Function at 0x4ef130
Capabilities:
Get inbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x890
mov eax, dword [0x82aea4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x400
push ebx
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x834], eax
mov eax, dword [0x867ff8]
push esi
push edi
xor esi, esi
and eax, 0xffff0000
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], esi
cmp eax, 0x30000
jae 0x4ef1bc
push edi
push str.pg_SSPI_recvauth
push 0x4ec
push str.src_backendlibpq_auth.c
push 0x15
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef1bc
push str.SSPI_is_not_supported_in_protocol_version_2
call sym.postgres.exe_errmsg
add esp, 4
push eax
push 0x440
call sym.postgres.exe_errcode
add esp, 4
push eax
call sym.postgres.exe_errfinish
add esp, 8
lea ecx, [ebp - 0x890]
push ecx
lea edx, [ebp - 0x82c]
push edx
push edi
push edi
push edi
push edi
push 1
push str.negotiate
push edi
call sub.Secur32.dll_AcquireCredentialsHandleA
mov dword [ebp - 0x808], eax
cmp eax, edi
je 0x4ef212
push str.could_not_acquire_SSPI_credentials
call sub.libintl.dll_libintl_gettext
mov esi, dword [ebp - 0x808]
add esp, 4
mov edi, eax
mov ebx, 0x14
call fcn.004ef070
mov esi, dword [ebp - 0x80c]
mov ebx, dword [ebp - 0x810]
xor edi, edi
call sym.postgres.exe_pq_getbyte
mov dword [ebp - 0x808], eax
cmp eax, 0x70
jne 0x4ef517
lea eax, [ebp - 0x844]
push eax
call sym.postgres.exe_initStringInfo
lea ecx, [ebp - 0x844]
push 0xffff
push ecx
call sym.postgres.exe_pq_getmessage
add esp, 0xc
test eax, eax
jne 0x4ef579
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x85c], eax
mov eax, 2
lea edx, [ebp - 0x864]
push str.pg_SSPI_recvauth
mov ecx, 1
mov dword [ebp - 0x868], edx
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x858]
push 0x52b
push str.src_backendlibpq_auth.c
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x86c], ecx
mov dword [ebp - 0x864], edx
mov dword [ebp - 0x850], edi
mov dword [ebp - 0x858], edi
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x820], edi
call sym.postgres.exe_elog_start
mov ecx, dword [ebp - 0x840]
push ecx
push str.Processing_received_SSPI_token_of_length__u
push 0xb
call sym.postgres.exe_elog_finish
add esp, 0x18
push edi
lea edx, [ebp - 0x884]
push edx
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x84c]
push ecx
push edi
push pe_nt_image_headers32
lea edx, [ebp - 0x870]
push edx
push esi
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov ecx, dword [ebp - 0x844]
mov edi, eax
push ecx
mov dword [ebp - 0x808], edi
call sym.postgres.exe_pfree
add esp, 4
cmp dword [ebp - 0x81c], 0
jbe 0x4ef427
mov edx, dword [ebp - 0x818]
cmp dword [edx], 0
jbe 0x4ef427
push str.pg_SSPI_recvauth
push 0x540
push str.src_backendlibpq_auth.c
call sym.postgres.exe_elog_start
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax]
push ecx
push str.sending_SSPI_response_token_of_length__u
push 0xb
call sym.postgres.exe_elog_finish
mov eax, dword [ebp - 0x818]
mov ecx, dword [eax]
mov edx, dword [ebx + 0x170]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x818]
mov edx, dword [ebx + 0x170]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
lea edx, [ebp - 0x880]
push 0x52
push edx
call sym.postgres.exe_pq_beginmessage
push 4
lea eax, [ebp - 0x880]
push 8
push eax
call sym.postgres.exe_pq_sendint
mov ecx, dword [ebx + 0x170]
add esp, 0x2c
cmp dword [ecx + 4], 0
jle 0x4ef404
push str.sendAuthRequest
push 0x266
push str.src_backendlibpq_auth.c
call sym.postgres.exe_elog_start
mov edx, dword [ebx + 0x170]
mov eax, dword [edx + 4]
push eax
push str.sending_GSS_token_of_length__u
push 0xb
call sym.postgres.exe_elog_finish
mov eax, dword [ebx + 0x170]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp - 0x880]
push eax
call sym.postgres.exe_pq_sendbytes
add esp, 0x24
lea ecx, [ebp - 0x880]
push ecx
call sym.postgres.exe_pq_endmessage
add esp, 4
call sym.postgres.exe_pq_flush
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 8]
push eax
call sub.Secur32.dll_FreeContextBuffer
test edi, edi
je 0x4ef482
cmp edi, 0x90312
je 0x4ef482
test esi, esi
je 0x4ef448
push esi
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
push esi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
lea ecx, [ebp - 0x82c]
push ecx
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
push str.could_not_accept_SSPI_security_context
call sub.libintl.dll_libintl_gettext
mov esi, edi
add esp, 4
mov edi, eax
mov ebx, 0x14
call fcn.004ef070
mov esi, dword [ebp - 0x80c]
mov edi, dword [ebp - 0x808]
mov ebx, dword [ebp - 0x810]
test esi, esi
jne 0x4ef4d2
push 8
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov dword [ebp - 0x80c], eax
test eax, eax
jne 0x4ef4cc
push eax
push str.pg_SSPI_recvauth
push 0x562
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef4cc
push str.out_of_memory
call sym.postgres.exe_errmsg
push eax
call sym.postgres.exe_errfinish
add esp, 8
mov esi, dword [ebp - 0x80c]
mov edx, dword [ebp - 0x84c]
mov dword [esi], edx
mov eax, dword [ebp - 0x848]
mov dword [esi + 4], eax
cmp edi, 0x90312
jne 0x4ef59c
push str.pg_SSPI_recvauth
push 0x568
push str.src_backendlibpq_auth.c
call sym.postgres.exe_elog_start
push str.SSPI_continue_needed
push 0xb
call sym.postgres.exe_elog_finish
add esp, 0x14
jmp 0x4ef210
cmp eax, 0xffffffff
je 0x4ef565
push edi
push str.pg_SSPI_recvauth
push 0x50d
push str.src_backendlibpq_auth.c
push 0x10
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef565
mov ecx, dword [ebp - 0x808]
push ecx
push str.expected_SSPI_response__got_message_type__d
call sym.postgres.exe_errmsg
add esp, 8
push eax
push 0x1020200
call sym.postgres.exe_errcode
add esp, 4
push eax
call sym.postgres.exe_errfinish
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x844]
push edx
call sym.postgres.exe_pfree
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x82c]
push eax
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
push str.SECUR32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x808], edi
test edi, edi
jne 0x4ef5f8
push eax
push str.pg_SSPI_recvauth
push 0x581
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_load_secur32.dll:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
push str.QuerySecurityContextToken
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x4ef649
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push str.pg_SSPI_recvauth
push 0x58a
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef649
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_locate_QuerySecurityContextToken_in_secur32.dll:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
lea ecx, [ebp - 0x824]
push ecx
push esi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4ef687
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.could_not_get_token_from_SSPI_security_context
call sub.libintl.dll_libintl_gettext
mov esi, ebx
add esp, 4
mov edi, eax
mov ebx, 0x14
call fcn.004ef070
mov edi, dword [ebp - 0x808]
mov esi, dword [ebp - 0x80c]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
mov ebx, dword [sym.imp.MSVCR100.dll_free]
push esi
call ebx
mov eax, dword [ebp - 0x824]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
add esp, 4
lea edx, [ebp - 0x814]
push edx
push 0
push 0
push 1
push eax
call edi
test eax, eax
jne 0x4ef703
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
je 0x4ef703
push 0
push str.pg_SSPI_recvauth
push 0x5a1
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef703
call esi
push eax
push str.could_not_get_token_user_size:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ef74a
push eax
push str.pg_SSPI_recvauth
push 0x5a6
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef74a
push str.out_of_memory
call sym.postgres.exe_errmsg
push eax
call sym.postgres.exe_errfinish
add esp, 8
mov eax, dword [ebp - 0x814]
mov ecx, dword [ebp - 0x824]
lea edx, [ebp - 0x814]
push edx
push eax
push esi
push 1
push ecx
call edi
test eax, eax
jne 0x4ef7a0
push eax
push str.pg_SSPI_recvauth
push 0x5ab
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef7a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_get_user_token:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
lea edx, [ebp - 0x888]
push edx
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x404]
push ecx
mov ecx, dword [esi]
lea edx, [ebp - 0x830]
push edx
lea eax, [ebp - 0x804]
push eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x4ef80a
push eax
push str.pg_SSPI_recvauth
push 0x5b1
push str.src_backendlibpq_auth.c
push 0x14
call sym.postgres.exe_errstart
add esp, 0x14
test al, al
je 0x4ef80a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.could_not_look_up_account_SID:_error_code__lu
call sym.postgres.exe_errmsg_internal
push eax
call sym.postgres.exe_errfinish
add esp, 0xc
push esi
call ebx
mov edi, dword [ebp - 0x810]
mov edx, dword [edi + 0x144]
mov edx, dword [edx + 0x150]
add esp, 4
test edx, edx
je 0x4ef89a
mov eax, edx
lea esi, [eax + 1]
jmp 0x4ef830
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ef830
sub eax, esi
je 0x4ef89a
lea eax, [ebp - 0x404]
push eax
push edx
call sym.postgres.exe_pg_strcasecmp
add esp, 8
test eax, eax
je 0x4ef89a
push str.pg_SSPI_recvauth
push 0x5bd
push str.src_backendlibpq_auth.c
call sym.postgres.exe_elog_start
mov ecx, dword [edi + 0x144]
mov edx, dword [ecx + 0x150]
push edx
lea eax, [ebp - 0x404]
push eax
push str.SSPI_domain___s__and_configured_domain___s__dont_match
push 0xd
call sym.postgres.exe_elog_finish
add esp, 0x1c
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x144]
cmp byte [eax + 0x154], 0
je 0x4ef93f
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ef8b6
sub eax, edx
mov edx, eax
lea eax, [ebp - 0x404]
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ef8d0
sub eax, esi
lea ecx, [eax + edx + 2]
mov edx, dword [sym.postgres.exe_CurrentMemoryContext]
push ecx
push edx
call sym.postgres.exe_MemoryContextAlloc
mov esi, eax
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
push 0x6cfeb0
push esi
call sym.postgres.exe_pg_sprintf
mov edx, dword [edi + 0x138]
mov eax, dword [edi + 0x144]
mov ecx, dword [eax + 0x11c]
push 1
push esi
push edx
push ecx
call sym.postgres.exe_check_usermap
push esi
mov edi, eax
call sym.postgres.exe_pfree
add esp, 0x2c
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x138]
push 1
lea edx, [ebp - 0x804]
push edx
mov edx, dword [eax + 0x11c]
push ecx
push edx
call sym.postgres.exe_check_usermap
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006a8ca2
mov esp, ebp
pop ebp
ret