Function at 0x14002f3b0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov edx, 0x38
mov ecx, 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov qword [0x14049cc08], rax
test rax, rax
je 0x14002f5f6
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
xor esi, esi
test eax, eax
je 0x14002f5b6
mov rdi, qword [0x14049cc08]
mov ebx, esi
mov r9, rdi
nop dword [rax]
mov rax, qword [r9]
test rax, rax
je 0x14002f457
lea r8, [rsp + 0x20]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002f443
inc rax
test ecx, ecx
jne 0x14002f430
test edx, edx
je 0x14002f46b
inc ebx
add r9, 8
cmp ebx, 6
jl 0x14002f420
jmp 0x14002f5bd
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov rcx, rax
movsxd rax, ebx
mov qword [rdi + rax*8], rcx
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x14002f5b6
mov rdi, qword [0x14049cc08]
mov ebx, esi
mov r9, rdi
nop
mov rax, qword [r9]
test rax, rax
je 0x14002f4c7
lea r8, [rsp + 0x20]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002f4b3
inc rax
test ecx, ecx
jne 0x14002f4a0
test edx, edx
je 0x14002f4e2
inc ebx
add r9, 8
cmp ebx, 6
jl 0x14002f490
jmp 0x14002f5bd
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov rcx, rax
movsxd rax, ebx
mov qword [rdi + rax*8], rcx
mov rdi, qword [0x14049cc08]
lea rdx, [0x1400a73f4]
mov rcx, rdi
call fcn.14002f330
test eax, eax
jne 0x14002f5b6
mov r8d, 0x200
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14002f578
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov rdi, qword [0x14049cc08]
mov ebx, esi
mov r9, rdi
mov rax, qword [r9]
test rax, rax
je 0x14002f564
lea r8, [rsp + 0x20]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14002f553
inc rax
test ecx, ecx
jne 0x14002f540
test edx, edx
je 0x14002f578
inc ebx
add r9, 8
cmp ebx, 6
jl 0x14002f527
jmp 0x14002f5bd
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov rcx, rax
movsxd rax, ebx
mov qword [rdi + rax*8], rcx
lea rcx, str.MARIADB_HOME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
jne 0x14002f59a
lea rcx, str.MYSQL_HOME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14002f5ad
mov rcx, qword [0x14049cc08]
mov rdx, rax
call fcn.14002f330
test eax, eax
jne 0x14002f5b6
mov rax, qword [0x14049cc08]
jmp 0x14002f5f6
mov rdi, qword [0x14049cc08]
test rdi, rdi
je 0x14002f5f4
cmp qword [rdi], rsi
je 0x14002f5ec
mov rax, qword [rdi]
nop word [rax + rax]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rdi, qword [0x14049cc08]
lea rsi, [rsi + 1]
mov rax, qword [rdi + rsi*8]
test rax, rax
jne 0x14002f5d0
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14008e500
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret