Function at 0x10063a88
Capabilities:
Encrypt data using dpapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003898b
mov eax, dword fs:[0]
push eax
mov eax, 0x3204
call fcn.10037cc0
mov eax, dword [0x100ae134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_void___thiscall_CEXAutoBackupFile::constructor_void_]
and dword [ebp - 4], 0
lea eax, [ebp - 0x31dc]
push eax
mov ecx, esi
call fcn.10032db0
test eax, eax
jns 0x10063afc
test byte [0x100af360], 2
mov esi, 0x80004005
je 0x10063d1f
push 0x809
jmp 0x10063b27
push 0x40000000
lea edx, [ebp - 0x428]
mov ecx, edi
call fcn.100631e5
mov esi, eax
pop ecx
test esi, esi
jns 0x10063b39
test byte [0x100af360], 2
je 0x10063d1f
push 0x811
mov edx, 0x10019638
mov ecx, esi
call fcn.10036de6
pop ecx
jmp 0x10063d1f
lea eax, [ebp - 0x3210]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_long_int___thiscall_CEXAutoBackupFile::BackupFile_unsigned_short_int_const__]
mov esi, eax
test esi, esi
jns 0x10063b84
test byte [0x100af360], 2
je 0x10063b7a
push 0x81e
mov edx, 0x10019638
mov ecx, esi
call fcn.10036de6
pop ecx
mov esi, 0x80004005
jmp 0x10063cf6
test byte [ebp - 0x16bc], 1
je 0x10063baa
lea eax, [ebp - 0x16b8]
push 0x10004370
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10063baa
xor edi, edi
inc edi
jmp 0x10063bac
xor edi, edi
mov dword [ebp - 0x31e0], edi
xor ebx, ebx
mov dword [ebp - 0x31e4], 2
movzx edx, word [ebx + 0x100198c4]
movzx eax, dx
imul ecx, eax, 0x28
mov dword [ebp - 0x31f0], edx
add ecx, 0x10015bc0
mov dword [ebp - 0x31ec], ecx
imul ecx, eax, 0x214
mov dword [ebp - 0x31f4], ecx
mov eax, dword [ebp + ecx - 0x31c0]
test al, 6
jne 0x10063bf8
xor edi, edi
jmp 0x10063c57
cmp word [ebp - 0x31e4], dx
jne 0x10063c4f
test edi, edi
je 0x10063bf4
shr eax, 6
and eax, 0x3ff
push eax
mov dword [ebp - 0x31e8], eax
lea eax, [ebp - 0x31bc]
add eax, ecx
push eax
lea eax, [ebp - 0x220]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x220]
push 0
push dword [ebp - 0x31e8]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
neg eax
sbb edi, edi
lea eax, [ebp - 0x21c]
and edi, eax
jmp 0x10063c57
lea edi, [ebp - 0x31bc]
add edi, ecx
lea eax, [ebp - 0x428]
push eax
push edi
push dword [ebp - 0x31ec]
push 0x10019960
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 2
mov edx, eax
pop eax
cmp ax, word [ebp - 0x31f0]
jne 0x10063ca8
test edi, edi
je 0x10063ca8
mov eax, dword [ebp - 0x31f4]
lea ecx, [ebp - 0x220]
mov eax, dword [ebp + eax - 0x31c0]
shr eax, 6
and eax, 0x3ff
je 0x10063ca8
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x10063c9f
test edx, edx
je 0x10063ccc
mov edi, dword [ebp - 0x31e0]
add ebx, 6
cmp ebx, 0x78
jb 0x10063bbe
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_long_int___thiscall_CEXAutoBackupFile::UndoBackup_void_]
jmp 0x10063cf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.10063461
test byte [0x100af360], 2
mov esi, eax
je 0x10063cf6
push 0x867
mov edx, 0x10019638
mov ecx, esi
call fcn.10036de6
pop ecx
lea eax, [ebp - 0x3210]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_int___thiscall_CEXAutoBackupFile::fHaveBackup_void_]
test eax, eax
je 0x10063d1f
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_long_int___thiscall_CEXAutoBackupFile::RestoreFile_void_]
lea ecx, [ebp - 0x3200]
call dword [sym.imp.MSDART.DLL_public:_void___thiscall_CEXAutoBackupFile::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100365c0
mov esp, ebp
pop ebp
ret 4