Function at 0x11d4c810
Capabilities:
Check mutex on windows
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11dcdf91
push eax
mov dword fs:[0], esp
sub esp, 0x100
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
push edi
mov edi, dword [esp + 0x130]
test ebp, ebp
je 0x11d4e7fa
test edi, edi
jle 0x11d4e7fa
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4c88f
mov eax, dword [esp + 0x128]
push eax
push str.connectFunc_______d_
push str.test
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4c88f
push str.New_connecttion_come__
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0xc
push 0xfff7
lea ecx, [esp + 0x70]
call fcn.11d60c40
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
xor ebx, ebx
cmp word [ebp], 0x17
mov dword [esp + 0x118], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x28], ebx
jne 0x11d4c987
push edi
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.11da2380
add esp, 0xc
mov eax, dword [0x11dfd740]
mov byte [esp + 0x118], 1
test eax, eax
je 0x11d4c903
mov edx, dword [esp + 0x10]
push 0x1c
push edi
push edx
push str.wstrTemp___s___lu____lu_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x18
lea esi, [ebp + 8]
push esi
call fcn.11d4bed0
add esp, 4
test al, al
jne 0x11d4c924
push esi
call fcn.11d4bf30
add esp, 4
test al, al
je 0x11d4ca8c
cmp edi, 0x1c
jne 0x11d4ca8c
mov ecx, dword [0x11dfd740]
mov ebx, dword [ebp + 0x14]
mov ax, word [ebp + 2]
mov dword [esp + 0x44], ebx
test ecx, ecx
mov dword [esp + 0x2c], eax
je 0x11d4c968
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
push str.AAA___lu____d__1
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x14
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
call fcn.11d66f40
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11dfd740]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
test eax, eax
je 0x11d4c9d3
mov ax, word [ebp + 2]
push eax
call esi
mov ecx, dword [ebp + 4]
and eax, 0xffff
push eax
push ecx
call edi
movsx edx, word [ebp]
push eax
push edx
call edi
push eax
mov eax, dword [esp + 0x134]
push eax
push 0x187
push str.CCallback::connectCallback_line__lu___s__lu___family__lu__ip_0x_x___port__lu___r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x20
cmp word [ebp], 2
je 0x11d4cc9b
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4cc9b
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x6c]
test eax, eax
jne 0x11d4cb4e
call fcn.11d60d00
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
call fcn.11d60820
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d4cb00
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x130]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x12c]
push edx
mov edx, dword [esp + 0x12c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11d4cc60
mov ecx, 0x11df79d8
call fcn.11d3aa70
test eax, eax
jne 0x11d4caac
mov ecx, 0x11df79d8
call fcn.11d3aab0
test eax, eax
je 0x11d4c970
push 0
call fcn.11d56960
add esp, 4
test eax, eax
je 0x11d4c970
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
mov byte [esp + 0x118], 0
mov dword [eax + 0x10], 0x274d
mov dword [eax + 0x28], 0x2744
call fcn.11d66f40
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d60c70
or eax, 0xffffffff
jmp 0x11d4e8f6
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11d4cc60
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
push ecx
push edx
push eax
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4cc60
jmp 0x11d4cc57
call fcn.11d60d00
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
call fcn.11d60820
mov eax, dword [esp + 0x34]
add esp, 0x10
cmp eax, ebp
je 0x11d4cbf6
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
mov ebp, dword [esi + 0xc]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov eax, dword [esp + 0x34]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x24], eax
jmp 0x11d4cc60
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11d4cc60
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4cc60
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e7dc
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x130]
xor edx, edx
push ecx
mov dx, word [eax]
push edx
push str.TMAILHOOK::connectFunc_1...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x18
jmp 0x11d4e7dc
call fcn.11d55f10
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x4a], ecx
lea edi, [esp + 0x96]
mov dword [esp + 0x4e], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x52], ecx
mov word [esp + 0x48], ax
mov word [esp + 0x56], cx
mov ecx, 6
mov word [esp + 0x94], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4cd0a
mov edx, dword [ebp]
mov dword [esp + 0x48], edx
mov eax, dword [ebp + 4]
mov dword [esp + 0x4c], eax
mov ebx, eax
mov ecx, dword [ebp + 8]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], ecx
mov edx, dword [ebp + 0xc]
mov ebp, dword [esp + 0x4a]
mov dword [esp + 0x54], edx
mov dword [esp + 0x2c], ebp
jmp 0x11d4cd24
mov ecx, 7
mov esi, ebp
mov ebp, dword [esp + 0x2c]
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4cd5a
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x130]
push eax
push str.connectFunc_1__d___08x___d_
push str.test
push 4
call fcn.11d355b0
add esp, 0x18
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0x68]
push ecx
push edx
mov dword [esp + 0x70], 0
call fcn.11d4c6d0
mov dword [esp + 0x1c], eax
mov eax, dword [0x11dfd740]
add esp, 8
test eax, eax
je 0x11d4cda2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.TMAILHOOK::IP:_0x_lx__Port:__d
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x14
xor edx, edx
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xec]
mov dword [esp + 0xe8], edx
push ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ecx, 0x11df7c00
call fcn.11d47600
mov dword [esp + 0x18], eax
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4ce07
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x1c]
push eax
push str.http_bProtocolAnalysisIP:_d__ulIP:0x_x
push str.Protocal
push 4
call fcn.11d355b0
add esp, 0x14
mov eax, dword [0x11df7e4c]
mov dword [esp + 0x30], 0
test eax, eax
jne 0x11d4ce2a
mov eax, dword [0x11df7e3c]
test eax, eax
jne 0x11d4ce2a
mov eax, dword [0x11df7e50]
test eax, eax
je 0x11d4ce6f
push ebp
call esi
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7b28
call fcn.11d40880
test eax, eax
je 0x11d4ce75
mov eax, dword [0x11dfd740]
mov dword [esp + 0x30], 1
test eax, eax
je 0x11d4ce75
push 1
push str.IsInTAccCtrllist___d
push str.TAccCtrl
push 4
call fcn.11d355b0
add esp, 0x10
jmp 0x11d4ce75
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11df7e58]
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0xc4], ecx
mov dword [esp + 0xc0], 8
je 0x11d4d196
lea ecx, [esp + 0xc0]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7c70
mov eax, dword [esp + 0x13c]
push eax
call fcn.11d48000
test eax, eax
je 0x11d4cf07
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4ceea
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connect_NetSecurityCtrl_fobidden_IP:_0x_lx__Port:__d
push str.NetSecurityCtrl
push 4
call fcn.11d355b0
add esp, 0x14
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
mov ecx, 0x274d
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], ecx
mov dword [eax + 0x28], ecx
jmp 0x11d4d7e6
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x11d4cf22
mov dword [esp + 0x20], 1
mov dword [esp + 0x64], 5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4cf47
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4cf47
push str.http_bProtocolAnalysisIP_1
push str.Protocal
push 4
call fcn.11d355b0
add esp, 0xc
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x11d4d748
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x128]
push eax
push ecx
push 0x1008
push 0xffff
push edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x48], 4
call dword [sym.imp.WS2_32.dll_getsockopt]
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4cfce
mov eax, dword [esp + 0x10]
push eax
push ebp
call esi
and eax, 0xffff
mov ecx, dword [esp + 0x12c]
push eax
push ebx
push ecx
push str.TMAILHOOK::connectFunc:_New_Connect_come__SOCKET__d___IP_0x_lx___PORT__d___SOCKTYPE__d___TCP:1__UDP:2_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x1c
cmp dword [esp + 0x10], 1
jne 0x11d4d9db
mov eax, dword [0x11df7e58]
test eax, eax
jne 0x11d4d7fd
mov eax, dword [0x11df79dc]
test eax, eax
jne 0x11d4d001
mov eax, dword [0x11df7a14]
test eax, eax
je 0x11d4d072
mov eax, dword [0x11df7e40]
test eax, eax
je 0x11d4d072
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7b68
call fcn.11d41b20
test eax, eax
je 0x11d4d072
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d036
push ebx
call edi
push eax
call fcn.11d55ff0
add esp, 4
test eax, eax
je 0x11d4d072
mov dword [esp + 0x24], 1
call fcn.11d5a630
mov eax, dword [0x11dfd740]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11d4d072
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc::IsInProxylist_IP:_0x_lx__Port:__d_Limit_Upload
push str.Proxy
push 4
call fcn.11d355b0
add esp, 0x14
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7ae0
call fcn.11d3f090
push str.127.0.0.1
mov dword [esp + 0x44], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d943
push ebx
call edi
push eax
call fcn.11d55ff0
add esp, 4
test eax, eax
jne 0x11d4d943
mov eax, dword [0x11df7a14]
test eax, eax
je 0x11d4d5a8
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54fb0
add esp, 4
test eax, eax
je 0x11d4d0de
mov eax, dword [0x11df7e38]
test eax, eax
jne 0x11d4d59f
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d102
mov edx, dword [0x11df79dc]
push edx
push str.g_GWGatewayProcess.m_bIsGatewayProcess__d_...._r_n
push 0x11de1380
push 1
call fcn.11d355b0
add esp, 0x10
mov eax, dword [0x11df79dc]
test eax, eax
jne 0x11d4d136
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
jne 0x11d4d12d
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4d8e3
mov eax, dword [0x11df79dc]
test eax, eax
je 0x11d4d16a
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
jne 0x11d4d16a
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d16a
push ebp
call esi
push eax
mov ecx, 0x11df7c60
call fcn.11d47da0
test eax, eax
jne 0x11d4d913
mov eax, dword [0x11df7e3c]
test eax, eax
je 0x11d4d5bb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
je 0x11d4d5bb
jmp 0x11d4d5b1
cmp dword [0x11df7e4c], ecx
je 0x11d4d4bd
mov eax, dword [0x11df79dc]
cmp eax, ecx
mov eax, dword [0x11df7c50]
je 0x11d4d363
mov edx, eax
and edx, 1
cmp dl, 1
je 0x11d4d363
cmp dword [esp + 0x18], ecx
jne 0x11d4d2cb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
jne 0x11d4d2cb
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7c00
call fcn.11d46740
test eax, eax
jne 0x11d4d2cb
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d2cb
push ebx
call edi
push eax
call fcn.11d55ff0
add esp, 4
test eax, eax
jne 0x11d4d2cb
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d2cb
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d7d2
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4d7d2
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7c00
call fcn.11d46740
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4d7d2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_003_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4d7d2
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4cf22
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
push eax
push str.IsInBlacklist___d
push str.Security_Proxy
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4cf22
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7c00
call fcn.11d46740
push eax
push str.IsInWhiteList___d
push str.Security_Proxy
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4cf22
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_004_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4cf22
cmp dword [0x11df7a14], ecx
je 0x11d4d3d3
and eax, 1
cmp al, 1
je 0x11d4d3d3
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
je 0x11d4cf22
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4cf2a
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d3ba
push 0x228
push str.Security_Proxy_line__lu__CTSafeDoc::SetEncryption
push str.Security_Proxy
push 4
call fcn.11d355b0
add esp, 0x10
push 1
call fcn.11d35170
add esp, 4
mov dword [0x11df7e40], eax
call fcn.11d5a630
jmp 0x11d4cf47
cmp dword [0x11df7c54], ecx
je 0x11d4d46c
cmp dword [esp + 0x18], ecx
jne 0x11d4d46c
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
je 0x11d4d46c
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7c00
call fcn.11d46740
test eax, eax
jne 0x11d4d46c
push str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, ebx
je 0x11d4d46c
push ebx
call edi
push eax
call fcn.11d55ff0
add esp, 4
test eax, eax
jne 0x11d4d46c
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d46c
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d7d2
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d
push str.Security_Proxy
push 4
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4d7d2
mov eax, dword [0x11df7c54]
test eax, eax
jne 0x11d4cf22
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4cf47
mov eax, dword [0x11dfd740]
mov dword [esp + 0x18], 0
test eax, eax
je 0x11d4cf47
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.Security_Proxy_005_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push str.Security_Proxy
push 4
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4cf47
cmp dword [0x11df7e3c], ecx
je 0x11d4cf22
mov eax, dword [0x11df79dc]
cmp eax, ecx
mov eax, dword [0x11df7c50]
je 0x11d4d4e5
mov edx, eax
and edx, 1
cmp dl, 1
jne 0x11d4cf22
cmp dword [0x11df7a14], ecx
je 0x11d4d555
and eax, 1
cmp al, 1
je 0x11d4d555
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
je 0x11d4cf22
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4cf2a
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d53c
push 0x25c
push str.CCallback::connectCallback:_line__lu__SetEncryption_
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
push 1
call fcn.11d35170
add esp, 4
mov dword [0x11df7e40], eax
call fcn.11d5a630
jmp 0x11d4cf47
cmp dword [0x11df7c54], ecx
jne 0x11d4cf22
cmp dword [esp + 0x18], ecx
je 0x11d4cf47
mov eax, dword [0x11dfd740]
mov dword [esp + 0x18], ecx
cmp eax, ecx
je 0x11d4cf47
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.CCallback::connectCallback_IP:_0x_lx__Port:__d_Set_bProtocolAnalysisIP_FALSE
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4cf47
mov eax, dword [0x11df7a14]
test eax, eax
jne 0x11d4d5bb
mov eax, dword [0x11df7e3c]
test eax, eax
je 0x11d4d5bb
mov dword [0x11df7e44], 1
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54fb0
add esp, 4
test eax, eax
je 0x11d4d648
mov eax, dword [0x11df7e38]
test eax, eax
je 0x11d4d648
call fcn.11d4c4d0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11d4d5fc
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4a], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
jmp 0x11d4d615
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], ecx
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x64], eax
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4da51
push str.connectFunc_SMTP_Redirect
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0xc
jmp 0x11d4d9db
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d6c3
mov eax, dword [0x11df7e3c]
test eax, eax
je 0x11d4d9db
mov eax, dword [0x11df7e4c]
test eax, eax
je 0x11d4d680
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c980
test eax, eax
je 0x11d4d9db
mov ecx, 0x11df79d8
call fcn.11d3aa70
test eax, eax
jne 0x11d4d6c3
mov ecx, 0x11df79d8
call fcn.11d3aab0
test eax, eax
jne 0x11d4d6c3
mov eax, dword [0x11df7a14]
test eax, eax
je 0x11d4d9db
push ebp
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
je 0x11d4d9db
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d6e0
push str.connectFunc_SafeGW_Redirect
push 0x11de1380
push 1
call fcn.11d355b0
add esp, 0xc
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4d715
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x4a], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov eax, 1
mov dword [esp + 0x20], eax
mov dword [esp + 0xfc], eax
jmp 0x11d4da51
mov ecx, dword [esp + 0x68]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0xfc], eax
jmp 0x11d4da51
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d7a8
push str.GlobalTEC_OCULAR__AGENT_V3_MUTEX_TMAILGATEWAY
lea ecx, [esp + 0x3c]
call fcn.11d667a0
mov esi, eax
mov byte [esp + 0x118], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
push eax
push str.CCallback::connectCallback:_can_not_open_the_mutex__s_errno:__d_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x14
lea ecx, [esp + 0x38]
mov byte [esp + 0x118], 0
call fcn.11d66f40
mov esi, dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [esp + 0x2c]
mov edi, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11df7e3c]
test eax, eax
jne 0x11d4d7d2
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x11d4d7d2
mov eax, dword [0x11df7e58]
test eax, eax
je 0x11d4da51
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4da51
mov eax, dword [esp + 0x124]
or esi, 0xffffffff
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], 0x274d
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], esi
call fcn.11d60c70
mov eax, esi
jmp 0x11d4e8f6
push ebp
call esi
and eax, 0xffff
push eax
call fcn.11d54fb0
add esp, 4
test eax, eax
je 0x11d4d879
mov eax, dword [0x11df7e38]
test eax, eax
je 0x11d4d879
call fcn.11d4c4d0
mov ecx, dword [esp + 0x28]
push eax
test ecx, ecx
jne 0x11d4d84e
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov eax, 1
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], eax
mov dword [esp + 0x20], eax
jmp 0x11d4da51
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov eax, 1
mov dword [esp + 0xa8], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x20], eax
jmp 0x11d4da51
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4d9e3
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4d8b5
mov eax, dword [esp + 0x68]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov dword [esp + 0x4c], ecx
jmp 0x11d4d9db
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov dword [esp + 0xfc], 1
mov word [esp + 0x96], ax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xa8], eax
jmp 0x11d4d9db
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d9db
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.it_is_not_in_the_blacklist__d___d
push 0x11de1380
push 1
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4d9db
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d9db
push ebp
call esi
and eax, 0xffff
push eax
push ebx
push str.connectFunc_It_is_in_WhiteListProcessPort_IP__lu__Port__lu__r_n
push 0x11de1380
push 1
call fcn.11d355b0
add esp, 0x14
jmp 0x11d4d9db
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d960
push str.It_is_local_connecttion_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0xc
call fcn.11d56650
test eax, eax
jne 0x11d4d9b5
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d986
push str.Disable_Local_connecttion_____
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0xc
mov eax, dword [0x11df7e3c]
mov dword [esp + 0x1c], 1
test eax, eax
je 0x11d4d9bd
mov eax, dword [0x11df79dc]
test eax, eax
je 0x11d4d9bd
mov ecx, dword [0x11df7c50]
and ecx, 1
cmp cl, 1
je 0x11d4d9bd
call fcn.11d5a630
jmp 0x11d4d9bd
mov dword [esp + 0x40], 1
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4d9db
push ebx
push str.TMAILHOOK::It_is_Local_Addr._addr_0x_lx__n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x11d4da51
lea edx, [esp + 0x64]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x1c], 0
call esi
push eax
push ebx
call edi
push eax
call fcn.11d530b0
add esp, 0x10
test eax, eax
je 0x11d4da51
mov eax, dword [esp + 0x10]
test ax, ax
je 0x11d4da51
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], 1
test ecx, ecx
push eax
jne 0x11d4da38
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], ax
mov dword [esp + 0x4c], ecx
jmp 0x11d4da51
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], ax
mov dword [esp + 0xa8], edx
xor eax, eax
lea ecx, [esp + 0xd8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
push ecx
mov dword [esp + 0xe4], eax
push ebp
mov dword [esp + 0xec], eax
call esi
push eax
push ebx
call edi
push eax
mov ecx, 0x11df7588
call fcn.11d326c0
test eax, eax
je 0x11d4db4b
mov edx, dword [esp + 0xd8]
push edx
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe0]
cmp eax, 0xffffffff
je 0x11d4dac6
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, eax
jmp 0x11d4dac8
mov edi, ebp
mov eax, dword [0x11dfd740]
mov dword [esp + 0x10], edi
test eax, eax
je 0x11d4db0f
push edi
call esi
and eax, 0xffff
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebp
call esi
and eax, 0xffff
push eax
push ebx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push str.connectFunc_ConnRediPolicy__0x_08X__0x_08X________0x_08X__0x_08X__r_n
push str.IPG_16656
push 1
call fcn.11d355b0
add esp, 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4db21
mov dword [esp + 0x34], 1
jmp 0x11d4db4b
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4db38
mov ecx, dword [esp + 0x14]
mov word [esp + 0x4a], di
mov dword [esp + 0x4c], ecx
jmp 0x11d4db4b
mov edx, dword [esp + 0x14]
mov word [esp + 0x96], di
mov dword [esp + 0xa8], edx
mov eax, dword [esp + 0x128]
mov ecx, 0x11df78e8
push eax
call fcn.11d39680
mov ecx, 0x11df78e8
call fcn.11d399a0
mov eax, dword [esp + 0x28]
lea edi, [esp + 0x94]
test eax, eax
jne 0x11d4db7a
lea edi, [esp + 0x48]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x11d4db9f
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4dba6
push str.http_bProtocolAnalysisIP_2
push str.Protocal
push 4
call fcn.11d355b0
add esp, 0xc
mov eax, dword [0x11dfd740]
test eax, eax
mov ebp, dword [esp + 0x120]
je 0x11d4dbc4
push ebp
push str.CCallback::connectCallback_bWSAConnect__lu__r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov eax, dword [0x11dfd740]
test ebp, ebp
jne 0x11d4df2a
test eax, eax
je 0x11d4dc0e
mov cx, word [edi + 2]
push ecx
call esi
mov edx, dword [edi + 4]
and eax, 0xffff
push eax
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 0x130]
push eax
push 0x3a9
push str.CCallback::connectCallback_line__lu___s__lu___ip_0x_x___port__lu__DtCallNext_x1_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x1c
lea ecx, [esp + 0x6c]
call fcn.11d60d00
mov esi, dword [esp + 0x124]
lea eax, [esp + 0x38]
push eax
xor ebx, ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x40]
push ecx
push edx
push ebp
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x48], ebx
call fcn.11d60820
mov eax, dword [esp + 0x68]
add esp, 0x10
cmp eax, ebx
je 0x11d4dc9d
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x128]
push ecx
push edi
push edx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x1c], ebp
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
xor ebx, ebx
jmp 0x11d4dce0
mov ebp, dword [esi + 0x18]
cmp ebp, ebx
je 0x11d4dce0
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x130]
mov eax, dword [esp + 0x128]
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4dce0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d60ce0
cmp dword [0x11dfd740], ebx
je 0x11d4dd1d
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x3b7
push str.CCallback::connectCallback_line__lu__WSAErr_0x_x__DTFErr_0x_x__DTFErr2_0x_x__ret__lu__DtCallNext_x2_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x20
cmp dword [0x11df7e58], ebx
jne 0x11d4e275
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4e275
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4de10
push 0x3bf
push str.CCallback::connectCallback_line__lu__DtCallNext_x3_r_n
push 0x11de1380
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4de10
mov ecx, dword [0x11df7e4c]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4de10
mov edx, dword [esp + 0x40]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4de10
mov eax, dword [0x11df8124]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4de10
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov ebx, dword [esp + 0x48]
push ebx
call ebp
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0x10
jmp 0x11d4de1e
mov ebx, dword [esp + 0x44]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov edi, dword [esp + 0x2c]
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4de4c
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d4dede
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4dede
mov eax, dword [0x11df7e4c]
test eax, eax
je 0x11d4dea9
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x11d4de9c
mov eax, dword [0x11df8124]
test eax, eax
je 0x11d4de9c
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
jne 0x11d4de9c
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4dede
mov eax, dword [0x11df7e4c]
test eax, eax
jne 0x11d4e275
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [0x11df7e3c]
jne 0x11d4deca
test eax, eax
je 0x11d4deca
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x11d4deca
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11d4dede
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11d4e275
test eax, eax
je 0x11d4e275
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4defb
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x12c]
push eax
mov eax, dword [esp + 0x138]
push ecx
lea ecx, [esp + 0x54]
push eax
push ecx
push edx
call fcn.11d58a90
add esp, 0x18
jmp 0x11d4e275
test eax, eax
je 0x11d4df47
push 0x3d3
push str.CCallback::connectCallback_line__lu__DtCallNext_x4_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
lea ecx, [esp + 0x6c]
call fcn.11d60d00
mov esi, dword [esp + 0x124]
lea edx, [esp + 0x58]
push edx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x1c]
mov dword [esp + 0x64], eax
xor eax, eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x40]
push eax
push ecx
push ebp
call fcn.11d60820
mov eax, dword [esp + 0x48]
add esp, 0x10
test eax, eax
je 0x11d4dff8
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x58]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x140]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
mov ebx, dword [esi + 0xc]
push ecx
mov ecx, dword [esp + 0x13c]
push edx
mov edx, dword [esp + 0x13c]
push ecx
mov ecx, dword [esp + 0x138]
push edx
push edi
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
jmp 0x11d4e05b
mov ebp, dword [esi + 0x18]
test ebp, ebp
je 0x11d4e05b
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
push ecx
mov ecx, dword [esp + 0x138]
push edx
mov edx, dword [esp + 0x138]
push eax
mov eax, dword [esp + 0x134]
push ecx
push edx
push edi
push eax
call ebp
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4e05b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0x6c]
call fcn.11d60ce0
mov eax, dword [0x11df7e58]
test eax, eax
jne 0x11d4e275
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x11d4e275
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e150
push 0x3de
push str.CCallback::connectCallback_line__lu__DtCallNext_x5_r_n
push 0x11de1380
push 4
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4e150
mov ecx, dword [0x11df7e4c]
push ecx
push str.g_bStartSecurityProxy___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4e150
mov edx, dword [esp + 0x40]
push edx
push str.bInFilterList___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4e150
mov eax, dword [0x11df8124]
push eax
push str.CUploadCtrl::m_sbEnableCtrl___d
push str.IPG_5395
push 1
call fcn.11d355b0
mov eax, dword [0x11dfd740]
add esp, 0x10
test eax, eax
je 0x11d4e150
mov edi, dword [esp + 0x2c]
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
push eax
push str.g_GWProcBlacklist.IsInBlacklist_ntohl_ulIP___ntohs_usPort_____d
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0x10
jmp 0x11d4e15a
mov edi, dword [esp + 0x2c]
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e188
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
push ebx
call ebp
push eax
push str.it_is_not_in_the_blacklist__x___x
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x11d4e20e
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x11d4e20e
mov eax, dword [0x11df7e4c]
test eax, eax
je 0x11d4e1e1
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x11d4e1d4
mov eax, dword [0x11df8124]
test eax, eax
je 0x11d4e1d4
push edi
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
push ebx
call ebp
push eax
mov ecx, 0x11df7a10
call fcn.11d3c470
test eax, eax
jne 0x11d4e1d4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x11d4e20e
mov eax, dword [0x11df7e4c]
test eax, eax
jne 0x11d4e275
mov eax, dword [esp + 0x20]
test eax, eax
mov eax, dword [0x11df7e3c]
jne 0x11d4e202
test eax, eax
je 0x11d4e202
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x11d4e202
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x11d4e20e
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x11d4e275
test eax, eax
je 0x11d4e275
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e22b
push str.CUploadCtrl::UCconnect
push str.IPG_5395
push 1
call fcn.11d355b0
add esp, 0xc
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push edx
mov edx, dword [esp + 0x13c]
push eax
mov eax, dword [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x148]
push eax
mov eax, dword [esp + 0x144]
push ecx
mov ecx, dword [esp + 0x144]
push edx
push eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x64]
push ecx
push edx
push eax
call fcn.11d598e0
add esp, 0x28
mov ecx, 0x11df78e8
call fcn.11d39ad0
mov ebx, dword [esp + 0x128]
mov ecx, 0x11df7998
push ebx
call fcn.11d38d00
test eax, eax
je 0x11d4e2c0
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e2b3
push ebx
push str.CCallback::connectCallback:_socket__u__IsSocketConnected_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov dword [esp + 0x20], 0
jmp 0x11d4e740
mov eax, dword [esp + 0x20]
test eax, eax
je 0x11d4e739
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e2e9
push str.CCallback::connectCallback:_Start_to_redirect_the_connection_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0xc
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0x7a], ecx
mov dword [esp + 0x7e], ecx
mov dword [esp + 0x82], ecx
test eax, eax
mov word [esp + 0x86], cx
jne 0x11d4e334
mov edx, dword [esp + 0x12c]
mov eax, dword [edx]
mov dword [esp + 0x78], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x7c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x80], eax
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x84], ecx
jmp 0x11d4e34d
mov dx, word [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov word [esp + 0x78], 2
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], eax
mov edi, dword [esp + 0x34]
test edi, edi
je 0x11d4e367
mov cx, word [esp + 0x10]
mov edx, dword [esp + 0x14]
mov word [esp + 0x7a], cx
mov dword [esp + 0x7c], edx
lea eax, [esp + 0x78]
mov ecx, 0x11df7960
push eax
push ebx
call fcn.11d391c0
mov dword [esp + 0xe8], 0x35026200
mov word [esp + 0xec], 0x10
mov word [esp + 0xee], 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x44]
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], 1
call ebx
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x104], eax
push edx
call ebp
mov word [esp + 0x10a], ax
mov ax, word [esp + 0x64]
mov word [esp + 0x10c], ax
call fcn.11da0270
test edi, edi
mov word [esp + 0x10e], ax
je 0x11d4e41f
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x104], eax
push edx
call ebp
mov word [esp + 0x10a], ax
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d4e432
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e456
push 0x28
push 0x435
push str.CCallback::connectCallback_line__lu__HOOKINFO__lu__a1_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x14
xor ebp, ebp
mov dword [esp + 0x24], 0xa
xor ebx, ebx
mov eax, dword [esp + 0x120]
test eax, eax
je 0x11d4e478
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x11df78e8
call fcn.11d399a0
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e4a5
push ebx
push 0x449
push str.CCallback::connectCallback_line__lu__i__lu__before_send_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x14
mov eax, dword [esp + 0x128]
mov ecx, 0x28
sub ecx, ebp
push 0
lea edx, [esp + ebp + 0xec]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e4eb
push edi
push ebx
push 0x44d
push str.CCallback::connectCallback_line__lu__i__lu__send__lu__r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x18
mov ecx, 0x11df78e8
call fcn.11d39ad0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp edi, 0xffffffff
jne 0x11d4e562
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
je 0x11d4e518
call edi
cmp eax, 0x2749
jne 0x11d4e56b
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e538
call edi
push eax
push str.CCallback::connectCallback:_6543_Send_hook_info_failed_errno:__d_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x120]
add ecx, 3
test eax, eax
mov dword [esp + 0x24], ecx
jne 0x11d4e556
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x64
jl 0x11d4e462
jmp 0x11d4e5bd
add ebp, edi
cmp ebp, 0x28
jae 0x11d4e5bd
jmp 0x11d4e538
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e58b
call edi
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov ecx, dword [esp + 0x128]
or edi, 0xffffffff
push ecx
mov ecx, 0x11df78e8
mov dword [esi + 0x14], edi
call fcn.11d397b0
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], edi
call fcn.11d60c70
mov eax, esi
jmp 0x11d4e8f6
cmp ebx, 0x64
jne 0x11d4e5e6
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e5e6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CCallback::connectCallback:_Send_hook_info_failed__errno:__d_r_n
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
mov edi, dword [esp + 0x128]
xor edx, edx
xor eax, eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0xb2], eax
mov dword [esp + 0x90], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xb6], eax
lea edx, [esp + 0xb0]
push ecx
xor ebx, ebx
mov dword [esp + 0xbe], eax
push edx
push edi
mov dword [esp + 0x94], ebx
mov word [esp + 0xbc], bx
mov word [esp + 0xca], ax
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x11d4e67d
mov eax, dword [esp + 0xb4]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0xb2]
mov dword [esp + 0x8c], eax
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x92], ax
jmp 0x11d4e6a0
cmp dword [0x11dfd740], ebx
je 0x11d4e6a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.TMAILHOOK32::getpeername_failed__errno:__d
push 0x11de1380
push 4
call fcn.11d355b0
add esp, 0x10
xor edx, edx
lea eax, [esp + 0x1c]
mov dword [esp + 0xca], edx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xce], edx
push eax
mov dword [esp + 0xd6], edx
push ecx
push edi
mov word [esp + 0xd4], bx
mov word [esp + 0xe2], dx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.WS2_32.dll_getpeername]
mov edi, eax
cmp edi, 0xffffffff
je 0x11d4e715
mov edx, dword [esp + 0xcc]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xca]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esp + 0x90], ax
cmp ebp, 0xffffffff
je 0x11d4e739
cmp edi, 0xffffffff
je 0x11d4e739
mov edx, dword [esp + 0x128]
lea ecx, [esp + 0x88]
push ecx
push edx
mov ecx, 0x11df7998
call fcn.11d38ad0
mov ebx, dword [esp + 0x128]
mov eax, dword [0x11df7e58]
test eax, eax
je 0x11d4e77d
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x60]
push 0
push eax
push 1
push ecx
mov dword [esp + 0x70], 0
call dword [sym.imp.WS2_32.dll_ntohs]
push eax
mov edx, dword [esp + 0x54]
push edx
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
push ebx
mov ecx, 0x11df7c70
call fcn.11d48000
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e7af
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x134]
xor eax, eax
mov ax, word [ecx]
push eax
push str.TMAILHOOK::connectFunc_2...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x18
push ebx
mov ecx, 0x11df78e8
call fcn.11d397b0
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e7dc
mov eax, dword [esi + 0x14]
push eax
push ebx
push str.connectFunc___d___d_
push str.test
push 4
call fcn.11d355b0
add esp, 0x14
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + 0x118], 0xffffffff
call fcn.11d60c70
mov eax, esi
jmp 0x11d4e8f6
mov esi, dword [esp + 0x124]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x5c], edx
lea ecx, [esp + 0x34]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
push edi
call fcn.11d60820
mov eax, dword [esp + 0x44]
add esp, 0x10
test eax, eax
je 0x11d4e884
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x130]
mov dword [esi + 0x24], edx
mov edx, dword [esp + 0x12c]
push ecx
mov ecx, dword [esp + 0x12c]
push edx
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov dword [esi + 0xc], ebp
mov ebp, dword [esp + 0x12c]
mov edx, dword [esp + 0x5c]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edx
jmp 0x11d4e8c7
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11d4e8c7
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x128]
push ecx
push ebp
push edx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4e8c7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov eax, dword [0x11dfd740]
test eax, eax
je 0x11d4e8f3
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor edx, edx
push eax
mov dx, word [ebp]
push ecx
push edx
push str.TMAILHOOK::connectFunc_...addr_family__d___bRet__d___errno__d_
push str.TMailHook_DBG
push 4
call fcn.11d355b0
add esp, 0x18
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10c
ret 0x24