x18
mov ecx, 0x11e45888
call fcn.11d6a6a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11d804ff
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11d804ad
call edi
cmp eax, 0x2749
jne 0x11d80510
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d804cd
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
add ecx, 3
test eax, eax
mov dword [esp + 0x20], ecx
jne 0x11d804eb
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 0x64
mov dword [esp + 0x2c], eax
jl 0x11d803eb
jmp 0x11d8055b
mov eax, dword [esp + 0x18]
add eax, edi
cmp eax, 0x28
mov dword [esp + 0x18], eax
jae 0x11d8055b
jmp 0x11d804cd
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80530
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
or edi, 0xffffffff
push ebp
mov ecx, 0x11e45888
mov dword [esi + 0x14], edi
call fcn.11d6a380
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], edi
call fcn.11d95890
mov eax, esi
jmp 0x11d809b9
cmp dword [esp + 0x2c], 0x64
jne 0x11d80586
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80586
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
xor edx, edx
xor ecx, ecx
mov dword [esp + 0xb2], edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0xb6], edx
mov dword [esp + 0x90], ecx
mov dword [esp + 0xba], edx
lea eax, [esp + 0x44]
mov word [esp + 0xbe], dx
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0xb0]
push eax
xor edi, edi
push ecx
push edx
mov dword [esp + 0x94], edi
mov word [esp + 0xbc], di
mov dword [esp + 0x50], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11d8061d
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xb2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11d80640
cmp dword [0x11e4b918], edi
je 0x11d80640
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getsockname_failed__errno:__d
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x44]
mov dword [esp + 0xca], edx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xce], edx
push eax
mov dword [esp + 0xd6], edx
push ecx
mov word [esp + 0xde], dx
mov edx, dword [esp + 0x130]
push edx
mov word [esp + 0xd4], 0
mov dword [esp + 0x50], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d806c0
mov eax, dword [esp + 0xcc]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xca]
mov dword [esp + 0x88], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
jmp 0x11d806e4
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d806e4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11e2d404
push 4
call fcn.11d65710
add esp, 0x10
cmp ebp, 0xffffffff
je 0x11d807ff
cmp edi, 0xffffffff
je 0x11d807ff
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x88]
push edx
push eax
mov ecx, 0x11e45938
call fcn.11d69420
jmp 0x11d807ff
xor ebp, ebp
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
mov edi, eax
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d8075b
mov eax, dword [esp + 0x18]
push edi
push ebp
push eax
push str.after_connectEx_add_health_log__bForce__d___bSmart__d__bVisitProIP__d_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d807ff
test ebp, ebp
jne 0x11d807ff
test edi, edi
je 0x11d807ff
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [esp + 0x48]
push eax
push ecx
call fcn.11ddad50
add esp, 8
mov edi, dword [eax]
push 0x11e45ef4
lea ecx, [esp + 0x54]
mov byte [esp + 0x11c], 7
call fcn.11d9b3c0
mov edx, dword [esp + 0x34]
mov ebp, dword [eax]
push 0
push edx
mov byte [esp + 0x120], 8
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e459e8
call fcn.11d6d2c0
push eax
push edi
push 0
push ebp
mov ecx, 0x11e4a618
call fcn.11d92620
lea ecx, [esp + 0x50]
mov byte [esp + 0x118], 7
call fcn.11d9bb60
lea ecx, [esp + 0x48]
mov byte [esp + 0x118], 0
call fcn.11d9bb60
mov eax, dword [0x11e45ef0]
test eax, eax
je 0x11d8083f
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x50]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x60], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11e45ce8
mov edx, dword [esp + 0x13c]
push edx
call fcn.11d79df0
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d80871
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x134]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
mov edi, dword [esp + 0x128]
mov ecx, 0x11e45888
push edi
call fcn.11d6a380
mov eax, dword [0x11e4b918]
test eax, eax
je 0x11d808a5
mov eax, dword [esi + 0x14]
push eax
push edi
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11d65710
add esp, 0x14
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d95890
mov eax, esi
jmp 0x11d809b9
mov esi, dword [esp + 0x124]
lea ecx, [esp + 0x40]
push ecx
xor ebp, ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov ebx, dword [esi + 0x1c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x50], ebp
call fcn.11d95440
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d80949
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x40]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov dword [esi + 0x1c], ebx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebp, ebp
jmp 0x11d8098c
mov ebx, dword [esi + 0x18]
cmp ebx, ebp
je 0x11d8098c
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x128]
push eax
push edi
push ecx
call ebx
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d8098c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
cmp dword [0x11e4b918], ebp
je 0x11d809b6
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
xor ecx, ecx
push edx
mov cx, word [edi]
push eax
push ecx
push str.TMAILHOOK::connectFunc_...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d65710
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10c
ret 0x24