c2w doesn't load the IOS at all. It's all loaded by the IOSU into memory in a function called "LoadCompatBinaries" (0x05008a64).
The IOSU will load the c2w image itself, the wii eeprom and romfont into memory.
It will then parse the tmd of the system menu and load the system menu itself and its' IOS into memory as well.
c2w then copies the buffers to their correct locations, boots the console into vWii mode, and probably (?) directly jumps to the loaded IOS. GaryOderNichts (talk) 03:13, 26 May 2021 (CEST)