Function at 0x140081bc0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x430
mov rax, qword [0x1404b3fb8]
xor rax, rsp
mov qword [rsp + 0x420], rax
xor r15d, r15d
mov rbp, rcx
mov esi, r15d
lea edx, [r15 + 0x38]
call fcn.14007fa30
mov rbx, rax
test rax, rax
je 0x140081e89
xor eax, eax
mov qword [rsp + 0x458], rdi
mov qword [rbx], rax
lea rcx, str.kernel32.dll
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rsp + 0x460], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetSystemWindowsDirectoryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x200
lea rcx, [rsp + 0x20]
test rax, rax
je 0x140081c5f
call rax
mov edi, eax
jmp 0x140081c8c
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
cmp rdi, 8
jbe 0x140081c8c
lea rcx, [rsp + rdi + 0x18]
lea rdx, str.System32
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140081c8c
sub rdi, 8
mov byte [rsp + rdi + 0x20], sil
mov r14d, 1
test rdi, rdi
je 0x140081cd7
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14007f290
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.14007fd80
test rax, rax
jne 0x140081cc6
mov esi, r14d
jmp 0x140081cd7
mov r8d, 7
mov rdx, rbx
mov rcx, rax
call fcn.140098bb0
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140081d30
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14007f290
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.14007fd80
test rax, rax
jne 0x140081d1a
mov eax, r14d
jmp 0x140081d2e
mov r8d, 7
mov rdx, rbx
mov rcx, rax
call fcn.140098bb0
mov eax, r15d
add esi, eax
lea rdx, [0x140138224]
lea rcx, [rsp + 0x220]
call fcn.14007f290
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.14007fd80
test rax, rax
jne 0x140081d61
mov eax, r14d
jmp 0x140081d75
mov r8d, 7
mov rdx, rbx
mov rcx, rax
call fcn.140098bb0
mov eax, r15d
mov r8d, 0x200
lea rdx, [rsp + 0x20]
xor ecx, ecx
add esi, eax
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140081e0a
lea rcx, [rsp + 0x20]
call fcn.140084420
lea rcx, [rsp + 0x20]
cmp rax, rcx
jbe 0x140081dc5
cmp byte [rax], 0x5c
jne 0x140081db2
test rdi, rdi
jne 0x140081dc1
mov rdi, rax
dec rax
lea rcx, [rsp + 0x20]
cmp rax, rcx
ja 0x140081da5
jmp 0x140081dc5
mov byte [rax + 1], r15b
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14007f290
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.14007fd80
test rax, rax
jne 0x140081df4
mov eax, r14d
jmp 0x140081e08
mov r8d, 7
mov rdx, rbx
mov rcx, rax
call fcn.140098bb0
mov eax, r15d
add esi, eax
lea rcx, str.MYSQL_HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, qword [rsp + 0x458]
test rax, rax
je 0x140081e34
mov r8, rbx
mov rdx, rax
mov rcx, rbp
call fcn.140081aa0
add esi, eax
lea rdx, [0x140135a5a]
lea rcx, [rsp + 0x220]
call fcn.14007f290
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.14007fd80
test rax, rax
je 0x140081e74
mov r8d, 7
mov rdx, rbx
mov rcx, rax
call fcn.140098bb0
mov r14d, r15d
lea eax, [r14 + rsi]
mov r14, qword [rsp + 0x460]
test eax, eax
cmovg rbx, r15
mov rax, rbx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14012e750
mov rbx, qword [rsp + 0x468]
add rsp, 0x430
pop r15
pop rsi
pop rbp
ret