Function at 0x4034e0
Capabilities:
Get inbound credentials handle via credssp
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0xc064
call fcn.00417ee0
mov eax, dword [0x423004]
xor eax, esp
mov dword [esp + 0xc060], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
call fcn.004020a0
mov edx, edi
mov dword [esp + 0x10], eax
mov ecx, esi
call fcn.004022c0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 0x4d4c544e
mov word [esp + 0x34], 0x5353
mov byte [esp + 0x36], 0x50
nop
push 0
push 0x2000
lea eax, [esp + 0x70]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
xor ecx, ecx
xor esi, esi
test edi, edi
jle 0x4038a0
mov dl, byte [esp + esi + 0x68]
cmp dl, byte [esp + ecx + 0x30]
jne 0x403581
inc ecx
cmp ecx, 7
jne 0x403583
add esi, 0xfffffffa
test esi, esi
jg 0x40358a
test edi, edi
jg 0x403540
jmp 0x4038a0
xor ecx, ecx
inc esi
cmp esi, edi
jl 0x403561
jmp 0x403540
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0xa070]
push eax
call fcn.004064f0
add esp, 0xc
lea eax, [esp + 0x68]
mov ebx, edi
add eax, esi
sub ebx, esi
push ebx
push eax
lea eax, [esp + 0x8070]
push eax
call fcn.004064f0
mov ax, word [0x4215bc]
add esp, 0xc
movq xmm0, qword [str.NTLM]
mov word [esp + 0x2070], ax
lea eax, [esp + 0x2072]
movq qword [esp + 0x2068], xmm0
push 0x7f6
push 0
push eax
call fcn.00405090
add esp, 0xc
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
push 1
lea eax, [esp + 0x2084]
push eax
push 0
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
je 0x40362c
push str.Error_in_AquireCredentialsHandle_n
call fcn.00401050
add esp, 4
jmp 0x4036f2
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x24]
push 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 1
mov dword [esp + 0x2c], 2
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], eax
call fcn.00403c23
add esp, 4
lea ecx, [esp + 0x8068]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ebx
push ecx
lea ecx, [esp + 0x40]
push ecx
push eax
push 0x10
push 0x100
lea eax, [esp + 0x5c]
push eax
push 0
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x4070]
push eax
call fcn.004064f0
add esp, 0xc
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xa068]
mov ebx, dword [sym.imp.WS2_32.dll_send]
xorps xmm0, xmm0
push 0
push edi
push eax
push esi
movq qword [esp + 0x4098], xmm0
call ebx
cmp eax, 0xffffffff
jne 0x40372d
push str.____Couldnt_communicate_with_the_fake_RPC_Server_n
call fcn.00401050
add esp, 4
jmp 0x4038a0
push 0
push 0x2000
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403759
push str.____Couldnt_receive_the_type2_message_from_the_fake_RPC_Server_n
call fcn.00401050
add esp, 4
jmp 0x4038a0
xor ecx, ecx
mov dword [esp + 0x30], 0x4d4c544e
xor edx, edx
mov word [esp + 0x34], 0x5353
mov byte [esp + 0x36], 0x50
test esi, esi
jle 0x403791
mov al, byte [esp + edx + 0x68]
cmp al, byte [esp + ecx + 0x30]
jne 0x40378a
inc ecx
cmp ecx, 7
jne 0x40378c
lea edi, [edx - 6]
jmp 0x403794
xor ecx, ecx
inc edx
cmp edx, esi
jl 0x403775
or edi, 0xffffffff
mov eax, dword [esp + 0xc]
movzx ecx, ax
mov eax, ecx
mov word [esp + 0x72], cx
sub eax, esi
add eax, edi
add word [esp + 0x70], ax
lea eax, [esp + 0x68]
push edi
push eax
lea eax, [esp + 0x6070]
push eax
call fcn.004064f0
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x4074]
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x6070]
add eax, edi
push eax
call fcn.004064f0
add esp, 0xc
lea eax, [esi + edi]
mov esi, dword [esp + 0x10]
push 0
push eax
lea eax, [esp + 0x6070]
push eax
push esi
call ebx
cmp eax, 0xffffffff
jne 0x40380c
push str.____Couldnt_send_the_altered_type2_to_the_rpc_client__the_privileged_auth__n
call fcn.00401050
add esp, 4
jmp 0x4038a0
push 0
push 0x2000
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x403835
push str.____Couldnt_receive_the_type3_auth_from_the_rpc_client_n
call fcn.00401050
add esp, 4
jmp 0x4038a0
xor ecx, ecx
mov dword [esp + 0x30], 0x4d4c544e
xor edx, edx
mov word [esp + 0x34], 0x5353
mov byte [esp + 0x36], 0x50
test esi, esi
jle 0x40386d
mov al, byte [esp + edx + 0x68]
cmp al, byte [esp + ecx + 0x30]
jne 0x403866
inc ecx
cmp ecx, 7
jne 0x403868
add edx, 0xfffffffa
jmp 0x403870
xor ecx, ecx
inc edx
cmp edx, esi
jl 0x403851
or edx, 0xffffffff
movsx eax, word [esp + 0x72]
push eax
lea eax, [esp + 0x6c]
add eax, edx
push eax
lea eax, [esp + 0x2070]
push eax
call fcn.004064f0
add esp, 0xc
lea edx, [esp + 0x2068]
lea ecx, [esp + 0x4068]
call fcn.004038d0
push dword [esp + 0x10]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [esp + 0x14]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0xc06c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403ad0
mov esp, ebp
pop ebp
ret