Function at 0x140018830
Capabilities:
Get common file path
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5e8]
sub rsp, 0x6c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400731a0]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
lea rbx, [0x1400755f0]
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x30], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
nop
xor r13d, r13d
movzx r14d, r13w
movzx esi, r13w
mov word [rbp + 0x190], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x192]
call fcn.140020fe0
lea r15d, [r13 + 2]
mov rax, qword [0x140073110]
mov ecx, 0xf00dbaad
lea r12, [0x140075600]
cmp rax, rcx
jne 0x140018ffe
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
movzx r14d, ax
mov eax, 0x3ff
and r14w, ax
shr si, 0xa
lea edx, [r13 + 0x50]
lea rbx, [0x140075330]
mov rcx, rbx
lea r8, str.Arial_10__
sub r8, rbx
lea rax, [rdx + 0x7fffffae]
test rax, rax
je 0x140018927
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140018927
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x140018904
jmp 0x14001892c
test rdx, rdx
jne 0x14001892f
sub rcx, r15
mov word [rcx], r13w
movzx eax, r14w
dec eax
lea rdi, str.NVWRSENU.dll
mov r8d, 1
cmp eax, 0x23
ja case.0x140018962.2
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x19084]
add rcx, rdx
jmp rcx
lea r8, str.NVWRSAR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPAR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
lea r8, str.Arabic_Transparent_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x140018df3
movzx ecx, si
dec ecx
je 0x140018a00
dec ecx
je 0x1400189c0
dec ecx
je 0x140018a00
dec ecx
je 0x1400189c0
dec ecx
je 0x140018a00
jmp case.0x140018962.2
lea r8, str.NVWRSZHC.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPZHC.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
lea r8, str.SimHei_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x140018df3
lea r8, str.NVWRSZHT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPZHT.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
lea r8, str.MingLiU_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x140018df3
lea r8, str.NVWRSDA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPDA.chm
jmp 0x140018de7
movzx eax, si
add eax, 0xfffffffe
test eax, 0xfffffffb
jne 0x140018a99
lea r8, str.NVWRSENG.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPENG.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
mov r8, rdi
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
mov r8d, 1
mov esi, r8d
jmp case.0x140018962.2
lea r8, str.NVWRSDE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPDE.chm
jmp 0x140018de7
lea r8, str.NVWRSFI.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPFI.chm
jmp 0x140018de7
lea r8, str.NVWRSFR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPFR.chm
jmp 0x140018de7
movzx eax, si
cmp eax, r8d
je 0x140018b49
cmp eax, r15d
je 0x140018b69
cmp eax, 3
je 0x140018b49
add eax, 0xfffffffc
cmp eax, 0x10
jbe 0x140018b69
lea r8, str.NVWRSES.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPES.chm
jmp 0x140018de7
lea r8, str.NVWRSESM.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPESM.chm
jmp 0x140018de7
lea r8, str.NVWRSIT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPIT.chm
jmp 0x140018de7
lea r8, str.NVWRSJA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPJA.chm
jmp 0x140018de7
lea r8, str.NVWRSKO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPKO.chm
jmp 0x140018de7
lea r8, str.NVWRSNL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPNL.chm
jmp 0x140018de7
lea r8, str.NVWRSNO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPNO.chm
jmp 0x140018de7
lea r8, str.NVWRSRU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPRU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
lea r8, str.Microsoft_Sans_Serif_8__
mov edx, 0xa0
mov rcx, rbx
jmp 0x140018df3
lea r8, str.NVWRSSV.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPSV.chm
jmp 0x140018de7
lea r8, str.NVWRSTH.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPTH.chm
jmp 0x140018de7
movzx ecx, si
dec ecx
je 0x140018cd8
dec ecx
jne case.0x140018962.2
lea r8, str.NVWRSPT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPPT.chm
jmp 0x140018de7
lea r8, str.NVWRSPTB.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPPTB.chm
jmp 0x140018de7
lea r8, str.NVWRSCS.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPCS.chm
jmp 0x140018de7
lea r8, str.NVWRSEL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPEL.chm
jmp 0x140018de7
lea r8, str.NVWRSHE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPHE.chm
jmp 0x140018c44
lea r8, str.NVWRSHU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPHU.chm
jmp 0x140018de7
lea r8, str.NVWRSPL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPPL.chm
jmp 0x140018de7
lea r8, str.NVWRSSK.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPSK.chm
jmp 0x140018de7
lea r8, str.NVWRSSL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPSL.chm
jmp 0x140018de7
lea r8, str.NVWRSTR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.14001a410
lea r8, str.NVWCPTR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.14001a410
mov r8d, 1
mov ebx, 0x104
cmp word [0x140075600], r13w
jne 0x140018e58
mov edx, ebx
mov rcx, r12
sub rdi, r12
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140018e42
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140018e42
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x140018e20
jmp 0x140018e47
test rdx, rdx
jne 0x140018e4a
sub rcx, r15
mov word [rcx], r13w
mov r14d, 9
movzx esi, r8w
mov word [rbp + 0x3a0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call fcn.140020fe0
mov dword [rsp + 0x40], r13d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x44]
call fcn.140020fe0
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14001a340
mov rcx, rbx
lea rax, [rbp + 0x3a0]
nop dword [rax]
cmp word [rax], r13w
je 0x140018ed0
add rax, r15
dec rcx
jne 0x140018ec0
jmp 0x140018f36
test rcx, rcx
je 0x140018f36
mov rdx, rbx
sub rdx, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rbx
sub rcx, rdx
lea rax, [rbp + 0x3a0]
lea rax, [rax + rdx*2]
je 0x140018f2d
add rdx, 0x7ffffefa
add rdx, rcx
lea r9, [rbp + 0x190]
sub r9, rax
test rdx, rdx
je 0x140018f28
movzx r8d, word [rax + r9]
test r8w, r8w
je 0x140018f28
mov word [rax], r8w
add rax, r15
dec rdx
dec rcx
jne 0x140018f07
jmp 0x140018f2d
test rcx, rcx
jne 0x140018f30
sub rax, r15
mov word [rax], r13w
jmp 0x140018f3b
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140018f95
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14001a340
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14001a340
lea r8, str.::_nviewhlp_loc.txt
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14001a340
lea rcx, [0x1400753d0]
lea rdx, [rbp + 0x3a0]
sub rdx, rcx
nop
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140018fe2
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140018fe2
mov word [rcx], ax
add rcx, r15
dec rbx
jne 0x140018fc0
jmp 0x140018fe7
test rbx, rbx
jne 0x140018fea
sub rcx, r15
mov word [rcx], r13w
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rbx, [0x1400755f0]
cmp word [0x140075600], r13w
je 0x140019045
mov rcx, r12
call fcn.140015450
test rax, rax
cmovne r15d, r13d
test r15d, r15d
jne 0x140019045
mov qword [0x140073110], rax
inc word [0x1400755f8]
cmp r14w, 9
jne 0x14001903e
cmp si, 1
mov byte [0x1400755d8], 1
je 0x140019045
mov byte [0x1400755d8], r13b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, r15d
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.140020e30
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret