Function at 0x11198
Capabilities:
Create directory
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x90
lea rdi, [rcx + 0x70]
mov rbp, rcx
lea rax, [0x00011008]
xor r13d, r13d
mov ecx, 0x1c
lea rdx, [0x00020860]
rep stosq qword [rdi], rax
lea rcx, [r11 - 0x68]
mov qword [r11 + 0x18], r13
mov dword [r11 + 8], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
lea ebx, [r13 + 0x30]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, r13d
jl 0x1129d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
lea rdx, [0x00020940]
xor eax, eax
mov rdi, rdx
lea r9d, [r13 + 1]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, 0x78
mov r8d, 0x774e6350
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r13
je 0x11361
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0001fbf0
xor edx, edx
mov rcx, rsi
call fcn.000196a8
mov dword [rsi + 0x40], r13d
lea rax, [0x00021460]
lea rcx, [rsi + 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsi], rax
mov qword [rsi + 0x70], rbp
mov dword [rsi + 0x50], r13d
mov dword [rsi + 0x54], r13d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea rdx, [0x00020aa0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsi + 0x48]
mov edx, 0xf000f
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x78], 0x10
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
call qword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
cmp eax, r13d
jne 0x11364
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwMakeTemporaryObject]
jmp 0x11364
mov rsi, r13
mov rdi, r13
cmp rsi, r13
je 0x11377
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rdi, rsi
mov edx, 0xe0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
mov rbx, rax
call fcn.0001fbf0
lea rax, [0x00019cd0]
mov dword [rbx], 0xe0
mov qword [rbx + 8], rax
lea rax, [0x00019dd4]
mov qword [rbx + 0x68], r13
mov qword [rbx + 0x10], rax
lea rax, [0x00019ee0]
lea r8, [0x00020990]
mov qword [rbx + 0x18], rax
lea rax, [0x00019fec]
mov r9d, 0x22
mov qword [rbx + 0x20], rax
lea rax, [0x0001a0b8]
mov rdx, rbp
mov qword [rbx + 0x28], rax
lea rax, [0x0001a184]
mov rcx, rsi
mov qword [rbx + 0x30], rax
lea rax, [0x0001a29c]
mov byte [rsp + 0x28], r13b
mov qword [rbx + 0x38], rax
lea rax, [0x0001a38c]
mov dword [rsp + 0x20], r13d
mov qword [rbx + 0x40], rax
lea rax, [0x0001a444]
mov qword [rbx + 0x48], rax
lea rax, [0x0001a6c8]
mov qword [rbx + 0x70], rax
lea rax, [0x0001af70]
mov qword [rbx + 0xc0], rax
lea rax, [0x0001a850]
mov qword [rbx + 0x80], rax
lea rax, [0x0001a948]
mov qword [rbx + 0x88], rax
lea rax, [0x0001a9f4]
mov qword [rbx + 0x90], rax
lea rax, [0x0001aaec]
mov qword [rbx + 0x98], rax
lea rax, [0x0001aba8]
mov qword [rbx + 0xa0], rax
lea rax, [0x0001acd8]
mov qword [rbx + 0xa8], rax
lea rax, [0x0001ae08]
mov qword [rbx + 0xb0], rax
lea rax, [0x0001aeb4]
mov qword [rbx + 0xb8], rax
lea rax, [0x0001a510]
mov qword [rbx + 0x50], rax
lea rax, [0x0001a628]
mov qword [rbx + 0x58], rax
lea rax, [0x0001a678]
mov qword [rbx + 0x60], rax
lea rax, [0x0001a794]
mov qword [rbx + 0x78], rax
lea rax, [0x0001b01c]
mov qword [rbx + 0xc8], rax
lea rax, [0x0001b0c8]
mov qword [rbx + 0xd0], rax
lea rax, [0x0001b164]
mov qword [rbx + 0xd8], rax
mov qword [rbp + 0x50], rbx
call fcn.00019738
mov ebx, eax
cmp eax, r13d
jne 0x11535
lea rdx, [0x000209c0]
mov rcx, rsi
call fcn.000198ec
mov ebx, eax
cmp eax, r13d
jne 0x11535
mov rcx, rsi
call fcn.00019808
mov ebx, eax
cmp eax, r13d
je 0x11545
cmp rdi, r13
je 0x11543
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 8]
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret