Function at 0x140071a03
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x250
movaps xmmword [rsp + 0x240], xmm6
mov rbx, rcx
mov rax, qword [rcx + 0x30]
xor ebp, ebp
mov r12d, 0
test rax, rax
je 0x140071a5d
mov rcx, qword [rbx + 0x40]
mov r12d, 0
test rcx, rcx
je 0x140071a5d
xor r12d, r12d
lea rdx, [0x1400fa9a0]
xor r8d, r8d
movzx r9d, byte [rax + r8]
or r12d, dword [rdx + r9*4]
inc r8
cmp rcx, r8
jne 0x140071a4c
xorps xmm6, xmm6
movups xmmword [rsp + 0x90], xmm6
movups xmmword [rsp + 0x80], xmm6
movups xmmword [rsp + 0x70], xmm6
movups xmmword [rsp + 0x60], xmm6
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x98], 0x400010
mov dword [rsp + 0x88], r12d
mov r15, qword [rbx + 0x10]
lea rsi, [r15*8]
test r15, r15
je 0x140071ae6
mov rax, r15
shr rax, 0x3c
jne 0x140071ccb
mov r14, qword [rbx]
mov ecx, 8
mov rdx, rsi
call fcn.140036b27
test rax, rax
je 0x140071ccb
mov rdi, rax
xor eax, eax
mov rcx, qword [r14 + rax*8]
mov qword [rdi + rax*8], rcx
inc rax
cmp r15, rax
jne 0x140071ad1
mov ebp, r15d
jmp 0x140071aeb
mov edi, 8
mov dword [rsp + 0x54], ebp
mov qword [rsp + 0x58], rdi
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
and qword [rsp + 0xc0], 0
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
and qword [rsp + 0x110], 0
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140071bb3
mov ecx, dword [rbx + 0x28]
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x80], rax
xor eax, eax
test rax, rax
lea rcx, [rsp + 0x50]
cmovne rcx, rax
xorps xmm0, xmm0
lea rax, [rsp + 0x120]
movaps xmmword [rax], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rcx
and qword [rsp + 0x40], 0
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
mov r8d, 2
xor r9d, r9d
call sub.secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x140071c6e
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r14d, 1
jmp 0x140071c96
lea rcx, [0x1400d5168]
call sub.kernel32.dll_GetModuleHandleW
test rax, rax
je 0x140071b4e
lea rdx, str.RtlGetVersion
mov rcx, rax
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140071b4e
mov rbx, rax
lea r14, [rsp + 0x124]
mov r8d, 0x110
mov rcx, r14
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [r14 - 4], 0x114
lea r14, [rsp + 0x120]
mov rcx, r14
call rbx
cmp dword [r14 + 4], 0xa
ja 0x140071c2a
jne 0x140071b4e
cmp dword [rsp + 0x12c], 0x4562
jbe 0x140071b4e
test r12d, r12d
je 0x140071c3a
not r12d
mov dword [rsp + 0xb0], r12d
lea rax, [rsp + 0xd0]
mov dword [rax], 5
movabs rcx, 0x100400010
mov qword [rax + 0x34], rcx
mov dword [rax + 8], ebp
mov qword [rax + 0x10], rdi
lea rcx, [rsp + 0xa0]
mov qword [rax + 0x40], rcx
jmp 0x140071b50
movaps xmm6, xmmword [rsp + 0x120]
mov ecx, 0x20
call fcn.1400716ab
mov rbx, rax
mov eax, 1
mov qword [rbx], rax
mov qword [rbx + 8], rax
movups xmmword [rbx + 0x10], xmm6
xor r14d, r14d
test r15, r15
je 0x140071cab
mov edx, 8
mov rcx, rdi
mov r8, rsi
call fcn.140001f79
mov rax, r14
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x250
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2