Function at 0x404d00
Capabilities:
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
test byte [0x425010], 8
jne 0x4051c9
mov dword [ebp - 0x28], eax
xor esi, esi
xor ebx, ebx
test eax, eax
je 0x404f43
movzx ecx, word [eax]
test cx, cx
je 0x404f43
cmp cx, 0x20
je 0x404d56
cmp cx, 9
jne 0x404d80
lea edx, [eax + 2]
lea esi, [esi]
mov dword [ebp - 0x28], edx
movzx ecx, word [edx]
mov eax, edx
test cx, cx
je 0x404f43
add edx, 2
cmp cx, 0x20
je 0x404d60
cmp cx, 9
je 0x404d60
mov dword [esp + 4], ecx
mov edi, dword [sym.imp.ucrtbase.dll_wcschr]
mov dword [esp], str.__t_________
call edi
test eax, eax
je 0x404f90
mov eax, dword [ebp - 0x28]
movzx edx, word [eax]
test si, si
je 0x404daf
cmp si, dx
jne 0x40536f
lea edi, [edx - 0x21]
movzx ecx, dx
cmp di, 0x5d
ja case.0x404dc2.1
movzx edi, di
jmp dword [edi*4 + 0x426774]
movzx edx, word [edx*4 + 0x427d62]
mov word [eax], dx
lea eax, [ebp - 0x24]
call dbg.WCMD_popoperator
mov eax, dword [ebp - 0x28]
movzx edx, word [eax]
cmp dx, 0x2b
jne 0x404df6
mov ecx, 0x50
mov word [eax], cx
mov eax, dword [ebp - 0x28]
movzx edx, word [eax]
cmp dx, 0x2d
je 0x405017
movzx ecx, dx
sub edx, 0x21
xor edi, edi
cmp dx, 0x5d
jbe 0x404f11
mov eax, dword [ebp - 0x24]
test byte [0x425010], 8
je 0x404e63
mov edx, 0xffffffff
test eax, eax
je 0x404e29
mov edx, dword [eax]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Found_operator__c_precedence__d__head_is__d__n
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.9
mov eax, dword [ebp - 0x24]
jmp 0x404e63
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x404f20
cmp dword [eax], edi
jg 0x404e87
jne 0x404f20
cmp edi, 1
je 0x404f20
cmp edi, 8
je 0x404f20
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call dbg.WCMD_reduce
test eax, eax
je 0x404e60
mov ebx, eax
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x404eaf
nop
lea eax, [ebp - 0x24]
call dbg.WCMD_popoperator
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x404ea0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x404ece
lea esi, [ebp - 0x20]
lea esi, [esi]
mov eax, esi
call dbg.WCMD_popnumber
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x404ec0
test byte [0x425010], 8
jne 0x40518e
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test si, si
je 0x4052ba
xor esi, esi
cmp dx, 0x3d
je case.0x404dc2.28
test ebx, ebx
je 0x404de2
sub edx, 0x21
xor edi, edi
cmp dx, 0x5d
ja 0x404e12
movzx edx, dx
movsx edi, byte [edx + 0x427a60]
jmp 0x404e12
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
mov edx, edi
xor ebx, ebx
movzx eax, word [eax]
call dbg.WCMD_pushoperator
mov eax, dword [ebp - 0x28]
add eax, 2
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x404d3e
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
mov dword [ebx], eax
test esi, esi
je 0x404f6a
nop
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call dbg.WCMD_reduce
test eax, eax
jne 0x404e96
mov esi, dword [ebp - 0x24]
test esi, esi
jne 0x404f50
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40538d
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x4052d3
mov ebx, 0x413
jmp 0x404eb6
test si, si
jne 0x40536f
and ebx, 1
jne 0x40536f
mov ebx, dword [ebp - 0x28]
movzx eax, word [ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_iswdigit]
test eax, eax
je 0x405200
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_wcstoul]
lea ecx, [ebp - 0x20]
mov edx, eax
xor eax, eax
call dbg.WCMD_pushnumber
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
movzx edx, word [eax]
test dx, dx
je 0x405003
mov dword [esp + 4], edx
mov dword [esp], str.__t_________
call edi
test eax, eax
je 0x4052c9
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ebx, 1
jmp 0x404d36
test ebx, ebx
jne 0x4052a1
mov edx, 0x4e
mov word [eax], dx
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, ecx
jmp case.0x404dc2.0
mov edi, dword [ebp - 0x30]
add eax, 2
mov dword [ebp - 0x28], eax
test edi, edi
jne 0x404f43
mov ebx, 0x414
jmp 0x404e98
test byte [0x425010], 8
jne 0x4052e9
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40507a
lea esi, [esi]
nop
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x24]
call dbg.WCMD_reduce
test eax, eax
jne 0x404e96
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x405060
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40538d
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x404f80
lea ecx, [ebp - 0x20]
mov eax, ecx
call dbg.WCMD_popnumber
test byte [0x425010], 8
jne 0x405342
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], 0
xor ebx, ebx
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], 0
sub esp, 0xc
add eax, 2
mov dword [ebp - 0x28], eax
jmp 0x404d36
add eax, 2
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
lea ecx, [eax + 1]
lea eax, [ebp - 0x28]
call dbg.WCMD_handleExpression
mov ebx, eax
test eax, eax
jne 0x404e98
mov edx, dword [ebp - 0x1c]
xor eax, eax
lea ecx, [ebp - 0x20]
call dbg.WCMD_pushnumber
mov eax, dword [ebp - 0x28]
jmp 0x404d36
mov edi, dword [ebp - 0x24]
test bl, 1
jne case.0x404dc2.10
test edi, edi
je case.0x404dc2.10
movzx ebx, word [edi + 4]
cmp bx, 0x2a
je 0x405383
mov ecx, 0x2f
xor edx, edx
jmp 0x405161
cmp bx, cx
je 0x404dc9
movzx ecx, word [edx*4 + 0x427d64]
add edx, 1
cmp cx, 0x20
jne 0x405150
mov ebx, 0x412
jmp 0x404ea0
test byte [0x425010], 2
jne 0x405312
add eax, 2
xor ebx, ebx
mov dword [ebp - 0x28], eax
jmp 0x404d36
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x14], ebx
mov eax, dword [eax]
mov dword [esp + 0xc], str.Returning_result__d__rc__d_n
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.9
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._wine_dbgstr_wn.constprop.5
mov dword [esp + 0xc], str.Handling_expression__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.9
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
jmp 0x404d2f
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], str.__t_________
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call dbg.WCMD_parameter_with_delims
mov esi, eax
test eax, eax
je 0x405397
cmp word [eax], 0
je 0x405379
add eax, 2
cmp word [eax], 0
jne 0x405243
sub eax, esi
sar eax, 1
lea edi, [eax + eax + 2]
mov dword [esp], edi
call dbg.heap_xalloc
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov ebx, eax
mov dword [esp], eax
call sym._memcpy
xor edx, edx
mov eax, ebx
lea ecx, [ebp - 0x20]
call dbg.WCMD_pushnumber
cmp word [ebx], 0
mov eax, dword [ebp - 0x1c]
je 0x405292
mov edx, ebx
add edx, 2
cmp word [edx], 0
jne 0x405285
sub edx, ebx
add eax, edx
mov dword [ebp - 0x28], eax
xor esi, esi
mov ebx, 1
jmp 0x404d36
mov edx, 0xc
mov ecx, 0x2d
movzx edx, dx
movsx edi, byte [edx + 0x427a60]
jmp 0x404e12
add eax, 2
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x28], eax
jmp 0x404d36
mov ebx, 0x415
jmp 0x404e98
lea esi, [ebp - 0x20]
mov eax, esi
call dbg.WCMD_popnumber
mov ebx, dword [ebp - 0x34]
mov dword [ebx], eax
xor ebx, ebx
jmp 0x404e98
mov dword [esp + 0xc], str.Found_expression_delimiter___reducing_existing_stacks_n
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.9
jmp 0x405054
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], str.Unrecognized_operator__c_n
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 4], 0x425010
mov dword [esp], 1
call sym._wine_dbg_log.constprop.9
mov eax, dword [ebp - 0x28]
jmp 0x405181
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Expression_resolved_to__d_n
mov dword [esp + 8], str.WCMD_handleExpression
mov dword [esp + 4], 0x425010
mov dword [esp], 3
call sym._wine_dbg_log.constprop.9
jmp 0x4050a7
mov ebx, 0x413
jmp 0x404e98
mov edi, 2
jmp 0x405254
mov edx, 0x61
jmp 0x404dd1
mov ebx, 0x413
jmp 0x404ece
xor eax, eax
lea ecx, [ebp - 0x20]
xor edx, edx
call dbg.WCMD_pushnumber
movzx eax, word [pe_dos_header]
ud2