Function at 0x4d9210
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x48
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x88]
mov dword [esp + 0x48], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x24], ebp
mov ecx, dword [eax + 0xc7c]
mov eax, dword [0x5646dc]
xor ebx, ebx
cmp eax, ebp
push edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x48], ecx
jne 0x4d8f5b
push str.wininet.dll
call dword [0x53d294]
mov edi, eax
cmp edi, ebp
jne 0x4d8e52
mov dword [0x5646dc], 2
jmp 0x4d9616
mov ebp, dword [0x53d298]
push str.InternetOpenA
push edi
call ebp
push str.InternetConnectA
push edi
mov dword [0x5646e0], eax
call ebp
push str.HttpOpenRequestA
push edi
mov dword [0x5646e4], eax
call ebp
push str.HttpSendRequestA
push edi
mov dword [0x5646e8], eax
call ebp
push 0x549000
push edi
mov dword [0x5646ec], eax
call ebp
push str.InternetQueryOptionA
push edi
mov dword [0x5646f0], eax
call ebp
push str.InternetQueryDataAvailable
push edi
mov dword [0x5646f4], eax
call ebp
push str.InternetReadFile
push edi
mov dword [0x5646f8], eax
call ebp
push str.InternetCloseHandle
push edi
mov dword [0x5646fc], eax
call ebp
push str.FtpOpenFileA
push edi
mov dword [0x564700], eax
call ebp
mov dword [0x564704], eax
mov eax, dword [0x5646e0]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646e4]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646e8]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646ec]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646f0]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646f4]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646f8]
test eax, eax
je 0x4d8e43
mov eax, dword [0x5646fc]
test eax, eax
je 0x4d8e43
mov eax, dword [0x564700]
test eax, eax
je 0x4d8e43
mov dword [0x5646dc], 1
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
push 0x548f84
call dword [0x5646e0]
cmp eax, ebp
mov dword [esp + 0x2c], eax
je 0x4d9616
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
mov edx, dword [str.https:__]
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d8f90
mov ecx, dword [esi + 0x30]
sub eax, edi
push eax
push edx
push ecx
call fcn.004c9030
add esp, 0xc
test eax, eax
jne 0x4d8fb7
mov ebx, 1
mov ebp, 0x1bb
jmp 0x4d8fba
mov ebp, dword [esi + 0x60]
mov eax, dword [esi + 0x64]
mov edi, dword [esi + 0x3c]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x2c]
push esi
sete dl
push 0
lea edx, [edx + edx + 1]
push edx
push 0
push 0
push ebp
push edi
push eax
call dword [0x5646e4]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4d9616
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
mov ecx, dword [esi + 0x88]
call fcn.00497d20
cmp eax, 6
mov eax, dword [esi + 0x54]
jl 0x4d9017
push 0
push eax
call fcn.004d9d70
add esp, 8
jmp 0x4d9020
push eax
call fcn.00435680
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x4d9616
mov eax, dword [esi + 0x64]
sub eax, 0
je 0x4d908a
dec eax
jne 0x4d9066
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push esi
push 2
push 0x80000000
push ecx
push edx
call dword [0x564704]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4d9616
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
xor ebp, ebp
push 0xc
call fcn.0052b380
add esp, 4
cmp eax, ebp
je 0x4d945e
mov ecx, dword [esi + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
jmp 0x4d9460
mov eax, dword [esi + 0x84]
test ah, 2
jne 0x4d9266
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x4d90ab
mov ecx, dword [esi + 0x70]
test ecx, ecx
ja 0x4d9279
mov ecx, 0x53de90
mov edx, eax
and edx, 0xffffff80
shl edx, 0xd
and eax, 0x8000
or edx, eax
mov eax, dword [esp + 0x14]
shl edx, 0xb
push esi
neg ebx
sbb ebx, ebx
and ebx, 0x800000
or edx, ebx
push edx
push 0
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0x38]
push ecx
call dword [0x5646e8]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4d9616
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
mov edx, dword [str.http:__]
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9110
mov ecx, dword [esi + 0x30]
sub eax, edi
push eax
push edx
push ecx
call fcn.004c9030
add esp, 0xc
test eax, eax
je 0x4d9151
mov edx, dword [str.https:__]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d9136
mov ecx, dword [esi + 0x30]
sub eax, edi
push eax
push edx
push ecx
call fcn.004c9030
add esp, 0xc
test eax, eax
jne 0x4d917a
push str.Referer:
lea ecx, [esp + 0x50]
call fcn.00435140
mov edx, dword [esi + 0x30]
push edx
lea ecx, [esp + 0x50]
call fcn.00435140
push 0x53de00
lea ecx, [esp + 0x50]
call fcn.00435140
push str.x_flash_version:
lea ecx, [esp + 0x50]
call fcn.00435140
push 0x548f58
lea ecx, [esp + 0x50]
call fcn.00435140
push 0x53de00
lea ecx, [esp + 0x50]
call fcn.00435140
mov edx, dword [esi + 0x30]
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d91b0
sub eax, edi
mov ebp, 4
cmp eax, ebp
jbe 0x4d9207
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d91c7
sub eax, edi
lea edi, [eax + edx - 4]
push str..jpg
push edi
call fcn.00435350
add esp, 8
test eax, eax
jne 0x4d91f9
push str..jpeg
dec edi
push edi
call fcn.00435350
add esp, 8
test eax, eax
je 0x4d9207
push str.Cache_Control:_no_transform_r_n
lea ecx, [esp + 0x50]
call fcn.00435140
mov eax, dword [esi + 0x6c]
test eax, eax
lea ecx, [esp + 0x4c]
je 0x4d92dc
mov edi, dword [esi + 0x70]
mov ebx, eax
mov eax, dword [esi + 0x74]
test eax, eax
je 0x4d9283
push str.Content_type:
call fcn.00435140
mov eax, dword [esi + 0x74]
push eax
lea ecx, [esp + 0x50]
call fcn.00435140
push str._r_nContent_length:
lea ecx, [esp + 0x50]
call fcn.00435140
push 0xa
push edi
lea ecx, [esp + 0x54]
call fcn.00434ea0
push 0x53de00
lea ecx, [esp + 0x50]
call fcn.00435140
jmp 0x4d92ee
mov edi, dword [esi + 0x6c]
test edi, edi
setne cl
movzx ecx, cl
test ecx, ecx
je 0x4d90ab
mov ecx, str.POST
jmp 0x4d90b0
mov eax, dword [esi + 0x84]
test ah, 2
je 0x4d92a8
push str.Content_type:
call fcn.00435140
push str.application_x_amf
lea ecx, [esp + 0x50]
call fcn.00435140
jmp 0x4d92ee
push str.Content_Type:
call fcn.00435140
push str.application_x_www_form_urlencoded
lea ecx, [esp + 0x50]
call fcn.00435140
push str._r_nContent_length:
lea ecx, [esp + 0x50]
call fcn.00435140
push 0xa
push edi
lea ecx, [esp + 0x54]
call fcn.00434ea0
jmp 0x4d92ee
push 0x53de00
call fcn.00435140
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x4d92fc
mov eax, dword [esp + 0x4c]
jmp 0x4d9304
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x14]
push ebx
push ecx
push eax
push edi
call dword [0x5646ec]
test eax, eax
je 0x4d9610
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9610
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
push 0x20000013
push edi
mov dword [esp + 0x34], ebp
call dword [0x5646f0]
test eax, eax
je 0x4d9616
push 0xc
call fcn.0052b380
add esp, 4
test eax, eax
je 0x4d936d
mov ecx, dword [esp + 0x34]
mov edx, dword [esi + 0x20]
mov dword [eax], edx
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
jmp 0x4d936f
xor eax, eax
push eax
mov eax, dword [esi + 0x88]
mov ecx, dword [eax + 0xc7c]
push 0
push 0x407
push ecx
call dword [0x53d41c]
cmp dword [esp + 0x34], 0xc8
jne 0x4d9616
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ebp
xor ebp, ebp
push ebp
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x30]
push eax
push 0x20000005
push ebx
call dword [0x5646f0]
test eax, eax
jne 0x4d93c5
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0x22
push ebx
mov dword [esp + 0x28], ebp
call dword [0x5646f4]
test eax, eax
jne 0x4d9068
call dword [0x53d26c]
