Function at 0x10029990
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x100f37f0], 0
jne 0x100299a6
cmp dword [0x100f37ec], 3
jbe 0x100299b0
mov eax, dword [0x100f37f0]
jmp 0x10029ecb
mov eax, dword [0x100f37ec]
add eax, 1
mov dword [0x100f37ec], eax
mov dword [ebp - 4], 0
call fcn.1006c530
test eax, eax
je 0x100299dd
push 0x100dec34
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 4], eax
jmp 0x100299eb
push 0x100dec50
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100299f8
xor eax, eax
jmp 0x10029ecb
push str.OpenThreadToken
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f36f8], eax
push str.SetThreadToken
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f36fc], eax
push str.OpenProcessToken
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3700], eax
push str.DuplicateToken
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3704], eax
push str.DuplicateTokenEx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3708], eax
push str.GetTokenInformation
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f370c], eax
push str.SetTokenInformation
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3710], eax
push str.GetFileSecurityA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3714], eax
push str.GetFileSecurityW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3718], eax
push str.SetFileSecurityA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f371c], eax
push str.SetFileSecurityW
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3720], eax
push str.RegGetKeySecurity
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3724], eax
push str.RegSetKeySecurity
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3728], eax
push str.GetKernelObjectSecurity
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f372c], eax
push str.SetKernelObjectSecurity
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3730], eax
push str.GetAclInformation
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3734], eax
push str.SetAclInformation
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3738], eax
push str.GetSecurityDescriptorDacl
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f373c], eax
push str.SetSecurityDescriptorDacl
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3740], eax
push str.GetSecurityDescriptorGroup
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3744], eax
push str.SetSecurityDescriptorGroup
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3748], eax
push str.GetSecurityDescriptorOwner
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f374c], eax
push str.SetSecurityDescriptorOwner
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3750], eax
push str.GetSecurityDescriptorSacl
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3754], eax
push str.SetSecurityDescriptorSacl
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3758], eax
push str.LookupAccountNameA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f375c], eax
push str.LookupAccountNameW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3760], eax
push str.LookupAccountSidA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3764], eax
push str.LookupAccountSidW
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3768], eax
push str.LookupPrivilegeValueA
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f376c], eax
push str.LookupPrivilegeValueW
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3770], eax
push str.LookupPrivilegeNameA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3774], eax
push str.LookupPrivilegeNameW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3778], eax
push str.LookupPrivilegeDisplayNameA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f377c], eax
push str.LookupPrivilegeDisplayNameW
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3780], eax
push str.AdjustTokenPrivileges
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3784], eax
push str.ImpersonateAnonymousToken
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3788], eax
push str.ImpersonateNamedPipeClient
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f378c], eax
push str.ImpersonateLoggedOnUser
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3790], eax
push str.RevertToSelf
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3794], eax
push str.LogonUserA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f3798], eax
push str.LogonUserW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f379c], eax
push str.CreateProcessAsUserA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37a0], eax
push str.CreateProcessAsUserW
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37a4], eax
push str.CreateProcessWithLogonW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37a8], eax
push str.CreateProcessWithTokenW
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37ac], eax
push str.ConvertSidToStringSidA
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37b0], eax
push str.ConvertSidToStringSidW
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37b4], eax
push str.ConvertStringSidToSidA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37b8], eax
push str.ConvertStringSidToSidW
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37bc], eax
push str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37c0], eax
push str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37c4], eax
push str.CopySid
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37c8], eax
push str.EqualSid
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37cc], eax
push str.EqualPrefixSid
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37d0], eax
push str.FreeSid
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37d4], eax
push str.QueryServiceConfig2A
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37d8], eax
push str.QueryServiceConfig2W
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37dc], eax
push str.ChangeServiceConfig2A
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37e0], eax
push str.ChangeServiceConfig2W
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37e4], eax
push str.QueryServiceStatusEx
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100f37e8], eax
mov dword [0x100f37f0], 1
mov eax, 1
mov esp, ebp
pop ebp
ret