Function at 0x18004f1b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801528b4]
test ecx, ecx
jne 0x18004f7a9
mov eax, dword [0x1801528b0]
cmp eax, 3
ja 0x18004f7a9
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1801528b0], eax
call fcn.18009fed0
test eax, eax
je 0x18004f1f6
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18004f203
lea rcx, [0x1800e4220]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18004f215
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.OpenThreadToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadToken
mov rcx, rbx
mov qword [0x1801526c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7518]
mov rcx, rbx
mov qword [0x1801526d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateToken
mov rcx, rbx
mov qword [0x1801526d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f74f0]
mov rcx, rbx
mov qword [0x1801526e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f74d8]
mov rcx, rbx
mov qword [0x1801526e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetTokenInformation
mov rcx, rbx
mov qword [0x1801526f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f74a8]
mov rcx, rbx
mov qword [0x1801526f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7490]
mov rcx, rbx
mov qword [0x180152700], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7478]
mov rcx, rbx
mov qword [0x180152708], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7460]
mov rcx, rbx
mov qword [0x180152710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegGetKeySecurity
mov rcx, rbx
mov qword [0x180152718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7430]
mov rcx, rbx
mov qword [0x180152720], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetKernelObjectSecurity
mov rcx, rbx
mov qword [0x180152728], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetKernelObjectSecurity
mov rcx, rbx
mov qword [0x180152730], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f73e8]
mov rcx, rbx
mov qword [0x180152738], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAclInformation
mov rcx, rbx
mov qword [0x180152740], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f73b0]
mov rcx, rbx
mov qword [0x180152748], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7390]
mov rcx, rbx
mov qword [0x180152750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, rbx
mov qword [0x180152758], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorGroup
mov qword [0x180152760], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x180152768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x180152770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180152778], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180152780], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameA
mov rcx, rbx
mov qword [0x180152788], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f72a0]
mov rcx, rbx
mov qword [0x180152790], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7288]
mov rcx, rbx
mov qword [0x180152798], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7270]
mov rcx, rbx
mov qword [0x1801527a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7258]
mov rcx, rbx
mov qword [0x1801527a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueW
mov rcx, rbx
mov qword [0x1801527b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameA
mov rcx, rbx
mov qword [0x1801527b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameW
mov rcx, rbx
mov qword [0x1801527c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, rbx
mov qword [0x1801527c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, rbx
mov qword [0x1801527d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f71b8]
mov rcx, rbx
mov qword [0x1801527d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateAnonymousToken
mov rcx, rbx
mov qword [0x1801527e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, rbx
mov qword [0x1801527e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
mov qword [0x1801527f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RevertToSelf
mov rcx, rbx
mov qword [0x1801527f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserA
mov qword [0x180152800], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserW
mov rcx, rbx
mov qword [0x180152808], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
mov qword [0x180152810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
mov qword [0x180152818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithLogonW
mov rcx, rbx
mov qword [0x180152820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithTokenW
mov rcx, rbx
mov qword [0x180152828], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidA
mov rcx, rbx
mov qword [0x180152830], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rbx
mov qword [0x180152838], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidA
mov rcx, rbx
mov qword [0x180152840], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [0x180152848], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, rbx
mov qword [0x180152850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, rbx
mov qword [0x180152858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [0x180152860], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7018]
mov rcx, rbx
mov qword [0x180152868], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualPrefixSid
mov rcx, rbx
mov qword [0x180152870], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800f7000]
mov rcx, rbx
mov qword [0x180152878], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2A
mov rcx, rbx
mov qword [0x180152880], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2W
mov rcx, rbx
mov qword [0x180152888], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2A
mov rcx, rbx
mov qword [0x180152890], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2W
mov rcx, rbx
mov qword [0x180152898], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatusEx
mov rcx, rbx
mov qword [0x1801528a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1801528a8], rax
mov dword [0x1801528b4], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret