Function at 0x1800bd620
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180173fa4]
test ecx, ecx
jne 0x1800bdc19
mov eax, dword [0x180173fa0]
cmp eax, 3
ja 0x1800bdc19
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180173fa0], eax
call fcn.1800a3710
test eax, eax
je 0x1800bd666
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800bd673
lea rcx, [0x18011a6a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800bd685
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.OpenThreadToken
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadToken
mov rcx, rbx
mov qword [0x180173db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801236a0]
mov rcx, rbx
mov qword [0x180173dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateToken
mov rcx, rbx
mov qword [0x180173dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DuplicateTokenEx
mov rcx, rbx
mov qword [0x180173dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123660]
mov rcx, rbx
mov qword [0x180173dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetTokenInformation
mov rcx, rbx
mov qword [0x180173de0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityA
mov rcx, rbx
mov qword [0x180173de8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityW
mov rcx, rbx
mov qword [0x180173df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123600]
mov rcx, rbx
mov qword [0x180173df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetFileSecurityW
mov rcx, rbx
mov qword [0x180173e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegGetKeySecurity
mov rcx, rbx
mov qword [0x180173e08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801235b8]
mov rcx, rbx
mov qword [0x180173e10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetKernelObjectSecurity
mov rcx, rbx
mov qword [0x180173e18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetKernelObjectSecurity
mov rcx, rbx
mov qword [0x180173e20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetAclInformation
mov rcx, rbx
mov qword [0x180173e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetAclInformation
mov rcx, rbx
mov qword [0x180173e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorDacl
mov rcx, rbx
mov qword [0x180173e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123518]
mov rcx, rbx
mov qword [0x180173e40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorGroup
mov rcx, rbx
mov qword [0x180173e48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorGroup
mov qword [0x180173e50], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x180173e58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorOwner
mov rcx, rbx
mov qword [0x180173e60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180173e68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetSecurityDescriptorSacl
mov rcx, rbx
mov qword [0x180173e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountNameA
mov rcx, rbx
mov qword [0x180173e78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123428]
mov rcx, rbx
mov qword [0x180173e80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupAccountSidA
mov rcx, rbx
mov qword [0x180173e88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801233f8]
mov rcx, rbx
mov qword [0x180173e90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801233e0]
mov rcx, rbx
mov qword [0x180173e98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeValueW
mov rcx, rbx
mov qword [0x180173ea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameA
mov rcx, rbx
mov qword [0x180173ea8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeNameW
mov rcx, rbx
mov qword [0x180173eb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameA
mov rcx, rbx
mov qword [0x180173eb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LookupPrivilegeDisplayNameW
mov rcx, rbx
mov qword [0x180173ec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180123340]
mov rcx, rbx
mov qword [0x180173ec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateAnonymousToken
mov rcx, rbx
mov qword [0x180173ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateNamedPipeClient
mov rcx, rbx
mov qword [0x180173ed8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ImpersonateLoggedOnUser
mov rcx, rbx
mov qword [0x180173ee0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RevertToSelf
mov rcx, rbx
mov qword [0x180173ee8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserA
mov qword [0x180173ef0], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LogonUserW
mov rcx, rbx
mov qword [0x180173ef8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserA
mov rcx, rbx
mov qword [0x180173f00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessAsUserW
mov rcx, rbx
mov qword [0x180173f08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithLogonW
mov rcx, rbx
mov qword [0x180173f10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateProcessWithTokenW
mov rcx, rbx
mov qword [0x180173f18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidA
mov rcx, rbx
mov qword [0x180173f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertSidToStringSidW
mov rcx, rbx
mov qword [0x180173f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidA
mov rcx, rbx
mov qword [0x180173f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSidToSidW
mov rcx, rbx
mov qword [0x180173f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorA
mov rcx, rbx
mov qword [0x180173f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, rbx
mov qword [0x180173f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopySid
mov rcx, rbx
mov qword [0x180173f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualSid
mov rcx, rbx
mov qword [0x180173f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EqualPrefixSid
mov rcx, rbx
mov qword [0x180173f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FreeSid
mov rcx, rbx
mov qword [0x180173f68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2A
mov rcx, rbx
mov qword [0x180173f70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2W
mov rcx, rbx
mov qword [0x180173f78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2A
mov rcx, rbx
mov qword [0x180173f80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfig2W
mov rcx, rbx
mov qword [0x180173f88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatusEx
mov rcx, rbx
mov qword [0x180173f90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180173f98], rax
mov dword [0x180173fa4], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret