Function at 0x140001420
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x368
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov word [rsp + 0xd6], r8w
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xc0], rcx
mov ecx, 0x202
lea rdx, [rsp + 0x1c8]
call qword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0
je 0x140001480
mov dword [rsp + 0xd8], 0xffffffff
jmp 0x140001b85
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rax
mov rax, qword [rsp + 0xc0]
mov qword [rax], rcx
mov rax, qword [rsp + 0xc0]
cmp qword [rax], 0xffffffffffffffff
jne 0x1400014c9
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0xd8], 0xffffffff
jmp 0x140001b85
movzx r9d, word [rsp + 0xd6]
lea rcx, [rsp + 0x180]
lea r8, [0x14001c412]
mov rax, qword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov edx, 0x40
call rax
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
xor eax, eax
mov r9d, eax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
call sub.WS2_32.dll_WSAConnectByNameA
cmp eax, 0
jne 0x140001571
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0xd8], 0xffffffff
jmp 0x140001b85
mov dword [rsp + 0x100], 4
mov dword [rsp + 0x148], 0x400030
mov dword [rsp + 0x138], 0xc00
mov rax, qword [rsp + 0xc0]
add rax, 8
xor ecx, ecx
mov r9d, ecx
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
mov r8d, 2
lea r10, [rsp + 0x100]
mov rcx, r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
call sub.Secur32.dll_AcquireCredentialsHandleA
cmp eax, 0
je 0x140001615
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0xd8], 0xffffffff
jmp 0x140001b85
mov rax, qword [rsp + 0xc0]
mov dword [rax + 0x44], 0
mov rax, qword [rsp + 0xc0]
mov dword [rax + 0x40], 0
mov rax, qword [rsp + 0xc0]
mov dword [rax + 0x3c], 0
mov rax, qword [rsp + 0xc0]
mov qword [rax + 0x48], 0
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xb4], 0
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8d, 0x20
call fcn.14001a520
mov dword [rsp + 0x164], 2
mov rax, qword [rsp + 0xc0]
add rax, 0x50
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x160], eax
mov dword [rsp + 0x174], 0
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, reloc.WS2_32.dll_recv
call fcn.14001a520
mov dword [rsp + 0x154], 2
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0xf4], 2
lea rax, [rsp + 0x160]
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0xe4], 1
lea rax, [rsp + 0x150]
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0xdc], 0x8819c
cmp qword [rsp + 0xb8], 0
je 0x14000174f
xor eax, eax
mov qword [rsp + 0x90], rax
jmp 0x140001763
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0xb8], 0
je 0x140001797
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x80], rax
jmp 0x1400017a6
xor eax, eax
mov qword [rsp + 0x80], rax
jmp 0x1400017a6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0x7c], eax
cmp qword [rsp + 0xb8], 0
je 0x1400017d9
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x1400017e6
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x68], rax
mov r11, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x7c]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
add rcx, 8
xor eax, eax
lea r10, [rsp + 0xe0]
lea rax, [rsp + 0xdc]
xor edi, edi
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
call sub.Secur32.dll_InitializeSecurityContextA
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0xb8], rax
cmp dword [rsp + 0x174], 5
jne 0x1400018dd
mov rcx, qword [rsp + 0xc0]
add rcx, 0x50
mov rdx, qword [rsp + 0xc0]
add rdx, 0x50
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x3c]
sub eax, dword [rsp + 0x170]
mov eax, eax
add rdx, rax
mov eax, dword [rsp + 0x170]
mov r8d, eax
call fcn.14001a8e0
mov ecx, dword [rsp + 0x170]
mov rax, qword [rsp + 0xc0]
mov dword [rax + 0x3c], ecx
jmp 0x1400018ec
mov rax, qword [rsp + 0xc0]
mov dword [rax + 0x3c], 0
cmp dword [rsp + 0xb0], 0
jne 0x1400018ff
jmp 0x140001b04
cmp dword [rsp + 0xb0], 0x90320
jne 0x140001920
mov dword [rsp + 0xb4], 0xffffffff
jmp 0x140001b04
cmp dword [rsp + 0xb0], 0x90312
jne 0x140001a04
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0
je 0x1400019d4
mov r8d, dword [rsp + 0xa4]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0
jg 0x14000199b
jmp 0x1400019d4
mov ecx, dword [rsp + 0xa0]
mov eax, dword [rsp + 0xa4]
sub eax, ecx
mov dword [rsp + 0xa4], eax
mov ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
movsxd rcx, ecx
add rax, rcx
mov qword [rsp + 0xa8], rax
jmp 0x14000194f
mov rcx, qword [rsp + 0x158]
call sub.Secur32.dll_FreeContextBuffer
cmp dword [rsp + 0xa4], 0
je 0x1400019ff
mov dword [rsp + 0xb4], 0xffffffff
jmp 0x140001b04
jmp 0x140001a2a
cmp dword [rsp + 0xb0], 0x80090318
je 0x140001a25
mov dword [rsp + 0xb4], 0xffffffff
jmp 0x140001b04
jmp 0x140001a2a
jmp 0x140001a2f
jmp 0x140001a34
mov rax, qword [rsp + 0xc0]
movsxd rax, dword [rax + 0x3c]
cmp rax, 0x4200
jne 0x140001a5c
mov dword [rsp + 0xb4], 0xffffffff
jmp 0x140001b04
mov rax, qword [rsp + 0xc0]
movsxd rcx, dword [rax + 0x3c]
mov eax, 0x4200
sub rax, rcx
mov r8d, eax
mov rdx, qword [rsp + 0xc0]
add rdx, 0x50
mov rax, qword [rsp + 0xc0]
movsxd rax, dword [rax + 0x3c]
add rdx, rax
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0
jne 0x140001ac7
mov dword [rsp + 0xd8], 0
jmp 0x140001b85
cmp dword [rsp + 0x9c], 0
jge 0x140001ae5
mov dword [rsp + 0xb4], 0xffffffff
jmp 0x140001b04
jmp 0x140001aea
mov ecx, dword [rsp + 0x9c]
mov rax, qword [rsp + 0xc0]
add ecx, dword [rax + 0x3c]
mov dword [rax + 0x3c], ecx
jmp 0x140001669
cmp dword [rsp + 0xb4], 0
je 0x140001b5c
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.Secur32.dll_DeleteSecurityContext]
mov rcx, qword [rsp + 0xc0]
add rcx, 8
call qword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0xd8], eax
jmp 0x140001b85
mov r8, qword [rsp + 0xc0]
add r8, 0x28
mov rcx, qword [rsp + 0xb8]
mov edx, 4
call sub.Secur32.dll_QueryContextAttributesA
mov dword [rsp + 0xd8], 0
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1400026e0
mov eax, dword [rsp + 0x64]
add rsp, 0x368
pop rdi
pop rsi
ret