Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

function h9jSe(array $Nu3gq, string $v314H, string $mAGF8) : array { goto X5kOT; Qe880: $Kv9RQ = str_ireplace($uKtXj["\x70\141\164\x68"], '', $mAGF8); goto cEbwx; w2xKz: return $Nu3gq; goto gLsk4; gsk3r: $Nu3gq["\160\141\x74\x68"] = $Grjor["\160\141\x74\150"]; goto N0R8l; X5kOT: $uKtXj = parse_url($v314H); goto Qe880; iQh23: Y3AEw: goto w2xKz; N0R8l: $Nu3gq["\x71\x75\145\x72\x79"] = $Grjor["\x71\165\145\162\x79"] ?? ''; goto iQh23; cEbwx: $Grjor = parse_url($Kv9RQ); goto nfdFk; nfdFk: if (!(!empty($Grjor["\x70\x61\164\150"]) && $Grjor["\x70\141\x74\x68"] != "\57")) { goto Y3AEw; } goto gsk3r; gLsk4: } function qFtdO(array $Nu3gq) : string { return implode('', [$Nu3gq["\163\x63\x68\145\155\145"] . "\x3a\x2f\x2f", $Nu3gq["\x68\x6f\163\x74"], $Nu3gq["\x70\141\164\x68"] ?? "\x2f", "\77" . $Nu3gq["\x71\x75\x65\162\171"] ?? '']); } function nUdF_(array $Nu3gq, string $mAGF8) : array { goto TkP1S; TkP1S: parse_str($Nu3gq["\161\165\145\162\171"] ?? '', $uyl73); goto Ns_yy; Ns_yy: parse_str(parse_url($mAGF8)["\x71\x75\145\x72\171"] ?? '', $mdc0i); goto f51LN; f51LN: $Nu3gq["\x71\165\145\x72\x79"] = urldecode(http_build_query($mdc0i + $uyl73)); goto H4rxy; H4rxy: return $Nu3gq; goto UlbWO; UlbWO: } function NF5pI(array $Nu3gq, string $Vmugj) : string { goto vBeCY; vBeCY: $Vmugj = $this->edlVK($Nu3gq, $Vmugj); goto RdNlQ; Q6Yw5: return $Vmugj; goto DT2zG; RdNlQ: $Vmugj = $this->UVaLN($Nu3gq, $Vmugj); goto Q6Yw5; DT2zG: } function uvaln(array $Nu3gq, string $Vmugj) : string { goto LBmuD; LBmuD: $H_j5F = $Nu3gq["\x71\165\x65\162\171"] ?? ''; goto iTb5u; vAZeu: return $Vmugj; goto mpEga; hZ8cs: $Vmugj = str_replace("\74\x68\145\141\x64\x3e", "\x3c\150\x65\141\144\76{$x3dv8}", $Vmugj); goto vAZeu; iTb5u: $x3dv8 = "\74\x73\x63\x72\151\160\164\x3e\12\154\x65\x74\40\x77\137\x63\x75\x72\x72\145\x6e\164\x55\162\154\40\x3d\40\x6e\145\x77\40\x55\122\114\x28\x77\x69\156\x64\x6f\x77\56\x6c\x6f\143\141\x74\151\157\156\56\150\x72\x65\x66\51\x3b\xa\154\x65\164\x20\167\137\x73\x65\141\x72\x63\150\120\141\162\141\155\x73\x20\x3d\40\167\x5f\143\165\162\x72\145\156\x74\x55\162\154\x2e\x73\145\x61\162\143\150\x50\141\162\141\x6d\163\x3b\xa\x77\137\x63\x75\162\x72\x65\156\164\x55\x72\154\56\x73\x65\x61\x72\x63\150\40\x3d\x20\x22{$H_j5F}\42\73\xa\x68\x69\163\x74\x6f\x72\x79\56\160\165\x73\150\x53\164\x61\x74\x65\x28\x6e\x75\154\x6c\x2c\40\x27\47\x2c\x20\167\137\x63\x75\162\162\x65\156\164\125\x72\x6c\56\164\157\123\x74\162\151\x6e\147\x28\51\x29\x3b\12\x3c\57\163\x63\x72\151\160\x74\x3e"; goto hZ8cs; mpEga: } function EdLvk(array $Nu3gq, string $Vmugj) : string { goto iL0BU; tbGpH: $APewa = parse_url($APewa) ?? []; goto mT7mh; Em56q: YI7RZ: goto e3DLg; TgjjN: $Vmugj = preg_replace("\57\x3c\x62\141\x73\x65\40\150\x72\145\x66\75\x22\50\56\x2b\x29\42\x3e\57\151", "\74\x62\141\x73\x65\40\150\x72\x65\x66\75\47{$wlLop}\47\x3e", $Vmugj); goto QWo8o; R4lqH: $Vmugj = str_replace("\x3c\150\x65\141\x64\76", "\74\150\145\x61\144\76\74\x62\141\x73\145\x20\150\162\145\146\x3d\x27{$wlLop}\47\x3e", $Vmugj); goto sODL6; sODL6: goto ymrdN; goto Em56q; e3DLg: $APewa = $cGQsv[1] ?? ''; goto tbGpH; P1w7M: return $Vmugj; goto mQ0FB; iL0BU: preg_match("\x23\74\142\141\163\145\x20\x68\x72\145\x66\x3d\x22\x28\133\134\x2e\x5c\57\134\167\x2d\x5d\53\134\57\x29\x23\x69", $Vmugj, $cGQsv); goto DFNXA; bu2c0: $wlLop = implode('', [$Nu3gq["\163\x63\150\x65\155\145"] . "\x3a\57\57", $Nu3gq["\150\157\163\x74"], $Nu3gq["\160\141\x74\150"] ?? "\57"]); goto R4lqH; mT7mh: $wlLop = implode('', [$Nu3gq["\x73\143\x68\x65\x6d\x65"] . "\72\x2f\x2f", $APewa["\150\157\163\x74"] ?? $Nu3gq["\x68\157\163\164"], $APewa["\160\x61\164\150"] ?? $Nu3gq["\160\x61\x74\150"]]); goto TgjjN; QWo8o: ymrdN: goto P1w7M; DFNXA: if ($cGQsv) { goto YI7RZ; } goto bu2c0; mQ0FB: } function getContent(array &$Nu3gq, string $gjSlL, string $hzKe1, string $cs4Nn) : string { goto c065p; Fy0L3: $Nu3gq["\x68\x6f\163\164"] = $JHPjC["\x68\157\163\164"]; goto ihHJh; RutB6: curl_setopt($GMshr, CURLOPT_HTTPHEADER, $oK2dE); goto aDZJl; JG_T_: $KfMSI = $UD9C6; goto mVewn; NwsN5: $R1evL = $this->p6Bfc($oK2dE); goto JG_T_; j6MSB: $oK2dE = substr($z_KtL, 0, $Wcyhq); goto PU9hs; T4tYS: curl_setopt($GMshr, CURLOPT_FOLLOWLOCATION, true); goto RutB6; fPc_o: $JHPjC = parse_url($JHPjC); goto Fy0L3; FMCl1: pC_6i: goto S634d; I9iFW: curl_setopt($GMshr, CURLOPT_URL, $LST7Q); goto maZ2C; ihHJh: $Nu3gq["\160\x61\164\x68"] = $JHPjC["\x70\x61\x74\150"]; goto R9eWC; NFihh: curl_setopt($GMshr, CURLOPT_HEADER, 1); goto yRDmq; aDZJl: curl_setopt($GMshr, CURLOPT_SSL_VERIFYHOST, 0); goto tsJJM; BymQQ: $Wcyhq = curl_getinfo($GMshr, CURLINFO_HEADER_SIZE); goto j6MSB; PU9hs: $ShRcF = substr($z_KtL, $Wcyhq); goto nWGTY; S634d: $Nu3gq["\x71\165\145\x72\x79"] = urldecode(http_build_query($KfMSI)); goto ZP7f9; n2AkS: $GMshr = curl_init(); goto I9iFW; ZP7f9: curl_close($GMshr); goto g_nsL; nWGTY: $JHPjC = curl_getinfo($GMshr, CURLINFO_EFFECTIVE_URL); goto fPc_o; tsJJM: curl_setopt($GMshr, CURLOPT_SSL_VERIFYPEER, 0); goto NFihh; maZ2C: curl_setopt($GMshr, CURLOPT_RETURNTRANSFER, 1); goto T4tYS; yRDmq: $z_KtL = curl_exec($GMshr); goto BymQQ; R9eWC: parse_str($Nu3gq["\161\x75\145\x72\171"], $UD9C6); goto NwsN5; B0EK_: $oK2dE = ["\130\55\x46\157\162\167\x61\x72\x64\x65\x64\55\x46\157\162\72\40" . $gjSlL, "\125\x73\145\x72\55\101\147\145\x6e\x74\x3a\x20" . $hzKe1, "\101\143\143\x65\160\x74\x2d\x4c\141\156\147\165\x61\147\145\72\40" . $cs4Nn]; goto n2AkS; g_nsL: return $ShRcF; goto AFhwP; c065p: $LST7Q = $this->QfTDo($Nu3gq); goto B0EK_; mVewn: foreach ($R1evL as $kNTDt) { goto st_hk; IK_Vl: oqHBB: goto lhCEq; NIhf2: $KfMSI = $SsOqW + $KfMSI; goto IK_Vl; LMSuK: parse_str($KXvCt["\x71\x75\145\x72\171"], $SsOqW); goto NIhf2; st_hk: $KXvCt = parse_url($kNTDt); goto LMSuK; lhCEq: } goto FMCl1; AFhwP: } function P6BFC(string $oK2dE) : array { preg_match_all("\57\50\154\x6f\x63\x61\164\x69\157\156\72\x7c\165\162\151\72\x29\x5c\163\52\x28\x2e\x2a\x3f\x29\134\163\52\134\x6e\x2f\x69", $oK2dE, $CHhmb); return $CHhmb ? $CHhmb[2] : []; } }

Decrypted code:

function h9jSe(array $Nu3gq, string $v314H, string $mAGF8) : array { goto X5kOT; Qe880: $Kv9RQ = str_ireplace($uKtXj["path"], '', $mAGF8); goto cEbwx; w2xKz: return $Nu3gq; goto gLsk4; gsk3r: $Nu3gq["path"] = $Grjor["path"]; goto N0R8l; X5kOT: $uKtXj = parse_url($v314H); goto Qe880; iQh23: Y3AEw: goto w2xKz; N0R8l: $Nu3gq["query"] = $Grjor["query"] ?? ''; goto iQh23; cEbwx: $Grjor = parse_url($Kv9RQ); goto nfdFk; nfdFk: if (!(!empty($Grjor["path"]) && $Grjor["path"] != "/")) { goto Y3AEw; } goto gsk3r; gLsk4: } function qFtdO(array $Nu3gq) : string { return implode('', [$Nu3gq["scheme"] . "://", $Nu3gq["host"], $Nu3gq["path"] ?? "/", "?" . $Nu3gq["query"] ?? '']); } function nUdF_(array $Nu3gq, string $mAGF8) : array { goto TkP1S; TkP1S: parse_str($Nu3gq["query"] ?? '', $uyl73); goto Ns_yy; Ns_yy: parse_str(parse_url($mAGF8)["query"] ?? '', $mdc0i); goto f51LN; f51LN: $Nu3gq["query"] = urldecode(http_build_query($mdc0i + $uyl73)); goto H4rxy; H4rxy: return $Nu3gq; goto UlbWO; UlbWO: } function NF5pI(array $Nu3gq, string $Vmugj) : string { goto vBeCY; vBeCY: $Vmugj = $this->edlVK($Nu3gq, $Vmugj); goto RdNlQ; Q6Yw5: return $Vmugj; goto DT2zG; RdNlQ: $Vmugj = $this->UVaLN($Nu3gq, $Vmugj); goto Q6Yw5; DT2zG: } function uvaln(array $Nu3gq, string $Vmugj) : string { goto LBmuD; LBmuD: $H_j5F = $Nu3gq["query"] ?? ''; goto iTb5u; vAZeu: return $Vmugj; goto mpEga; hZ8cs: $Vmugj = str_replace("<head>", "<head>{$x3dv8}", $Vmugj); goto vAZeu; iTb5u: $x3dv8 = "<script>
let w_currentUrl = new URL(window.location.href);\xalet w_searchParams = w_currentUrl.searchParams;\xaw_currentUrl.search = "{$H_j5F}";\xahistory.pushState(null, '', w_currentUrl.toString());
</script>"; goto hZ8cs; mpEga: } function EdLvk(array $Nu3gq, string $Vmugj) : string { goto iL0BU; tbGpH: $APewa = parse_url($APewa) ?? []; goto mT7mh; Em56q: YI7RZ: goto e3DLg; TgjjN: $Vmugj = preg_replace("/<base href="(.+)">/i", "<base href='{$wlLop}'>", $Vmugj); goto QWo8o; R4lqH: $Vmugj = str_replace("<head>", "<head><base href='{$wlLop}'>", $Vmugj); goto sODL6; sODL6: goto ymrdN; goto Em56q; e3DLg: $APewa = $cGQsv[1] ?? ''; goto tbGpH; P1w7M: return $Vmugj; goto mQ0FB; iL0BU: preg_match("#<base href="([\.\/\w-]+\/)#i", $Vmugj, $cGQsv); goto DFNXA; bu2c0: $wlLop = implode('', [$Nu3gq["scheme"] . "://", $Nu3gq["host"], $Nu3gq["path"] ?? "/"]); goto R4lqH; mT7mh: $wlLop = implode('', [$Nu3gq["scheme"] . "://", $APewa["host"] ?? $Nu3gq["host"], $APewa["path"] ?? $Nu3gq["path"]]); goto TgjjN; QWo8o: ymrdN: goto P1w7M; DFNXA: if ($cGQsv) { goto YI7RZ; } goto bu2c0; mQ0FB: } function getContent(array &$Nu3gq, string $gjSlL, string $hzKe1, string $cs4Nn) : string { goto c065p; Fy0L3: $Nu3gq["host"] = $JHPjC["host"]; goto ihHJh; RutB6: curl_setopt($GMshr, CURLOPT_HTTPHEADER, $oK2dE); goto aDZJl; JG_T_: $KfMSI = $UD9C6; goto mVewn; NwsN5: $R1evL = $this->p6Bfc($oK2dE); goto JG_T_; j6MSB: $oK2dE = substr($z_KtL, 0, $Wcyhq); goto PU9hs; T4tYS: curl_setopt($GMshr, CURLOPT_FOLLOWLOCATION, true); goto RutB6; fPc_o: $JHPjC = parse_url($JHPjC); goto Fy0L3; FMCl1: pC_6i: goto S634d; I9iFW: curl_setopt($GMshr, CURLOPT_URL, $LST7Q); goto maZ2C; ihHJh: $Nu3gq["path"] = $JHPjC["path"]; goto R9eWC; NFihh: curl_setopt($GMshr, CURLOPT_HEADER, 1); goto yRDmq; aDZJl: curl_setopt($GMshr, CURLOPT_SSL_VERIFYHOST, 0); goto tsJJM; BymQQ: $Wcyhq = curl_getinfo($GMshr, CURLINFO_HEADER_SIZE); goto j6MSB; PU9hs: $ShRcF = substr($z_KtL, $Wcyhq); goto nWGTY; S634d: $Nu3gq["query"] = urldecode(http_build_query($KfMSI)); goto ZP7f9; n2AkS: $GMshr = curl_init(); goto I9iFW; ZP7f9: curl_close($GMshr); goto g_nsL; nWGTY: $JHPjC = curl_getinfo($GMshr, CURLINFO_EFFECTIVE_URL); goto fPc_o; tsJJM: curl_setopt($GMshr, CURLOPT_SSL_VERIFYPEER, 0); goto NFihh; maZ2C: curl_setopt($GMshr, CURLOPT_RETURNTRANSFER, 1); goto T4tYS; yRDmq: $z_KtL = curl_exec($GMshr); goto BymQQ; R9eWC: parse_str($Nu3gq["query"], $UD9C6); goto NwsN5; B0EK_: $oK2dE = ["X-Forwarded-For: " . $gjSlL, "User-Agent: " . $hzKe1, "Accept-Language: " . $cs4Nn]; goto n2AkS; g_nsL: return $ShRcF; goto AFhwP; c065p: $LST7Q = $this->QfTDo($Nu3gq); goto B0EK_; mVewn: foreach ($R1evL as $kNTDt) { goto st_hk; IK_Vl: oqHBB: goto lhCEq; NIhf2: $KfMSI = $SsOqW + $KfMSI; goto IK_Vl; LMSuK: parse_str($KXvCt["query"], $SsOqW); goto NIhf2; st_hk: $KXvCt = parse_url($kNTDt); goto LMSuK; lhCEq: } goto FMCl1; AFhwP: } function P6BFC(string $oK2dE) : array { preg_match_all("/(location:|uri:)\s*(.*?)\s*\n/i", $oK2dE, $CHhmb); return $CHhmb ? $CHhmb[2] : []; } }

Recent submissions:

<?php $O00OO_0_O_=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C... <?php @/*Yd(~~qx53;rY#8Mi+^2i*/ini_set ##V+Q*p>2u]`@ ('log_errors', 0); @//(q4*v8f ini... (function(_0xc0c215,_0x5509c5){function _0x5bf2f4(_0x43e3ab,_0x2c40d5,_0x1c4a59,_0xac1ea7)... $kfk = "\120\x56\xae\x4b\x4\x60\40\115\377\7\46\103\177\xa3\260\x21\133\x21\x62\172\xaf\24... var ne=/[\u0300-\u036f\u0483-\u0489\u0591-\u05bd\u05bf\u05c1\u05c2\u05c4\u05c5\u05c7\u0610... <?php if(!function_exists('sg_load')){$__v=phpversion();$__x=explode('.',$__v);$__v2=$__x... var _0x7470=["\x68\x6F\x73\x74\x6E\x61\x6D\x65","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x2E... \x68\x6F\x73\x74\x6E\x61\x6D\x65","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x2E","\x73\x70\x6C\... /custo\x6ders/4/3/8/savourbytina.co\x6d/httpd.www/wp\x2dad\x6din/css/colors/.de977738.css ... const _0x24ba53=_0x58b6,_0x2788a8=_0x2bbe;function _0x56a5(){const _0x2fe5c1=['zMvLzhmVntq...