Function at 0x1800e17e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x18023f92c], 0
jne 0x1800e17f6
cmp dword [0x18023f928], 3
jbe 0x1800e1801
mov eax, dword [0x18023f92c]
jmp 0x1800e1e5a
mov eax, dword [0x18023f928]
inc eax
mov dword [0x18023f928], eax
mov qword [rsp + 0x20], 0
call fcn.18012a2e0
test eax, eax
je 0x1800e1835
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x20], rax
jmp 0x1800e1847
lea rcx, [0x1801c1188]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1800e1856
xor eax, eax
jmp 0x1800e1e5a
lea rdx, str.OpenThreadToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f740], rax
lea rdx, str.SetThreadToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f748], rax
lea rdx, [0x1801cfd00]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f750], rax
lea rdx, str.DuplicateToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f758], rax
lea rdx, str.DuplicateTokenEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f760], rax
lea rdx, [0x1801cfcc0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f768], rax
lea rdx, str.SetTokenInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f770], rax
lea rdx, str.GetFileSecurityA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f778], rax
lea rdx, [0x1801cfc78]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f780], rax
lea rdx, str.SetFileSecurityA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f788], rax
lea rdx, [0x1801cfc48]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f790], rax
lea rdx, [0x1801cfc30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f798], rax
lea rdx, [0x1801cfc18]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7a0], rax
lea rdx, str.GetKernelObjectSecurity
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7a8], rax
lea rdx, str.SetKernelObjectSecurity
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7b0], rax
lea rdx, str.GetAclInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7b8], rax
lea rdx, str.SetAclInformation
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7c0], rax
lea rdx, str.GetSecurityDescriptorDacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7c8], rax
lea rdx, [0x1801cfb78]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7d0], rax
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7d8], rax
lea rdx, str.SetSecurityDescriptorGroup
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7e0], rax
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7e8], rax
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7f0], rax
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f7f8], rax
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f800], rax
lea rdx, str.LookupAccountNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f808], rax
lea rdx, [0x1801cfa88]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f810], rax
lea rdx, str.LookupAccountSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f818], rax
lea rdx, [0x1801cfa58]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f820], rax
lea rdx, str.LookupPrivilegeValueA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f828], rax
lea rdx, [0x1801cfa28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f830], rax
lea rdx, str.LookupPrivilegeNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f838], rax
lea rdx, str.LookupPrivilegeNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f840], rax
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f848], rax
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f850], rax
lea rdx, [0x1801cf9a0]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f858], rax
lea rdx, str.ImpersonateAnonymousToken
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f860], rax
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f868], rax
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f870], rax
lea rdx, str.RevertToSelf
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f878], rax
lea rdx, str.LogonUserA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f880], rax
lea rdx, str.LogonUserW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f888], rax
lea rdx, str.CreateProcessAsUserA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f890], rax
lea rdx, str.CreateProcessAsUserW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f898], rax
lea rdx, str.CreateProcessWithLogonW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8a0], rax
lea rdx, str.CreateProcessWithTokenW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8a8], rax
lea rdx, str.ConvertSidToStringSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8b0], rax
lea rdx, str.ConvertSidToStringSidW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8b8], rax
lea rdx, str.ConvertStringSidToSidA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8c0], rax
lea rdx, str.ConvertStringSidToSidW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8c8], rax
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8d0], rax
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8d8], rax
lea rdx, str.CopySid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8e0], rax
lea rdx, str.EqualSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8e8], rax
lea rdx, str.EqualPrefixSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8f0], rax
lea rdx, str.FreeSid
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f8f8], rax
lea rdx, str.QueryServiceConfig2A
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f900], rax
lea rdx, str.QueryServiceConfig2W
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f908], rax
lea rdx, str.ChangeServiceConfig2A
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f910], rax
lea rdx, str.ChangeServiceConfig2W
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f918], rax
lea rdx, str.QueryServiceStatusEx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18023f920], rax
mov dword [0x18023f92c], 1
mov eax, 1
add rsp, 0x38
ret