Function at 0x4023c9
Capabilities:
Create pipe
Create thread
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x41f1c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0x1c]
push ebx
xor ebx, ebx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
call fcn.00404518
push 0x3c
lea eax, [ebp - 0x88]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x7c], 0xffffffff
add esp, 0xc
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x80], eax
test al, 2
jne 0x402441
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7c], eax
push edi
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x64], eax
cmp eax, ebx
jne 0x402464
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, ebx
jne 0x4026d5
mov edi, dword [sym.imp.KERNEL32.dll_CreatePipe]
push ebx
push ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
call edi
test eax, eax
jne 0x402490
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
cmp esi, ebx
jne 0x4026d5
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
call edi
test eax, eax
jne 0x4024b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
cmp esi, ebx
jne 0x4026d5
push 0x38
pop esi
push esi
lea eax, [ebp - 0x3c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x60]
push eax
push str.PfmApi5
mov edi, 0x41f018
mov dword [ebp - 0x3c], esi
call fcn.00401017
add esp, 0x14
test eax, eax
jne 0x402532
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push edx
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [ecx + 8]
add esp, 0xc
test eax, eax
jne 0x402532
push str.using_existing_pfmapi_n
call fcn.00401211
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
pop ecx
mov esi, eax
jmp 0x402562
lea eax, [ebp - 0x58]
push eax
call fcn.004014ea
mov esi, eax
sub eax, ebx
pop ecx
je 0x402558
dec eax
dec eax
je 0x402554
sub eax, 0x518
je 0x402554
sub eax, 0x2b7
jne 0x402563
xor esi, esi
jmp 0x40256b
push str.using_existing_driver_n
call fcn.00401211
pop ecx
cmp esi, ebx
jne 0x4026d5
cmp dword [ebp - 0x5c], ebx
jne 0x402619
cmp dword [ebp - 0x58], ebx
jne 0x4025e4
push dword [0x41f030]
push str.pfmfs.sys._s.lzma
call fcn.004137cd
lea ecx, [ebp - 0x90]
push ecx
push eax
mov dword [ebp - 0x4c], eax
call fcn.00401326
add esp, 0x10
mov dword [ebp - 0x48], eax
cmp eax, ebx
je 0x4025da
push dword [ebp - 0x4c]
push str.driver__s_read_from_resources_n
call fcn.00401225
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x90]
push dword [ebp - 0x48]
call fcn.00401528
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x4026d5
push str.using_driver_from_resources_n
call fcn.00401211
pop ecx
cmp dword [ebp - 0x5c], ebx
jne 0x402619
cmp dword [ebp - 0x58], ebx
je 0x402619
push dword [ebp - 0x68]
push dword [ebp - 0x74]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push dword [ebp - 0x88]
push dword [ebp - 0x58]
call fcn.00401a52
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x402619
push esi
push str.error__i_creating_mount_n
call fcn.00401225
pop ecx
pop ecx
jmp 0x4026d5
cmp byte [ebp + 0x14], bl
je 0x40262e
lea eax, [ebp - 0xfc]
mov ecx, eax
mov dword [ebp - 0x54], eax
call fcn.0040446a
lea eax, [ebp - 0x9c]
push eax
push ebx
lea eax, [ebp - 0x88]
push eax
push 0x401f02
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x44], eax
cmp eax, ebx
jne 0x402664
lea ecx, [ebp - 0xfc]
call fcn.004044d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0xfc]
call fcn.004044d1
cmp dword [ebp - 0x44], ebx
je 0x4026d5
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x64]
call edi
mov esi, dword [ebp - 0x78]
cmp esi, ebx
je 0x4026aa
push esi
push str.error__i_creating_file_set_volume_n
call fcn.00401225
pop ecx
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x44]
call edi
push dword [ebp - 0x44]
call fcn.00401453
pop ecx
mov dword [ebp - 0x44], ebx
jmp 0x4026d5
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x4026be
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x4c]
jmp 0x402612
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x6b
push 0x222000
push dword [ebp - 0x58]
call fcn.004013f7
add esp, 0x20
cmp byte [ebp - 0x50], bl
je 0x402708
push dword [0x41f050]
lea eax, [ebp - 0x40]
push eax
call fcn.00410421
push dword [ebp - 0x88]
mov edi, eax
push dword [0x41f054]
lea eax, [ebp - 0x40]
push eax
call fcn.00410438
add esp, 0x14
push 0x30
push edi
jmp 0x402775
cmp esi, 0x7f
jne 0x402736
push dword [0x41f040]
lea eax, [ebp - 0x40]
push eax
call fcn.00410421
pop ecx
pop ecx
push 0x30
push dword [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402787
cmp esi, 0x522
jne 0x402746
push dword [0x41f04c]
jmp 0x402713
cmp esi, ebx
je 0x4027a4
mov edi, dword [str.error_file_mount_failed]
push esi
lea eax, [ebp - 0x40]
push 0x419ac4
push eax
call fcn.00401000
push eax
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.00410438
add esp, 0x18
push 0x30
push dword [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, ebx
je 0x4027a4
mov eax, dword [ebp - 0x5c]
cmp eax, ebx
je 0x402798
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
pop ecx
mov dword [ebp - 0x5c], ebx
push dword [ebp - 0x58]
call fcn.00401453
pop ecx
mov dword [ebp - 0x58], ebx
pop edi
cmp dword [ebp - 0x48], ebx
je 0x4027b3
push dword [ebp - 0x48]
call fcn.00418508
pop ecx
push dword [ebp - 0x4c]
call fcn.0041273e
push dword [ebp - 0x64]
call fcn.00401453
push dword [ebp - 0x74]
call fcn.00401453
push dword [ebp - 0x70]
call fcn.00401453
push dword [ebp - 0x6c]
call fcn.00401453
push dword [ebp - 0x68]
call fcn.00401453
mov eax, dword [ebp - 0x60]
add esp, 0x18
cmp eax, ebx
je 0x4027f4
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
pop ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x94]
mov dword [ecx], eax
lea ecx, [ebp - 0xfc]
call fcn.004044ee
lea eax, [ebp - 0x40]
push eax
call fcn.00410024
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418842
leave
ret