Function at 0x1400110af
Capabilities:
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp
Terminate process

Disassembly:
jmp 0x140013740
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x140027169]
call fcn.140011410
nop
mov qword [rbp + 0x288], 0xffffffffffffffff
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, str.NTLM
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x1400137e9
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
lea rdx, str.NTLM
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x14001384c
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0xa8], 0
mov dword [rbp + 0xac], 1
lea rax, [rbp + 0x138]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x138], 0x2ee0
mov dword [rbp + 0x13c], 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x2ee0
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x224]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
mov r9d, 0x400
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140013921
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0xd8], 0
mov dword [rbp + 0xdc], 1
lea rax, [rbp + 0x168]
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0x168], 0x2ee0
mov dword [rbp + 0x16c], 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x2ee0
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x244]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 0x400
lea r8, [rbp + 0xa8]
xor edx, edx
lea rcx, [rbp + 0x38]
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x1400139e4
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov dword [rbp + 0x108], 0
mov dword [rbp + 0x10c], 1
lea rax, [rbp + 0x198]
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x198], 0x2ee0
mov dword [rbp + 0x19c], 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x2ee0
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x224]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140013abc
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x244]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x1f8]
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140013b25
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Secur32.dll_QuerySecurityContextToken]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x140]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x170]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x1a0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Secur32.dll_FreeCredentialsHandle]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.Secur32.dll_FreeCredentialsHandle]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Secur32.dll_DeleteSecurityContext]
nop
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Secur32.dll_DeleteSecurityContext]
nop
mov rax, qword [rbp + 0x288]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001dc20]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001120d
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret