Function at 0x1005a6a
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x698
mov eax, dword [0x10106f0]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x658], eax
xor eax, eax
mov word [ebp - 0x214], si
mov ecx, 0x83
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x105
xor ebx, ebx
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x640], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x630], edi
je 0x1005ee6
lea eax, [ebp - 0x63c]
push eax
push 8
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1005b17
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005ee6
lea eax, [ebp - 0x650]
push eax
push esi
push esi
push 1
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x650]
mov edi, dword [sym.imp.msvcrt.dll_malloc]
call edi
cmp eax, esi
pop ecx
mov dword [ebp - 0x64c], eax
jne 0x1005b4f
push dword [ebp - 0x630]
jmp 0x1005b75
lea ecx, [ebp - 0x650]
push ecx
push dword [ebp - 0x650]
push eax
push 1
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
push dword [ebp - 0x630]
jne 0x1005b8a
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x63c]
call edi
jmp 0x1005ed1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x62c]
push eax
mov eax, dword [ebp - 0x64c]
push dword [eax]
push esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x1005ed1
push 0x1c
lea eax, [ebp - 0x688]
push eax
call fcn.010020f9
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x680], eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x67c], eax
lea eax, [ebp - 0x62c]
push eax
mov dword [ebp - 0x688], eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
push 2
mov dword [ebp - 0x684], eax
pop eax
lea ecx, [ebp - 0x694]
push ecx
push 0x1010c8c
push esi
push esi
lea ecx, [ebp - 0x688]
push ecx
push esi
push eax
push 0x1001694
push esi
mov dword [ebp - 0x670], eax
call sub.Security.dll_AcquireCredentialsHandleW
test eax, eax
jne 0x1005ed1
push 0x1010c88
push 0x1001694
call sub.Security.dll_QuerySecurityPackageInfoW
test eax, eax
jne 0x1005ed1
mov eax, dword [0x1010c88]
cmp eax, esi
je 0x1005ed1
lea ecx, [ebp - 0x648]
mov dword [ebp - 0x66c], esi
mov dword [ebp - 0x668], 1
mov dword [ebp - 0x664], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x648], ecx
mov dword [ebp - 0x644], 2
push dword [eax + 8]
call edi
cmp eax, esi
pop ecx
mov dword [ebp - 0x640], eax
je 0x1005ed1
push 0x1000
call edi
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1005ed1
push 0x10107e8
push 0x1001d78
lea eax, [ebp - 0x214]
push 0x107
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
test eax, eax
jl 0x1005ed1
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0x1010c94
push esi
push esi
push 0x10
push esi
push 4
lea eax, [ebp - 0x214]
push eax
push esi
push 0x1010c8c
call sub.Security.dll_InitializeSecurityContextW
cmp eax, 0x90312
jne 0x1005ed1
push 7
pop edi
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x634]
mov byte [ebx], 0xff
mov byte [ebx + 1], 0xfa
mov byte [ebx + 2], 0x25
mov byte [ebx + 3], 0
mov byte [ebx + 4], 0xf
mov byte [ebx + 5], 0
mov byte [ebx + 6], 0
push eax
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x638], 8
call fcn.01004af9
test eax, eax
jne 0x1005da3
mov eax, dword [ebp - 0x638]
add eax, 9
cmp eax, 0x1000
jae 0x1005de1
mov eax, dword [ebp - 0x648]
mov dword [ebx + 7], eax
mov eax, dword [ebp - 0x644]
mov dword [ebx + 0xb], eax
mov dword [ebp - 0x630], 0xf
jmp 0x1005ddb
mov ecx, dword [ebp - 0x638]
lea eax, [ecx + 9]
cmp eax, 0x1000
jae 0x1005de1
mov esi, dword [ebp - 0x634]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 7]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x638]
add eax, 7
mov dword [ebp - 0x630], eax
xor esi, esi
mov edi, dword [ebp - 0x630]
cmp dword [ebp - 0x634], esi
je 0x1005dfc
push dword [ebp - 0x634]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [ebp - 0x634], esi
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x638]
push eax
push dword [ebp - 0x640]
lea eax, [ebp - 0x634]
push eax
call fcn.01004af9
test eax, eax
jne 0x1005e54
mov ecx, dword [ebp - 0x648]
lea eax, [edi + ecx + 2]
cmp eax, 0x1000
jae 0x1005e8f
mov esi, dword [ebp - 0x640]
mov eax, ecx
shr ecx, 2
add edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x648]
jmp 0x1005e81
mov ecx, dword [ebp - 0x638]
lea eax, [edi + ecx + 2]
cmp eax, 0x1000
jae 0x1005e8f
mov esi, dword [ebp - 0x634]
mov eax, ecx
shr ecx, 2
add edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x638]
add dword [ebp - 0x630], eax
mov edi, dword [ebp - 0x630]
xor esi, esi
cmp dword [ebp - 0x634], esi
je 0x1005eaa
push dword [ebp - 0x634]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [ebp - 0x634], esi
mov byte [edi + ebx], 0xff
inc edi
mov byte [edi + ebx], 0xf0
inc edi
push edi
mov edi, dword [ebp - 0x658]
push ebx
push edi
call fcn.01004662
xor eax, eax
inc eax
mov dword [edi + 0x7dc], eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x64c], esi
je 0x1005ee6
push dword [ebp - 0x64c]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x640], esi
je 0x1005efb
push dword [ebp - 0x640]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp ebx, esi
je 0x1005f07
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x654]
pop edi
pop esi
pop ebx
call fcn.0100cdd8
leave
ret 4