Function at 0x64ef44
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
call fcn.00406d68
xor eax, eax
push ebp
push 0x64f164
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0x64f180
call fcn.00407264
call fcn.0064e80c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 8], 0xffffffff
jne 0x64f03f
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0xc]
call fcn.00406e0c
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x64f035
call sub.kernel32.dll_GetLastError_1
sub eax, 2
je 0x64efd5
sub eax, 0xe5
je 0x64efeb
jmp 0x64f01f
cmp dword [ebp + 0x18], 0
je 0x64f146
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], edx
jmp 0x64f146
push 0
call sub.kernel32.dll_Sleep_2
push 1
call sub.kernel32.dll_Sleep_2
call fcn.0064e80c
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
push edx
push eax
mov eax, dword [0x71520c]
cdq
cmp edx, dword [esp + 4]
jne 0x64f015
cmp eax, dword [esp]
pop edx
pop eax
jb 0x64f146
jmp 0x64f035
cmp dword [ebp + 0x18], 0
je 0x64f146
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], edx
jmp 0x64f146
cmp dword [ebp - 8], 0xffffffff
je 0x64ef9c
xor eax, eax
push ebp
push 0x64f13f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x64f072
call fcn.00405448
jmp 0x64f146
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x1000
lea eax, [ebp - 0x1028]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x64f09b
call fcn.00405448
jmp 0x64f146
push 0
lea eax, [ebp - 0x20]
push eax
push 1
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x64f0be
call fcn.00405448
jmp 0x64f146
cmp dword [ebp + 0x18], 0
je 0x64f105
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cdq
cmp edx, dword [esp + 4]
jne 0x64f0e0
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x64f0f1
jmp 0x64f0e4
pop edx
pop eax
jle 0x64f0f1
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
jmp 0x64f0fd
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
cmp dword [ebp + 0x18], 0
je 0x64f124
cmp dword [ebp + 0x14], 0
je 0x64f124
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x1028]
call fcn.0040331c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f146
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64f16b
lea eax, [ebp - 0xc]
call fcn.00406d70
lea eax, [ebp + 8]
call fcn.00406d70
ret