Function at 0x409de9
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x40
xor ebx, ebx
push edi
mov byte [ebp - 1], bl
call fcn.00403e69
lea ecx, [ebp - 0x38]
push ecx
lea eax, [edi + 4]
push eax
push ebx
push ebx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x94]
push eax
push ebx
push 2
pop esi
push esi
push 0x401b90
push ebx
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], 0x80
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], 0xfffffffe
mov dword [ebp - 0x64], 0x181c
mov dword [ebp - 0x60], ebx
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
jne 0x40a0cd
push ebx
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x30]
push ecx
mov dword [ebp - 0x28], eax
lea eax, [edi + 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x8c11c
push 0x401bec
push ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
call dword [sym.imp.Secur32.dll_InitializeSecurityContextW]
cmp eax, 0x90312
jne 0x40a0a4
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00405573
test al, al
je 0x40a0a8
lea esi, [ebp - 0x1c]
call fcn.00409dcb
mov eax, 0x10000
call fcn.00403db0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
cmp eax, ebx
je 0x40a0a8
mov dword [ebp - 8], 0x90312
cmp dword [ebp - 8], 0x90312
mov esi, 0x80090318
je 0x409f1b
cmp dword [ebp - 8], esi
jne 0x40a062
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x409f27
cmp dword [ebp - 8], esi
jne 0x409f55
mov edi, dword [ebp + 8]
push ebx
mov ecx, 0x10000
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x10]
add eax, ecx
push eax
call fcn.0040549f
cmp eax, ebx
je 0x40a05f
cmp eax, 0xffffffff
je 0x40a05f
add dword [ebp - 0xc], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push 2
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], eax
pop eax
push ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x8c11c
push 0x401bec
push dword [ebp - 0x34]
lea ecx, [ebp - 0x50]
push dword [ebp - 0x24]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.Secur32.dll_InitializeSecurityContextW]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x409f04
cmp eax, ebx
je 0x409fea
cmp eax, 0x90312
je 0x409fea
cmp eax, ebx
jge 0x409f04
test dword [ebp - 0x20], 0x4000
je 0x409f04
cmp dword [ebp - 0x1c], ebx
je 0x40a00e
cmp dword [ebp - 0x14], ebx
je 0x40a00e
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00405573
test al, al
je 0x40a062
lea esi, [ebp - 0x1c]
call fcn.00409dcb
cmp dword [ebp - 0x40], 5
jne 0x40a04a
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x44]
push dword [ebp - 0x44]
add eax, dword [ebp - 0x10]
push eax
cmp dword [ebp - 8], ebx
jne 0x40a03a
call fcn.00403e1b
mov dword [edi + 0x28], eax
cmp eax, ebx
je 0x40a062
mov eax, dword [ebp - 0x44]
mov dword [edi + 0x2c], eax
jmp 0x40a056
push dword [ebp - 0x10]
call fcn.00403e04
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
jmp 0x40a04d
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 8], ebx
jne 0x409f04
mov byte [ebp - 1], 1
jmp 0x409f04
mov edi, dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00403dc8
cmp byte [ebp - 1], bl
je 0x40a0a8
lea esi, [edi + 0x14]
push esi
push 4
push dword [ebp - 0x34]
call dword [sym.imp.Secur32.dll_QueryContextAttributesW]
test eax, eax
jne 0x40a0a8
mov eax, dword [edi + 0x1c]
add eax, dword [edi + 0x18]
mov ecx, dword [esi]
add eax, ecx
mov dword [edi + 0x34], eax
call fcn.00403db0
mov dword [edi + 0x30], eax
cmp eax, ebx
je 0x40a0a8
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov al, 1
jmp 0x40a0cf
cmp eax, ebx
jl 0x40a0c4
push dword [edi + 0x28]
call fcn.00403dc8
lea esi, [ebp - 0x1c]
mov dword [edi + 0x28], ebx
call fcn.00409dcb
push dword [ebp - 0x34]
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
push dword [ebp - 0x24]
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8