Function at 0x1800093b0
Capabilities:
Get file size
Register raw input devices

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
xor edi, edi
mov ebx, edx
test edx, edx
je 0x1800093cf
mov eax, 0x9673b0f8
mov dword [0x180101cc4], eax
jmp 0x1800093d5
mov eax, dword [0x180101cc4]
cmp eax, 0xc4e2f5
jne 0x1800095cc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
xor r8d, r8d
lea rcx, str.LLe31NEGI5E28LfQfw6
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov r9d, dword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor r9d, r9d
lea rdx, str.p8HG7itT6sJg5X8mPY9Crf7
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
xor r9d, r9d
lea rdx, str.uHN17RFYvuoxHBXgSo2J75qAHaQz
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
lea rax, str.Ysdg5UhjE8h1PznB7ih7Ybl6Ke
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, str.spxZ69Yzmt6BO8nQ8NgOXVB2
mov dword [rsp + 0x28], edi
lea rcx, str.ZHdqjbV9tRVC14XuP91L2
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetDateFormatEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
mov qword [rsp + 0x48], rdi
lea rax, str.nPUce4fYdkUOPwRk3
mov qword [rsp + 0x40], rdi
lea r8, str.qZvAhafRpNdCXhg61CvyG5LMTyAEO
mov qword [rsp + 0x38], rdi
lea rcx, str.RVt7d6o5aM6R52Mw6
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
mov eax, edi
xchg dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov qword [rsp + 0x38], rdi
lea rax, str.2ak1h3c1m5O2j14
mov qword [rsp + 0x30], rax
lea r8, str.mfyVdyz7YvoiQRAAdB7s9snbHx
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, 1
jne 0x1800095fe
mov ecx, 0x29d
lea rax, [0x180008f00]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000da5c
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rdi
ret