Function at 0x180019cc0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r12
sub rsp, 0x60
mov esi, edx
mov ebp, 1
mov edx, 0x1c0000
mov ecx, ebp
call qword [sym.imp.msvcrt.dll_calloc]
mov r12, rax
test rax, rax
jne 0x180019cf5
lea eax, [rbp + 8]
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [0x18002dba8]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r13
lea r8, str.EXEFILE
mov edx, 0x8b
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x18001a050
mov rcx, qword [0x18002dba8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18002dba8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
je 0x18001a050
mov rcx, qword [0x18002dba8]
xor ebx, ebx
lea r8, str.EXEFILE
mov r13d, ebx
mov edx, 0x8d
test esi, esi
jne 0x180019d8c
mov edx, 0x8c
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x180019dcb
mov rcx, qword [0x18002dba8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [0x18002dba8]
mov rdx, rdi
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r13, rax
jmp 0x180019dd3
mov r14d, dword [rsp + 0x90]
test r13, r13
je 0x18001a050
mov byte [r12 + 0x8000], bpl
mov eax, 0x380
lea rdi, [r12 + 0x8001]
lea rsi, str.CD001
mov ecx, 6
mov rdx, r15
rep movsb byte [rdi], byte [rsi]
mov byte [r12 + 0x8006], bpl
lea rdi, [r12 + 0x8028]
lea rsi, str.DiskCryptor_boot_disk
mov ecx, 0x20
mov r8d, 0x200
rep movsb byte [rdi], byte [rsi]
mov dword [r12 + 0x8050], eax
mov dword [r12 + 0x8078], 0x1000001
mov dword [r12 + 0x807c], 0x1000001
mov dword [r12 + 0x8080], 0x80800
mov byte [r12 + 0x8084], 0xa
mov word [r12 + 0x808b], 0x140a
mov byte [r12 + 0x809c], 0x22
mov byte [r12 + 0x809e], 0x18
bswap eax
lea rdi, [r12 + 0x8801]
lea rsi, str.CD001
mov dword [r12 + 0x8054], eax
mov byte [r12 + 0x8800], 0
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov byte [r12 + 0x8806], bpl
lea rdi, [r12 + 0x8807]
lea rsi, str.EL_TORITO_SPECIFICATION
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov byte [r12 + 0x8847], 0x19
mov byte [r12 + 0x9000], 0xff
lea rdi, [r12 + 0x9001]
lea rsi, str.CD001
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov byte [r12 + 0x9006], bpl
mov byte [r12 + 0xa000], bpl
mov byte [r12 + 0xa002], 0x18
mov byte [r12 + 0xa006], bpl
mov dword [r12 + 0xc01f], 0x101
mov byte [r12 + 0xc022], 0x22
mov byte [r12 + 0xc000], 0x22
mov byte [r12 + 0xc002], 0x18
mov byte [r12 + 0xc009], 0x18
mov byte [r12 + 0xc00b], 8
mov byte [r12 + 0xc010], 8
mov byte [r12 + 0xc019], 2
mov byte [r12 + 0xc01c], bpl
mov byte [r12 + 0xc024], 0x18
mov byte [r12 + 0xc02b], 0x18
mov byte [r12 + 0xc02d], 8
mov byte [r12 + 0xc032], 8
mov byte [r12 + 0xc03b], 2
mov byte [r12 + 0xc03e], bpl
mov dword [r12 + 0xc041], 0x10101
mov byte [r12 + 0xc800], bpl
mov dword [r12 + 0xc81c], 0xaa5555aa
lea rcx, [r12 + 0xd000]
mov word [r12 + 0xc820], 0x288
mov byte [r12 + 0xc826], bpl
mov byte [r12 + 0xc828], 0x1a
call sub.msvcrt.dll_memcpy
lea rcx, [r12 + 0xd200]
movsxd r8, r14d
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov r8d, ebp
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001a049
lea r9, [rsp + 0x90]
mov r8d, 0x1c0000
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001a04e
mov ebx, 0xd
mov ebp, ebx
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
mov eax, ebp
add rsp, 0x60
pop r12
pop rsi
pop rbp
ret