Function at 0x402270
Capabilities:
Get common file path
Get process heap flags

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x230
mov esi, dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [esp + 4], str.runtime.system32
mov dword [esp], eax
call esi
test eax, eax
je 0x4022c8
mov dword [esp + 4], str.runtime.windows
mov dword [esp], ebx
call esi
test eax, eax
je 0x402480
test byte [section..data], 1
jne 0x402350
xor edx, edx
add esp, 0x230
mov eax, edx
pop ebx
pop esi
pop edi
ret
lea ebx, [esp + 0x28]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
sub esp, 8
cmp word [esp + 0x28], 0
je 0x4025f0
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x4022f0
sub eax, ebx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
sub esp, 0xc
xor eax, eax
test edx, edx
je 0x4022b4
lea esi, [esi]
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402330
add esp, 0x230
mov eax, edx
pop ebx
pop esi
pop edi
ret
test ebx, ebx
je 0x402600
mov eax, ebx
shr eax, 0x10
je 0x4025d8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov ecx, eax
sub esp, 8
mov eax, 0x40b00d
test ecx, ecx
jne 0x402452
movzx eax, word [ebx]
test ax, ax
je 0x4025ba
lea esi, [esi]
mov edx, ecx
lea ecx, [ecx + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x402398
mov ecx, 0x224c
lea esi, [esp + 0x2a]
lea edi, [esp + 0x14a]
mov word [esp + 0x28], cx
jmp 0x4023f0
cmp ax, 9
je 0x402598
cmp ax, 0xa
jne 0x402512
mov eax, 0x6e5c
add esi, 2
mov word [esi - 2], ax
lea ecx, [edx - 1]
cmp esi, edi
ja 0x402428
test edx, edx
jle 0x402428
movzx eax, word [ebx]
mov edx, ecx
add ebx, 2
cmp ax, 0xd
je 0x402580
jbe 0x4023c0
cmp ax, 0x22
je 0x402568
cmp ax, 0x5c
jne 0x402505
mov eax, 0x5c5c
add esi, 2
mov word [esi - 2], ax
jmp 0x4023e0
mov byte [esi], 0x22
test ecx, ecx
jle 0x4025cd
mov edi, 0x2e2e
mov byte [esi + 3], 0x2e
lea eax, [esi + 4]
mov word [esi + 1], di
mov byte [eax], 0
lea eax, [esp + 0x28]
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unknown_expression__s_n
mov dword [esp + 8], str.lookup_expression
mov dword [esp + 4], 0x40a000
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x4022b4
lea ebx, [esp + 0x28]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
sub esp, 8
cmp word [esp + 0x28], 0
je 0x40260a
mov eax, ebx
lea esi, [esi]
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4024b0
sub eax, ebx
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x4022b4
xor eax, eax
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4024f0
jmp 0x4022b6
lea ecx, [eax - 0x20]
cmp cx, 0x5e
jbe 0x4025b0
mov ecx, eax
mov byte [esi], 0x5c
add esi, 5
shr cx, 0xc
movzx ecx, cx
movzx ecx, byte [ecx + str.0123456789abcdefcabinet_copy_file]
mov byte [esi - 4], cl
mov ecx, eax
shr cx, 8
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefcabinet_copy_file]
mov byte [esi - 3], cl
mov ecx, eax
and eax, 0xf
shr cx, 4
movzx eax, byte [eax + str.0123456789abcdefcabinet_copy_file]
and ecx, 0xf
movzx ecx, byte [ecx + str.0123456789abcdefcabinet_copy_file]
mov byte [esi - 1], al
mov byte [esi - 2], cl
jmp 0x4023e0
mov eax, 0x225c
add esi, 2
mov word [esi - 2], ax
jmp 0x4023e0
mov eax, 0x725c
add esi, 2
mov word [esi - 2], ax
jmp 0x4023e0
mov eax, 0x745c
add esi, 2
mov word [esi - 2], ax
jmp 0x4023e0
mov byte [esi], al
add esi, 1
jmp 0x4023e0
mov ebx, 0x224c
mov byte [esp + 0x2a], 0x22
lea esi, [esp + 0x2a]
mov word [esp + 0x28], bx
lea eax, [esi + 1]
jmp 0x402443
movzx ebx, bx
mov dword [esp], section..rdata
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x402452
mov eax, 2
jmp 0x4022fe
mov eax, 0x40b006
jmp 0x402452
mov eax, 2
jmp 0x4024be