Function at 0x111f4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
lea rdi, [rcx + 0x70]
mov rbp, rcx
lea rax, [0x00011008]
mov ecx, 0x1c
mov r8d, 0x774e6350
rep stosq qword [rdi], rax
mov edi, 0x78
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x112e2
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0001fb70
xor edx, edx
mov rcx, rsi
call fcn.000198f0
and dword [rsi + 0x40], 0
and dword [rsi + 0x50], 0
and dword [rsi + 0x54], 0
lea rax, [0x00021460]
lea rcx, [rsi + 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsi], rax
mov qword [rsi + 0x70], rbp
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rdx, [0x000208f0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [rsi + 0x48]
mov edx, 0xf000f
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
test eax, eax
jne 0x112e4
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwMakeTemporaryObject]
jmp 0x112e4
xor esi, esi
xor edi, edi
test rsi, rsi
je 0x112f6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdi, rsi
mov edx, 0xe0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
mov rbx, rax
call fcn.0001fb70
and qword [rbx + 0x68], 0
lea rax, [0x00019f18]
mov qword [rbx + 8], rax
lea rax, [0x0001a01c]
mov dword [rbx], 0xe0
mov qword [rbx + 0x10], rax
lea rax, [0x0001a128]
lea r8, [0x000207e0]
mov qword [rbx + 0x18], rax
lea rax, [0x0001a234]
mov r9d, 0x22
mov qword [rbx + 0x20], rax
lea rax, [0x0001a300]
mov rdx, rbp
mov qword [rbx + 0x28], rax
lea rax, [0x0001a3cc]
mov rcx, rsi
mov qword [rbx + 0x30], rax
lea rax, [0x0001a4e4]
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov qword [rbx + 0x38], rax
lea rax, [0x0001a5d4]
mov qword [rbx + 0x40], rax
lea rax, [0x0001a68c]
mov qword [rbx + 0x48], rax
lea rax, [0x0001a910]
mov qword [rbx + 0x70], rax
lea rax, [0x0001b1b8]
mov qword [rbx + 0xc0], rax
lea rax, [0x0001aa98]
mov qword [rbx + 0x80], rax
lea rax, [0x0001ab90]
mov qword [rbx + 0x88], rax
lea rax, [0x0001ac3c]
mov qword [rbx + 0x90], rax
lea rax, [0x0001ad34]
mov qword [rbx + 0x98], rax
lea rax, [0x0001adf0]
mov qword [rbx + 0xa0], rax
lea rax, [0x0001af20]
mov qword [rbx + 0xa8], rax
lea rax, [0x0001b050]
mov qword [rbx + 0xb0], rax
lea rax, [0x0001b0fc]
mov qword [rbx + 0xb8], rax
lea rax, [0x0001a758]
mov qword [rbx + 0x50], rax
lea rax, [0x0001a870]
mov qword [rbx + 0x58], rax
lea rax, [0x0001a8c0]
mov qword [rbx + 0x60], rax
lea rax, [0x0001a9dc]
mov qword [rbx + 0x78], rax
lea rax, [0x0001b264]
mov qword [rbx + 0xc8], rax
lea rax, [0x0001b310]
mov qword [rbx + 0xd0], rax
lea rax, [0x0001b3ac]
mov qword [rbx + 0xd8], rax
mov qword [rbp + 0x50], rbx
call fcn.00019980
mov ebx, eax
test eax, eax
jne 0x114b2
lea rdx, [0x00020810]
mov rcx, rsi
call fcn.00019b34
mov ebx, eax
test eax, eax
jne 0x114b2
mov rcx, rsi
call fcn.00019a50
mov ebx, eax
test eax, eax
je 0x114c2
test rdi, rdi
je 0x114c0
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 8]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret