Function at 0x18007f920
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x18014123c]
test ecx, ecx
jne 0x18007ff19
mov eax, dword [0x180141238]
cmp eax, 3
ja 0x18007ff19
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180141238], eax
call fcn.180036d30
test eax, eax
je 0x18007f966
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x18007f973
lea rcx, [0x1800d4740]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x18007f985
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.OpenThreadToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadToken
mov rcx, rbx
mov qword [0x180141050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8fd0]
mov rcx, rbx
mov qword [0x180141058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateToken
mov rcx, rbx
mov qword [0x180141060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateTokenEx
mov rcx, rbx
mov qword [0x180141068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8f90]
mov rcx, rbx
mov qword [0x180141070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetTokenInformation
mov rcx, rbx
mov qword [0x180141078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8f60]
mov rcx, rbx
mov qword [0x180141080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8f48]
mov rcx, rbx
mov qword [0x180141088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8f30]
mov rcx, rbx
mov qword [0x180141090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8f18]
mov rcx, rbx
mov qword [0x180141098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegGetKeySecurity
mov rcx, rbx
mov qword [0x1801410a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8ee8]
mov rcx, rbx
mov qword [0x1801410a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1801410b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetKernelObjectSecurity
mov rcx, rbx
mov qword [0x1801410b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8ea0]
mov rcx, rbx
mov qword [0x1801410c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAclInformation
mov rcx, rbx
mov qword [0x1801410c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8e68]
mov rcx, rbx
mov qword [0x1801410d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8e48]
mov rcx, rbx
mov qword [0x1801410d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, rbx
mov qword [0x1801410e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorGroup
mov qword [0x1801410e8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1801410f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x1801410f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180141100], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180141108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameA
mov rcx, rbx
mov qword [0x180141110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8d58]
mov rcx, rbx
mov qword [0x180141118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8d40]
mov rcx, rbx
mov qword [0x180141120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8d28]
mov rcx, rbx
mov qword [0x180141128], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8d10]
mov rcx, rbx
mov qword [0x180141130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueW
mov rcx, rbx
mov qword [0x180141138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameA
mov rcx, rbx
mov qword [0x180141140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameW
mov rcx, rbx
mov qword [0x180141148], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, rbx
mov qword [0x180141150], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, rbx
mov qword [0x180141158], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8c70]
mov rcx, rbx
mov qword [0x180141160], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateAnonymousToken
mov rcx, rbx
mov qword [0x180141168], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, rbx
mov qword [0x180141170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
mov qword [0x180141178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RevertToSelf
mov rcx, rbx
mov qword [0x180141180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserA
mov qword [0x180141188], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserW
mov rcx, rbx
mov qword [0x180141190], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
mov qword [0x180141198], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
mov qword [0x1801411a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithLogonW
mov rcx, rbx
mov qword [0x1801411a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithTokenW
mov rcx, rbx
mov qword [0x1801411b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidA
mov rcx, rbx
mov qword [0x1801411b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rbx
mov qword [0x1801411c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidA
mov rcx, rbx
mov qword [0x1801411c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [0x1801411d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, rbx
mov qword [0x1801411d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, rbx
mov qword [0x1801411e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [0x1801411e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8ad0]
mov rcx, rbx
mov qword [0x1801411f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualPrefixSid
mov rcx, rbx
mov qword [0x1801411f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8ab8]
mov rcx, rbx
mov qword [0x180141200], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8aa0]
mov rcx, rbx
mov qword [0x180141208], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2W
mov rcx, rbx
mov qword [0x180141210], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800e8a70]
mov rcx, rbx
mov qword [0x180141218], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2W
mov rcx, rbx
mov qword [0x180141220], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatusEx
mov rcx, rbx
mov qword [0x180141228], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180141230], rax
mov dword [0x18014123c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret