On the sub-sites of this site I write together what I can get directly from the binary disassembling.
IDA Pro is a real helper for that stuff... and there's LOTS of what I call "lost code" in the ASM file. In vshell.exe, I found 20 or so function blocks without a sub_ label, only loc_. The problem seems to be that their entry points are messed up (and I don't know the calling functions, so no idea how they might be called).
dbsim.exe has even MORE lost code, in this file even IDA reports some "sp-analysis failed" errors. The tpid structures with the class informations are messed up, too, so this WILL be a hard nut to reverse engineer.
I have collected a list of the .cpp source files identifiable in the asm output... and wtf, why are there assert messages from C HEADER FILES?
IDA identifies procedures by interpreting "call" instructions. So, when a code block isn't called from anywhere, IDA doesn't automatically mark it as a sub_, but a loc_ block. If it begins with "push ebp", it's a function and can be marked as such by moving the cursor BEFORE the push and pressing "P". See also <http://www.codeproject.com/KB/tips/stackdumper.aspx> for the explanation.
Sometimes there simply is no push ebp instruction - in this case go before the first instruction anyway, it should work.