Function at 0x401be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
movzx esi, word [eax]
test si, si
je 0x401c40
mov ebx, eax
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401bf8
sub eax, ebx
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401c5d
mov edx, eax
jmp 0x401c23
movzx esi, word [ebx]
add edx, 2
add ebx, 2
mov word [edx - 2], si
test si, si
jne 0x401c20
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401c5d
xor edx, edx
mov word [eax], dx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [section..data], 2
jne 0x401c73
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x401c66

Function at 0x401ca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
sub esp, 0x18
mov edi, eax
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x401d2c
mov ebx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, ebx
sub esp, 0x18
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401d42
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x401d35

Function at 0x401d70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x24
mov edx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [ebp - 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
sub esp, 0x20
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x10]
test eax, eax
je 0x401e1a
mov ebx, eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, ebx
sub esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [section..data], 2
jne 0x401e30
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.out_of_memory_n
mov dword [esp + 8], str.xmalloc
mov dword [esp + 4], 0x40f000
mov dword [esp], 1
call fcn.00401580
jmp 0x401e23