Function at 0x140006ac0
Capabilities:
Get inbound credentials handle via credssp

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x880
mov rax, qword [0x14006a008]
xor rax, rsp
mov qword [rsp + 0x870], rax
xor r13d, r13d
movsxd r15, r8d
mov dword [rsp + 0x50], 0x4d4c544e
mov rbp, rdx
mov word [rsp + 0x54], 0x5353
mov r12, rcx
mov byte [rsp + 0x56], 0x50
mov esi, r13d
mov edi, r13d
test r8d, r8d
jle 0x140006bbf
mov ebx, r13d
nop dword [rax + rax]
movzx eax, byte [rsp + rbx + 0x50]
cmp byte [rdi + rbp], al
jne 0x140006bef
lea rdx, str.get_header
lea rcx, [0x14006d010]
call fcn.1400053d0
mov rcx, rax
call fcn.1400059f0
inc rbx
cmp rbx, 7
jne 0x140006bf2
lea r14d, [rsi - 6]
cmp r14d, 0xffffffff
je 0x140006bbf
movsxd rax, esi
lea rdx, str.PotatoAPI::processNtlmBytes
lea rcx, [0x14006d010]
movsx ebx, byte [rax + rbp + 2]
call fcn.140005680
mov rcx, rax
mov edx, ebx
call fcn.140002c30
mov rcx, rax
call fcn.1400059f0
sub ebx, 1
je 0x140006cbe
sub ebx, 1
je 0x140006ca1
cmp ebx, 1
je 0x140006c02
lea rdx, str.Error___Unknown_NTLM_message_type...
lea rcx, [0x14006d010]
call fcn.1400053d0
mov rcx, rax
call fcn.1400059f0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140008660
mov rbx, qword [rsp + 0x8d8]
add rsp, 0x880
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbx, r13
inc esi
inc rdi
cmp rdi, r15
jl 0x140006b20
jmp 0x140006bbf
mov rbx, qword [r12 + 0x10]
sub r15d, r14d
mov dword [rbx + 0x44], 2
mov qword [rbx + 0x48], r13
mov dword [rbx + 0x20], r13d
mov dword [rbx + 0x24], 1
lea r9, [rbx + 0x30]
lea rcx, [rbx + 0x40]
mov qword [rbx + 0x28], rcx
lea rax, [rbx + 0x50]
mov dword [rax + 4], 2
lea r8, [rbx + 0x20]
mov dword [rax], r13d
mov qword [rax + 8], r13
mov qword [r9 + 8], rax
mov dword [r9], r13d
mov dword [r9 + 4], 1
mov rdx, qword [rbx]
mov dword [rcx], r15d
lea rcx, [rbx + 0x10]
movsxd rax, r14d
add rax, rbp
mov qword [rbx + 0x48], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r9
mov r9d, 0x900
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbx + 8], eax
xor eax, eax
jmp 0x140006bc4
mov rcx, qword [r12 + 0x10]
sub r15d, r14d
movsxd rdx, r14d
mov r8d, r15d
add rdx, rbp
call fcn.140002720
xor eax, eax
jmp 0x140006bc4
movups xmm0, xmmword [str.Negotiate]
mov eax, dword [0x14005d948]
lea rcx, [rsp + 0x84]
mov r12, qword [r12 + 0x10]
xor edx, edx
mov r8d, 0x7ec
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x80], eax
call fcn.14000dcf0
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea r13, [r12 + 0x10]
xor eax, eax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [rax + 1]
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
je 0x140006d50
lea rdx, str.Error_in_AquireCredentialsHandle
lea rcx, [0x14006d010]
call fcn.1400053d0
mov rcx, rax
call fcn.1400059f0
xor eax, eax
jmp 0x140006bc4
mov dword [r12 + 0x44], 2
lea rax, [r12 + 0x50]
xor ecx, ecx
lea rdi, [r12 + 0x40]
mov dword [rdi], ecx
lea rbx, [r12 + 0x30]
mov qword [rdi + 8], rcx
mov dword [r12 + 0x20], ecx
mov dword [r12 + 0x24], 1
mov qword [r12 + 0x28], rdi
mov dword [rax], ecx
mov qword [rax + 8], rcx
mov dword [rax + 4], 2
mov dword [rbx], ecx
mov ecx, reloc.WS2_32.dll_recv
mov dword [rbx + 4], 1
mov qword [rbx + 8], rax
call fcn.140008954
xor ecx, ecx
movsxd rdx, r14d
add rdx, rbp
lea r8, [r12 + 0x20]
sub r15d, r14d
mov r9d, 0x900
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r13
mov qword [rsp + 0x30], rbx
mov qword [r12 + 0x48], rdx
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov qword [r12], rax
mov dword [rdi], r15d
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
xor eax, eax
jmp 0x140006bc4