Function at 0x14000c480
Capabilities:
Get common file path
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5e8]
sub rsp, 0x6c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140057130]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
lea rbx, [0x1400594c0]
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x30], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
nop
xor r13d, r13d
movzx r14d, r13w
movzx esi, r13w
mov word [rbp + 0x190], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x192]
call fcn.1400150f0
lea r15d, [r13 + 2]
mov rax, qword [0x140057090]
mov ecx, 0xf00dbaad
lea r12, [0x1400594d0]
cmp rax, rcx
jne 0x14000cc4e
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
movzx r14d, ax
mov eax, 0x3ff
and r14w, ax
shr si, 0xa
lea edx, [r13 + 0x50]
lea rbx, [0x140059200]
mov rcx, rbx
lea r8, str.Arial_10__
sub r8, rbx
lea rax, [rdx + 0x7fffffae]
test rax, rax
je 0x14000c577
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000c577
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x14000c554
jmp 0x14000c57c
test rdx, rdx
jne 0x14000c57f
sub rcx, r15
mov word [rcx], r13w
movzx eax, r14w
dec eax
lea rdi, str.NVWRSENU.dll
mov r8d, 1
cmp eax, 0x23
ja case.0x14000c5b2.2
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xccd4]
add rcx, rdx
jmp rcx
lea r8, str.NVWRSAR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPAR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
lea r8, str.Arabic_Transparent_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x14000ca43
movzx ecx, si
dec ecx
je 0x14000c650
dec ecx
je 0x14000c610
dec ecx
je 0x14000c650
dec ecx
je 0x14000c610
dec ecx
je 0x14000c650
jmp case.0x14000c5b2.2
lea r8, str.NVWRSZHC.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPZHC.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
lea r8, str.SimHei_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x14000ca43
lea r8, str.NVWRSZHT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPZHT.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
lea r8, str.MingLiU_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x14000ca43
lea r8, str.NVWRSDA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPDA.chm
jmp 0x14000ca37
movzx eax, si
add eax, 0xfffffffe
test eax, 0xfffffffb
jne 0x14000c6e9
lea r8, str.NVWRSENG.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPENG.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
mov r8, rdi
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
mov r8d, 1
mov esi, r8d
jmp case.0x14000c5b2.2
lea r8, str.NVWRSDE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPDE.chm
jmp 0x14000ca37
lea r8, str.NVWRSFI.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPFI.chm
jmp 0x14000ca37
lea r8, str.NVWRSFR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPFR.chm
jmp 0x14000ca37
movzx eax, si
cmp eax, r8d
je 0x14000c799
cmp eax, r15d
je 0x14000c7b9
cmp eax, 3
je 0x14000c799
add eax, 0xfffffffc
cmp eax, 0x10
jbe 0x14000c7b9
lea r8, str.NVWRSES.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPES.chm
jmp 0x14000ca37
lea r8, str.NVWRSESM.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPESM.chm
jmp 0x14000ca37
lea r8, str.NVWRSIT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPIT.chm
jmp 0x14000ca37
lea r8, str.NVWRSJA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPJA.chm
jmp 0x14000ca37
lea r8, str.NVWRSKO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPKO.chm
jmp 0x14000ca37
lea r8, str.NVWRSNL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPNL.chm
jmp 0x14000ca37
lea r8, str.NVWRSNO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPNO.chm
jmp 0x14000ca37
lea r8, str.NVWRSRU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPRU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
lea r8, str.Microsoft_Sans_Serif_8__
mov edx, 0xa0
mov rcx, rbx
jmp 0x14000ca43
lea r8, str.NVWRSSV.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPSV.chm
jmp 0x14000ca37
lea r8, str.NVWRSTH.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPTH.chm
jmp 0x14000ca37
movzx ecx, si
dec ecx
je 0x14000c928
dec ecx
jne case.0x14000c5b2.2
lea r8, str.NVWRSPT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPPT.chm
jmp 0x14000ca37
lea r8, str.NVWRSPTB.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPPTB.chm
jmp 0x14000ca37
lea r8, str.NVWRSCS.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPCS.chm
jmp 0x14000ca37
lea r8, str.NVWRSEL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPEL.chm
jmp 0x14000ca37
lea r8, str.NVWRSHE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPHE.chm
jmp 0x14000c894
lea r8, str.NVWRSHU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPHU.chm
jmp 0x14000ca37
lea r8, str.NVWRSPL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPPL.chm
jmp 0x14000ca37
lea r8, str.NVWRSSK.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPSK.chm
jmp 0x14000ca37
lea r8, str.NVWRSSL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPSL.chm
jmp 0x14000ca37
lea r8, str.NVWRSTR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.140002cf0
lea r8, str.NVWCPTR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.140002cf0
mov r8d, 1
mov ebx, 0x104
cmp word [0x1400594d0], r13w
jne 0x14000caa8
mov edx, ebx
mov rcx, r12
sub rdi, r12
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000ca92
movzx eax, word [rcx + rdi]
test ax, ax
je 0x14000ca92
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x14000ca70
jmp 0x14000ca97
test rdx, rdx
jne 0x14000ca9a
sub rcx, r15
mov word [rcx], r13w
mov r14d, 9
movzx esi, r8w
mov word [rbp + 0x3a0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call fcn.1400150f0
mov dword [rsp + 0x40], r13d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x44]
call fcn.1400150f0
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.140006eb0
mov rcx, rbx
lea rax, [rbp + 0x3a0]
nop dword [rax]
cmp word [rax], r13w
je 0x14000cb20
add rax, r15
dec rcx
jne 0x14000cb10
jmp 0x14000cb86
test rcx, rcx
je 0x14000cb86
mov rdx, rbx
sub rdx, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rbx
sub rcx, rdx
lea rax, [rbp + 0x3a0]
lea rax, [rax + rdx*2]
je 0x14000cb7d
add rdx, 0x7ffffefa
add rdx, rcx
lea r9, [rbp + 0x190]
sub r9, rax
test rdx, rdx
je 0x14000cb78
movzx r8d, word [rax + r9]
test r8w, r8w
je 0x14000cb78
mov word [rax], r8w
add rax, r15
dec rdx
dec rcx
jne 0x14000cb57
jmp 0x14000cb7d
test rcx, rcx
jne 0x14000cb80
sub rax, r15
mov word [rax], r13w
jmp 0x14000cb8b
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cbe5
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.140006eb0
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.140006eb0
lea r8, str.::_nviewhlp_loc.txt
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.140006eb0
lea rcx, [0x1400592a0]
lea rdx, [rbp + 0x3a0]
sub rdx, rcx
nop
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x14000cc32
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14000cc32
mov word [rcx], ax
add rcx, r15
dec rbx
jne 0x14000cc10
jmp 0x14000cc37
test rbx, rbx
jne 0x14000cc3a
sub rcx, r15
mov word [rcx], r13w
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rbx, [0x1400594c0]
cmp word [0x1400594d0], r13w
je 0x14000cc95
mov rcx, r12
call fcn.14000fdb0
test rax, rax
cmovne r15d, r13d
test r15d, r15d
jne 0x14000cc95
mov qword [0x140057090], rax
inc word [0x1400594c8]
cmp r14w, 9
jne 0x14000cc8e
cmp si, 1
mov byte [0x1400594a8], 1
je 0x14000cc95
mov byte [0x1400594a8], r13b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, r15d
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.1400150c0
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret