Function at 0x10012ea5
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push 0x38
mov eax, 0x10051563
call fcn.1002524a
mov edi, ecx
mov dword [ebp - 0x44], edi
lea eax, [ebp - 0x24]
push eax
call fcn.10020af1
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1001feef
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push str.cr:info
push eax
mov byte [ebp - 4], 1
call fcn.10024667
add esp, 0x10
test eax, eax
jne 0x10013682
mov eax, dword [0x1006a014]
mov dword [ebp + 8], eax
mov esi, 0x10056ad8
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.10001b63
push str.App_Name:
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.10001b63
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 4
call fcn.1001feef
mov edi, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.10020985
push edi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 7
call fcn.10020985
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 8
call fcn.10020985
add esp, 0x28
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 9
call fcn.100057ea
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x14]
call fcn.10001270
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x14]
call fcn.10001b63
push str.BHO_File_Path:
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.10001b63
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0xb
push eax
call fcn.1002243d
mov edi, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xd
call fcn.10020985
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xe
call fcn.10020985
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0xf
call fcn.10020985
add esp, 0x28
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x10
call fcn.100057ea
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x20]
call fcn.10001b63
push 0x1005832c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x11
call fcn.10001b63
push str.BHO_Version:
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x12
call fcn.10001b63
mov eax, dword [0x1006a014]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x14
call fcn.10020985
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10020985
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x16
call fcn.10020985
add esp, 0x24
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x17
call fcn.100057ea
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x14]
call fcn.10001270
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x18]
call fcn.10001b63
push str.Platform_Version:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x18
call fcn.10001b63
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x19
call fcn.100217d3
mov edi, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x1b
call fcn.10020985
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x1c
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x1d
call fcn.10020985
add esp, 0x28
mov eax, dword [eax]
mov byte [ebp - 4], 0x1e
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
call fcn.100057ea
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x14]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x18]
call fcn.10001b63
push str.App_Version:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1f
call fcn.10001b63
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x20
call fcn.1001fe74
mov edi, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x22
call fcn.10020985
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x23
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x24
call fcn.10020985
add esp, 0x28
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x25
call fcn.100057ea
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x14]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.10001270
push 0x10058d34
lea ecx, [ebp - 0x14]
call fcn.10001b63
push 0x10058d30
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x26
call fcn.10001b63
push str.IE_Version:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x27
call fcn.10001b63
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x28
call fcn.100220ce
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x29
call fcn.100221d0
mov ebx, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x2b
call fcn.10020985
push ebx
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x2c
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x2d
call fcn.10020985
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x2e
call fcn.10020985
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 0x2f
call fcn.10020985
add esp, 0x44
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x30
call fcn.100057ea
lea ecx, [ebp - 0x30]
call fcn.10001270
lea ecx, [ebp - 0x2c]
call fcn.10001270
lea ecx, [ebp - 0x28]
call fcn.10001270
lea ecx, [ebp - 0x34]
call fcn.10001270
lea ecx, [ebp - 0x38]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x3c]
call fcn.10001270
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x14]
call fcn.10001b63
mov byte [ebp - 4], 0x31
call fcn.10020cdc
mov ebx, 0x10058d1c
test al, al
mov edi, 0x10058d18
mov eax, ebx
jne 0x100133db
mov eax, edi
push eax
lea ecx, [ebp - 0x18]
call fcn.10001b63
push str.Is_currently_in_debug_mode:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x32
call fcn.10001b63
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x34
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x35
call fcn.10020985
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x36
call fcn.10020985
add esp, 0x24
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x37
call fcn.100057ea
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp - 0x3c]
call fcn.10001270
lea ecx, [ebp - 0x38]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001270
push str.Build_Type:_RELEASE_n
lea ecx, [ebp - 0x1c]
call fcn.10001b63
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x39
call fcn.10020985
add esp, 0xc
mov eax, dword [eax]
push eax
push dword [eax - 8]
mov byte [ebp - 4], 0x3a
lea ecx, [ebp + 8]
call fcn.100057ea
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.10001270
push esi
lea ecx, [ebp - 0x14]
call fcn.10001b63
mov byte [ebp - 4], 0x3b
call fcn.1002190a
test al, al
mov eax, ebx
jne 0x100134fc
mov eax, edi
push eax
lea ecx, [ebp - 0x18]
call fcn.10001b63
push str.Using_Testing_Domain:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x3c
call fcn.10001b63
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x3e
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x3f
call fcn.10020985
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x40
call fcn.10020985
add esp, 0x24
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x41
call fcn.100057ea
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp - 0x3c]
call fcn.10001270
lea ecx, [ebp - 0x38]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001270
call fcn.1002190a
test al, al
je 0x10013669
push esi
lea ecx, [ebp - 0x18]
call fcn.10001b63
push str.Testing_Domain:
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x42
call fcn.10001b63
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0x43
call fcn.1002199c
mov esi, eax
mov eax, dword [0x1006a014]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x45
call fcn.10020985
push esi
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0x46
call fcn.10020985
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x47
call fcn.10020985
add esp, 0x28
mov eax, dword [eax]
push eax
push dword [eax - 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x48
call fcn.100057ea
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp - 0x3c]
call fcn.10001270
lea ecx, [ebp - 0x38]
call fcn.10001270
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp - 0x34]
call fcn.10001270
lea ecx, [ebp - 0x1c]
call fcn.10001270
lea ecx, [ebp - 0x18]
call fcn.10001270
mov eax, dword [ebp - 0x44]
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100139a6
mov eax, dword [esi]
push str.cr:updateapp
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x100136a2
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str._updateapp__forcedownload
jmp 0x100136c0
mov eax, dword [esi]
push str.cr:updateplatform
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x100136d1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str._updateplatform__updateapp__forcedownload
call fcn.10001b63
mov ecx, edi
call fcn.10010671
jmp 0x100139ae
push ebx
push str.cr:installapp
mov ecx, esi
call fcn.1000215d
cmp eax, 0xffffffff
je 0x1001377d
push ebx
push 0x10056724
mov ecx, esi
call fcn.1000215d
mov ecx, dword [esi]
mov ecx, dword [ecx - 8]
sub ecx, eax
dec ecx
push ecx
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.1000d517
push str.__forcedownload
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x49
call fcn.10001b63
push str._installapp
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x4a
call fcn.10001b63
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 0x4b
call fcn.10020985
add esp, 8
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp + 8]
push edx
push eax
push ecx
mov byte [ebp - 4], 0x4c
call fcn.10020985
add esp, 0xc
mov ecx, edi
call fcn.10010671
lea ecx, [ebp - 0x44]
call fcn.10001270
lea ecx, [ebp - 0x40]
call fcn.10001270
lea ecx, [ebp + 8]
call fcn.10001270
lea ecx, [ebp - 0x20]
jmp 0x100139a9
mov eax, dword [esi]
push str.cr:undebug
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x100137a5
push ebx
call fcn.10020d3d
pop ecx
push ebx
push dword [ebp - 0x10]
push str.Not_in_deubg_mode_anymore...
jmp 0x100138ac
mov eax, dword [esi]
push str.cr:debug
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x10013815
push 1
call fcn.10020d3d
pop ecx
push ebx
push dword [ebp - 0x10]
push str.Moving_into_deubg_mode...
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp + 8]
push eax
call fcn.10020d9a
pop ecx
push ebx
push str.file:__
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x4d
call fcn.1000215d
cmp eax, 0xffffffff
je 0x100137fe
push 7
push eax
lea ecx, [ebp + 8]
call fcn.1000d223
push ebx
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x100139a6
mov eax, dword [esi]
push str.cr:stoptesting
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x1001383a
push ebx
call fcn.10021b9f
pop ecx
push ebx
push dword [ebp - 0x10]
push str.Now_working_with_Crossrider_production_servers...
jmp 0x100138ac
mov eax, dword [esi]
push str.cr:testwithstaging
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x10013874
push 1
call fcn.10021b9f
mov ecx, esp
mov dword [ebp + 8], esp
push str.http:__staging.crossrider.com
call fcn.10001b63
call fcn.10021c29
pop ecx
push ebx
push dword [ebp - 0x10]
push str.Now_working_with_Crossrider_staging_servers...
jmp 0x100138ac
mov eax, dword [esi]
push str.cr:testwithlocalhost
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x100138ba
push 1
call fcn.10021b9f
mov ecx, esp
mov dword [ebp + 8], esp
push str.http:__localhost
call fcn.10001b63
call fcn.10021c29
pop ecx
push ebx
push dword [ebp - 0x10]
push str.Now_working_with_your_localhost_instead_of_Crossrider_servers...
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100139ae
mov eax, dword [esi]
push str.cr:reloadbg
push eax
call fcn.10024667
pop ecx
pop ecx
test eax, eax
jne 0x100138df
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.100226c8
pop ecx
pop ecx
jmp 0x100139ae
mov esi, dword [esi]
push str.cr:try
push esi
call fcn.10024667
pop ecx
pop ecx
test eax, eax
je 0x100139ae
mov eax, dword [0x1006a014]
mov dword [ebp + 8], eax
push str.Available_options_are:_n
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x4e
call fcn.10005875
push str.cr:info___General_info_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:updateapp___Updates_the_active_app_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:updateplatform___Updates_the_platform_files__and_the_active_app__n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:installapp_app_id____Installs_a_new_app_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:debug___Moves_into_debug_mode__and_attempts_to_open_the_debugging_JS_file__n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:undebug___Moves_out_of_debug_mode_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:stoptesting___Use_Crossrider_production_servers_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:testwithstaging___Use_Crossrider_staging_servers_n
lea ecx, [ebp + 8]
call fcn.10005875
push str.cr:testwithlocalhost___Use_the_localhost_instead_of_Crossrider_servers_n
lea ecx, [ebp + 8]
call fcn.10005875
lea eax, [ebp - 0x20]
push eax
call fcn.1001feef
pop ecx
push ebx
push dword [ebp - 0x20]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x20]
call fcn.10001270
lea ecx, [ebp + 8]
call fcn.10001270
lea ecx, [ebp - 0x10]
call fcn.10001270
lea ecx, [ebp - 0x24]
call fcn.10001270
call fcn.10025322
ret 4