Function at 0x40cd90
Capabilities:
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
mov eax, 0x432c
call fcn.00418c00
push ebx
push ebp
mov ebp, dword [esp + 0x4338]
push esi
push edi
mov ecx, 0x80
lea edx, [ebp + 0x24]
xor eax, eax
mov edi, edx
mov byte [ebp + 8], 0x73
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
xor esi, esi
push eax
push 8
mov word [ebp + 0xe], 0xc807
mov dword [ebp + 0x39], 0x800000d4
mov byte [edx], 0xc
mov word [ebp + 0x25], 0xff
mov word [ebp + 0x27], 0xb0
mov word [ebp + 0x29], 0x4104
mov word [ebp + 0x2b], 0x32
mov word [ebp + 0x2d], si
mov dword [ebp + 0x2f], esi
mov dword [ebp + 0x35], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40ce4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], 0
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x58]
push str.OpenProcessToken_err__errcode_d
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x60]
push edx
call fcn.0040b9a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x432c
ret
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x50]
push eax
push 0x38
push 0x422498
push 0xa
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x40cebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], 0
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea eax, [esp + 0x58]
push str.OpenProcessToken_err__errcode_d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x60]
push ecx
call fcn.0040b9a0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x432c
ret
mov edx, dword [esp + 0x4344]
xor ecx, ecx
xor eax, eax
cmp word [edx], si
je 0x40ced7
add ecx, 2
inc eax
add edx, 2
cmp eax, 0x30
jl 0x40cec6
mov edi, dword [esp + 0x4348]
xor edx, edx
xor eax, eax
cmp word [edi], si
je 0x40cef3
add edx, 2
inc eax
add edi, 2
cmp eax, 0x30
jl 0x40cee2
mov edi, dword [esp + 0x434c]
xor ebx, ebx
xor eax, eax
cmp word [edi], si
je 0x40cf0f
add ebx, 2
inc eax
add edi, 2
cmp eax, 0x30
jl 0x40cefe
lea eax, [esp + 0xf0]
mov dword [esp + 0xd4], eax
mov eax, ecx
shr eax, 1
cmp edx, esi
mov dword [esp + 0xd8], eax
jbe 0x40cf4b
mov esi, edx
lea eax, [esp + ecx + 0xf2]
shr esi, 1
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], esi
lea eax, [eax + edx + 2]
jmp 0x40cf60
mov dword [esp + 0xdc], esi
mov dword [esp + 0xe0], esi
lea eax, [esp + ecx + 0xf2]
mov dword [esp + 0xe4], eax
mov esi, dword [esp + 0x4344]
mov eax, ebx
lea edi, [esp + 0xf0]
shr eax, 1
mov dword [esp + 0xe8], eax
mov eax, ecx
shr ecx, 2
mov dword [esp + 0xec], 6
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
jbe 0x40cfb9
mov esi, dword [esp + 0x4348]
mov edi, dword [esp + 0xdc]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x434c]
mov edi, dword [esp + 0xe4]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x4344]
cmp word [ecx], 0
jne 0x40cff6
lea edx, [esp + 0x20]
push edx
push 0x422480
push 0
push 0
push 0
jmp 0x40d00c
lea eax, [esp + 0x20]
lea ecx, [esp + 0xd4]
push eax
push 0x422480
push 0
push 0
push ecx
push 0x4224a0
push 2
push str.Negotiate
push 0
call sub.Secur32.dll_AcquireCredentialsHandleW
mov dword [0x422490], eax
lea edx, [esp + 0x28]
mov eax, 2
mov dword [esp + 0x3c], edx
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ecx
lea eax, [esp + 0x2f0]
mov dword [esp + 0x48], edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x4c]
push ecx
lea eax, [esp + 0x44]
push edx
xor esi, esi
push eax
push 0x4224d0
lea ecx, [esp + 0x44]
push esi
push ecx
push 0x10
push esi
push 0x210003
push str.HOST_192.168.20.181
mov ebx, 1
push esi
push 0x422480
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x44], 0x404c
call sub.Secur32.dll_InitializeSecurityContextW
mov edx, dword [esp + 0x10]
mov dword [0x422490], eax
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x422490]
cmp eax, esi
je 0x40d128
cmp eax, 0x90312
je 0x40d128
cmp eax, 0x90313
je 0x40d128
cmp eax, 0x90314
je 0x40d128
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x55]
mov byte [esp + 0x54], 0
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x422490]
lea ecx, [esp + 0x58]
push eax
push str.InitializeSecurityContextW_return:_x__errorcode:_d
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [esp + 0x64]
push edx
call fcn.0040b9a0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x432c
ret
mov eax, dword [esp + 0x14]
lea esi, [esp + 0x2f0]
mov ecx, eax
lea edi, [ebp + 0x3f]
mov edx, ecx
mov word [ebp + 0x33], ax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [eax + ebp + 0x40]
mov ecx, 9
mov esi, str.windows_2000_2195
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, 8
mov esi, str.windows_2000_5.0
lea edi, [eax + ebp + 0x66]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
lea ecx, [eax + 0x49]
add eax, 0x84
push eax
mov word [ebp + 0x3d], cx
call dword [sym.imp.WS2_32.dll_htons]
pop edi
mov word [ebp + 2], ax
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x432c
ret