Function at 0x180026ab0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800d280c]
test ecx, ecx
jne 0x1800270a9
mov eax, dword [0x1800d2808]
cmp eax, 3
ja 0x1800270a9
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800d2808], eax
call fcn.1800464a0
test eax, eax
je 0x180026af6
lea rcx, [0x18007dd30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180026b03
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180026b15
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.OpenThreadToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadToken
mov rcx, rbx
mov qword [0x1800d2620], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenProcessToken
mov rcx, rbx
mov qword [0x1800d2628], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateToken
mov rcx, rbx
mov qword [0x1800d2630], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateTokenEx
mov rcx, rbx
mov qword [0x1800d2638], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetTokenInformation
mov rcx, rbx
mov qword [0x1800d2640], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetTokenInformation
mov rcx, rbx
mov qword [0x1800d2648], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityA
mov rcx, rbx
mov qword [0x1800d2650], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityW
mov rcx, rbx
mov qword [0x1800d2658], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileSecurityA
mov rcx, rbx
mov qword [0x1800d2660], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileSecurityW
mov rcx, rbx
mov qword [0x1800d2668], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegGetKeySecurity
mov rcx, rbx
mov qword [0x1800d2670], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegSetKeySecurity
mov rcx, rbx
mov qword [0x1800d2678], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1800d2680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1800d2688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAclInformation
mov rcx, rbx
mov qword [0x1800d2690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAclInformation
mov rcx, rbx
mov qword [0x1800d2698], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorDacl
mov rcx, rbx
mov qword [0x1800d26a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007e1f0]
mov rcx, rbx
mov qword [0x1800d26a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, rbx
mov qword [0x1800d26b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorGroup
mov qword [0x1800d26b8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1800d26c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1800d26c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x1800d26d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x1800d26d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameA
mov rcx, rbx
mov qword [0x1800d26e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameW
mov rcx, rbx
mov qword [0x1800d26e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountSidA
mov rcx, rbx
mov qword [0x1800d26f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountSidW
mov rcx, rbx
mov qword [0x1800d26f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueA
mov rcx, rbx
mov qword [0x1800d2700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueW
mov rcx, rbx
mov qword [0x1800d2708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameA
mov rcx, rbx
mov qword [0x1800d2710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameW
mov rcx, rbx
mov qword [0x1800d2718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, rbx
mov qword [0x1800d2720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, rbx
mov qword [0x1800d2728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AdjustTokenPrivileges
mov rcx, rbx
mov qword [0x1800d2730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateAnonymousToken
mov rcx, rbx
mov qword [0x1800d2738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, rbx
mov qword [0x1800d2740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
mov qword [0x1800d2748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RevertToSelf
mov rcx, rbx
mov qword [0x1800d2750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserA
mov qword [0x1800d2758], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserW
mov rcx, rbx
mov qword [0x1800d2760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
mov qword [0x1800d2768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
mov qword [0x1800d2770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithLogonW
mov rcx, rbx
mov qword [0x1800d2778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithTokenW
mov rcx, rbx
mov qword [0x1800d2780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidA
mov rcx, rbx
mov qword [0x1800d2788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rbx
mov qword [0x1800d2790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidA
mov rcx, rbx
mov qword [0x1800d2798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [0x1800d27a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, rbx
mov qword [0x1800d27a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, rbx
mov qword [0x1800d27b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [0x1800d27b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualSid
mov rcx, rbx
mov qword [0x1800d27c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualPrefixSid
mov rcx, rbx
mov qword [0x1800d27c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeSid
mov rcx, rbx
mov qword [0x1800d27d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2A
mov rcx, rbx
mov qword [0x1800d27d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2W
mov rcx, rbx
mov qword [0x1800d27e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2A
mov rcx, rbx
mov qword [0x1800d27e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18007ddd0]
mov rcx, rbx
mov qword [0x1800d27f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatusEx
mov rcx, rbx
mov qword [0x1800d27f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1800d2800], rax
mov dword [0x1800d280c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret