Exception while trying to install winace 2.2

[György 'Nog' Jeney]

While trying to get the winace 2.2 installer to run on wine, I got the
following exception without any messages on the console:

First chance exception: page fault on read access to 0x23c94fed in 32-bit
code (0x23c94fed).
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:008f GS:0000
 EIP:23c94fed ESP:40682e52 EBP:00400000 EFLAGS:00010646(  R- 00 DI  Z- -P1 )
 EAX:00000000 EBX:40682e66 ECX:0000038b EDX:00420654
 ESI:00000001 EDI:0044efb5
Stack dump:
0x40682e52 (_end+0x32cc32):  004209e2 40682e98 00420658 00000000
0x40682e62 (_end+0x32cc42):  00000000 00463047 0042066b 40682f44
0x40682e72 (_end+0x32cc52):  00463000 401111c0 00000001 40682f38
0x40682e82 (_end+0x32cc62):  40682e96 400fd024 00463042 00000600
0x40682e92 (_end+0x32cc72):  00463000 2f440246 c81a4068 66b12fc3
0x40682ea2 (_end+0x32cc82):  c19d6f8a 25b92f81 51634d58 33c04011
0x40682eb2 (_end+0x32cc92):

0011: sel=008f base=401133c0 limit=00000fff 32-bit rw-
Backtrace:
=>0 0x23c94fed (_end+0x1bc38885) (ebp=00400000)
  1 0x00000002 (ebp=00505a4d)
*** Invalid address 0x00505a4d (wace22.exe.EntryPoint+0xa2a0b)

0x23c94fed (_end+0x1bc38885): *** Invalid address 0x23c94fed
(_end+0x1bc38885)
-- no code --

It seemd to me that the stack frame(s?) got corrupted so I debugged
further.  It
seems that the app throws an exception and catches it later on.  I set a
breakpoint on EXC_CallHandler where the backtrace still looked fine.  Just
before wine calls the exception handler, it pushes edx and then edi onto the
stack, then the handler gets called: call *%edx.  This puts excecution into
0x420658 which calls 0x4206ac. The assembly code at 0x4206ac looks like this:
0x004206ac (wace22.exe.+0x1f6ac in C:\wace22.exe): xorl %eax,%eax
0x004206ae (wace22.exe.+0x1f6ae in C:\wace22.exe): popl %esi
0x004206af (wace22.exe.+0x1f6af in C:\wace22.exe): movl %fs:0x0(%eax),%ebx
0x004206b2 (wace22.exe.+0x1f6b2 in C:\wace22.exe): movl 0x0(%ebx),%ebx
0x004206b4 (wace22.exe.+0x1f6b4 in C:\wace22.exe): leal 0xffffffd6(%ebx),%esp
0x004206b7 (wace22.exe.+0x1f6b7 in C:\wace22.exe): popl %ebp

This last pop is what makes the backtrace weird, before this the backtrace
looks like:
=>0 0x004206b7 (wace22.exe.+0x1f6b7 in C:\wace22.exe) (ebp=40570938)
  1 0x400c84c0 (EXC_RtlRaiseException+0x10c(rec=0x405709dc,
context=0x40570a34) [exception.c:214] in libntdll.dll.so) (ebp=405709c0)
  2 0x400d26e9 (do_segv+0x1a5(context=0x40570d1c, trap_code=0x400d2b98,
cr2=0x40570a50, err_code=0x1) [signal_i386.c:798] in libntdll.dll.so)
(ebp=40570a2c)
  3 0x400d2b4c (segv_handler+0x3c(__signal=0x2b, __context=0x2b)
[[signal_i386.c:986] in libntdll.dll.so) (ebp=40570d28)
  4 0x0000008f (ebp=00000000)

But after it, it looks like this:
=>0 0x004206c1 (wace22.exe.+0x1f6c1 in C:\wace22.exe) (ebp=00400000)
  1 0x00000002 (ebp=00505a4d)
*** Invalid address 0x00505a4d (wace22.exe.EntryPoint+0xa2a0b)

Is this normal?  If I just continue from this point then the first exception
will be thrown but quite a lot of functions get called between here and that
exception. The exception handler never does return.  Any one have any ideas
as to what might go wrong here?

nog.