Function at 0x140011750
Capabilities:
Check for foreground window switch
Get graphical window text
Get session user name
Read file via mapping

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140084060]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor edx, edx
lea r8, str.GlobalWesl
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
je 0x1400119f9
xor r9d, r9d
mov qword [rsp + 0x20], 0x9c6
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x140088338], rax
test rax, rax
je 0x1400119f9
lea rcx, [rax + 0x7d0]
mov dword [rbp - 0x29], 0xfa
lea rdx, [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400119f9
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xa8], r12
xor r12d, r12d
mov qword [rsp + 0xa0], r13
mov r13, 0xffffffffffffffff
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x90], r15
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
je 0x1400118a0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
mov eax, 2
movsxd rcx, ebx
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.14003bc90
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r8, r13
mov qword [rbp + 7], r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x1f], 7
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], r12w
jne 0x140011870
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.1400023b0
mov rcx, rdi
call fcn.14003ba0c
movups xmm0, xmmword [rbp + 7]
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm1
jmp 0x1400118c3
xor r8d, r8d
mov qword [rbp - 0x19], r12
lea rdx, [0x140078c80]
mov qword [rbp - 9], r12
lea rcx, [rbp - 0x19]
mov qword [rbp - 1], 7
call fcn.1400023b0
mov r14, qword [0x140088338]
xor edx, edx
mov rcx, r14
mov r8d, 0x7d0
call fcn.14003e230
mov rax, qword [rbp - 9]
lea rbx, [rbp - 0x19]
mov r15, qword [rbp - 1]
mov rdi, qword [rbp - 0x19]
cmp r15, 8
lea rsi, [rax + rax]
cmovae rbx, rdi
test rsi, rsi
je 0x140011966
test r14, r14
jne 0x14001190d
call fcn.140041ebc
mov dword [rax], socket
jmp 0x140011961
test rbx, rbx
je 0x14001192b
cmp rsi, 0x7ce
ja 0x14001192b
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.14003dae0
jmp 0x140011966
xor edx, edx
mov r8d, 0x7ce
mov rcx, r14
call fcn.14003e230
test rbx, rbx
jne 0x14001194d
call fcn.140041ebc
mov dword [rax], socket
jmp 0x140011961
cmp rsi, 0x7ce
jbe 0x140011966
call fcn.140041ebc
mov dword [rax], 0x22
call fcn.140042fa0
lea rcx, [rbp - 0x21]
mov qword [rbp - 0x21], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400119a0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rbp - 0x1d]
sub rax, rcx
cmp rax, 0x7530
jbe 0x1400119a0
mov rax, qword [0x140088338]
mov byte [rax + 0x9c4], 0x31
jmp 0x1400119ae
mov rax, qword [0x140088338]
mov byte [rax + 0x9c4], 0x30
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r15, 8
jb 0x140011815
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400119ec
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011a0e
mov rcx, rdi
call fcn.14003ba0c
jmp 0x140011815
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14003b9b0
add rsp, 0xb0
pop rbp
ret
call fcn.140042fc0
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
int3