Function at 0x14014a520
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor r15d, r15d
mov rax, qword [0x140150768]
test rax, rax
jne 0x14014a61e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a5f8
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a5f8
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe4cdfdff
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14014a5f3
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x14014a5c0
cmp r10d, 0x6165fd52
je 0x14014a600
test r11d, r11d
jne 0x14014a5a0
mov rax, qword [rax]
jmp 0x14014a571
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x140150768], rax
call rax
mov rbp, rax
mov dword [rsp + 0x30], 0x63
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r10, qword [0x140150780]
test r10, r10
jne 0x14014a720
mov rcx, qword gs:[0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a6f9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a6f9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe7c136c5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014a6f4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014a6c0
cmp r10d, 0x4e9f114
je 0x14014a701
test r11d, r11d
jne 0x14014a6a0
mov rax, qword [rax]
jmp 0x14014a670
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r10d, dword [rcx + rax*4]
add r10, rbx
mov qword [0x140150780], r10
mov r9d, 2
mov r8b, 0xe6
xor edx, edx
mov rcx, rbp
call r10
mov rdi, qword [0x140150760]
test rdi, rdi
jne 0x14014a80f
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a7e9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a7e9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x6ec449e1
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014a7e4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014a7b0
cmp r10d, 0x2cea1372
je 0x14014a7f1
test r11d, r11d
jne 0x14014a790
mov rax, qword [rax]
jmp 0x14014a760
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edi, dword [rcx + rax*4]
add rdi, rbx
mov qword [0x140150760], rdi
mov edx, 0xfffffff0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x17
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbp
call rdi
mov rdi, qword [0x140150770]
test rdi, rdi
jne 0x14014a8ff
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a8d9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a8d9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xddbca9d9
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014a8d4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014a8a0
cmp r10d, 0x6641d80a
je 0x14014a8e1
test r11d, r11d
jne 0x14014a880
mov rax, qword [rax]
jmp 0x14014a850
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edi, dword [rcx + rax*4]
add rdi, rbx
mov qword [0x140150770], rdi
mov edx, 0xfffffff0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongW]
bts eax, 0x13
mov r8d, eax
mov edx, 0xffffffec
mov rcx, rbp
call rdi
mov rax, qword [0x140150778]
test rax, rax
jne 0x14014a9ef
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14014a9c9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14014a9c9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xe4bef375
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14014a9c4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x14014a990
cmp r10d, 0xa99a0e1a
je 0x14014a9d1
test r11d, r11d
jne 0x14014a970
mov rax, qword [rax]
jmp 0x14014a940
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x140150778], rax
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbp
call rax
mov edx, 0xfffffff0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffaffff
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rdx, [0x140150048]
lea rcx, [rsp + 0x40]
call fcn.140149950
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0xe
jb 0x14014aac6
lea rax, [r8 + 0xe]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0x10
jb 0x14014aa5b
mov rdi, qword [rbx]
lea rax, [0x14014d68e]
mov ebp, 0xe
lea r14, str.current_user:
cmp rax, rdi
jbe 0x14014aa8e
lea rax, [rdi + r8]
cmp r14, rax
ja 0x14014aa8e
cmp rdi, r14
ja 0x14014aa86
mov rsi, r15
jmp 0x14014aa91
mov rsi, rdi
sub rsi, r14
jmp 0x14014aa91
mov rsi, rbp
inc r8
lea rcx, [rdi + 0xe]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub rbp, rsi
lea rdx, [r14 + 0xe]
add rdx, rsi
lea rcx, [rdi + rsi]
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14014aadd
mov ebp, 0xe
mov qword [rsp + 0x28], rbp
mov edx, ebp
mov rcx, rbx
call fcn.14014b090
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r15
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14014ab52
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014ab4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14014ab4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014b5a4
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov rsi, 0xffffffffffffffff
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14014b840
mov rdi, rax
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov rcx, rdi
call fcn.14014b5a4
cmp byte [0x140150044], 0
je 0x14014ac08
lea rcx, str.clicker:_enabled
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov dword [rsp + 0x64], r15d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14014ac7b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014ac76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14014ac76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014b5a4
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14014b220
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret