Function at 0x14015bd61
Capabilities:
Get keyboard layout
Get session user name

Disassembly:
push rbp
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov word [rbp - 2], 0x12e3
mov word [rbp + 0x8e], 0x4cbc
movzx eax, word [rbp + 0x8e]
cmp ax, 0x17e8
jg 0x14015be92
mov rax, qword [rbp + 0x140]
mov edx, 0x1e
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetSubMenu]
call rax
mov qword [rbp + 0xb0], rax
call fcn.14015bd61
movzx eax, word [rbp + 0x8e]
add eax, 0x11
mov word [rbp + 0x8e], ax
mov edx, 0xce
mov ecx, 0x6d
call fcn.14015b610
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0x8e]
mov rax, qword [rbp + 0x138]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd
mov r9, rcx
mov r8, rdx
mov edx, 0x55
mov ecx, 0x85
mov rax, qword [sym.imp.USER32.dll_ToAsciiEx]
call rax
mov dword [rbp + 0xa0], eax
movzx eax, word [rbp + 0x8e]
and ax, 0x77b2
mov word [rbp + 0x8e], ax
mov edx, 0x79
mov ecx, 0x46
call fcn.14015b610
movzx eax, word [rbp + 0x8e]
xor ax, 0x29de
mov word [rbp + 0x8e], ax
lea rax, [rbp + 0xb0]
mov rdx, rax
mov ecx, 0x13
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
call rax
mov dword [rbp + 0x9c], eax
call fcn.14015bd61
mov rax, rbp
mov edx, 0xb0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharUpperBuffA]
call rax
mov dword [rbp + 0xbc], eax
mov dword [rbp + 0xbc], 0xf28eeba1
jmp 0x14015bec2
movzx eax, word [rbp + 0x8e]
cmp ax, 0x36ed
jne 0x14015bec2
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x148]
mov r8d, 7
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetClassNameA]
call rax
mov dword [rbp + 0x154], eax
movzx eax, word [rbp + 0x8e]
cwde
mov edx, 0x32f2
mov ecx, edx
sar eax, cl
cmp eax, 0x54f4
jle 0x14015bef4
movzx eax, word [rbp + 0x8e]
cwde
mov r8d, 0xd4
mov edx, 0x44
mov ecx, eax
call fcn.140001729
movzx eax, word [rbp + 0x8e]
or ax, 0x3680
mov word [rbp - 2], ax
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x80], rax
movabs rax, 0x24dc0f70fb94aa6a
mov qword [rbp + 0x168], rax
lea rax, [rbp + 0xbc]
mov qword [rbp + 0x130], rax
movabs rax, 0x2aef5fa4519b82f2
cmp qword [rbp + 0x168], rax
jg 0x14015c41d
mov eax, dword [rbp + 0xbc]
mov dword [rbp + 0x164], eax
movabs rax, 0xf1d38ee6b55d543
cmp qword [rbp + 0x168], rax
je 0x14015c047
movabs rax, 0x556167c5a96168e4
cmp qword [rbp + 0x168], rax
jne 0x14015c085
lea rdx, [rbp + 0x80]
mov rax, qword [rbp + 0x128]
mov dword [rsp + 0x20], 0x86
mov r9, rdx
mov r8d, 0x69
lea rdx, str.quagmire_Priapic_Hardy_hunt
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DrawTextA]
call rax
mov dword [rbp + 0x9c], eax
mov rax, qword [rbp + 0x80]
mov ecx, dword [rax]
mov edx, dword [rbp + 0xa0]
mov rax, qword [rbp + 0xc0]
and edx, ecx
mov dword [rax], edx
mov rdx, qword [rbp + 0x168]
mov rax, qword [rbp + 0x168]
mov rcx, rax
call fcn.14015b610
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
mov dword [rbp + 0xbc], eax
mov edx, dword [rbp + 0xbc]
mov eax, dword [rbp + 0x164]
add edx, eax
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
mov rax, qword [rbp + 0xc8]
lea rdx, [rbp + 0xb0]
mov r8, rdx
mov edx, 0xa5
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetScrollBarInfo]
call rax
mov dword [rbp + 0x124], eax
jmp 0x14015c085
mov eax, dword [rbp + 0xbc]
sub eax, dword [rbp + 0x164]
mov edx, eax
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
movzx eax, word [rbp - 2]
sub ax, 0x2aec
mov word [rbp + 0x8e], ax
mov edx, dword [rbp + 0xbc]
mov eax, dword [rbp + 0x164]
add edx, eax
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
nop
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
test eax, eax
jne 0x14015c10b
movabs rax, 0xf21d1eebe8c250d
cmp qword [rbp + 0x168], rax
jne 0x14015c0d4
movabs rax, 0x1b790ec17526379d
xor qword [rbp + 0x168], rax
lea rax, [rbp + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetCaretPos]
call rax
mov dword [rbp + 0x120], eax
jmp 0x14015c1bb
movabs rax, 0x544b0b25602a2533
mov qword [rbp + 0x158], rax
mov byte [rbp - 0x41], 0x77
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
mov dword [rbp + 0xa4], eax
jmp 0x14015c1bb
movzx eax, word [rbp - 2]
movsx ecx, ax
mov rax, qword [rbp + 0x80]
mov edx, dword [rax]
mov rax, qword [rbp + 0x90]
