Function at 0x10018e60
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0x1c0000
push 1
call dword [sym.imp.msvcrt.dll_calloc]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10018e85
lea eax, [ebx + 9]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100278f4]
push esi
push edi
push 0x1001f2cc
push 0x8b
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10018ed1
mov ecx, dword [0x100278f4]
mov edi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ecx
call edi
mov edx, dword [0x100278f4]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov dword [ebp - 0xc], eax
cmp eax, ecx
jne 0x10018ee9
push ebx
mov esi, 1
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100278f4]
mov dword [ebp - 8], ecx
push 0x1001f2cc
cmp dword [ebp + 0xc], ecx
je 0x10018f02
push 0x8d
jmp 0x10018f07
push 0x8c
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x10018f38
mov ecx, dword [0x100278f4]
push esi
push ecx
call edi
mov edx, dword [0x100278f4]
push esi
push edx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10018f3b
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x10018ed1
mov byte [ebx + 0x8000], 1
lea edi, [ebx + 0x8001]
mov esi, str.CD001
mov ecx, 6
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x8006], 1
mov eax, 0x380
bswap eax
lea edi, [ebx + 0x8028]
mov esi, str.DiskCryptor_boot_disk
mov ecx, 0x20
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x8054], eax
mov dword [ebx + 0x8050], 0x380
mov dword [ebx + 0x8080], 0x80800
mov word [ebx + 0x808b], 0x140a
mov eax, 0x1000001
mov dword [ebx + 0x8078], eax
mov dword [ebx + 0x807c], eax
mov al, 0xa
mov byte [ebx + 0x8084], al
mov al, 0x18
mov byte [ebx + 0x809e], al
mov dl, 0x22
mov byte [ebx + 0x809c], dl
mov byte [ebx + 0x8800], 0
lea edi, [ebx + 0x8801]
mov esi, str.CD001
mov ecx, 6
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x8806], 1
lea edi, [ebx + 0x8807]
mov esi, str.EL_TORITO_SPECIFICATION
mov ecx, 0x17
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x8847], 0x19
mov byte [ebx + 0x9000], 0xff
lea edi, [ebx + 0x9001]
mov esi, str.CD001
mov ecx, 6
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
mov byte [ebx + 0x9006], 1
mov byte [ebx + 0xa002], al
mov byte [ebx + 0xa000], 1
mov byte [ebx + 0xa006], 1
mov dword [ebx + 0xc01f], 0x101
mov byte [ebx + 0xc000], dl
mov byte [ebx + 0xc002], al
mov byte [ebx + 0xc009], al
mov byte [ebx + 0xc022], dl
mov edx, dword [ebp - 4]
mov byte [ebx + 0xc024], al
mov byte [ebx + 0xc02b], al
mov cl, 8
mov byte [ebx + 0xc00b], cl
mov byte [ebx + 0xc010], cl
mov byte [ebx + 0xc02d], cl
mov byte [ebx + 0xc032], cl
mov byte [ebx + 0xc019], 2
mov byte [ebx + 0xc01c], 1
mov byte [ebx + 0xc03b], 2
mov byte [ebx + 0xc03e], 1
mov dword [ebx + 0xc041], 0x10101
mov byte [ebx + 0xc800], 1
mov dword [ebx + 0xc81c], 0xaa5555aa
mov word [ebx + 0xc820], 0x288
mov byte [ebx + 0xc826], 1
mov byte [ebx + 0xc828], 0x1a
lea edi, [ebx + 0xd000]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
push ecx
push edx
lea eax, [ebx + 0xd200]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0
push 0
mov ecx, dword [ebp + 8]
push 2
push 0
push 1
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10019140
push 0
lea edx, [ebp - 0xc]
push edx
push 0x1c0000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
xor esi, esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov esi, 0xd
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret