Function at 0x140016546
Capabilities:
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
jmp 0x140021b40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x488
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4a8]
mov rax, qword [0x140074400]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14007dbd0]
call fcn.140016b68
nop
mov qword [rbp + 0x288], 0
mov rax, qword [rbp + 0x440]
mov qword [rax], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov edx, InitCommonControls
lea rcx, [rbp + 0x138]
call fcn.140016825
nop
mov edx, InitCommonControls
lea rcx, [rbp + 0x168]
call fcn.140016825
nop
mov edx, InitCommonControls
lea rcx, [rbp + 0x198]
call fcn.140016825
nop
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, str.NTLM
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021c6e
jmp 0x140021f78
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
lea rdx, str.NTLM
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021cca
jmp 0x140021f78
mov dword [rbp + 0xa8], 0
mov dword [rbp + 0xac], 1
lea rax, [rbp + 0x138]
mov qword [rbp + 0xb0], rax
mov dword [rbp + 0x138], 0x2ee0
mov dword [rbp + 0x13c], 2
mov ecx, 0x2ee0
call fcn.140016695
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x224]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], InitCommonControls
mov dword [rsp + 0x20], 0
mov r9d, 0x400
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021d88
jmp 0x140021f78
mov dword [rbp + 0xd8], 0
mov dword [rbp + 0xdc], 1
lea rax, [rbp + 0x168]
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0x168], 0x2ee0
mov dword [rbp + 0x16c], 2
mov ecx, 0x2ee0
call fcn.140016695
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x244]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], InitCommonControls
mov r9d, 0x400
lea r8, [rbp + 0xa8]
xor edx, edx
lea rcx, [rbp + 0x38]
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021e34
jmp 0x140021f78
mov dword [rbp + 0x108], 0
mov dword [rbp + 0x10c], 1
lea rax, [rbp + 0x198]
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x198], 0x2ee0
mov dword [rbp + 0x19c], 2
mov ecx, 0x2ee0
call fcn.140016695
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x224]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], InitCommonControls
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021ef5
jmp 0x140021f78
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x244]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], InitCommonControls
xor r9d, r9d
lea r8, [rbp + 0x108]
lea rdx, [rbp + 0x1f8]
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jge 0x140021f54
jmp 0x140021f78
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Secur32.dll_QuerySecurityContextToken]
mov dword [rbp + 0x264], eax
xor eax, eax
test eax, eax
jne 0x140021c15
cmp qword [rbp + 0x140], 0
je 0x140021f8f
mov rcx, qword [rbp + 0x140]
call fcn.140016c21
nop
cmp qword [rbp + 0x170], 0
je 0x140021fa6
mov rcx, qword [rbp + 0x170]
call fcn.140016c21
nop
cmp qword [rbp + 0x1a0], 0
je 0x140021fbd
mov rcx, qword [rbp + 0x1a0]
call fcn.140016c21
nop
lea rcx, [rbp + 8]
call qword [sym.imp.Secur32.dll_FreeCredentialsHandle]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.Secur32.dll_FreeCredentialsHandle]
nop
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.Secur32.dll_DeleteSecurityContext]
nop
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.Secur32.dll_DeleteSecurityContext]
nop
mov rax, qword [rbp + 0x440]
mov rcx, qword [rbp + 0x288]
mov qword [rax], rcx
mov eax, dword [rbp + 0x264]
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x14004bc10]
call fcn.1400169a6
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400165b9
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret