Function at 0x1400140e0
Capabilities:
Get common file path
Identify system language via api

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5e8]
sub rsp, 0x6c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140074150]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
lea rbx, [0x140076ad0]
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x30], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
nop
xor r13d, r13d
movzx r14d, r13w
movzx esi, r13w
mov word [rbp + 0x190], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x192]
call fcn.14001cc90
lea r15d, [r13 + 2]
mov rax, qword [0x1400740b8]
mov ecx, 0xf00dbaad
lea r12, [0x140076ae0]
cmp rax, rcx
jne 0x1400148ae
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
movzx r14d, ax
mov eax, 0x3ff
and r14w, ax
shr si, 0xa
lea edx, [r13 + 0x50]
lea rbx, [0x140076810]
mov rcx, rbx
lea r8, str.Arial_10__
sub r8, rbx
lea rax, [rdx + 0x7fffffae]
test rax, rax
je 0x1400141d7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400141d7
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x1400141b4
jmp 0x1400141dc
test rdx, rdx
jne 0x1400141df
sub rcx, r15
mov word [rcx], r13w
movzx eax, r14w
dec eax
lea rdi, str.NVWRSENU.dll
mov r8d, 1
cmp eax, 0x23
ja case.0x140014212.2
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x14934]
add rcx, rdx
jmp rcx
lea r8, str.NVWRSAR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPAR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
lea r8, str.Arabic_Transparent_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x1400146a3
movzx ecx, si
dec ecx
je 0x1400142b0
dec ecx
je 0x140014270
dec ecx
je 0x1400142b0
dec ecx
je 0x140014270
dec ecx
je 0x1400142b0
jmp case.0x140014212.2
lea r8, str.NVWRSZHC.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPZHC.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
lea r8, str.SimHei_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x1400146a3
lea r8, str.NVWRSZHT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPZHT.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
lea r8, str.MingLiU_10__
mov edx, 0xa0
mov rcx, rbx
jmp 0x1400146a3
lea r8, str.NVWRSDA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPDA.chm
jmp 0x140014697
movzx eax, si
add eax, 0xfffffffe
test eax, 0xfffffffb
jne 0x140014349
lea r8, str.NVWRSENG.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPENG.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
mov r8, rdi
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
mov r8d, 1
mov esi, r8d
jmp case.0x140014212.2
lea r8, str.NVWRSDE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPDE.chm
jmp 0x140014697
lea r8, str.NVWRSFI.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPFI.chm
jmp 0x140014697
lea r8, str.NVWRSFR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPFR.chm
jmp 0x140014697
movzx eax, si
cmp eax, r8d
je 0x1400143f9
cmp eax, r15d
je 0x140014419
cmp eax, 3
je 0x1400143f9
add eax, 0xfffffffc
cmp eax, 0x10
jbe 0x140014419
lea r8, str.NVWRSES.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPES.chm
jmp 0x140014697
lea r8, str.NVWRSESM.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPESM.chm
jmp 0x140014697
lea r8, str.NVWRSIT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPIT.chm
jmp 0x140014697
lea r8, str.NVWRSJA.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPJA.chm
jmp 0x140014697
lea r8, str.NVWRSKO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPKO.chm
jmp 0x140014697
lea r8, str.NVWRSNL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPNL.chm
jmp 0x140014697
lea r8, str.NVWRSNO.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPNO.chm
jmp 0x140014697
lea r8, str.NVWRSRU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPRU.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
lea r8, str.Microsoft_Sans_Serif_8__
mov edx, 0xa0
mov rcx, rbx
jmp 0x1400146a3
lea r8, str.NVWRSSV.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPSV.chm
jmp 0x140014697
lea r8, str.NVWRSTH.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPTH.chm
jmp 0x140014697
movzx ecx, si
dec ecx
je 0x140014588
dec ecx
jne case.0x140014212.2
lea r8, str.NVWRSPT.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPPT.chm
jmp 0x140014697
lea r8, str.NVWRSPTB.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPPTB.chm
jmp 0x140014697
lea r8, str.NVWRSCS.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPCS.chm
jmp 0x140014697
lea r8, str.NVWRSEL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPEL.chm
jmp 0x140014697
lea r8, str.NVWRSHE.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPHE.chm
jmp 0x1400144f4
lea r8, str.NVWRSHU.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPHU.chm
jmp 0x140014697
lea r8, str.NVWRSPL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPPL.chm
jmp 0x140014697
lea r8, str.NVWRSSK.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPSK.chm
jmp 0x140014697
lea r8, str.NVWRSSL.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPSL.chm
jmp 0x140014697
lea r8, str.NVWRSTR.DLL
mov edx, 0x208
mov rcx, r12
call fcn.1400012d5
lea r8, str.NVWCPTR.chm
mov edx, 0x208
lea rcx, [rbp + 0x190]
call fcn.1400012d5
mov r8d, 1
mov ebx, 0x104
cmp word [0x140076ae0], r13w
jne 0x140014708
mov edx, ebx
mov rcx, r12
sub rdi, r12
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400146f2
movzx eax, word [rcx + rdi]
test ax, ax
je 0x1400146f2
mov word [rcx], ax
add rcx, r15
dec rdx
jne 0x1400146d0
jmp 0x1400146f7
test rdx, rdx
jne 0x1400146fa
sub rcx, r15
mov word [rcx], r13w
mov r14d, 9
movzx esi, r8w
mov word [rbp + 0x3a0], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3a2]
call fcn.14001cc90
mov dword [rsp + 0x40], r13d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x44]
call fcn.14001cc90
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14000131b
mov rcx, rbx
lea rax, [rbp + 0x3a0]
nop dword [rax]
cmp word [rax], r13w
je 0x140014780
add rax, r15
dec rcx
jne 0x140014770
jmp 0x1400147e6
test rcx, rcx
je 0x1400147e6
mov rdx, rbx
sub rdx, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rbx
sub rcx, rdx
lea rax, [rbp + 0x3a0]
lea rax, [rax + rdx*2]
je 0x1400147dd
add rdx, 0x7ffffefa
add rdx, rcx
lea r9, [rbp + 0x190]
sub r9, rax
test rdx, rdx
je 0x1400147d8
movzx r8d, word [rax + r9]
test r8w, r8w
je 0x1400147d8
mov word [rax], r8w
add rax, r15
dec rdx
dec rcx
jne 0x1400147b7
jmp 0x1400147dd
test rcx, rcx
jne 0x1400147e0
sub rax, r15
mov word [rax], r13w
jmp 0x1400147eb
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140014845
mov edx, ebx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.help_
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14000131b
lea r8, str.NVWCPENU.chm
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14000131b
lea r8, str.::_nviewhlp_loc.txt
mov edx, 0x208
lea rcx, [rbp + 0x3a0]
call fcn.14000131b
lea rcx, [0x1400768b0]
lea rdx, [rbp + 0x3a0]
sub rdx, rcx
nop
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140014892
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140014892
mov word [rcx], ax
add rcx, r15
dec rbx
jne 0x140014870
jmp 0x140014897
test rbx, rbx
jne 0x14001489a
sub rcx, r15
mov word [rcx], r13w
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rbx, [0x140076ad0]
cmp word [0x140076ae0], r13w
je 0x1400148f5
mov rcx, r12
call fcn.140017830
test rax, rax
cmovne r15d, r13d
test r15d, r15d
jne 0x1400148f5
mov qword [0x1400740b8], rax
inc word [0x140076ad8]
cmp r14w, 9
jne 0x1400148ee
cmp si, 1
mov byte [0x140076ab8], 1
je 0x1400148f5
mov byte [0x140076ab8], r13b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, r15d
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.14001cc60
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret