Function at 0x1000b970
Capabilities:
Create directory
Create thread
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x1001d040]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.1000f680
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x7ffffff2
jg 0x1000b9bb
mov eax, dword [esp + 0x18]
jl 0x1000b9a9
cmp eax, 0x7b8a7ff
jae 0x1000b9bb
add eax, 0xf8475800
mov dword [esp + 0x10], eax
adc ecx, 0xd
mov dword [esp + 0x14], ecx
jmp 0x1000b9cb
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0x7fffffff
lea ecx, [esp + 0x10]
call fcn.1000f160
lea ecx, [esp + 0x20]
call fcn.1000b250
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov edx, dword [esp + 0x20]
lea esi, [esp + 0x20]
mov eax, dword [esp + 0x30]
cmp edi, 0xf
cmova ecx, edx
cmova esi, edx
add eax, ecx
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x1000ba9e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp byte [esi], 0x5c
jne 0x1000ba8d
lea eax, [esp + 0x20]
mov byte [esi], 0
push eax
lea ecx, [esp + 0x3c]
call fcn.1000f8b0
cmp dword [esp + 0x4c], 0xf
lea eax, [esp + 0x38]
push 0
cmova eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000ba4e
call edi
cmp eax, 0xb7
je 0x1000ba4e
xor bl, bl
jmp 0x1000ba50
mov bl, 1
mov ecx, dword [esp + 0x4c]
cmp ecx, 0xf
jbe 0x1000ba82
mov edx, dword [esp + 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000ba78
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bac0
push ecx
push edx
call fcn.1001005b
add esp, 8
test bl, bl
je 0x1000bac6
mov eax, dword [esp + 0x10]
mov byte [esi], 0x5c
inc esi
cmp esi, eax
jne 0x1000ba10
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x20]
cmp edi, 0xf
jbe 0x1000baf8
lea ecx, [edi + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000baee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000baee
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [esp + 0x34]
cmp ecx, 0xf
jbe 0x1000baf8
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000baee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bac0
push ecx
push edx
call fcn.1001005b
add esp, 8
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
nop word [eax + eax]
push str.Hook_started..._Timer_started
lea ecx, [esp + 0x3c]
call fcn.1000fde0
lea ecx, [esp + 0x38]
call fcn.1000a7d0
mov ecx, dword [esp + 0x4c]
cmp ecx, 0xf
jbe 0x1000bb5d
mov edx, dword [esp + 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bb53
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bac0
push ecx
push edx
call fcn.1001005b
add esp, 8
cmp byte [0x1001d0b0], 0
jne 0x1000bbdb
mov eax, dword [0x1001d0b4]
push 8
mov byte [0x1001d0b0], 1
mov dword [0x1001d0b8], eax
call fcn.10010069
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [eax], 0x1001d0a8
push ecx
push 0
push eax
push 0x1000f3c0
push 0
push 0
mov dword [eax + 4], 0x1000b3a0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x1000bcdc
cmp dword [0x1001d0ac], 0
jne 0x1000bcd6
mov eax, dword [esp + 0x1c]
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov dword [0x1001d0a8], ecx
mov dword [0x1001d0ac], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x1000b6e0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push 0
mov dword [0x1001d774], eax
lea eax, [esp + 0x60]
push 0
push eax
call esi
test eax, eax
je 0x1000bc2f
nop dword [eax]
lea eax, [esp + 0x58]
push eax
call edi
lea eax, [esp + 0x58]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call esi
test eax, eax
jne 0x1000bc10
cmp dword [0x1001d0ac], 0
mov byte [0x1001d0b0], 0
je 0x1000bcfc
call dword [sym.imp.MSVCP140.dll__Thrd_id]
mov ecx, dword [0x1001d0ac]
cmp ecx, eax
je 0x1000bcf4
push 0
push ecx
push dword [0x1001d0a8]
call dword [sym.imp.MSVCP140.dll__Thrd_join]
add esp, 0xc
test eax, eax
jne 0x1000bcec
xorps xmm0, xmm0
lea ecx, [esp + 0x50]
movlpd qword [0x1001d0a8], xmm0
call fcn.1000f680
mov ecx, dword [esp + 0x54]
cmp ecx, 0x7ffffff2
jg 0x1000bcb8
mov eax, dword [esp + 0x50]
jl 0x1000bc9a
cmp eax, 0x7b8a7ff
jae 0x1000bcb8
add eax, 0xf8475800
mov dword [esp + 0x10], eax
adc ecx, 0xd
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
call fcn.1000f160
jmp 0x1000bb10
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0x7fffffff
call fcn.1000f160
jmp 0x1000bb10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 6
mov dword [esp + 0x20], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3