mov dword [rsp + 0x20], 0xb8
mov r9d, ecx
mov r8d, edx
mov rdx, rax
mov ecx, 0xf0
call fcn.14015b080
movabs rax, 0x6d0f1fb27486b882
cmp qword [rbp + 0x168], rax
jne 0x14015c19f
mov r8d, dword [rbp + 0x9c]
mov rax, qword [rbp + 0xc0]
mov edx, dword [rbp + 0x154]
mov ecx, edx
sar r8d, cl
mov edx, r8d
mov dword [rax], edx
lea rdx, [rbp + 0xc8]
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
mov dword [rbp + 0x114], eax
movzx eax, word [rbp + 0x8e]
and ax, 0x354c
mov word [rbp - 2], ax
jmp 0x14015c1ba
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax]
mov edx, dword [rbp + 0xa0]
mov rax, qword [rbp + 0x80]
add edx, ecx
mov dword [rax], edx
nop
nop
movabs rdx, 0x49cbf08b779a77a2
mov rax, qword [rbp + 0x158]
add rax, rdx
mov rdx, qword [rbp + 0x90]
cmp rdx, rax
jae 0x14015c38d
mov edx, dword [rbp + 0xbc]
mov eax, dword [rbp + 0xa4]
sub edx, eax
mov dword [rbp + 0x164], edx
lea rax, [rbp + 0x9c]
mov qword [rbp + 0x108], rax
lea rax, [rbp - 0x41]
mov qword [rbp + 0x100], rax
movabs rax, 0x24dc0f70fb94aa6a
cmp qword [rbp + 0x168], rax
jne 0x14015c23a
lea rax, [rbp + 0xbc]
mov qword [rbp + 0xf8], rax
lea rax, [rbp - 2]
mov qword [rbp + 0xf0], rax
jmp 0x14015c29c
mov eax, dword [rbp + 0x9c]
mov edx, dword [rbp + 0x154]
mov ecx, eax
shl edx, cl
mov rax, qword [rbp + 0x108]
mov dword [rax], edx
movabs rax, 0x82b86d9c8c1be1d4
or rax, qword [rbp + 0x158]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x108]
mov ecx, dword [rax]
movzx eax, word [rbp + 0x8e]
cwde
mov edx, dword [rbp + 0x154]
mov dword [rsp + 0x20], edx
mov r9d, 2
mov r8d, ecx
mov edx, eax
mov ecx, 0x20
call fcn.1400017de
nop
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
mov dword [rbp + 0xbc], eax
lea rdx, [rbp + 0xa8]
mov rax, qword [rbp + 0xe8]
mov r9, rdx
mov r8d, 9
mov edx, 9
mov rcx, rax
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
cmp eax, 0x11a0c19d
je 0x14015c2ed
cmp eax, 0xbf21c21d
jmp 0x14015c34c
movzx eax, word [rbp - 2]
movsx ecx, ax
mov rax, qword [rbp + 0x80]
mov edx, dword [rax]
mov rax, qword [rbp + 0x90]
mov dword [rsp + 0x20], 0x2b
mov r9d, ecx
mov r8d, edx
mov rdx, rax
mov ecx, 0x35
call fcn.14015b080
lea rcx, [rbp + 0xb0]
lea rdx, [rbp + 0x90]
mov rax, qword [rbp + 0xe8]
mov r9, rcx
mov r8d, 0xe6
mov rcx, rax
call sub.WINSPOOL.DRV_WritePrinter
mov dword [rbp + 0x124], eax
nop
mov ecx, dword [rbp + 0x9c]
mov edx, dword [rbp + 0xa0]
mov rax, qword [rbp + 0x80]
add edx, ecx
mov dword [rax], edx
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
sub eax, 0x47
mov byte [rbp - 0x41], al
mov rax, qword [rbp + 0x80]
mov edx, dword [rax]
mov eax, dword [rbp + 0x154]
add edx, eax
mov rax, qword [rbp + 0x108]
mov dword [rax], edx
lea rdx, [rbp + 0xa4]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
mov dword [rbp + 0x120], eax
mov rdx, qword [rbp + 0x168]
mov rax, qword [rbp + 0x168]
mov rcx, rax
call fcn.14015b610
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
sub eax, dword [rbp + 0x164]
mov edx, eax
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
movabs rax, 0x501c9a331344b05e
add qword [rbp + 0x168], rax
mov rax, qword [rbp + 0xa8]
mov rcx, rax
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0xc0]
mov edx, dword [rax]
mov rax, qword [rbp + 0x80]
and edx, dword [rbp + 0x154]
mov dword [rax], edx
jmp 0x14015c455
movzx eax, word [rbp + 0x8e]
cwde
mov edx, 0x3c13
mov ecx, edx
shl eax, cl
mov edx, eax
movzx eax, word [rbp - 2]
cwde
cmp edx, eax
jge 0x14015c455
movzx eax, word [rbp + 0x8e]
cwde
mov rdx, qword [rbp + 0x168]
mov r8d, 8
mov ecx, eax
call fcn.140001729
mov rax, qword [rbp + 0x80]
mov eax, dword [rax]
cmp eax, 0x78b8acf
jne 0x14015c4b9
mov eax, dword [rbp + 0xbc]
lea edx, [rax + 0x6ae12fa9]
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
mov eax, dword [rbp + 0x154]
mov dword [rbp + 0xa0], eax
mov ecx, 0x6a
mov rax, qword [sym.imp.USER32.dll_IsCharAlphaNumericA]
call rax
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x80]
mov edx, dword [rax]
mov rax, qword [rbp + 0xc0]
sub ecx, edx
mov dword [rax], ecx
jmp 0x14015c4c9
mov rax, qword [rbp + 0x130]
mov eax, dword [rax]
mov dword [rbp + 0xbc], eax
nop
mov eax, 0x31
add rsp, 0x1f0
pop rbp
ret