cmp eax, 0x7a
jne 0x4d9068
mov eax, dword [esp + 0x18]
cmp eax, ebp
jbe 0x4d9068
push eax
call fcn.0052b380
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x4d9068
lea edx, [esp + 0x18]
push edx
push edi
push 0x22
push ebx
call dword [0x5646f4]
test eax, eax
je 0x4d9450
push 0xc
call fcn.0052b380
add esp, 4
cmp eax, ebp
je 0x4d9447
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x20]
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov dword [esp + 0x24], eax
jmp 0x4d9068
mov dword [esp + 0x24], ebp
jmp 0x4d9068
push edi
call fcn.00439d00
add esp, 4
jmp 0x4d9068
xor eax, eax
mov edx, dword [esi + 0x88]
mov ebx, dword [0x53d41c]
push eax
mov eax, dword [edx + 0xc7c]
push ebp
push 0x404
push eax
call ebx
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4d949a
mov ecx, dword [esi + 0x88]
mov edx, dword [ecx + 0xc7c]
push eax
push ebp
push 0x408
push edx
call ebx
push 0xc
call fcn.0052b380
add esp, 4
cmp eax, ebp
je 0x4d94b9
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x20]
mov dword [eax], edx
mov dword [eax + 4], ebp
mov dword [eax + 8], ecx
jmp 0x4d94bb
xor eax, eax
push eax
mov eax, dword [esi + 0x88]
mov ecx, dword [eax + 0xc7c]
push ebp
push 0x406
push ecx
call ebx
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
mov ebp, dword [esp + 0x48]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push eax
call dword [0x5646f8]
test eax, eax
je 0x4d959f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4d959f
mov cl, byte [esi + 0x1d]
test cl, cl
jne 0x4d959f
cmp eax, 0x10000
jbe 0x4d9523
mov eax, 0x10000
mov dword [esp + 0x24], eax
push eax
call fcn.0052b380
mov edx, dword [esp + 0x28]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
mov eax, dword [esp + 0x14]
push edx
push edi
push eax
call dword [0x5646fc]
test eax, eax
je 0x4d959f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4d959f
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
push 0xc
call fcn.0052b380
add esp, 4
test eax, eax
je 0x4d957c
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x20]
mov dword [eax + 4], edi
mov dword [eax], edx
mov dword [eax + 8], ecx
mov edi, eax
jmp 0x4d957e
xor edi, edi
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d95cb
push edi
push 0
push 0x402
push ebp
call ebx
test eax, eax
je 0x4d95cb
mov al, byte [esi + 0x1d]
test al, al
je 0x4d94e0
mov al, byte [esi + 0x1d]
test al, al
jne 0x4d9616
push 0xc
mov dword [esp + 0x34], 1
call fcn.0052b380
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x4d95f2
mov edx, dword [esi + 0x20]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x4d95f4
test edi, edi
je 0x4d95e8
mov eax, dword [edi + 4]
test eax, eax
je 0x4d95df
push eax
call fcn.00439d00
add esp, 4
push edi
call fcn.00439d00
add esp, 4
mov dword [esp + 0x30], 1
jmp 0x4d9616
xor eax, eax
push eax
mov eax, dword [esi + 0x88]
push ecx
mov ecx, dword [eax + 0xc7c]
push 0x405
push ecx
call dword [0x53d41c]
jmp 0x4d9616
call dword [0x53d26c]
mov edx, dword [esp + 0x14]
push edx
call fcn.00439d00
mov eax, dword [esp + 0x14]
xor edi, edi
add esp, 4
cmp eax, edi
je 0x4d9634
push eax
call dword [0x564700]
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4d9643
push eax
call dword [0x564700]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x4d9652
push eax
call dword [0x564700]
cmp dword [esp + 0x30], edi
jne 0x4d968f
push 0xc
call fcn.0052b380
add esp, 4
cmp eax, edi
je 0x4d9673
mov ecx, dword [esi + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edi
jmp 0x4d9675
xor eax, eax
mov edx, dword [esi + 0x88]
push eax
mov eax, dword [edx + 0xc7c]
push edi
push 0x403
push eax
call dword [0x53d41c]
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00439d00
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret