Function at 0x1400d7420
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov rdi, rcx
xor r12d, r12d
cmp r12, qword [rcx + 0x30]
jo 0x1400d7471
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400d7471
mov rcx, qword [rdi + 0x38]
xor r12d, r12d
lea rdx, [0x1401a53c0]
xor r8d, r8d
nop
movzx r9d, byte [rcx + r8]
or r12d, dword [rdx + r9*4]
inc r8
cmp rax, r8
jne 0x1400d7460
xorps xmm6, xmm6
movups xmmword [rsp + 0xe0], xmm6
movups xmmword [rsp + 0xd0], xmm6
movups xmmword [rsp + 0xc0], xmm6
movups xmmword [rsp + 0xb0], xmm6
mov dword [rsp + 0xa0], 4
mov dword [rsp + 0xe8], 0x400010
mov dword [rsp + 0xd8], r12d
mov r15, qword [rdi + 0x10]
test r15, r15
je 0x1400d74f4
mov r14, qword [rdi + 8]
lea rbx, [r15*8]
movzx eax, byte [0x1401b2168]
xor ecx, ecx
mov rdx, rbx
call fcn.1400ff580
test rax, rax
je 0x1400d770a
mov rsi, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x1400d74f9
mov esi, 8
movabs rax, 0x8000000000000000
mov dword [rsp + 0xa4], r15d
mov qword [rsp + 0xa8], rsi
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
mov qword [rsp + 0x110], 0
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x90], 0
cmp qword [rdi + 0x18], rax
jne 0x1400d761a
lea rcx, str.ntdll.dll
call sub.kernel32.dll_GetModuleHandleW
test rax, rax
je 0x1400d7630
lea rdx, str.RtlGetVersion
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x1400d7630
mov rdi, rax
lea rcx, [rsp + 0x124]
mov r8d, 0x110
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x120], 0x114
lea rcx, [rsp + 0x120]
call rdi
cmp dword [rsp + 0x124], 0xa
ja 0x1400d75cf
jne 0x1400d7630
cmp dword [rsp + 0x12c], 0x4562
jbe 0x1400d7630
test r12d, r12d
je 0x1400d75df
not r12d
mov dword [rsp + 0x100], r12d
mov dword [rsp + 0x50], 5
movabs rax, 0x100400010
mov qword [rsp + 0x84], rax
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
jmp 0x1400d7632
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0xc8], eax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0xd0], rax
xor eax, eax
test rax, rax
lea rcx, [rsp + 0xa0]
cmovne rcx, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x120], xmm0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x1400d76cb
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov ebx, 1
test r15, r15
je 0x1400d76ac
mov rcx, qword [0x1401b2100]
xor edx, edx
mov r8, rsi
call fcn.14011d4ec
mov rax, rbx
mov rdx, rdi
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movaps xmm6, xmmword [rsp + 0x120]
movzx eax, byte [0x1401b2168]
mov edx, 0x20
xor ecx, ecx
call fcn.1400ff580
test rax, rax
je 0x1400d7717
mov rdi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
movups xmmword [rax + 0x10], xmm6
xor ebx, ebx
test r15, r15
jne 0x1400d769b
jmp 0x1400d76ac
mov ecx, 8
mov rdx, rbx
call fcn.140017699
mov ecx, 8
mov edx, 0x20
call fcn.140017699
int3