Function at 0x55eed0
Capabilities:
Acquire debug privileges
Enumerate gui resources
Enumerate process modules

Disassembly:
push ebp
mov eax, 0x24f4
push edi
call fcn.00567770
sub esp, eax
lea edx, [esp + 0x4c]
mov dword [esp + 0x64], 0x567468
lea eax, [esp + 0x24f0]
mov dword [esp], edx
mov dword [esp + 0x68], 0x5c597e
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], 0x55f7db
mov dword [esp + 0x74], esp
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Register
cmp byte [0x638054], 0
mov dword [esp + 0x3c], 0
je 0x55ef40
lea eax, [esp + 0x4c]
mov dword [esp], eax
call sub.libgcc_s_sjlj_1.dll__Unwind_SjLj_Unregister
mov eax, dword [esp + 0x3c]
add esp, 0x24f4
pop edi
pop ebp
ret
mov dword [esp + 0x50], 0xffffffff
mov byte [0x638054], 1
mov dword [0x638058], 0
call fcn.0055e420
mov dword [esp + 0x90], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x90]
mov dword [esp + 4], 0x28
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
mov eax, dword [esp + 0x90]
mov dword [esp + 8], 1
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], eax
call fcn.00555310
mov eax, dword [esp + 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], eax
call eax
sub esp, 4
lea eax, [esp + 0x94]
mov dword [esp + 4], 0x2000
lea edx, [esp + 0x4f0]
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.PSAPI.DLL_EnumProcesses
sub esp, 0xc
test eax, eax
je 0x55f7c0
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0xc0]
mov dword [esp + 0x50], 0xffffffff
shr eax, 2
mov dword [esp + 0x48], eax
call dword [0x63a32c]
mov edx, dword [esp + 0x48]
test edx, edx
je 0x55f664
mov dword [esp + 0x3c], 0
jmp 0x55f4dc
mov ecx, dword [esp + 0x98]
lea eax, [esp + 0x9c]
mov edx, dword [method.QString.operator_QString_const_]
mov dword [esp], eax
add ecx, 8
mov dword [esp + 0x40], edx
call edx
sub esp, 4
lea eax, [esp + 0xe0]
mov ecx, 0x104
mov dword [esp + 0xa0], 0x208
mov dword [esp + 0x2c], eax
xor eax, eax
mov edi, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x98]
mov eax, dword [eax]
mov dword [esp + 4], 0
mov dword [esp], 0x410
mov dword [esp + 0x50], 1
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
test eax, eax
mov dword [esp + 0x38], eax
je 0x55f4a4
mov dword [esp], 0x5f4c34
mov dword [esp + 0x50], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
mov dword [esp + 0x34], eax
je 0x55f6b0
mov eax, dword [esp + 0x34]
mov dword [esp + 4], str.QueryFullProcessImageNameW
mov dword [esp + 0x50], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x55f790
lea edx, [esp + 0xa0]
mov dword [esp + 4], 0
mov dword [esp + 0xc], edx
lea edx, [esp + 0xe0]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x38]
mov dword [esp], edx
call eax
sub esp, 0x10
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x50], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
mov eax, dword [esp + 0x44]
test eax, eax
je 0x55f6b0
lea eax, [esp + 0x8e]
mov dword [esp + 0x50], 1
lea edx, [esp + 0xe0]
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0xa4]
call fcn.00567740
sub esp, 8
mov eax, dword [esp + 0xa4]
mov edx, dword [eax - 0xc]
mov dword [esp + 4], eax
lea eax, [esp + 0xa8]
mov dword [esp], eax
mov dword [esp + 0x50], 2
mov dword [esp + 8], edx
call dword [method.QString.fromUtf16_unsigned_short_const__int_]
mov ecx, dword [esp + 0x98]
lea edx, [esp + 0xa8]
mov dword [esp + 0x50], 3
mov dword [esp], edx
add ecx, 4
call dword [esp + 0x40]
sub esp, 4
mov eax, dword [esp + 0xa8]
mov edx, dword [eax]
test edx, edx
je 0x55f760
cmp edx, 0xffffffff
je 0x55f1eb
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x55f756
mov ecx, dword [esp + 0xa4]
mov eax, 0xffffffff
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x55f7a0
mov eax, dword [esp + 0x98]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x5f49aa
mov edx, dword [eax + 4]
mov dword [esp + 4], edx
add eax, dword [eax + 0xc]
mov dword [esp + 0x50], 1
mov dword [esp], eax
call dword [method.QString.compare_helper_QChar_const__int__char_const__int__Qt::CaseSensitivity_]
test eax, eax
jne 0x55f264
mov eax, dword [esp + 0x98]
mov dword [esp + 0x50], 1
lea ecx, [eax + 8]
add eax, 4
mov dword [esp], eax
call dword [esp + 0x40]
sub esp, 4
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0xac]
mov dword [esp + 0x50], 1
add eax, 4
mov dword [esp], eax
call dword [method.QFileInfo.QFileInfo_QString_const_]
sub esp, 4
lea eax, [esp + 0xac]
mov dword [esp + 0x50], 4
lea edx, [esp + 0xc0]
mov dword [esp + 4], eax
mov dword [esp], edx
lea ecx, [esp + 0xb0]
call dword [method.QFileIconProvider.icon_QFileInfo_const__const]
sub esp, 8
lea ecx, [esp + 0xb0]
mov dword [esp + 0x50], 5
call dword [method.QIcon.isNull___const]
test al, al
jne 0x55f358
lea eax, [esp + 0xc8]
mov dword [esp + 0xc], 1
mov dword [esp + 4], eax
lea eax, [esp + 0xb0]
mov dword [esp + 8], 0
lea ecx, [esp + 0xd0]
mov dword [esp], eax
mov dword [esp + 0xc8], 0x20
mov dword [esp + 0xcc], 0x20
call dword [method.QIcon.pixmap_QSize_const__QIcon::Mode__QIcon::State__const]
sub esp, 0x10
mov ecx, dword [esp + 0x98]
lea edx, [esp + 0xd0]
mov dword [esp + 0x50], 6
mov dword [esp], edx
add ecx, 0x18
call dword [method.QPixmap.operator_QPixmap_const_]
sub esp, 4
lea ecx, [esp + 0xd0]
mov dword [esp + 0x50], 5
call dword [method.QPixmap.QPixmap__]
lea eax, [esp + 0xac]
mov dword [esp + 0x50], 5
mov dword [esp], eax
lea ecx, [esp + 0xb4]
call dword [method.QFileInfo.fileName___const]
sub esp, 4
mov ecx, dword [esp + 0x98]
lea edx, [esp + 0xb4]
mov dword [esp + 0x50], 7
mov dword [esp], edx
add ecx, 4
call dword [esp + 0x40]
sub esp, 4
mov eax, dword [esp + 0xb4]
mov edx, dword [eax]
test edx, edx
je 0x55f730
cmp edx, 0xffffffff
je 0x55f3c2
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x55f726
mov eax, dword [esp + 0x98]
lea edx, [esp + 0xbc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5f49aa
mov dword [esp], edx
mov dword [esp + 0x50], 5
add eax, 0x10
mov dword [esp + 0x34], eax
call dword [method.QString.fromUtf8_helper_char_const__int_]
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0xbc]
mov dword [esp + 0x50], 0xb
mov dword [esp], eax
call dword [esp + 0x40]
sub esp, 4
mov eax, dword [esp + 0xbc]
mov edx, dword [eax]
test edx, edx
je 0x55f700
cmp edx, 0xffffffff
je 0x55f43a
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x55f6f2
mov eax, dword [esp + 0x98]
mov ecx, 0x63805c
mov byte [eax + 0x14], 0
lea eax, [esp + 0x98]
mov dword [esp], eax
mov dword [esp + 0x50], 5
call fcn.00598920
sub esp, 4
lea ecx, [esp + 0xb0]
mov dword [esp + 0x50], 4
call dword [method.QIcon.QIcon__]
lea ecx, [esp + 0xac]
mov dword [esp + 0x50], 1
call dword [method.QFileInfo.QFileInfo__]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x50], 1
mov dword [esp], eax
call dword [esp + 0x28]
sub esp, 4
mov eax, dword [esp + 0x9c]
mov edx, dword [eax]
test edx, edx
je 0x55f630
cmp edx, 0xffffffff
je 0x55f4c9
lock sub dword [eax], 1
setne dl
test dl, dl
je 0x55f626
add dword [esp + 0x3c], 1
mov edx, dword [esp + 0x48]
cmp dword [esp + 0x3c], edx
je 0x55f664
mov dword [esp], 0x2c
mov dword [esp + 0x50], 8
call sub.libstdc_6.dll_operator_new_unsigned_int_
mov dword [esp + 0x30], eax
mov ecx, 0xb
xor eax, eax
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov ecx, edx
add ecx, 0x18
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov edx, dword [reloc.Qt5Gui.dll__ZN7QPixmapC1Ev]
mov dword [esp + 0x50], 9
call edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x98], edx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + edx*4 + 0x4f0]
mov edx, dword [esp + 0x30]
mov dword [edx], eax
mov edx, dword [sym.imp.Qt5Core.dll_QArrayData::shared_null]
mov dword [esp], eax
mov dword [esp + 0x50], 1
mov dword [esp + 0x9c], edx
lea edx, [esp + 0x9c]
mov dword [esp + 4], edx
call fcn.00559750
test al, al
jne 0x55f030
mov eax, dword [esp + 0x98]
lea edx, [esp + 0xb8]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5f49aa
mov dword [esp], edx
mov dword [esp + 0x50], 1
add eax, 8
mov dword [esp + 0x38], eax
call dword [method.QString.fromUtf8_helper_char_const__int_]
mov edx, dword [method.QString.operator_QString_const_]
lea eax, [esp + 0xb8]
mov dword [esp + 0x50], 0xa
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x40], edx
call edx
sub esp, 4
mov eax, dword [esp + 0xb8]
mov edx, dword [eax]
test edx, edx
je 0x55f600
cmp edx, 0xffffffff
je 0x55f053
lock sub dword [eax], 1
setne dl
test dl, dl
jne 0x55f053
mov eax, dword [esp + 0xb8]
nop
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x50], 1
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x55f053
mov eax, dword [esp + 0x9c]
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x50], 8
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
add dword [esp + 0x3c], 1
mov edx, dword [esp + 0x48]
cmp dword [esp + 0x3c], edx
jne 0x55f4dc
mov dword [esp + 4], 0
mov dword [esp], 0x55e770
mov dword [esp + 0x50], 8
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x638058]
sub esp, 8
mov byte [0x638054], 0
lea ecx, [esp + 0xc0]
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x3c], eax
call dword [method.QFileIconProvider.QFileIconProvider__]
jmp 0x55ef22
mov eax, dword [esp + 0xa0]
lea edx, [esp + 0xe0]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp + 0x50], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sub.PSAPI.DLL_GetModuleFileNameExW
sub esp, 0x10
test eax, eax
je 0x55f48e
jmp 0x55f14d
mov eax, dword [esp + 0xbc]
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x50], 5
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x55f43a
mov eax, dword [esp + 0xb4]
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x50], 5
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x55f3c2
mov eax, dword [esp + 0xa8]
lea esi, [esi]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
mov dword [esp + 0x50], 2
call dword [method.QArrayData.deallocate_QArrayData__unsigned_int__unsigned_int_]
jmp 0x55f1eb
mov dword [esp + 0x44], 0
jmp 0x55f129
lea eax, [esp + 0x8f]
sub ecx, 0xc
mov dword [esp], eax
call fcn.00567728
sub esp, 4
jmp 0x55f204
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [0x638054], 0
mov dword [esp + 0x3c], eax
mov dword [0x638058], eax
jmp 0x55ef22