Function at 0x14014a8d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140157010]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r12d, r12d
mov rax, qword [0x1401579f8]
test rax, rax
jne 0x14014a9de
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a9b8
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a9b8
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x3951daba
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14014a9b3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14014a980
cmp r10d, 0xb01b998f
je 0x14014a9c0
test r11d, r11d
jne 0x14014a960
mov rax, qword [rax]
jmp 0x14014a930
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1401579f8], rax
call rax
mov r15, rax
mov dword [rsp + 0x30], 0x63
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r10, qword [0x140157a00]
test r10, r10
jne 0x14014aae0
mov rcx, qword gs:[0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014aab9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014aab9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xba45d9da
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014aab4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014aa80
cmp r10d, 0xdb14333f
je 0x14014aac1
test r11d, r11d
jne 0x14014aa60
mov rax, qword [rax]
jmp 0x14014aa30
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
mov qword [0x140157a00], r10
mov r9d, 2
mov r8b, 0xe6
xor edx, edx
mov rcx, r15
call r10
mov rdi, qword [0x1401579e0]
test rdi, rdi
jne 0x14014abcf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014aba9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014aba9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x44bfcafb
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014aba4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014ab70
cmp r10d, 0x21ecdfa0
je 0x14014abb1
test r11d, r11d
jne 0x14014ab50
mov rax, qword [rax]
jmp 0x14014ab20
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edi, dword [rcx + rax*4]
add rdi, rbx
mov qword [0x1401579e0], rdi
mov edx, 0xfffffff0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x17
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, r15
call rdi
mov rdi, qword [0x1401579f0]
test rdi, rdi
jne 0x14014acbf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014ac99
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014ac99
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xc3bcc151
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014ac94
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014ac60
cmp r10d, 0xbf938f02
je 0x14014aca1
test r11d, r11d
jne 0x14014ac40
mov rax, qword [rax]
jmp 0x14014ac10
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edi, dword [rcx + rax*4]
add rdi, rbx
mov qword [0x1401579f0], rdi
mov edx, 0xfffffff0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, r15
call rdi
mov rax, qword [0x1401579e8]
test rax, rax
jne 0x14014adaf
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014ad89
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014ad89
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x36c4321f
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014ad84
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014ad50
cmp r10d, 0x6587d6a4
je 0x14014ad91
test r11d, r11d
jne 0x14014ad30
mov rax, qword [rax]
jmp 0x14014ad00
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1401579e8], rax
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r15
call rax
mov edx, 0xfffffff0
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffaffff
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, r15
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [0x140157048]
lea rcx, [rbp - 0x19]
call fcn.1401499b0
nop
lea r8, str.current_user:
xor edx, edx
mov rcx, rax
call fcn.14014ca80
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0x27], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14014ae6c
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014ae67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14014ae67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014d284
mov qword [rbp - 9], r12
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
lea r8, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae r8, qword [rbp + 0xf]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov rsi, 0xffffffffffffffff
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14014d520
mov rdi, rax
lea r8, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae r8, qword [rbp + 0xf]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov rcx, rdi
call fcn.14014d284
cmp byte [0x140157044], 0
je 0x14014af13
lea rcx, str.clicker:_enabled
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x2f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov dword [rbp + 0x33], r12d
lea rdx, [rbp + 0x2f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp + 7]
and edx, 0xffffffbf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14014afa8
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014afa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14014afa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014d284
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14014cf00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret