Function at 0x41026bd0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov edi, r8d
mov rbp, rdx
xor ebx, ebx
mov rax, qword [0x4135c020]
test rax, rax
jne 0x4102654f
lea ecx, [rbx + 0x20]
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x41026545
mov rcx, rax
call fcn.4111c370
jmp 0x41026548
mov rax, rbx
mov qword [0x4135c020], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftKeyboard
mov rcx, rax
call fcn.4111d6d0
mov edx, 8
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, rax
call fcn.410b18d0
xor r8d, r8d
lea edx, [r8 + 8]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x410265c1
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x410265b7
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x410265ba
mov rcx, rbx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 0x64]
call qword [rax + 0x90]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
lea ecx, [r9 + 2]
call fcn.410b5d90
mov rsi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41026ab5
test edi, edi
js 0x41026600
cmp edi, 0xc
jle 0x41026602
mov edi, ebx
mov r8, rsi
mov edx, 8
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
xor edx, edx
mov rcx, rsi
call fcn.410b1950
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x41026654
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x4102664a
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x4102664d
mov rcx, rbx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov edx, 0x64
lea r8d, [rdx - 0x63]
call qword [rax + 0x90]
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x4102669d
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x41026693
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x41026696
mov rcx, rbx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov r8d, edi
mov edx, 0x65
call qword [rax + 0x90]
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x410266e5
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x410266db
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x410266de
mov rcx, rbx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov r8d, edi
mov edx, 0x65
call qword [rax + 0x18]
mov rcx, qword [0x4135c008]
test rcx, rcx
jne 0x4102672a
mov ecx, 8
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x41026720
mov rcx, rax
call fcn.41097220
mov rcx, rax
jmp 0x41026723
mov rcx, rbx
mov qword [0x4135c008], rcx
mov rax, qword [rcx]
mov edx, 0x65
call qword [rax + 0x28]
mov rax, qword [0x4135c020]
test rax, rax
jne 0x41026767
lea ecx, [rax + 0x20]
call fcn.41211580
mov qword [rsp + 0x30], rax
test rax, rax
je 0x4102675d
mov rcx, rax
call fcn.4111c370
jmp 0x41026760
mov rax, rbx
mov qword [0x4135c020], rax
mov r9d, 1
mov r8d, r9d
lea rdx, str.SoftKeyboard
mov rcx, rax
call fcn.4111d6d0
call fcn.410500d0
mov r12d, eax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r13d, dword [rsp + 0x40]
sub r13d, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x44]
sub r14d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x48]
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
sub r8d, r14d
sub r8d, 2
jns 0x410267d2
mov r8d, dword [rsp + 0x54]
add r8d, 2
sub r12d, r13d
cmp edx, r12d
cmovg edx, r12d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r14d
mov r9d, r13d
mov rcx, rsi
call qword [sym.imp.USER32.dll_MoveWindow]
mov edx, 4
mov rcx, rsi
call fcn.410b1950
mov dword [rsp + 0x60], 2
mov byte [rsp + 0x470], 0x20
mov byte [rsp + 0x471], 0x30
mov byte [rsp + 0x472], 0x31
mov byte [rsp + 0x473], 0x32
mov byte [rsp + 0x474], 0x33
mov byte [rsp + 0x475], 0x34
mov byte [rsp + 0x476], 0x35
mov byte [rsp + 0x477], 0x36
mov byte [rsp + 0x478], 0x37
mov byte [rsp + 0x479], 0x38
mov byte [rsp + 0x47a], 0x39
mov byte [rsp + 0x47b], 0x41
mov byte [rsp + 0x47c], 0x42
mov byte [rsp + 0x47d], 0x43
mov byte [rsp + 0x47e], 0x44
mov byte [rsp + 0x47f], 0x45
mov byte [rsp + 0x480], 0x46
mov byte [rsp + 0x481], 0x47
mov byte [rsp + 0x482], 0x48
mov byte [rsp + 0x483], 0x49
mov byte [rsp + 0x484], 0x4a
mov byte [rsp + 0x485], 0x4b
mov byte [rsp + 0x486], 0x4c
mov byte [rsp + 0x487], 0x4d
mov byte [rsp + 0x488], 0x4e
mov byte [rsp + 0x489], 0x4f
mov byte [rsp + 0x48a], 0x50
mov byte [rsp + 0x48b], 0x51
mov byte [rsp + 0x48c], 0x52
mov byte [rsp + 0x48d], 0x53
mov byte [rsp + 0x48e], 0x54
mov byte [rsp + 0x48f], 0x55
mov byte [rsp + 0x490], 0x56
mov byte [rsp + 0x491], 0x57
mov byte [rsp + 0x492], 0x58
mov byte [rsp + 0x493], 0x59
mov byte [rsp + 0x494], 0x5a
mov byte [rsp + 0x495], 0xba
mov byte [rsp + 0x496], 0xbb
mov byte [rsp + 0x497], 0xbc
mov byte [rsp + 0x498], 0xbd
mov byte [rsp + 0x499], 0xbe
mov byte [rsp + 0x49a], 0xbf
mov byte [rsp + 0x49b], 0xc0
mov byte [rsp + 0x49c], 0xdb
mov byte [rsp + 0x49d], 0xdc
mov byte [rsp + 0x49e], 0xdd
mov byte [rsp + 0x49f], 0xde
movsxd rdx, edi
imul rdx, rdx, 0xc4
lea r8, [0x41000000]
nop
nop
movzx ecx, byte [rsp + rbx + 0x470]
movzx eax, word [rdx + r8 + 0x3303b0]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330db0]
mov word [rsp + rcx*2 + 0x264], ax
movzx ecx, byte [rsp + rbx + 0x471]
movzx eax, word [rdx + r8 + 0x3303b2]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330db2]
mov word [rsp + rcx*2 + 0x264], ax
movzx ecx, byte [rsp + rbx + 0x472]
movzx eax, word [rdx + r8 + 0x3303b4]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330db4]
mov word [rsp + rcx*2 + 0x264], ax
movzx ecx, byte [rsp + rbx + 0x473]
movzx eax, word [rdx + r8 + 0x3303b6]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330db6]
mov word [rsp + rcx*2 + 0x264], ax
movzx ecx, byte [rsp + rbx + 0x474]
movzx eax, word [rdx + r8 + 0x3303b8]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330db8]
mov word [rsp + rcx*2 + 0x264], ax
movzx ecx, byte [rsp + rbx + 0x475]
movzx eax, word [rdx + r8 + 0x3303ba]
mov word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rdx + r8 + 0x330dba]
mov word [rsp + rcx*2 + 0x264], ax
add rbx, 6
add rdx, 0xc
cmp rbx, 0x30
jl 0x410269a0
lea r9, [rsp + 0x60]
mov edx, 0x283
mov r8d, 0x18
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.41211b80
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov r8d, edx
mov rdx, qword [rcx + 8]
jmp 0x410264e0