Function at 0x1800e8040
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801e0f34]
test ecx, ecx
jne 0x1800e8639
mov eax, dword [0x1801e0f30]
cmp eax, 3
ja 0x1800e8639
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1801e0f30], eax
call fcn.1800dbb00
test eax, eax
je 0x1800e8086
lea rcx, [0x180162190]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800e8093
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800e80a5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.OpenThreadToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadToken
mov rcx, rbx
mov qword [0x1801e0d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b418]
mov rcx, rbx
mov qword [0x1801e0d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateToken
mov rcx, rbx
mov qword [0x1801e0d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateTokenEx
mov rcx, rbx
mov qword [0x1801e0d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b3d8]
mov rcx, rbx
mov qword [0x1801e0d68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetTokenInformation
mov rcx, rbx
mov qword [0x1801e0d70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityA
mov rcx, rbx
mov qword [0x1801e0d78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityW
mov rcx, rbx
mov qword [0x1801e0d80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileSecurityA
mov rcx, rbx
mov qword [0x1801e0d88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b360]
mov rcx, rbx
mov qword [0x1801e0d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegGetKeySecurity
mov rcx, rbx
mov qword [0x1801e0d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b330]
mov rcx, rbx
mov qword [0x1801e0da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1801e0da8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1801e0db0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAclInformation
mov rcx, rbx
mov qword [0x1801e0db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAclInformation
mov rcx, rbx
mov qword [0x1801e0dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorDacl
mov rcx, rbx
mov qword [0x1801e0dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b290]
mov rcx, rbx
mov qword [0x1801e0dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, rbx
mov qword [0x1801e0dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorGroup
mov qword [0x1801e0de0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1801e0de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1801e0df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x1801e0df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x1801e0e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameA
mov rcx, rbx
mov qword [0x1801e0e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b1a0]
mov rcx, rbx
mov qword [0x1801e0e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountSidA
mov rcx, rbx
mov qword [0x1801e0e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b170]
mov rcx, rbx
mov qword [0x1801e0e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueA
mov rcx, rbx
mov qword [0x1801e0e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b140]
mov rcx, rbx
mov qword [0x1801e0e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameA
mov rcx, rbx
mov qword [0x1801e0e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameW
mov rcx, rbx
mov qword [0x1801e0e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, rbx
mov qword [0x1801e0e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, rbx
mov qword [0x1801e0e50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18016b0b8]
mov rcx, rbx
mov qword [0x1801e0e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateAnonymousToken
mov rcx, rbx
mov qword [0x1801e0e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, rbx
mov qword [0x1801e0e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
mov qword [0x1801e0e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RevertToSelf
mov rcx, rbx
mov qword [0x1801e0e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserA
mov qword [0x1801e0e80], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserW
mov rcx, rbx
mov qword [0x1801e0e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
mov qword [0x1801e0e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
mov qword [0x1801e0e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithLogonW
mov rcx, rbx
mov qword [0x1801e0ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithTokenW
mov rcx, rbx
mov qword [0x1801e0ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidA
mov rcx, rbx
mov qword [0x1801e0eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rbx
mov qword [0x1801e0eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidA
mov rcx, rbx
mov qword [0x1801e0ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [0x1801e0ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, rbx
mov qword [0x1801e0ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, rbx
mov qword [0x1801e0ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [0x1801e0ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualSid
mov rcx, rbx
mov qword [0x1801e0ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualPrefixSid
mov rcx, rbx
mov qword [0x1801e0ef0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeSid
mov rcx, rbx
mov qword [0x1801e0ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2A
mov rcx, rbx
mov qword [0x1801e0f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2W
mov rcx, rbx
mov qword [0x1801e0f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2A
mov rcx, rbx
mov qword [0x1801e0f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2W
mov rcx, rbx
mov qword [0x1801e0f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatusEx
mov rcx, rbx
mov qword [0x1801e0f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1801e0f28], rax
mov dword [0x1801e0f34], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret