Function at 0x1800e04e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x18023a7cc], 0
jne 0x1800e04f6
cmp dword [0x18023a7c8], 3
jbe 0x1800e0501
mov eax, dword [0x18023a7cc]
jmp 0x1800e0b5a
mov eax, dword [0x18023a7c8]
inc eax
mov dword [0x18023a7c8], eax
mov qword [rsp + 0x20], 0
call fcn.180127760
test eax, eax
je 0x1800e0535
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x20], rax
jmp 0x1800e0547
lea rcx, [0x1801bdb98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800e0556
xor eax, eax
jmp 0x1800e0b5a
lea rdx, str.OpenThreadToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a5e0], rax
lea rdx, str.SetThreadToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a5e8], rax
lea rdx, [0x1801cc720]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a5f0], rax
lea rdx, str.DuplicateToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a5f8], rax
lea rdx, str.DuplicateTokenEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a600], rax
lea rdx, [0x1801cc6e0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a608], rax
lea rdx, str.SetTokenInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a610], rax
lea rdx, str.GetFileSecurityA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a618], rax
lea rdx, [0x1801cc698]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a620], rax
lea rdx, str.SetFileSecurityA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a628], rax
lea rdx, [0x1801cc668]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a630], rax
lea rdx, [0x1801cc650]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a638], rax
lea rdx, [0x1801cc638]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a640], rax
lea rdx, str.GetKernelObjectSecurity
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a648], rax
lea rdx, str.SetKernelObjectSecurity
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a650], rax
lea rdx, str.GetAclInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a658], rax
lea rdx, str.SetAclInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a660], rax
lea rdx, str.GetSecurityDescriptorDacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a668], rax
lea rdx, [0x1801cc598]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a670], rax
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a678], rax
lea rdx, str.SetSecurityDescriptorGroup
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a680], rax
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a688], rax
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a690], rax
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a698], rax
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6a0], rax
lea rdx, str.LookupAccountNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6a8], rax
lea rdx, [0x1801cc4a8]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6b0], rax
lea rdx, str.LookupAccountSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6b8], rax
lea rdx, [0x1801cc478]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6c0], rax
lea rdx, str.LookupPrivilegeValueA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6c8], rax
lea rdx, [0x1801cc448]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6d0], rax
lea rdx, str.LookupPrivilegeNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6d8], rax
lea rdx, str.LookupPrivilegeNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6e0], rax
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6e8], rax
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6f0], rax
lea rdx, [0x1801cc3c0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a6f8], rax
lea rdx, str.ImpersonateAnonymousToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a700], rax
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a708], rax
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a710], rax
lea rdx, str.RevertToSelf
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a718], rax
lea rdx, str.LogonUserA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a720], rax
lea rdx, str.LogonUserW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a728], rax
lea rdx, str.CreateProcessAsUserA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a730], rax
lea rdx, str.CreateProcessAsUserW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a738], rax
lea rdx, str.CreateProcessWithLogonW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a740], rax
lea rdx, str.CreateProcessWithTokenW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a748], rax
lea rdx, str.ConvertSidToStringSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a750], rax
lea rdx, str.ConvertSidToStringSidW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a758], rax
lea rdx, str.ConvertStringSidToSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a760], rax
lea rdx, str.ConvertStringSidToSidW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a768], rax
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a770], rax
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a778], rax
lea rdx, str.CopySid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a780], rax
lea rdx, str.EqualSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a788], rax
lea rdx, str.EqualPrefixSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a790], rax
lea rdx, str.FreeSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a798], rax
lea rdx, str.QueryServiceConfig2A
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7a0], rax
lea rdx, str.QueryServiceConfig2W
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7a8], rax
lea rdx, str.ChangeServiceConfig2A
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7b0], rax
lea rdx, str.ChangeServiceConfig2W
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7b8], rax
lea rdx, str.QueryServiceStatusEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023a7c0], rax
mov dword [0x18023a7cc], 1
mov eax, 1
add rsp, 0x38
ret