Function at 0x180085240
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1803490c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov qword [0x18034cf10], rcx
lea r8, [0x18034cde8]
mov edx, 8
mov ecx, 3
call fcn.180086320
test eax, eax
je 0x180085294
xor eax, eax
jmp 0x180085814
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbp - 0x29], eax
xor eax, eax
mov qword [rbp - 0x21], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x29]
lea rcx, [0x1800851b0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbp - 0x21]
mov qword [0x18034cee8], rcx
mov r8d, 0x40
lea rdx, [rbp + 7]
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rdi
lea rax, [rbp + 7]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], dil
jne 0x180085300
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.180004d60
nop
lea rbx, [0x18034cb40]
lea rsi, [0x18034cd50]
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.180064b20
mov rax, qword [rbx + 0x20]
mov qword [rbp + 0x27], rax
mov eax, dword [rbx + 0x28]
mov dword [rbp + 0x2f], eax
lea r9, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova r9, qword [rbp + 7]
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rcx, qword [rbp - 0x19]
mov rax, qword [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 9]
call fcn.180084d70
cmp rax, 0xffffffffffffffff
jne 0x180085392
lea rcx, [rbp + 7]
call fcn.180004130
add rbx, 0x30
cmp rbx, rsi
jne 0x180085330
jmp 0x1800853bf
lea rdx, [rbp + 7]
lea rcx, [0x180349d18]
call fcn.18007a740
mov rax, qword [rbp + 0x27]
mov qword [0x180349d38], rax
mov eax, dword [rbp + 0x2f]
mov dword [0x180349d40], eax
lea rcx, [rbp + 7]
call fcn.180004130
mov rax, qword [sym.imp.jvm.dll_gHotSpotVMStructs]
cmp qword [rax], 0
je 0x180085809
mov rax, qword [sym.imp.jvm.dll_gHotSpotVMTypes]
cmp qword [rax], 0
je 0x180085809
mov rax, qword [sym.imp.jvm.dll_gHotSpotVMIntConstants]
cmp qword [rax], 0
je 0x180085809
mov rax, qword [sym.imp.jvm.dll_gHotSpotVMLongConstants]
cmp qword [rax], 0
je 0x180085809
mov ecx, dword [0x180349d40]
sub ecx, 1
je 0x180085612
sub ecx, 1
je 0x180085612
sub ecx, 1
je 0x180085429
cmp ecx, 1
jne 0x180085809
lea rcx, str.lwjgl_opengl.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rbp + 7]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x180085809
cmp qword [rbp + 7], 0
je 0x180085809
lea rdx, str.Java_org_lwjgl_opengl_GL11C_glClear
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18034cea8], rax
test rax, rax
je 0x180085809
mov ecx, 0x38
call fcn.180096120
mov rbx, rax
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov word [rbx], 1
lea rax, [0x1800850e0]
mov qword [rbx + 8], rax
mov rcx, qword [0x18034cea8]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006a700
mov byte [rbx + 1], al
mov edx, 0xe
mov r8d, 0x40
mov rcx, qword [rbx + 0x10]
call fcn.18006df30
mov qword [rbx + 0x20], rax
test rax, rax
je 0x180085606
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x2e], rcx
movsd xmm0, qword [rbx + 0x28]
movsd qword [rax], xmm0
mov ecx, dword [rbx + 0x30]
mov dword [rax + 8], ecx
movzx ecx, word [rbx + 0x34]
mov word [rax + 0xc], cx
movzx edx, byte [rbx + 1]
add rdx, 0xe
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x180085606
mov qword [0x18034cea0], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
call fcn.1800c3a80
movzx edx, byte [rbx + 1]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov esi, dword [rbx + 0x20]
sub esi, dword [rbx + 0x10]
sub esi, 5
mov dword [rbp - 0x29], edi
lea r9, [rbp - 0x29]
mov edx, 5
mov r8d, 0x40
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180085606
mov rax, qword [rbx + 0x10]
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], esi
lea r9, [rbp - 0x29]
mov r8d, dword [rbp - 0x29]
mov edx, 5
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov qword [0x18034ce98], rbx
jmp 0x1800857f6
lea rcx, str.lwjgl64.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rbp + 7]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x180085809
cmp qword [rbp + 7], 0
je 0x180085809
lea rdx, str.Java_org_lwjgl_opengl_GL11_nglClear
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18034ce80], rax
test rax, rax
je 0x180085809
mov ecx, 0x38
call fcn.180096120
mov rbx, rax
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
mov word [rbx], 1
lea rax, [0x180085000]
mov qword [rbx + 8], rax
mov rcx, qword [0x18034ce80]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006a700
mov byte [rbx + 1], al
mov edx, 0xe
mov r8d, 0x40
mov rcx, qword [rbx + 0x10]
call fcn.18006df30
mov qword [rbx + 0x20], rax
test rax, rax
je 0x1800857ef
mov rcx, qword [rbx + 8]
mov qword [rbx + 0x2e], rcx
movsd xmm0, qword [rbx + 0x28]
movsd qword [rax], xmm0
mov ecx, dword [rbx + 0x30]
mov dword [rax + 8], ecx
movzx ecx, word [rbx + 0x34]
mov word [rax + 0xc], cx
movzx edx, byte [rbx + 1]
add rdx, 0xe
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1800857ef
mov qword [0x18034ce90], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
call fcn.1800c3a80
movzx edx, byte [rbx + 1]
mov rcx, qword [rbx + 0x10]
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov esi, dword [rbx + 0x20]
sub esi, dword [rbx + 0x10]
sub esi, 5
mov dword [rbp - 0x29], edi
lea r9, [rbp - 0x29]
mov edx, 5
mov r8d, 0x40
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800857ef
mov rax, qword [rbx + 0x10]
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], esi
lea r9, [rbp - 0x29]
mov r8d, dword [rbp - 0x29]
mov edx, 5
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov qword [0x18034ce88], rbx
cmp byte [rbx], 0
jne 0x180085809
call fcn.180069670
test al, al
je 0x180085809
mov edi, 1
lea rcx, [rbp - 0x19]
call fcn.180004130
mov eax, edi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180095fe0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret