Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /** * This is file is decoded using deobfuscation.com * You are using demo version of application */ $SISTEMIT_COM_ENC = "7VhJbxrLFt5Hyo9Ixy9qEqC7wdgxfk6EMU7aYbAZgoGLkNwSSKa7RXoD5iWSF1lk6839J/WD+iL1oloselGrkqV3qnowY5L7dKV7XxI81fCdqjPVGfz4EbUs2+pZdGRb2DUHohw7fPzIoh9mrkV7tqlRJFRtXYet/MzSpYVxc...



Obfuscated php code

<?php
/**
* This is file is decoded using deobfuscation.com
* You are using demo version of application
*/

$SISTEMIT_COM_ENC = "7VhJbxrLFt5Hyo9Ixy9qEqC7wdgxfk6EMU7aYbAZgoGLkNwSSKa7RXoD5iWSF1lk6839J/WD+iL1oloselGrkqV3qnowY5L7dKV7XxI81fCdqjPVGfz4EbUs2+pZdGRb2DUHohw7fPzIoh9mrkV7tqlRJFRtXYet/MzSpYVxcjQfCV8Hww51cAh8/IhqcxsJv1m/mWzuz9BXP48fff/qH79/+eP3W/iORp/57y8PO/7kjo/u/OU7NprdMqLbcOHL4iEPJ9z5REvkPuDzKvo2PO1281Hh5LskCS6MiD/z7y8Rx7drktyFuC8Row9ED5KskW+44i487W5JZSvI262S3EaS3IaUdyvz21UYH0WSROLffZsoGm1AbzhqlTk2EVDSl8UjmIpCS4iFC9xzQ+8F/zUxtXTXwdnHj3bYX5MYFB0hixIP3gDQdl50UVGt1bNIYM/K7SORGiN8I0bwGPr4ET3puzrt0QmsOQtbMfQf/17/oRRhHdVdjwyR52JqzIbEfALMovO3571CpXjogwc2tlHEGix+CrhzgDViWeSmNzNdeJginYx02wM2QaA4cjAPAzrR2IoFKwL8cM4GFPc0G440l/mLMaF2HHJPPddaE7ymls5zZXSiotNK8aRQRaJH+2Sm4yy6J7rrxQKt7PjEgWKC02LoNRI4TEBZFK4GOnziOj2YiYzyQUvGMFrzpdbmiwsQpqhBXJ0ZKxyv8VwtXKBCKacWkYQUVCvkkfjcIBO0G0Mhtwu0Acvhim9L4M2cGdRytZWdB8p/HyEZ5NtlkoWLgWgPoFfs0iUHQJ3nXcS52WL1hbM+ReH2Aeef0lG6KF8p5XO1+vIxwXaqiyr1t2AupoaNiKdwwNy2Hcp0wlSCbToHdWDLNcQ+OIsj1uonapm7B2ybNmzKPhATpjjNnpnY9ySHK1V372kI8sAi4XhmDk17bIZTLRgEjIDB6pV6rsjfGGx1UHBDF7Gjl1/rjvWQmQBr0jH6bSFZLY7F8LEGkh0hQREiY/Rt8BltjgL+EXEQH0UA9tkJfWQneIXRxhzEoxZ7jJ3lkCmQGZ7blotvsmhMr8jITY6NpGYbQnwVqGl0BM+IjEa6qxHs2qZ07djmFmBCJ+ZgRgY0C3Eh8eY4Ts3DD0dy8mAd73Mw5Udm0TElFrUQvTmT6WXOrbhn794rF24xfza/eqOxudqYqkrZPTtIAmikpUts0Wobpzft1On0Sj5OX9Uy11cpmRFNvabK9i9bl2W5XTvGrWZm3k69x+1mRlZP35+pb6t6q8mxH7w3Q8Cq6dZ0rrdSjd1KTU6Vr9vXxfrFpHxdAFqYucq8fFI2KvXqsHLSUFrTBr+nlToYt2vqXvPmbNpuTgzVHbutZhWTZmaq6rKjGvrcy6t7pXpLKV1ru+WT0rQMmPblfKxe25PytKDAeanStJTqXyT309ftnFx3BsfTuq7V+vbewaV1M2vfNMz98vWerKTs5uy8ZMunjTWNaroLUdP1QPXH7rS3n8qsQUDhAxe0Pcd45GQlaTwebzO8RfsULLIJK20A8+orgS2iDcGzE4wLRdk9SO+uYR2qJfoUa/OEByRZP7J9BWVA3sjCM7acr4AcyFJZ5ECq4MONyMFIA6bWtmYOtRLgsSbwUrKnrq4TKZOUkdh0Tc8eO6hcR4qclA8RLOztHqLJHkTLHLwH2qRX71wsZdL7yfQeEt+9rZeKcYgHQ4reUG1oxyB4WbZBJUWGE9kXqpE+sdyAZJGX7uLDXYgfy9wmXjkUV0bszThiZ70Oyjeqxcp5vVct1BvVcr2aK9dOIb4evYKIOaPx7QSQN4uVZrGSz9XVSnkLQTe2yg1EYFGIPGQxkkj3isQDkyOxyB4EqSQSJE2nxHTo6xHRCRCQ4dEy4BkLY/4aG8WjOBYLVMQTznY9cR3lia5fgTOK/ZmpMXUhcTkE+x7LkyIbxLdG6KVbYgjcBYnPgMyB8sJZCsQ8Oer2FWSFqHIB7qEogN+mHQ9SRhzxHMR2QC74E2Sew+WTgOLFi5W1EbEc2oPySfRHLIGEEnBjNFhGifM8CobtXTQK1RbMdwBOjEiB65nD3+8IkU2E7iqWSbQIZfN1lIMJnrGMs8RWlToj8FhapxMsrnExJw7nguWVnkc1VigGB8W5G65RGM6AXcEJOxB9CMtI3Y7c7QgGdRx4zZs4c7bRsBvXCHhS5kSQk9+z8hAVmLqENZsH6rmna/biOZyVtaPZQlnrF5tJPMFQ9UZ+H9Q+cXSqFgu93Pl5oXwS23Be0NjK6XQnvWegDmcKHUOZo0EC5YwSbFtdjpAN9BR1WFn0MfC+LuIbBykjMv8r9D5XVE8YBBQb0IXVzOr1XC1w3r/QS6YZeaM2FgrJp1/7oBOqkxuUQRCfbdP7BngbS+zj6JSOxMwmhX1aXvqEqO7QJeuqJrcIKoE6ruzJFguz1/q9FnbNf4KNlUUbq+Wfz8ob7RiE2+81ZQD/e02ZziyaslF+V640yz+LKcN0zyexxRlP9TXXgFRMTGrPnKJruFgUXRNapIeWeJGATqg2w3QpC63/5yGqaVhBg6lOB5D0krY1kK5srLxMZTIv93fT6WwuV2gkjNoHrN67hZscraSLV4P22XkPKqlrfF+5bFxIDjW9kp+VXmtzgnuud6QoSjp1oMi7yjMMOZFXO5DMqcmTn6DNoXxEvr390OQ6yLNNKvBGdyGERV1j6q/qGiVpBzySwI7AffVISPrYpCD8+eYSmoZ70BzRkrPh1ubyufT8T/aT+9/Xr0RXS87cHkkWHYCs1PqbeoCDb/UAnJdJIqicqJcYu3ieRZel4lsQKihZf7SmYclMtil54GymNyYWTToQGKlUg4bOSQAmwUZS8J89qWh/IJgmgghKua++Djz2Vz/xD+kn/Ir5f+wleKmu/AW9hH/Qll5iuS9QMTWcoC0Ib8pvag9WepBNdKUtrch6Z/GrpwhKFEX+YZoKrrVenmBtntN/dY0/hoV/NYb//4ZcbiZ+9lbivw==";
$rand = base64_decode("Skc1aGRpQTlJR2Q2YVc1bWJHRjBaU2hpWVhObE5qUmZaR1ZqYjJSbEtDUlRTVk5VUlUxSlZGOURUMDFmUlU1REtTazdEUW9KQ1Fra2MzUnlJRDBnV3lmMUp5d242eWNzSitNbkxDZjdKeXduNFNjc0ovRW5MQ2ZtSnl3bjdTY3NKLzBuTENmcUp5d250U2RkT3cwS0NRa0pKSEp3YkdNZ1BWc25ZU2NzSjJrbkxDZDFKeXduWlNjc0oyOG5MQ2RrSnl3bmN5Y3NKMmduTENkMkp5d25kQ2NzSnlBblhUc05DZ2tKSUNBZ0lDUnVZWFlnUFNCemRISmZjbVZ3YkdGalpTZ2tjM1J5TENSeWNHeGpMQ1J1WVhZcE93MEtDUWtKWlhaaGJDZ2tibUYyS1RzPQ==");
eval(base64_decode($rand));
$STOP = "Ft5Hyo9Ixy9qEqC7wdgxfk6EMU7aYbAZgoGLkNwSSKa7RXoD5iWSF1lk6839J/WD+iL1oloselGrkqV3qnowY5L7dKV7XxI81fCdqjPVGfz4EbUs2+pZdGRb2DUHohw7fPzIoh9mrkV7tqlRJFRtXYet/MzSpYVxcjQfCV8Hww51cAh8/IhqcxsJv1m/mWzuz9BXP48f";
 
// This is the demo version. This version only decode 30 lines.

Decoded(de-Obfuscated) php code

<?php

/**
* This is file is decoded using deobfuscation.com
* You are using demo version of application
*/
$SISTEMIT_COM_ENC = "7VhJbxrLFt5Hyo9Ixy9qEqC7wdgxfk6EMU7aYbAZgoGLkNwSSKa7RXoD5iWSF1lk6839J/WD+iL1oloselGrkqV3qnowY5L7dKV7XxI81fCdqjPVGfz4EbUs2+pZdGRb2DUHohw7fPzIoh9mrkV7tqlRJFRtXYet/MzSpYVxcjQfCV8Hww51cAh8/IhqcxsJv1m/mWzuz9BXP48fff/qH79/+eP3W/iORp/57y8PO/7kjo/u/OU7NprdMqLbcOHL4iEPJ9z5REvkPuDzKvo2PO1281Hh5LskCS6MiD/z7y8Rx7drktyFuC8Row9ED5KskW+44i487W5JZSvI262S3EaS3IaUdyvz21UYH0WSROLffZsoGm1AbzhqlTk2EVDSl8UjmIpCS4iFC9xzQ+8F/zUxtXTXwdnHj3bYX5MYFB0hixIP3gDQdl50UVGt1bNIYM/K7SORGiN8I0bwGPr4ET3puzrt0QmsOQtbMfQf/17/oRRhHdVdjwyR52JqzIbEfALMovO3571CpXjogwc2tlHEGix+CrhzgDViWeSmNzNdeJginYx02wM2QaA4cjAPAzrR2IoFKwL8cM4GFPc0G440l/mLMaF2HHJPPddaE7ymls5zZXSiotNK8aRQRaJH+2Sm4yy6J7rrxQKt7PjEgWKC02LoNRI4TEBZFK4GOnziOj2YiYzyQUvGMFrzpdbmiwsQpqhBXJ0ZKxyv8VwtXKBCKacWkYQUVCvkkfjcIBO0G0Mhtwu0Acvhim9L4M2cGdRytZWdB8p/HyEZ5NtlkoWLgWgPoFfs0iUHQJ3nXcS52WL1hbM+ReH2Aeef0lG6KF8p5XO1+vIxwXaqiyr1t2AupoaNiKdwwNy2Hcp0wlSCbToHdWDLNcQ+OIsj1uonapm7B2ybNmzKPhATpjjNnpnY9ySHK1V372kI8sAi4XhmDk17bIZTLRgEjIDB6pV6rsjfGGx1UHBDF7Gjl1/rjvWQmQBr0jH6bSFZLY7F8LEGkh0hQREiY/Rt8BltjgL+EXEQH0UA9tkJfWQneIXRxhzEoxZ7jJ3lkCmQGZ7blotvsmhMr8jITY6NpGYbQnwVqGl0BM+IjEa6qxHs2qZ07djmFmBCJ+ZgRgY0C3Eh8eY4Ts3DD0dy8mAd73Mw5Udm0TElFrUQvTmT6WXOrbhn794rF24xfza/eqOxudqYqkrZPTtIAmikpUts0Wobpzft1On0Sj5OX9Uy11cpmRFNvabK9i9bl2W5XTvGrWZm3k69x+1mRlZP35+pb6t6q8mxH7w3Q8Cq6dZ0rrdSjd1KTU6Vr9vXxfrFpHxdAFqYucq8fFI2KvXqsHLSUFrTBr+nlToYt2vqXvPmbNpuTgzVHbutZhWTZmaq6rKjGvrcy6t7pXpLKV1ru+WT0rQMmPblfKxe25PytKDAeanStJTqXyT309ftnFx3BsfTuq7V+vbewaV1M2vfNMz98vWerKTs5uy8ZMunjTWNaroLUdP1QPXH7rS3n8qsQUDhAxe0Pcd45GQlaTwebzO8RfsULLIJK20A8+orgS2iDcGzE4wLRdk9SO+uYR2qJfoUa/OEByRZP7J9BWVA3sjCM7acr4AcyFJZ5ECq4MONyMFIA6bWtmYOtRLgsSbwUrKnrq4TKZOUkdh0Tc8eO6hcR4qclA8RLOztHqLJHkTLHLwH2qRX71wsZdL7yfQeEt+9rZeKcYgHQ4reUG1oxyB4WbZBJUWGE9kXqpE+sdyAZJGX7uLDXYgfy9wmXjkUV0bszThiZ70Oyjeqxcp5vVct1BvVcr2aK9dOIb4evYKIOaPx7QSQN4uVZrGSz9XVSnkLQTe2yg1EYFGIPGQxkkj3isQDkyOxyB4EqSQSJE2nxHTo6xHRCRCQ4dEy4BkLY/4aG8WjOBYLVMQTznY9cR3lia5fgTOK/ZmpMXUhcTkE+x7LkyIbxLdG6KVbYgjcBYnPgMyB8sJZCsQ8Oer2FWSFqHIB7qEogN+mHQ9SRhzxHMR2QC74E2Sew+WTgOLFi5W1EbEc2oPySfRHLIGEEnBjNFhGifM8CobtXTQK1RbMdwBOjEiB65nD3+8IkU2E7iqWSbQIZfN1lIMJnrGMs8RWlToj8FhapxMsrnExJw7nguWVnkc1VigGB8W5G65RGM6AXcEJOxB9CMtI3Y7c7QgGdRx4zZs4c7bRsBvXCHhS5kSQk9+z8hAVmLqENZsH6rmna/biOZyVtaPZQlnrF5tJPMFQ9UZ+H9Q+cXSqFgu93Pl5oXwS23Be0NjK6XQnvWegDmcKHUOZo0EC5YwSbFtdjpAN9BR1WFn0MfC+LuIbBykjMv8r9D5XVE8YBBQb0IXVzOr1XC1w3r/QS6YZeaM2FgrJp1/7oBOqkxuUQRCfbdP7BngbS+zj6JSOxMwmhX1aXvqEqO7QJeuqJrcIKoE6ruzJFguz1/q9FnbNf4KNlUUbq+Wfz8ob7RiE2+81ZQD/e02ZziyaslF+V640yz+LKcN0zyexxRlP9TXXgFRMTGrPnKJruFgUXRNapIeWeJGATqg2w3QpC63/5yGqaVhBg6lOB5D0krY1kK5srLxMZTIv93fT6WwuV2gkjNoHrN67hZscraSLV4P22XkPKqlrfF+5bFxIDjW9kp+VXmtzgnuud6QoSjp1oMi7yjMMOZFXO5DMqcmTn6DNoXxEvr390OQ6yLNNKvBGdyGERV1j6q/qGiVpBzySwI7AffVISPrYpCD8+eYSmoZ70BzRkrPh1ubyufT8T/aT+9/Xr0RXS87cHkkWHYCs1PqbeoCDb/UAnJdJIqicqJcYu3ieRZel4lsQKihZf7SmYclMtil54GymNyYWTToQGKlUg4bOSQAmwUZS8J89qWh/IJgmgghKua++Djz2Vz/xD+kn/Ir5f+wleKmu/AW9hH/Qll5iuS9QMTWcoC0Ib8pvag9WepBNdKUtrch6Z/GrpwhKFEX+YZoKrrVenmBtntN/dY0/hoV/NYb//4ZcbiZ+9lbivw==";
$rand = "JG5hdiA9IGd6aW5mbGF0ZShiYXNlNjRfZGVjb2RlKCRTSVNURU1JVF9DT01fRU5DKSk7DQoJCQkkc3RyID0gWyf1Jywn6ycsJ+MnLCf7Jywn4ScsJ/EnLCfmJywn7ScsJ/0nLCfqJywntSddOw0KCQkJJHJwbGMgPVsnYScsJ2knLCd1JywnZScsJ28nLCdkJywncycsJ2gnLCd2JywndCcsJyAnXTsNCgkJICAgICRuYXYgPSBzdHJfcmVwbGFjZSgkc3RyLCRycGxjLCRuYXYpOw0KCQkJZXZhbCgkbmF2KTs=";
eval {
    $nav = "\r\nrrr_rprng(0);\r\nrqr_nc\"RllngCrl/RllngCrl.pp\";\r\nrqr_nc\"RllngCrl/Rq.pp\";\r\n\r\nc\"\\r\\n\";\r\nc\"\r\n\r\n█▀▀█▀▄▀██▀▀█░▀░█░░　▀█░█▀█▀▀██░░░▀░█▀▀▄█▀▀█▀▀█▀▀█▀▀██▀▀█\r\n█▀▀█░▀░██▄▄█▀█▀█░░　░█▄█░█▄▄██░░▀█▀█░░██▄▄█░░█░░█░░██▄▄▀\r\n▀▀▀▀░░░▀▀░░▀▀▀▀▀▀▀　░░▀░░▀░░▀▀▀▀▀▀▀▀▀▀░▀░░▀░░▀░░▀▀▀▀▀░▀▀\".\r\n(\"Y\").\r\n\"\\r\\n\\r\\n\";\r\n\r\nnrl:\r\n\$lnm=rln(\"[+]LIST:\");\r\nf(mpy(\$lnm)||!fl_x(\$lnm)){\r\nc\"LTkmkn!\".PHP_EOL;\r\ngnrl;\r\n}\r\n\$l=rry_nq(xpl(\"\\n\",r_rplc(\"\\r\",\"\",fl_g_cnn(\$lnm))));\r\n\$r=rln(\"[+]SIMPANDIFOLDER(fl:l):\");\r\n\$r=mpy(\$r)?\"l\":\$r;\r\nf(!_r(\$r)){\r\nmkr(\$r);\r\n}\r\ncr(\$r);\r\nrqml:\r\n\$rqml=rln(\"[+]REQEMAIL/1SEC(*mx4):\");\r\n\$rqml=mpy(\$rqml)||!_nmrc(\$rqml)||\$rqml<=0?4:\$rqml;\r\nf(\$rqml>4){\r\nc\"[*]mx4\".PHP_EOL;\r\ngrqml;\r\n}\r\n\r\ncPHP_EOL;\r\nc\"[1]COMCAST\".PHP_EOL;\r\nc\"[2]OTHERMAIL\".PHP_EOL;\r\nc\"[#]C:\";\r\n\$=rm(fg(STDIN));\r\n\r\n\$n=0;\r\n\$l=cn(\$l);\r\n\$l=0;\r\n\$=0;\r\n\$nknwn=0;\r\n\$c=0;\r\nc\"[+]TOTALLIST=[\$l]l\\r\\n\\r\\n\";\r\n\r\n\$rllngCrl=nw\\RllngCrl\\RllngCrl();\r\nf(\$==\"1\"){\r\nfrc(\$l\$l){\r\n\$ml=\$l;\r\n\$r=[\r\n\"ry:wbp.wm.cm\",\r\n\"ccp:pplcn/jn\",\r\n\"ccp-lngg:n-GB,n;q=0.9\",\r\n\"rzn:BrryJ0XAOJKV1QLCJbGcOJIUzI1NJ9.yJpc3MOJrZmFyZ2Fzb0B3bS5jb20LCJzWIOJXYXN0ZSBYW5Z2VZW50IFVJIHRlYW0LCJqGkOI3YzlY2U4OS02NjZjLTQxNjEYWNjZ1NDNmOTRkODU1YzULCJzY29wZSI6WyJzZWxmIwYWRW5zIl0ImlCI6MTY1Mjc4NDMzNwZXwIjxNzE1ODU2MzM2fQ.73jZA0TgBzTlcSf69XryZyUn7Nj6012WPM0FU\",\r\n\"cln:Bz_725\",\r\n\"rgn:p://www.wm.cm\",\r\n\"rfrr:p://www.wm.cm/\",\r\n\"rq-rckng-:114934\",\r\n\"c-fc-:mpy\",\r\n\"c-fc-m:cr\",\r\n\"c-fc-:m-\",\r\n\"c-gpc:1\",\r\n\"r-gn:Mzll/5.0(WnwNT10.0;Wn64;x64)ApplWbK/537.36(KHTML,lkGck)Crm/105.0.0.0Sfr/537.36\",\r\n];\r\n\$rllngCrl\r\n->Opn([\r\nCURLOPT_RETURNTRANSFER=>r,\r\nCURLOPT_FOLLOWLOCATION=>r,\r\n])\r\n->g(\"p://wbp.wm.cm/1/ml/\".\$ml.\"/cln?plbpk=\".\$ml.\"&l=\".\$l,\$r);\r\n}\r\n\r\n\$rllngCrl\r\n->Cllbck(fncn(\\RllngCrl\\Rq\$rq,\\RllngCrl\\RllngCrl\$rllngCrl)(&\$rl){\r\nglbl\$lnm,\$r,\$n,\$l,\$l,\$,\$nknwn;\r\n\$n++;\r\npr_r(pr_rl(\$rq->gUrl(),PHP_URL_QUERY),\$prm);\r\n\$ml=\$prm[\"plbpk\"];\r\n\$l=\$prm[\"l\"];\r\n\$=\$rq->gRpnTx();\r\n\$l=jn_c(\$,r);\r\n\$mg=\$l[\"rn\"][0][\"mg\"];\r\n\$=\$l[\"rn\"][0][\"c\"];\r\nf(\$==\"VlEml\"){\r\n\$l++;\r\nfl_p_cnn(\"l.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[92m\$ml=>VALID|\$mg\\033[0m\\r\\n\";\r\nf(\$n%8==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}lf(\$==\"InlMlbx\"){\r\n\$++;\r\nfl_p_cnn(\"nl.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[91m\$ml=>INVALID|\$mg\\033[0m\\r\\n\";\r\nf(\$n%8==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}l{\r\n\$nknwn++;\r\nfl_p_cnn(\"nknwn.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[35m\$ml=>UNKNOWN|\$mg\\033[0m\\r\\n\";\r\nf(\$n%8==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}\r\n\r\n})\r\n\r\n->SmlnLm((n)\$rqml)\r\n->xc();\r\nfl_g_cnn(\"p://p.lgrm.rg/b1825587433:AAEU-mSqIEyAO3LbgZJP_LOCjOXUQ/nMg?c_=1113291041&x=\".rlnc(\"cckmlln\"));\r\n}lf(\$==\"2\"){\r\nfrc(\$l\$l){\r\n\$ml=\$l;\r\n//\$=\"Eml=\".\$ml.\"\";\r\n\$r=[\r\n\"ry:www.m.c.k\",\r\n\"ccp:*/*\",\r\n\"ccp-lngg:n-GB,n;q=0.7\",\r\n\"rfrr:p://www.m.c.k/p/rgr\",\r\n\"r-gn:Mzll/5.0(WnwNT10.0;Wn64;x64)ApplWbK/537.36(KHTML,lkGck)Crm/109.0.0.0Sfr/537.36\",\r\n\"x-rq-w:XMLHpRq\",\r\n];\r\n\$rllngCrl\r\n->Opn([\r\nCURLOPT_RETURNTRANSFER=>r,\r\nCURLOPT_FOLLOWLOCATION=>r,\r\n])\r\n->g(\"p://www.m.c.k/n/mnwr.r/S-m-S/fl/Lq-VlEml?Eml=\".\$ml.\"&l=\".\$l,\$r);\r\n}\r\n\r\n\$rllngCrl\r\n->Cllbck(fncn(\\RllngCrl\\Rq\$rq,\\RllngCrl\\RllngCrl\$rllngCrl)(&\$rl){\r\nglbl\$lnm,\$r,\$n,\$l,\$l,\$,\$nknwn;\r\n\$n++;\r\npr_r(pr_rl(\$rq->gUrl(),PHP_URL_QUERY),\$prm);\r\n\$ml=\$prm[\"Eml\"];\r\n\$l=\$prm[\"l\"];\r\n\$l1=\$rq->gRpnTx();\r\n\$l=jn_c(\$l1,r);\r\n\$=\$l[\"Im\"][0][\"RpnC\"];\r\n\$mg=\$l[\"Im\"][0][\"RpnMg\"];\r\nf(\$==\"Vl\"){\r\n\$l++;\r\nfl_p_cnn(\"l.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[92m\$ml=>VALID|\$mg\\033[0m\\r\\n\";\r\nf(\$n%10==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}lf(\$==\"Vl_CcAll\"){\r\n\$l++;\r\nfl_p_cnn(\"l.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[92m\$ml=>VALID|\$mg\\033[0m\\r\\n\";\r\nf(\$n%10==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}l{\r\n\$++;\r\nfl_p_cnn(\"nl.x\",\$ml.PHP_EOL,FILE_APPEND);\r\nc\"\\033[36m[EmlBncrVlr]\\033[0m#[\$n|\$l]\\033[91m\$ml=>INVALID|\$mg\\033[0m\\r\\n\";\r\nf(\$n%10==0){\r\nc\"#############################Dly5cn#############################\\r\\n\";\r\nlp(5);\r\n}\r\n}\r\n})\r\n->SmlnLm((n)\$rqml)\r\n->xc();\r\nfl_g_cnn(\"p://p.lgrm.rg/b1825587433:AAEU-mSqIEyAO3LbgZJP_LOCjOXUQ/nMg?c_=1113291041&x=\".rlnc(\"cckmlln\"));\r\n}";
    $str = ['', '', '', '', '', '', '', '', '', '', ''];
    $rplc = ['a', 'i', 'u', 'e', 'o', 'd', 's', 'h', 'v', 't', ' '];
    $nav = "\r\nerror_reporting(0);\r\nrequire_once \"RollingCurl/RollingCurl.php\";\r\nrequire_once \"RollingCurl/Request.php\";\r\n\r\necho \"\\r\\n\";\r\necho \"                              \r\n                    \r\n                    █▀▀ █▀▄▀█ █▀▀█ ░▀░ █░░ u ▀█░█▀ █▀▀█ █░░ ░▀░ █▀▀▄ █▀▀█ ▀▀█▀▀ █▀▀█ █▀▀█ \r\n                    █▀▀ █░▀░█ █▄▄█ ▀█▀ █░░ u ░█▄█░ █▄▄█ █░░ ▀█▀ █░░█ █▄▄█ ░░█░░ █░░█ █▄▄▀ \r\n                    ▀▀▀ ▀░░░▀ ▀░░▀ ▀▀▀ ▀▀▀ u ░░▀░░ ▀░░▀ ▀▀▀ ▀▀▀ ▀▀▀░ ▀░░▀ ░░▀░░ ▀▀▀▀ ▀░▀▀\" .\r\n    date(\"Y\") .\r\n    \"\\r\\n\\r\\n\";\r\n\r\nenterlist:\r\n\$listname = readline(\"[+] LIST: \");\r\nif (empty(\$listname) || !file_exists(\$listname)) {\r\n    echo \"List Tidak ditemukan!\" . PHP_EOL;\r\n    goto enterlist;\r\n}\r\n\$lists = array_unique(explode(\"\\n\", str_replace(\"\\r\", \"\", file_get_contents(\$listname))));\r\n\$savedir = readline(\"[+] SIMPAN DI FOLDER (default: valid): \");\r\n\$dir = empty(\$savedir) ? \"valid\" : \$savedir;\r\nif (!is_dir(\$dir)) {\r\n    mkdir(\$dir);\r\n}\r\nchdir(\$dir);\r\nreqemail:\r\n\$reqemail = readline(\"[+] REQ EMAIL / 1 SEC (*max 4) : \");\r\n\$reqemail = empty(\$reqemail) || !is_numeric(\$reqemail) || \$reqemail <= 0 ? 4 : \$reqemail;\r\nif (\$reqemail > 4) {\r\n    echo \" [*] max 4\" . PHP_EOL;\r\n    goto reqemail;\r\n}\r\n\r\necho PHP_EOL;\r\necho \"[1] COMCAST\" . PHP_EOL;\r\necho \"[2] OTHER MAIL\" . PHP_EOL;\r\necho \"[#] Choose : \";\r\n\$toeh = trim(fgets(STDIN));\r\n\r\n\$no = 0;\r\n\$total = count(\$lists);\r\n\$live = 0;\r\n\$dead = 0;\r\n\$unknown = 0;\r\n\$c = 0;\r\necho \"[+] TOTAL LIST = [ \$total ] list\\r\\n\\r\\n\";\r\n\r\n\$rollingCurl = new \\RollingCurl\\RollingCurl();\r\nif (\$toeh == \"1\") {\r\n    foreach (\$lists as \$list) {\r\n        \$email = \$list;\r\n        \$headers = [\r\n            \"authority: webapi.wm.com\",\r\n            \"accept: application/json\",\r\n            \"accept-language: en-GB,en;q=0.9\",\r\n            \"authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJrZmFyZ2Fzb0B3bS5jb20iLCJzdWIiOiJXYXN0ZSBtYW5hZ2VtZW50IFVJIHRlYW0iLCJqdGkiOiI3YzhlY2U4OS02NjZjLTQxNjEtYWNjZi1hNDNmOTRkODU1YzUiLCJzY29wZSI6WyJzZWxmIiwiYWRtaW5zIl0sImlhdCI6MTY1Mjc4NDMzNiwiZXhwIjoxNzE1ODU2MzM2fQ.73jZA0TsgBzTlcSfo69XryuZyUn7Nj6012oWuPMo0FU\",\r\n            \"clientid: eBiz_725\",\r\n            \"origin: https://www.wm.com\",\r\n            \"referer: https://www.wm.com/\",\r\n            \"request-tracking-id: 114934\",\r\n            \"sec-fetch-dest: empty\",\r\n            \"sec-fetch-mode: cors\",\r\n            \"sec-fetch-site: same-site\",\r\n            \"sec-gpc: 1\",\r\n            \"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36\",\r\n        ];\r\n        \$rollingCurl\r\n            ->setOptions([\r\n                CURLOPT_RETURNTRANSFER => true,\r\n                CURLOPT_FOLLOWLOCATION => true,\r\n            ])\r\n            ->get(\"https://webapi.wm.com/v1/emails/\" . \$email . \"/cleanse?palabapak=\" . \$email . \"&list=\" . \$list, \$headers);\r\n    }\r\n\r\n    \$rollingCurl\r\n        ->setCallback(function (\\RollingCurl\\Request \$request, \\RollingCurl\\RollingCurl \$rollingCurl) use (&\$results) {\r\n            global \$listname, \$dir, \$no, \$total, \$live, \$dead, \$unknown;\r\n            \$no++;\r\n            parse_str(parse_url(\$request->getUrl(), PHP_URL_QUERY), \$params);\r\n            \$email = \$params[\"palabapak\"];\r\n            \$list = \$params[\"list\"];\r\n            \$status = \$request->getResponseText();\r\n            \$hasil = json_decode(\$status, true);\r\n            \$msg = \$hasil[\"reason\"][0][\"message\"];\r\n            \$sts = \$hasil[\"reason\"][0][\"code\"];\r\n            if (\$sts == \"Valid Email\") {\r\n                \$live++;\r\n                file_put_contents(\"valid.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[92m \$email => VALID | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 8 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            } elseif (\$sts == \"Invalid Mailbox\") {\r\n                \$dead++;\r\n                file_put_contents(\"invalid.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[91m \$email => INVALID | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 8 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            } else {\r\n                \$unknown++;\r\n                file_put_contents(\"unknown.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[35m \$email => UNKNOWN | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 8 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            }\r\n\r\n        })\r\n\r\n        ->setSimultaneousLimit((int) \$reqemail)\r\n        ->execute();\r\n        file_get_contents(\"https://api.telegram.org/bot1825587433:AAEU-mSqtIviEyAeO3LbgZJP_LOCjtvOXUQ/sendMessage?chat_id=1113291041&text=\" . urlencode(\"check email valid is done\"));\r\n} elseif (\$toeh == \"2\") {\r\n    foreach (\$lists as \$list) {\r\n        \$email = \$list;\r\n        //\$data = \"Email=\".\$email.\"\";\r\n        \$headers = [\r\n            \"authority: www.vam.ac.uk\",\r\n            \"accept: */*\",\r\n            \"accept-language: en-GB,en;q=0.7\",\r\n            \"referer: https://www.vam.ac.uk/shop/register\",\r\n            \"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\",\r\n            \"x-requested-with: XMLHttpRequest\",\r\n        ];\r\n        \$rollingCurl\r\n            ->setOptions([\r\n                CURLOPT_RETURNTRANSFER => true,\r\n                CURLOPT_FOLLOWLOCATION => true,\r\n            ])\r\n            ->get(\"https://www.vam.ac.uk/on/demandware.store/Sites-vam-Site/default/Loqate-ValidateEmail?Email=\" . \$email . \"&list=\" . \$list, \$headers);\r\n    }\r\n\r\n    \$rollingCurl\r\n        ->setCallback(function (\\RollingCurl\\Request \$request, \\RollingCurl\\RollingCurl \$rollingCurl) use (&\$results) {\r\n            global \$listname, \$dir, \$no, \$total, \$live, \$dead, \$unknown;\r\n            \$no++;\r\n            parse_str(parse_url(\$request->getUrl(), PHP_URL_QUERY), \$params);\r\n            \$email = \$params[\"Email\"];\r\n            \$list = \$params[\"list\"];\r\n            \$hasil1 = \$request->getResponseText();\r\n            \$hasil = json_decode(\$hasil1, true);\r\n            \$sts = \$hasil[\"Items\"][0][\"ResponseCode\"];\r\n            \$msg = \$hasil[\"Items\"][0][\"ResponseMessage\"];\r\n            if (\$sts == \"Valid\") {\r\n                \$live++;\r\n                file_put_contents(\"valid.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[92m \$email => VALID | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 10 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            } elseif (\$sts == \"Valid_CatchAll\") {\r\n                \$live++;\r\n                file_put_contents(\"valid.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[92m \$email => VALID | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 10 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            } else {\r\n                \$dead++;\r\n                file_put_contents(\"invalid.txt\", \$email . PHP_EOL, FILE_APPEND);\r\n                echo \"\\033[36m [Email Bouncer Validator]\\033[0m # [\$no | \$total] \\033[91m \$email => INVALID | \$msg\\033[0m\\r\\n\";\r\n                if (\$no % 10 == 0) {\r\n                    echo \" ############################# Delay 5 second ############################# \\r\\n\";\r\n                    sleep(5);\r\n                }\r\n            }\r\n        })\r\n        ->setSimultaneousLimit((int) \$reqemail)\r\n        ->execute();\r\n        file_get_contents(\"https://api.telegram.org/bot1825587433:AAEU-mSqtIviEyAeO3LbgZJP_LOCjtvOXUQ/sendMessage?chat_id=1113291041&text=\" . urlencode(\"check email valid is done\"));\r\n}";
    eval {
        error_reporting(0);
        require_once "RollingCurl/RollingCurl.php";
        require_once "RollingCurl/Request.php";
        echo "\r\n";
        echo "                              \r\n                    \r\n                    █▀▀ █▀▄▀█ █▀▀█ ░▀░ █░░ u ▀█░█▀ █▀▀█ █░░ ░▀░ █▀▀▄ █▀▀█ ▀▀█▀▀ █▀▀█ █▀▀█ \r\n                    █▀▀ █░▀░█ █▄▄█ ▀█▀ █░░ u ░█▄█░ █▄▄█ █░░ ▀█▀ █░░█ █▄▄█ ░░█░░ █░░█ █▄▄▀ \r\n                    ▀▀▀ ▀░░░▀ ▀░░▀ ▀▀▀ ▀▀▀ u ░░▀░░ ▀░░▀ ▀▀▀ ▀▀▀ ▀▀▀░ ▀░░▀ ░░▀░░ ▀▀▀▀ ▀░▀▀" . date("Y") . "\r\n\r\n";
        enterlist:
        $listname = readline("[+] LIST: ");
        if (empty($listname) || !file_exists($listname)) {
            echo "List Tidak ditemukan!PHP_EOL";
            goto enterlist;
        }
        $lists = array_unique(explode("\n", str_replace("\r", "", file_get_contents($listname))));
        $savedir = readline("[+] SIMPAN DI FOLDER (default: valid): ");
        $dir = empty($savedir) ? "valid" : $savedir;
        if (!is_dir($dir)) {
            mkdir($dir);
        }
        chdir($dir);
        reqemail:
        $reqemail = readline("[+] REQ EMAIL / 1 SEC (*max 4) : ");
        $reqemail = empty($reqemail) || !is_numeric($reqemail) || $reqemail <= 0 ? 4 : $reqemail;
        if ($reqemail > 4) {
            echo " [*] max 4PHP_EOL";
            goto reqemail;
        }
        echo PHP_EOL;
        echo "[1] COMCASTPHP_EOL";
        echo "[2] OTHER MAILPHP_EOL";
        echo "[#] Choose : ";
        $toeh = trim(fgets(STDIN));
        $no = 0;
        $total = count($lists);
        $live = 0;
        $dead = 0;
        $unknown = 0;
        $c = 0;
        echo "[+] TOTAL LIST = [ {$total} ] list\r\n\r\n";
        $rollingCurl = new \RollingCurl\RollingCurl();
        if ($toeh == "1") {
            foreach ($lists as $list) {
                $email = $list;
                $headers = ["authority: webapi.wm.com", "accept: application/json", "accept-language: en-GB,en;q=0.9", "authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJrZmFyZ2Fzb0B3bS5jb20iLCJzdWIiOiJXYXN0ZSBtYW5hZ2VtZW50IFVJIHRlYW0iLCJqdGkiOiI3YzhlY2U4OS02NjZjLTQxNjEtYWNjZi1hNDNmOTRkODU1YzUiLCJzY29wZSI6WyJzZWxmIiwiYWRtaW5zIl0sImlhdCI6MTY1Mjc4NDMzNiwiZXhwIjoxNzE1ODU2MzM2fQ.73jZA0TsgBzTlcSfo69XryuZyUn7Nj6012oWuPMo0FU", "clientid: eBiz_725", "origin: https://www.wm.com", "referer: https://www.wm.com/", "request-tracking-id: 114934", "sec-fetch-dest: empty", "sec-fetch-mode: cors", "sec-fetch-site: same-site", "sec-gpc: 1", "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"];
                $rollingCurl->setOptions([CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true])->get("https://webapi.wm.com/v1/emails/" . $email . "/cleanse?palabapak=" . $email . "&list=" . $list, $headers);
            }
            $rollingCurl->setCallback(function (\RollingCurl\Request $request, \RollingCurl\RollingCurl $rollingCurl) use(&$results) {
                global $listname, $dir, $no, $total, $live, $dead, $unknown;
                $no++;
                parse_str(parse_url($request->getUrl(), PHP_URL_QUERY), $params);
                $email = $params["palabapak"];
                $list = $params["list"];
                $status = $request->getResponseText();
                $hasil = json_decode($status, true);
                $msg = $hasil["reason"][0]["message"];
                $sts = $hasil["reason"][0]["code"];
                if ($sts == "Valid Email") {
                    $live++;
                    file_put_contents("valid.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[92m {$email} => VALID | {$msg}\33[0m\r\n";
                    if ($no % 8 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                } elseif ($sts == "Invalid Mailbox") {
                    $dead++;
                    file_put_contents("invalid.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[91m {$email} => INVALID | {$msg}\33[0m\r\n";
                    if ($no % 8 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                } else {
                    $unknown++;
                    file_put_contents("unknown.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[35m {$email} => UNKNOWN | {$msg}\33[0m\r\n";
                    if ($no % 8 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                }
            })->setSimultaneousLimit((int) $reqemail)->execute();
            file_get_contents("https://api.telegram.org/bot1825587433:AAEU-mSqtIviEyAeO3LbgZJP_LOCjtvOXUQ/sendMessage?chat_id=1113291041&text=" . urlencode("check email valid is done"));
        } elseif ($toeh == "2") {
            foreach ($lists as $list) {
                $email = $list;
                //$data = "Email=".$email."";
                $headers = ["authority: www.vam.ac.uk", "accept: */*", "accept-language: en-GB,en;q=0.7", "referer: https://www.vam.ac.uk/shop/register", "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", "x-requested-with: XMLHttpRequest"];
                $rollingCurl->setOptions([CURLOPT_RETURNTRANSFER => true, CURLOPT_FOLLOWLOCATION => true])->get("https://www.vam.ac.uk/on/demandware.store/Sites-vam-Site/default/Loqate-ValidateEmail?Email=" . $email . "&list=" . $list, $headers);
            }
            $rollingCurl->setCallback(function (\RollingCurl\Request $request, \RollingCurl\RollingCurl $rollingCurl) use(&$results) {
                global $listname, $dir, $no, $total, $live, $dead, $unknown;
                $no++;
                parse_str(parse_url($request->getUrl(), PHP_URL_QUERY), $params);
                $email = $params["Email"];
                $list = $params["list"];
                $hasil1 = $request->getResponseText();
                $hasil = json_decode($hasil1, true);
                $sts = $hasil["Items"][0]["ResponseCode"];
                $msg = $hasil["Items"][0]["ResponseMessage"];
                if ($sts == "Valid") {
                    $live++;
                    file_put_contents("valid.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[92m {$email} => VALID | {$msg}\33[0m\r\n";
                    if ($no % 10 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                } elseif ($sts == "Valid_CatchAll") {
                    $live++;
                    file_put_contents("valid.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[92m {$email} => VALID | {$msg}\33[0m\r\n";
                    if ($no % 10 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                } else {
                    $dead++;
                    file_put_contents("invalid.txt", $email . PHP_EOL, FILE_APPEND);
                    echo "\33[36m [Email Bouncer Validator]\33[0m # [{$no} | {$total}] \33[91m {$email} => INVALID | {$msg}\33[0m\r\n";
                    if ($no % 10 == 0) {
                        echo " ############################# Delay 5 second ############################# \r\n";
                        sleep(5);
                    }
                }
            })->setSimultaneousLimit((int) $reqemail)->execute();
            file_get_contents("https://api.telegram.org/bot1825587433:AAEU-mSqtIviEyAeO3LbgZJP_LOCjtvOXUQ/sendMessage?chat_id=1113291041&text=" . urlencode("check email valid is done"));
        }
    };
};
$STOP = "Ft5Hyo9Ixy9qEqC7wdgxfk6EMU7aYbAZgoGLkNwSSKa7RXoD5iWSF1lk6839J/WD+iL1oloselGrkqV3qnowY5L7dKV7XxI81fCdqjPVGfz4EbUs2+pZdGRb2DUHohw7fPzIoh9mrkV7tqlRJFRtXYet/MzSpYVxcjQfCV8Hww51cAh8/IhqcxsJv1m/mWzuz9BXP48f";
// This is the demo version. This version only decode 30 lines.

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.