1

Tenho um código em PHP só que está criptado:

<?php if(!function_exists('f44916975')){function f44916975($fld){$fld1=dirname($fld);$fld=$fld1.'/scopbin';clearstatcache();if(!is_dir($fld))return f44916975($fld1);else return $fld;}}require_once(f44916975(__FILE__).'/99348143.php');$REXISTHECAT4FBI='FE50E574D754E76AC679F242F450F768FB5DCB77F34DE341 660C280D176E374DE7FB3B090A782B6B68DBC97BEAD93B681C452F25BE26';f44916975g0666f0acdeed38d4cd9084ade1739498(f44916975f0666f0acdeed38d4cd9084ade1739498(__FILE__));$REXISTHEDOG4FBI='MjMyQzNGMzEzNkVCM0VDRERFNDhGQTMyRTAgNzFDRDUgRjNFRTMgODJFQ0E2NEQ5Q0Y2MUUxNkRGOTFEIDgzOUE3ODE5Q0EyQjA0RkM0NTdFMzc4OThFNSA0N0NDOTUyNEIzMjMzMkMxQzE4MjczNjU5QzRBNzhDODNFNDY0RjkxQUREMTNERDQxMzlENjEwQjQ1ODkxQjA1MzNFRUMzRjgxQkFCNDhGOEZGODRBREY1QUQ3NDAyNSAyNUUzQ0ZBNTI4QkFCNUY4OEJCNzE4N0M4NjU4MkE0OEFGRDUzM0EgMSBGMTk3Q0MxQUNCRjhBQTVFMTFFQ0VCMDVCQTI3MEQ3MUUxMzY1ODI4QkIwNUFFMDY1RkUgMDY1OEJBQUFEMjVDNjY3QzM2N0RENkQ4QkFCRkE1RDM1REMgRTFDRDFCRDg1REI0MkYyIDcyREMzIDYzNDI3QzI2OTgzOUY3N0FDODE4NEExNTIzQ0M4NzBBMzVDOUE5Q0ZCMzNDMDcxRTA0Rjk3QjY2QUM3NUVBRTI1QzE2NUMxQTU4MEQxNTRDNjc1OENBNDQ5RTggOTEyN0NBMTUwODhCNzY1QjM5MjM5RUQgOTNGRTgyRTM2RjgyRERGMTVEMzdBQjg3M0M2MzYxODZGOTE0N0UzMjdGNjE2Qzk2Nzg1RTE1M0U1NEY4N0E1NENFRjI3Q0E1REQxM0YgMjU5MkM3MEEwQjU5MEFFRjc1MCA4IDIgRjQ1RjQyNkM2Njc4NkFENDIzRTMwQUE1RUVBIDUyQ0QzNjhCQjE3QzhCQUIxQUE4NEE5QkQ4RkQ2Qjc5QkVGQThCMDcwRUIyRUNGN0ZGQiA0IDcxNjRERTE1N0M4N0VBMjdEODQ4NUZCMjRENyBCMjZERjRCNkEzQTEyNTYyNTYyRjQzQTkwNDgzREY0MUYxMjVFOUI0RUYzM0NGQjJERjAzQ0ZCNkY5MTU3RjYyRkQxNURBOUY4NzhEMDg4ODJBODc4QjQ5MUI1NEVEMUI0NDZFMSAxNTdGNjdERDU1MkMzNDJDOCBDNjM5OUFGQUE4MjgxQkU2Qjk2QUY4QjhFOUI1NEU4NkRDMzc4OTY5NUZBIDUgREIyNjc4NkZBN0Y5QjZGQjhEOSA2NzI4M0FGNzM4MEI5RUIxRTJBIDAyNUQ5MjJGNTY0RUY0QUZDMjBEODdERTM1NkY1IEJEQjVEM0IxMTE4NEVGOTI1IEYzRUVGNDcgQUIzNTI5MEEzNTVDODQ2RUYxQkMwNzJCRDY1ODVGMzY3NDYxRTdFQzJCODUwRDMyOTdBQUM0NEQzQjM2NkExNDBGMTEwMjFENSBDN0ZFOUEzOUZFMkI5ODhEN0FEREM3QUU4NDZGQjNDRTcgMDU3OUU0MUZCM0JGQTJFQzQ3RUE1RTExQ0QxIDggMCAwIEYxRUEyNEJFNzFGQ0FBNDlFNEJGMTI3REMxQjNCMjYgMTM3NDcxQTcxRTcgQzMzMUI0QjY2MjA3Q0Q3QTZBQzY0REUgMjNCRjQgMTc5QjA0RTk0M0JFNCAyMzExOUM0NDdENDIwMjdDNTZCOTk0N0QzNjc4RkIxQjlCMjUzQzA5OUY2MzYgRTRFMTIgODI3RjM1MTZEMzgxNDRGMUU2OUNGNkJDRTc4QkU3RUEzQjE0MUU1NjY5MkEyNUY5NThFOTQ5RjIzMkUyQkRFIDAyRkY2IDYzMUVBIEUxMDc4ODg5MkNBRTZCRDkyODRBMDVFRjY2NzQyIDA1RjNFIEU1OSA4NEIxMSAyMzcgRDMyRjUgRjIwNkZBQzc0OUY1Mjg4ODM4NEM0QkQ3QkIxNjRFQzU4OTE0M0VCMzQ3OEFDNzA4REE1MzVFNjUyRkMyNCA5IDAgRDNCRTYxRkRBIEMzMSA3NkM4ODg5QzI5NkU0QkY5OEY3MzcgRjFFQzg3NEE3QUQ3NEVCNjZERDEyQzc3NEIyNEVDNUE4QjJCNDVFOTY1OTJDQTc0MjJBIDYyOUMxNUJBQTIzMUE2OUY1NzQ5NjZBQkE5RjQ2RkU2NkNGMTUyQUNCNzM5MTk2RjI3N0Y3IEQxODRERjkzNEZCMjhDN0M1RTEgMjNBMjIgQjI4QzA2M0Y0IDM3Q0I1NTU4RDg2Rjk2NzkwQkI3MEI0OTJCNTcwRjc1RjlBNTA5OUJEN0NGQSBCNDhGODM4RDcgQjIyRkI3RDg4OEJFRiA2MjlEMTdBRUM1OUYyIDgyNDI1NjMzOTEzMkYyNURDIENDNEE5NzlCRUM4QTU0RkU2MTlDMzVCOUE0QzhFOTRFQzZDMjg2NjI2IDI0NTFCNkUzMTIwRUI2RkU0MTgyOERDNUM4Nzg2QTk0OUUxIDAyOTEwRDE2RThCRkIgNzI1RDkgNDI4MjIgNjQ2RkIyNUQ0NTdDODQwMjQ3NDMxNkEyRTdDRDc0MEY3NThEOEIwRjBCQjg4RkY2OTQxIDU1QjM2MzREQjkxQTM1M0Y3IEExRENBNkM4RkEwMzhFQSA1NzlBRjU1QUY4RUZDMjZDRjY3OUY0RkFCOTE5MEJFNzdCQzc3RTI0NkYyIDM1RTNEIDA0QzE0NzREMyA1MzgyMzYyMkE3OUU5QUNGM0IzRThBQkYzNjE5NkUzN0VCRTcxOUQ5QzQ0RDkyMkEyNTc5RTlFNDlGRjFBIDIxMDNFRjMzQzNGM0ZGNDY2NDEgNTQ3MUI2RTM1Mjg1MTZEMzgxMDQ4QzI2QkI3QUZBRTkyQTI1NjhCOTg4MEZBNkQ5ODVBRDI5OUVFOTFGOCA2MjVEQiAwNjY4MThGOTZGRDJGQ0E2NzhDQkNCQjg4RjQ3RkI2NkFBNjhCOUU2MEFFOUY1Q0VEMUJDNzQ3MjAgNyBBMTIyQ0QyMTg2QzgwRDY1QTI5RDcgNzM2QzE0REIzOUE4RDgyQjc2QkIxN0U5QTQyMkEgMzIwRDgxQiBDN0FFNzE5Qzg3OUZBNjIgRjc4OTNBOTcyRDQ3MEJFQTE4NkIzNDlFNiBGMkYzNkNDIEUzMkYzMTNDRTdFODdDQTNBMzkzREYzMUJERjc0RUE1RjhDQTE0MkM3ODVEQkJERjU3Q0I1NTU4REUwMjBFNzE2NzdCRTc2QTg1M0FBNEFGRDNDM0IgNyAyNUUzQzFDMTQ1MyA5NTgyNzJFRTU2NUZFM0VGNiBGIEEzMUNCNjk5RTRGRTcxNyAyMjNERiA1NzFGQTNGRTcxQTM2M0NFRjUxRjkzMkM5NzlBOEEyODRGNjE3IDE1NDE5NzdENUI3RjM3RUI1NjJFNkJFQTJDQ0U1QkQ5MkM5OTREM0I2QTg0RjIwREMxNTNERjI2NDkwQ0MgQzJGRDggNDI0MzhDQiA3MzgyMzM0RTUxREU3IDAyNEQ5QURCNDY0IEUyOERFN0FBNzRFQzBBOTQ2RUU5ODkxRDE4RUM5OTVFQzlDRjNCODhBQzBBNjRFOTE5QkZEM0EgOTQ2MTk2NUVDMjQyN0JDNjA5MEE0QTc1NkExNEVGNDEyMjdDMDYxREUxQkQ2NzVGRDE0Qzk3MUFDNzVCNTFCNzQ5M0FBNTdGMiBGMjJDMzdDQkJBRDlCQURCRjk5OTFEMDhGRDZBNkFGNzg4OUY0NEQgMjVEMjE2MCAwNjY4RkI3N0FDMDZEODBFOTU5ODlCNjdDQUE0QTMzM0YxRTY5ODJCRTY3QzE2NUEzQkE5OTRDRkIzMUQ4NkZGNzRGQkZCNTRGRjIyRiAyIDEgNjcwREQgNzIyRDAgODFFIDg2RkUyNjE5QzQ0RjgzRkZENTBGMTMwMjYxMzNBQzkyMzUyQzFBNTU4ODdCMzlCRjJCOUJBNEJFRTIyMTMyOEQ5MjUgOTJBRDkgQjIxRkE0QzlDNDNFNCBCMzZFNTIwRDVCMkJGQUY4NEFGNDhFQTdDOEFGNyA5MzhFODZBMUQ0NDYyMjMgQTNDRTMxNDVFOUQ0N0NCQjk3NDlFNDZFRSA5NUM4NEFDQUE4QTg1Rjg2MDVFMjc2NTNDIDM0MjE0MkYgQTNERkIzQkU2NzVCMzRDODBBQjRCRTYxNUM1OTk2OUUyMUMgRjMwRDMgNzEwNkFGOTEwMjJERDE3RDE2Mjg0QzU0QzJFQzU0MiAyNjYxMDI5NzlENjQxRTUxNjNFMTE1RTI0N0FEREEwRjg1NiBBMjExMzIxIEIzNUVBM0FDMzMyRDc2ODg4QkM1MEQ3Njc5MDRBRkYyOTEwRDE2RThCRkI3MDg0Qjg2MThCOTc2OEJCNkY4MUYzN0VBOTRBRTUxNzMxQzZGNDlGNUVDRUE4MzgzODEwNTAxQjY4MUY0QUI1NTc5Qzg4ODJGRiBFMkRFNjZBRjI3ODlCNTQ5RTg5QTRFMEI4ODhEMzkwQTY2OEUyMTY2MzlFNDVDQzg0QkM2OTk0QUM1NENFQTE4QjkyQzQ2MDgzRTkxNTM0MUI1RUUxIDQyREYwMUIxRTJBMzI3QUNCNTk5MTNDQ0NCODQ4OUZGMTZBODVCNDVBQTY3NURCNTdFRSBBQzZBODc4ODY4NkU3IEEyOURCNkM4RjkxQzY3OEIzNjI4MUJCNEFEQUNGNDEyOCA1MkZENjI3M0YzRTIyRDI2NjlCODhDMTlFOTlFRDdGQTk1NTg2Q0M1NThBODhGRjNCRDggNjFFREEgRjMyQzM3REFCOUM4RTlGRkMyRkNEIEUgQSBCNTBENzcyQTdCMEVGQkY4MkU2Nzk5ODREOTdFRDEwMjUzNiBENDJGRjNCRTUxOCA0NENFOTM5Qzc2MTExNzdGRDU3MkRENzc0ODhBRDhBRkYyNkMwIEEyQjE4Qzc3REFGNDhENSA0M0VGNjRCRUU2NEVFNzRGNzU3RkUzRUVGIDA3NDgzREEgNjczQTM0QkY0MzNDMURBNzNDOTg0Qzg5QkNGNTZGRjI2QzhCMjVCRUU3OENGIDEzRUY5MjREQTQwIDgyNSAxNDQgNDVDREU1MDFBRDY3OUE1NEZFMjEyMjYxQTE0NDVGQTNDRTgxNDM2IEUxREI2NjhEQTU2RDdBQURFQjFGRTZDQjU3MzlGNDMzNzIxNzNEOTZDRTU3MzhGQjA5QUVDIDc3Q0EzNTFEMTUxRUUxRiBFM0YyMDZBMjU2NjI1N0JBMDQ3Rjk1Q0Q0OUVBM0M1NDRDNTU5REE2MUVCNEMyOTIwMjYyRjNCIEEyQUQ5IEJDRTE3MzZFRTJGMjUxRjU0RDY3QzkzRjUyNUYyIDIzMUQwNjY4OUE5Qjc4QUZCNDNGOCBCMzcxODc3RDg4NkEzODhBRjQ3RkMzQ0MyNkRDODQ5M0RGMDJERjEzN0Y2NjQ5QjQ0RTMxMEM0ODZDOSBFMzBDOUEwOURGMzdFQzRBMThFRkE0MTI2NjIzOCA5NDlGNjNCMTEgODY1Qjg1MUY3MjZDNzc1OUQ0REFCNTVGODE3MkNDNDcwODBBRDgwOTY0N0Y5MjdEQSBBMTQ1RUFBRjg1NjkxNEQ4RTZBOENBRTVEOUQ1NzhEQTM5Rjk2Q0I3NUI2OTU5NkVFOTJGQzM0M0MyRjZFM0UgNTY1RTggQjM3Q0QxQUNFQkY3MDgwQzE2ODk4OTg5MjlDRDY1RkYxMTVEMUEzODFCRDQ3RTQgNTY4ODZBRjVFOUQ1NkUyNjU4NEYzMUIxMDdERDY3NjgxRkYzMUM4NzlGOTVDRDE3MzkzNUVDNjk0Q0Y4OEM3MzZENDZCQUI4REJCNEFFNDM0RDgxREQ5IDhDRTY4RDA0QTE4NzZEOUE0QjE3MTgxQzE2NTgwQkU5ODQ4QzM1MThCNEVGQTMwRDM1RkVCNkM4OEIxNDdDMDYzODRCOTdGQzFBREJFODFDRDk3Q0JCNzJGRDE2MDg3QjI1NkFFNzlFMjE1RDM2NzlDNTMyRiA0NzI5NjUzOEI0NjJCRTQzNzkwNEY5NDgzRUM1RUU0NEYzQTJFMUFENyA2RDE2M0Y1MkYyQyA2NkM5NEI4NzZCOEM2QTI1MTkxQkM1MEQ2QTdBMDhERTJCNUY4NTM5REFCMkMgMjNBRjkxODM0QzI0QkJCNjU5RjQ1MjMyOUUwIEYzMTE2NkIyMjZCMjVDRjY0RTQ0QjkxQkM1ODg3QUU3RkNCN0ZCNTc4OUI4Nzg0QjM2RDg5QkE0NkZGNzlGNjUxNjkzQ0YwMUQ3QkVFIDIgNDU2ODc5NjlBOENGMjQ5Mjg3MDM1NkFCOTU4RTggRjdBOTc5QUVGNTI4REJGNEJERUNENDUzMDMzMkExNDJFIEQ2OEU4NURENDQ5MjggQzc5ODFFRjc1Qzg5NEQwMkRFRDUzM0NGNSA1MzgzQkMyNjY4RkJGNjA5RjhBQTA1MjkzRTUgOUQ3NEEzNSBGNzMxRkE2NDdFQzVGOEFCNzRDOUE0NkNDNkVCRDY1OTc1OEU4MjVDMjdEQkI0RkYzIDgxRkI0OTNFOUE0RThCRjVDRTcxRjcwODBCQjcyOEU5RjU4RTMgNjMyRUMxNCBGMUNFMjY0RTcxQ0MyNkVEODY4MkY3Q0NBNjA5Q0ZCNzU4REJCIDczQTIzMUUgODdDRTM4RUE0NDZGMjNFRUQ2NUVENDQyMyAxMzFDOCA1MjM2NDNCNzZBMjUxODlFRjE5MTBFQTdGQkU2NDk3NTdEQTIzRDIgRjYwRjUzMkUzMTREOTU3NEJDMTY0OUI0M0ZDIEUxRTczRDBBN0E4NDhFMTNERjExMzNCM0NGODE5RDMxMjI2N0FFODVFRjgxOEM3QzU0NDQyRTcxOEQzIDAyRjNCM0QxQTI0Q0Q3NUEwNDRGMTRBODJBOTQ2RjIxMjc5Q0Y5MkQwIDkyN0M3N0E5NUE4NTVGRjI2Q0M3NEQxQUM5QUI4MkNFQSBBMjEgODIzRTIyRjkyQkM4QkU1NEVFRkJCNDRFMCBBMkQxNTc5RDdCNUVCNTBGRjI3IEQzQ0U2M0ZEMCBBMjRDMzY0ODNCMjg1QTk0QThFRkE2NjlGNDNGMDNGNTUzOSBDM0FEOUI0OTQ5NjM2RDQ2QjhGQjg5NjkwQUY4QUUzNDQzQzFCMkVDN0IyQ0E3RUExNERGOTEyMTFFMDYzQ0M2NDlCRkQ2RUYwNDkyQ0RGMTE2QkZGMzBGNjhCQzhBNjVFODlFRjVGRTE2N0Y4MTE2NEY3MUNDMDQwRjY1MkY5IEI3MUQ0NTAyNkRGNzdEOTcyOTk0NUY5NzBCNzJFIDE3NkYwNTVGNzM3IEQxMkM4NjM5MTQ2MzdDRjYwQjI5QTkzRkYyMkNBODBBOTJDRDcxNUQ2QjA1QkFBOTBGNzZCRDk2NDhFRkYxNTI5QUE1MDkxNEIyRERDMjgyQjdFRTU1RDkzQkU5MDg5QjQ2QzlFNThFMDE0RDJBNjVFRjE1QzJCMUQ3OUQ0NTNEQkM4NTc5OTVDOTdCNzQwRjU1M0Y4IEE3MEQ1NTMyMTE0NEFFMTU3RUYxOUMyNDJDQzFDQzE2NEQ2N0RBQ0E2OTJGQjUxMjVEMzdFQ0Y0MEYwNTlGMCBCMjdERiAyNDhDRiA2NjlERTVBMjE2NSA0MzJFNCA3MjhDRjcyQjE3MkY1NUY5RjVDOUE0NjIzMkZBQ0ZGNkZDNEJENjQ4QjZGOEFCOTYzOTA1MEVDIDAzNUZCNkJEOEFGOTFGNzU3RTgyRUJDNzlCMzhDRTg0NyAzNzRBNDVCOUQ0OEY3IDgyRUY1NjU5MEJFNjY5MzRGQTk3MUZENjY4QUJENTk4NURBQTYgMjZCQzA5N0U2QkU3N0IzMjVENDE3MzZFMjFBMjJGQTVFODhBOTVEQzNBQjhERTYgQyA1MTUxRUMwQUZCRkJCMTAzMUNBNzVGNTU1MTQ0MjdGQzc1MUQyIDAyREY1IDUzMEVCN0VFMDU3RUEgMDIzNTNDMUE1NDBFRjJCIDM3MzRFMTQ0QkQ1NDNFOTM5RjU3MUUyNDZGMDFEQzI1NTM3NzNDRThEODNBMTQ2RDY5NUNEN0RFRjQwRUIxRkU2MTNDNzc1OERFNDQwMkYzRkY1MjRDMjYwOEZCM0JEQjU0ODhCQkQ2NTk0QkU2QUYyMzlFNDFBIEQyNTI1MTYxMDYxRjQyRkY0MTAzMDEzNUZGRSA4M0VGRTM0MTJDQjU0RUQ2RURGNUFEMjQ1RkYzOUNGIDUyNEMyQkI1ODgwOUFBQjJGRDI2RkMzQTU1N0ExNDFFOCAxNkFENiAxMjBENTZDRTcxMkRFNTMzNTJCIEM0REI4QkJCRjczRjc0QjNGMTY2NUVFIDcyQUU3NTk5NkFGREU0RkU5IDUzNERCMjFGMDY2RDdBQ0I4QjI1QTEwMjJEMTc4OEE5REY4MzhGOTM5QUU1OUVGMjlDOEJCNDZDRCBEIDMyMCBGNzdFQjdBODVCNDY4OTk1QUNGQTA4QTkzQ0U3MjhDRTYxQ0MzNERFOTNGMjIgNTY2ODlCODcwOERCNzY0Qzc3MEE1NUE5NDk3M0FFNjFCNzdEMSA4MTZFQzZBODBFODU5OEVCMDc4ODFBRjZCQjBCMDk3OTk4MEY3IDQgRTY4ODM4N0Q5ODlGNTMzIEY0Q0RBNzlBQzQ5MzNEOTcxRkE0N0YzIDgyMUQ2NzRBODU4QzFBNUFFODA4MjkxQjY3Q0IzNUNENzkzQUU1ODgyQTQ1MkZDMzMzNUYwNkI5NTgxQjlCMDlGQTdBODNERTYgQzIzQ0ZCM0JGQTdBNjVGOTg1QTNERTEgMDM2NDEyRCBFNzZFMyAwIDcgQjQxRTkgODY1ODFBQzdCRjMyMUMwN0NDNEEzNDZFRTNEOUI0RkQ5QjE2NzlBOTE5NzMyRTkzNjIyIDQ3QkRDQTRBN0FDOEZBQUFGRURBM0U1REQ1NEVEMURENUI4NDhDRjNFMkZDOTdEQUM0MURBMTczRTNEIEIxMyA4MzggQzIxQTE0OUZBNzJEMjdCODA4RDM3RDMxM0Q1NDJGQyBGMjUyMURDNEUyQTFGMTIyM0RBN0ZBQTQ0MzgxQzE3MzlDMTFDQ0NCOTdGQjc1NUY4NDEyQTE3MTIyMUM5N0FCNTRFRjM2RDlBNDFFNCAxNDVENjc2OTJFMTUwODVCNzVCOUQ0NkNDQkE3MEE3NThFRiBDQjI2MkM5QTM5MjgwQzg2NDkzOERCQkFCRkU0NzNFMTIgQjc1OERBQzY0RjM2NEM2MTlDQzE2MUU2RDNBMUNFMzdFQkI4RUE1NENDNzgzQkY2QTkzQTM1RkQyQTVCN0E2RTcgMjNFRkU3QkZBNDBDNyAyMzcyMCBFMzREMzIwMUFDNjY0RjU0MkYxIEEyQUNBIDU3NUMyNEIxRTY1QzA1N0Y4MTVEQzk4NEFGMDMwQzk2RUFFQkVCNzVCOTU1OEMzMzIyRkM2N0FCNkI5OUY2N0UzMTU2MDlCNDZDRDg1QTE0RThFQkI3MUUwMTVEMDZBRUMxQ0M0NjM5NEZCNTBFRjJDREYxQ0MwQjhCQTgzQkQ2Mjk3ODFENDk5ODRCQzczREJCNTRBRTQ2NENCNDVENzc1QTY1RDgyQjA1Q0JBNkE5OEY1NjBDNkIyNDZGQjI3NTdERDU4RjYyNkQxN0FFNERENTVFQyA0M0MxMjExMkYyOSA0MjNDRCA2NzlFM0E1OURCRjdBQTQ0MEUxNjhBRjI2IDkxOUQ3IDcyNEU1IDM3OEQxMTQyQ0Q4MTggNzE2NjdDOTdBOTc0NkY4NzNGNDU0OEM1MUZFNjc5Mzk2NTBGQzNFRTU1MkU4NzVDMTU0QTBFM0I4OEZERkExQzE5RTMyRUI3RkRFQUVGNTZBMkQ3MkUxMTIyMUQwQTE1Rjk2RTE0QUY4MjJENiA2IERFMzZCODNBMjRBRkI2MEU4N0RGQzYzOTNBNjVBQzk1MkQ0IEIzQUU1NkUzRCBBN0RFNDEyMzlGNzNDMUFDRDU4Q0ZCNDY3OEY1OUNDQkZBOUUzREY3QUJDN0I5QTRBIDAgNzVGMzAyNkMwNkM4MTg2QTM4NkE1NDFFRTQ4Q0I2NTlFMzZFNiA1MjNENCA1NTUxOEI1NTc5RjQyM0IzOTEyNjg4OEE0NTk5MkY1NEJFOSBDQjE0MzMwRTggODIzRTIzNkE0NUU4MUI4NkE5RDc4QjE5NkJDQTM5OTlGOENDRDgyQkQ4OUMzODc4NUFBNzdENkQwOTVGNzUwMUI2QkNENjg5NDQ0MzBDMzZGRkQ3NDgyQzM3Q0E1NEQ4NkI3NzM4NENBNzFGMTQ2QzJCMEI1NDBFQzJDM0UyMCA4M0RGMjNDNDgxQjcwRTYgRDNCREI5ODMxREE0RDNERjYyNUYyN0NEQjU1MzYxQTYwM0JEQjFFQTA0Q0VENDREMDdCOEI5MzM1RDE2MzgwQjVBMUFENDZFRDJFQ0E1Q0RGNEUzQUNBMUNDQTZGQzVBRjZGQjQ0Rjk5RjQzMkM1NkE4MTk5QTA0OEY0NDNGQTcxQzA1NEM3RDVBQ0UzQkE4MkMyQTY4MUQwIEMxRjdFQ0U5NUY1NTkyNjJEQzU3NUFDOUQ1M0UyMTI3QTg4QkQ2QTkzOUU3MUQ2NzdCRTY2OUY5REQ1NEVDRkIxNDJGMTJGM0MyQyBFNDBFNyBCIDM1NjJEIDMgNDVFOUJFRSBBMjgyQjI3QzA3MEFDQjQ4QzhEQ0I4MURCRDc2NTkzNEFFODE1NUZDMyBCQ0Y2NDgyRkE1NUNEQUJBMkFFOUE1QUZBMzJGNTQzNTgzMENCNjQ5MTRGRTA2QkFBNTY5RTVFODZBNTcyOEJCNDZCODlBQzQ5RUM0MTMwOTA0RTkwQTE4NUJGNDVEMCA1MzEgNjMxMUI3NUMzQjU5MEY4NzNDMEFCOUE5NTk2OEZGNjY3Q0Q0QkM0QkJBNjgwQzU4N0MzNDZFNjMzMkI3REM4ODFEMTk5RjI3QjhBQzE3NkMzNjc4RDg3QzM0NDgwQTE0M0Y2MkNFRTNBRjQyRkVENzdDMzQ1RDA1NEVENjU5NTg2ODhGMTFCRUUgNjc3Q0I4MEVFMTUzMENDQjY2NTg2OTdFMzEwRDUxRCA3MUIxNzcxMzE3OENGNEVERTYwOEVBRjlEQUI0M0MwNkFFMTREQ0JCNUI2QTQ5MEEwMzZEMDE1N0ZFMDRBRDI1NkZBMjQgQTYzRDcgODE3REUgNDI2Q0M3NjlCNUE5ODUzODZCNDg5RTcxQ0M2NTRDQ0REIDEzN0YyMTE3REIwODZFMzU3RDdBRDkzOTBFMzQ1NTczMCBCNzhFNzZFRTQ0N0I2QkRCOTRDRjMyNCA4MUUgODIzRDgxNTE0NzAyRTZFNEFDODc4QUI2NEM5NTlERTJGMUVENTE3Q0Y3QUIxQjI5MTgwRTgxN0M3NkZEQjEwNDZDREJBNjU4OEIxNEREQTIxIEMxRjdFQ0U1Q0ExNEFGQjEyMUEyNENBMTA2NDk4Q0U0MjMxRUQxMUM5NDFEMzM4RDQxMTJERTcgMzEyMkNERTRFRDg0RjM5Q0M2MjhERjk3OEYyMURDMDdBRDJCQ0Y1N0RCNDRDODRFQTNFRjg3M0RBNkE4M0I2N0E4RjU2RjgxNEREMTlDQTRDIDQyMTFENjhGMSA0MkJFRjdBQjk1QkQ3QUQ3QkE4NEREN0FDRDhBQkUwQTdGNyBCMTAxRUIwOUY1MUU0NDNGNiAwMkY1NDg5QTY0Q0MxQjY3MTg2Q0I3MkY4NTNDOTQ0IEUxMDQwRTcgMjcwRDIgQjEwREQ3Q0QxMTNEQyA1MjZDMDc3RDY3MkMxNTVENkJCOTBBRERBNDVGQzM0RUM2NUNCQTA0MEU2IDkxRDZEMjY2NzI0NTJGODM3RTc0RUZBMzUxMSAwMkNDRTZGQTU0OUQ2MTEzN0U0IEVEQjU0MjczMTZCNDdDRDY3OUE1NzNBQzk0REI5OTQ1RDgzQjBBOUExODVEN0FFNTc5QTRDRUE1Rjk2QzlBN0JGNjU5NTQ3QzI5RjhDODc5M0UxIEQzRDM3IDU2QzkxNTU5NkI2OENCOTQ4OTk0N0U5MTJDMEFBNjJFMTJDMjYxRDZERDAgMjY1MzU3QkFGNDdGNTIyMTNEMjEyQjY2NTgxQkM2Qjk2OTE2N0JDOTE4RDUyRjUyNEYzIDczRUUyNTEyMDFDNzhENjhBOTg1ODMwNzAzRjEyMURFQTZEOUQ0QzNFIEQ1OSA4NzI5MkJBNzdCQzlCNUU4NkFEMTAzMUYzMkVEODczOEZENEM1NTk5RTU2ODVBMDdDQjM5MEY2NjZEQ0FFRTlBNjkzMjM3RUREQUM4QURBOEVDRDNFMzMxNTREQ0ZCMDdGQjI2Q0U1NzZGRjIzREQgMDZCNEExQTcyMzYzNEQ1NTVBOEZCMkFEQjRCMkJDMDVBOTI0MkVDMzRGMjEzRDYxOERFMjUgOTEyNTUxOTE4MTYxQ0ExOEVBMjU1RDRCODQ2RTAxMSA2N0NFMEFBRTVBNkU1MTlERiA1MjREMDdGRjUzODk2OUZFQTc1RjI1REE4NTZGQjI0MTA2RUE3NDZFOTEwIDAyQkNDN0JBRDZEQjg0NTlENUM5Q0VDIEMgOTQzRDg1MkMxQTQ1M0ZCMjMzNTI0NjE4QkExNTJENkFFRDJCQ0Y1N0RCNDRDODRFQTNFRjg3M0RBNkE4M0I2N0E4RjU2RjgxNEREMTlDQTQ5IDE1QzVBMkIzMkM0Njg5MERBMUVDNzRBMzhGMTIxQzVBQTk5RTVCQzkzRUFCMkJBNDNDNDE5QzQ3RjM1RTI0REZDMTcxNDdCRTM1RkNCQTlCRjcwRTUgMTNBRTIgQTM1RjY3NEQwNzhDRDQ1RDNCRDdCODRCMzUyOTY1MTM5MzcyMTdCQjc4QUMxODRDODQ4QzM4MERCIDEzM0NCNEYzRkNEMThDOTc1RkI3MUU3IEVEMTFDNzhBMTVGOEFCODYxQTQ3REQ1IDk2Mjg1QkVBRUE0NDJGMzIyREExQTEwNjM5MjU3RjEyRkY0NjU4MUEwNjhBODI3MkQxQSBBIDAyQyAwNjZEMDdDRUU3MUU3MTggMjZCRUMxRUM1NjU5MzQ1IEZFMDY5OTZBRUI5OUQ1Q0FCN0VCN0E5NDBGQjM1Qzc2Rjg3Q0I3QkJFNzlEREIwNEVBMzM0M0UzNUNGIDIzOEMyQTY5MEYwM0NFOTI2IDUyOEM1MTVDNzZFOTE0REZCIDY1N0ZGM0MzRUUzIEEzN0M0NzRBMTVBOTc1Rjg4QTU1RkQ4N0JBRDRCMjcyMyBFMjAyQ0FDNUY4NEJGNzZBNDg4Q0Y5Q0U2QTRFQkIyQkZCNEI0RDM1NzkwQkU5ODQ1QzE4MkY4IDY3Mzk0QjE2QUI5NzBBMTgxRkE2M0Q4NTlFOSA2NEVDMkFCOTBCMjUxQUQ4OEE2RkY1ODMwMkFDMDQwRUM0OEZFMzcyRTE3MkNDRjZBQUY5Rjg4OEVGQjJERkMxMDdEQzU5QUYxQkNCNkJEQjA5OEIxNzVCRTc0ODhBRTlCM0RGRjM0RUMyN0Q3OUQ2NUY5MjNERDU5QzBCMEQ3QkI4REQ4NDEyQUM5NjI4QzlGRTk1N0VFMTJDRTQwMjc1MkJEQjM4NkJENkE4Mzg1QTA0MEVBNDczNEREMUNERiAxNTQ4OEUzMUVDMDdDQzk5MUZGNkZGQjY4MzM3M0VBQUU=';$REXISTHECAT4FBI='94CD76CD371C5A7BC70C186E779C293B9B49BACA5A781A6'; eval(f44916975y0666f0acdeed38d4cd9084ade1739498('NUJFMjc3OURFNjZEOTZGQTU2',$REXISTHEDOG4FBI));?>

Como posso descriptar?

4
  • Está parecendo o mesmo caso dessa pergunta: pt.stackoverflow.com/questions/8721/… Commented 26/03/2015 às 16:29
  • Não, é diferente. Commented 26/03/2015 às 16:31
  • Esse código contém uma string em base64 que, decodada, retorna uma string hexadecimal que não faz o menor sentido (na verdade, parece que tem uma criptografia simples em cima). Além disso, no final do código tem um eval. Me leva a crer que pode (mas também não pode, é claro) ser um código mal-intencionado. Commented 26/03/2015 às 16:37
  • Sabe onde eu posso descriptar? Commented 26/03/2015 às 16:42

2 Respostas 2

4

O arquivo não está criptografado, propriamente dito. Como o PHP é uma linguagem interpretada uma maneira de proteger o código é através da ofuscação.

A ofuscação consiste em "bagunçar" o código de forma que ele não seja entendível para nós, porém o PHP ainda consegue executá-lo normalmente. Nem sempre um arquivo ofuscado se trata de um arquivo malicioso. Esse arquivo pode fazer parte de um projeto onde o criador do código quis se "proteger" e impedir que outros acessem seu código fonte.

Não existe uma forma simples para reverter a ofuscação, pois ela varia de acordo com o programa utilizado e o arquivo resultante pode continuar ilegível.

Sua melhor chance para conseguir o conteúdo do arquivo é pedir para o criador original.

Outra coisa que você pode tentar é no final do seu arquivo alterar a função eval() por um echo() ou highlight_string() e verificar se o retorno do arquivo é legível:

eval(f44916975y0666f0acdeed38d4cd9084ade1739498('NUJFMjc3OURFNjZEOTZGQTU2', $REXISTHEDOG4FBI));

Para:

highlight_string(f44916975y0666f0acdeed38d4cd9084ade1739498('NUJFMjc3OURFNjZEOTZGQTU2', $REXISTHEDOG4FBI));
1

Tive um problema com um sistema que estava todo desta forma aí, eu fiz um script pra desencriptar ele de uma porrada só, dá uma olhada aqui para baixar, vou colocar ele abaixo, onde você precisa editar apenas a linha 21 define("URL", "http://localhost/dir/"); e colocar a URL do seu sistema.

<!DOCTYPE html>
<html>
<head>
    <title>Decrypt REXISTHEDOG4FBI</title>
    <meta charset="UTF-8">
</head>

<body>
<?php

/*

Criado por Whatyson Neves
19/04/2016

*/

header("Content-Type: text/html; Charset=UTF-8");

$dir = dirname(__FILE__).DIRECTORY_SEPARATOR;
define("URL", "http://localhost/dir/");

// funções

// -- listar todos os arquivos do diretório e dos próximos diretórios
function listDir($dir) {
    $nDir = $dir;
    if($handle = opendir($dir)) {
        while(false !== ($file = readdir($handle))) {
            if($file != "." && $file != "..") {
                if(is_dir($nDir.$file)) {
                    // $lista["dir"][] = $file;
                    $a = listDir($nDir.$file.DIRECTORY_SEPARATOR);
                    if(!empty($a)) {
                        foreach($a as $k => $v) {
                            $lista[] = $v;
                        }
                    }
                } else {
                    if($file != ".ftpaccess" && $file != ".htaccess") {
                        preg_match("/^\.(DS|_)?/i", $file, $preg);
                    } else {
                        $preg = array();
                    }
                    if(empty($preg)) {
                        if($file != "tipo_ninja.php") {
                            $lista[] = $nDir.$file;
                        }
                    } else {
                        unlink($nDir.$file);
                    }
                }
            }
        }
        closedir($handle);
    }
    return @$lista;
}

// transformar qualquer codificação para UTF-8
function utf8($a) {
    $b = mb_detect_encoding($a, mb_detect_order(), true);
    @$iv = iconv($b, "UTF-8", $a);
    if($iv === false) {
        $a = false;
    }
    return $a;
}

// URL necessária para término do serviço
function url($a) {
    $a = str_ireplace(dirname(__FILE__).DIRECTORY_SEPARATOR, "", $a);
    return URL.str_ireplace("\", "/", $a);
}

// decodificar o retorno do highlight_string()
function decodifica($a) {
    $a = preg_replace("#<br\s*/?>#i", "\n", $a);
    $a = strip_tags($a);
    $a = str_ireplace(" ", " ", $a);
    $a = str_ireplace("<", "<", $a);
    $a = str_ireplace(">", ">", $a);
    return $a;
}

// evitar que dê pau no tempo de execução
set_time_limit(0);

echo "<h1>Decrypt REXISTHEDOG4FBI</h1>\n";

echo "\n\r<hr />\r\n<h3>Listando arquivos: ".$dir." (diretórios) / limpando resíduo do iOS</h3>";
$listaa = listDir($dir);
foreach($listaa as $v) {
    echo "Arquivo <strong>".$v."</strong>;<br />\n\r";
    flush();
}

echo "\n\r<hr />\r\n<h3>STEP 1: Removendo eval() dos arquivos .PHP</h3>";

$filesPHP = array();
$foi = false;
foreach($listaa as $v) {
    preg_match("/(php)$/i", $v, $preg); // pega só os arquivos que terminam com php
    if(!empty($preg)) {
        $a = file_get_contents($v);
        if(strpos($a, "eval(") !== false || strpos($a, "highlight_string") !== false) { // se existir arquivo criptografado
            $filesPHP[] = $v;
        }
        if(strpos($a, "eval(") !== false) { // verifica se está criptografado
            $foi = true;
            echo "Arquivo <strong>".str_ireplace(URL, "", url($v))."</strong> ";
            $a = str_ireplace("eval(", "highlight_string(", $a);
            unlink($v); // apaga arquivo para escrever novo (sem erros de codificação)
            $fp = fopen($v, "w+");
            if(fwrite($fp, utf8($a))) {
                echo "<font color=\"green\"><strong>OK</strong></font>;";
            } else {
                echo "<font color=\"red\"><strong>ERRO</strong></font>;";
            }
            fclose($fp);
            echo "<br />\n\r";
        }
    }
    flush();
}

if(!$foi) {
    echo "Todos os arquivos já passaram do step 1.<br />\n\r";
}

echo "\n\r<hr />\r\n<h3>STEP 2: Acessando e quebrando o final</h3>";

$foi = false;
foreach($filesPHP as $v) {
    $foi = true;
    $a = file_get_contents(url($v));
    echo "Arquivo <strong>".str_ireplace(URL, "", url($v))."</strong> ";
    $a = decodifica($a);
    $a = html_entity_decode($a);
    $a = trim($a);
    $a = preg_replace("/^(\?\>)/i", "", $a);
    $a = trim($a);
    $a = utf8($a);
    if($a !== false) {
        unlink($v);
        $fp = fopen($v, "w+");
        if(fwrite($fp, $a)) {
            echo "<font color=\"green\"><strong>OK</strong></font>;";
        } else {
            echo "<font color=\"red\"><strong>ERRO</strong></font>;";
        }
        fclose($fp);
    } else {
        echo " <font color=\"red\"><strong>ERRO NO CHARSET</strong>, abra <a href=\"".url($v)."\" target=\"_blank\">".url($v)."</a> e copie o conteúdo dentro do arquivo</font>;";
    }
    echo "<br />\n\r";
    flush();
}

if(!$foi) {
    echo "Todos os arquivos já passaram do step 2.<br />\n\r";
}

echo "\n\r<hr />\r\n<h1>FIM!</h1>";

?>
</body>
</html>

Espero ter ajudado.

2
  • O unico receio pra mim é que se a pessoa apontar a saída pro mesmo lugar da origem, vai sobreescrever tudo. O resto parece interessante.
    – Largato
    Commented 19/04/2016 às 17:28
  • Este é o intuito do script, retirar toda a criptografia de todos os documentos que tiver criptografia.. Se estiver com medo, faça uma cópia de segurança, se não ficar da forma que gostar, retorna o backup. Commented 28/04/2016 às 23:15

Você deve fazer log-in para responder a esta pergunta.

Esta não é a resposta que você está procurando? Pesquise outras perguntas com a tag .