<?php
/**
 * This file is a part of the phpMussel package.
 * Homepage: https://phpmussel.github.io/
 *
 * PHPMUSSEL COPYRIGHT 2013 AND BEYOND BY THE PHPMUSSEL TEAM.
 *
 * Authors:
 * @see PEOPLE.md
 *
 * License: GNU/GPLv2
 * @see LICENSE.txt
 *
 * This file: Functions file (last modified: 2017.10.27).
 */

/**
 * Extends compatibility with phpMussel to PHP 5.4.x by introducing some simple
 * polyfills for functions introduced with newer versions of PHP.
 */
if (substr(PHP_VERSION, 0, 4) === '5.4.') {
    require $phpMussel['Vault'] . 'php5.4.x.php';
}

/**
 * Registers plugin closures/functions to their intended hooks.
 *
 * @param string $what The name of the closure/function to execute.
 * @param string $where Where to execute it (the designated "plugin hook").
 * @return bool Execution failed(false)/succeeded(true).
 */
$phpMussel['Register_Hook'] = function ($what, $where) use (&$phpMussel) {
    if (
        !isset($phpMussel['MusselPlugins']['hooks']) ||
        !isset($phpMussel['MusselPlugins']['closures']) ||
        !$what ||
        !$where
    ) {
        return false;
    }
    if (!isset($phpMussel['MusselPlugins']['hooks'][$where])) {
        $phpMussel['MusselPlugins']['hooks'][$where] = [];
    }
    $phpMussel['MusselPlugins']['hooks'][$where][] = $what;
    if (!function_exists($what) && isset($GLOBALS[$what]) && is_object($GLOBALS[$what])) {
        $phpMussel['MusselPlugins']['closures'][] = $what;
    }
    return true;
};

/**
 * Executes plugin closures/functions.
 *
 * @param string $HookID Where to execute it (the designated "plugin hook").
 * @return bool Execution failed(false)/succeeded(true).
 */
$phpMussel['Execute_Hook'] = function ($HookID) use (&$phpMussel) {
    if (!isset($phpMussel['MusselPlugins']['hooks'][$HookID])) {
        return false;
    }
    foreach ($phpMussel['MusselPlugins']['hooks'][$HookID] as $Registered) {
        if (isset($GLOBALS[$Registered]) && is_object($GLOBALS[$Registered])) {
            $GLOBALS[$Registered]();
        } elseif (function_exists($Registered)) {
            call_user_func($Registered);
        }
    }
    return true;
};

/**
 * Replaces encapsulated substrings within an input string with the value of
 * elements within an input array, whose keys correspond to the substrings.
 * Accepts two input parameters: An input array (1), and an input string (2).
 *
 * @param array $Needle The input array (the needle[/s]).
 * @param string $Haystack The input string (the haystack).
 * @return string The resultant string.
 */
$phpMussel['ParseVars'] = function ($Needle, $Haystack) {
    if (!is_array($Needle) || empty($Haystack)) {
        return '';
    }
    array_walk($Needle, function($Value, $Key) use (&$Haystack) {
        if (!is_array($Value)) {
            $Haystack = str_replace('{' . $Key . '}', $Value, $Haystack);
        }
    });
    return $Haystack;
};

/**
 * Implodes multidimensional arrays.
 *
 * @param array $ar The array to be imploded.
 * @param string|array $j An optional "needle" or "joiner" to use for imploding
 *      the array. If a numeric array is used, an element of the array
 *      corresponding to the recursion depth will be used as the needle or
 *      joiner.
 * @param int $i Used by the function when calling itself recursively, for the
 *      purpose of tracking recursion depth (shouldn't be used outside the
 *      function).
 * @param bool $e Optional; When set to false, empty elements will be ignored.
 * @return string The imploded array.
 */
$phpMussel['implode_md'] = function ($ar, $j = '', $i = 0, $e = true) use (&$phpMussel) {
    if (!is_array($ar)) {
        return $ar;
    }
    $c = count($ar);
    if (!$c || is_array($i)) {
        return false;
    }
    if (is_array($j)) {
        if (!$x = $j[$i]) {
            return false;
        }
    } else {
        $x = $j;
    }
    $out = '';
    while ($c > 0) {
        $key = key($ar);
        if (is_array($ar[$key])) {
            $i++;
            $ar[$key] = $phpMussel['implode_md']($ar[$key], $j, $i);
            $i--;
        }
        if (!$out) {
            $out = $ar[$key];
        } elseif (!(!$e && empty($ar[$key]))) {
            $out .= $x . $ar[$key];
        }
        next($ar);
        $c--;
    }
    return $out;
};

/**
 * A function for comparing substrings with hex values.
 *
 * @param string $str The source/raw string to be compared.
 * @param int $st Optional; At what point in the source/raw string should the
 *      comparing begin? The first character of the string starts at "0".
 * @param int $l Optional; For how many bytes of the string, starting from
 *      `$st`, should the comparing occur? Defaults to the total length of the
 *      string.
 * @param string $x The hexadecimal value to compare the string against.
 * @param bool $p Optional; When set to false, the function will return true if
 *      the hexadecimal value can be matched to at least some part of the
 *      substring being compared; When set to true, the function will return
 *      true if the hexadecimal value is an exact match to the entirety of the
 *      substring being compared (optional).
 * @return bool The results of the comparison (true if matched, false if not
 *      matched).
 */
$phpMussel['substr_compare_hex'] = function ($str = '', $st = 0, $l = 0, $x = 0, $p = false) {
    if (!$l) {
        $l = strlen($str);
    }
    if (!$x || !$l) {
        return false;
    }
    for ($str = substr($str, $st, $l), $y = '', $i = 0; $i < $l; $i++) {
        $z = dechex(ord(substr($str, $i, 1)));
        $y .= (strlen($z) === 1) ? $z = '0' . $z : $z;
    }
    return !$p ? (substr_count($y, strtolower($x)) > 0) : ($y === strtolower($x));
};

/**
 * Does some simple decoding work on strings.
 *
 * @param string $str The string to be decoded.
 * @return string The decoded string.
 */
$phpMussel['prescan_decode'] = function ($str) use (&$phpMussel) {
    $nstr = html_entity_decode(urldecode(str_ireplace('&amp;#', '&#', str_ireplace('&amp;amp;', '&amp;', $str))));
    if ($nstr !== $str) {
        $nstr = $phpMussel['prescan_decode']($nstr);
    }
    return $nstr;
};

/**
 * Some simple obfuscation for potentially blocked functions; We need this to
 * avoid triggering false positives for some potentially overzealous
 * server-based security solutions that would usually flag this file as
 * malicious when they detect it containing the names of suspect functions.
 *
 * @param string $n An alias for the function that we want to call.
 * @param string $str Some data to parse to the function being called.
 * @return string The parsed data and/or decoded string (if $str is empty, the
 *      the resolved alias will be returned instead).
 */
$phpMussel['Function'] = function ($n, $str = '') {
    static $x = 'abcdefghilnorstxz12346_';
    $fList = [
        'GZ' =>
            $x[6] . $x[16] . $x[8] . $x[10] . $x[5] . $x[9] . $x[0] . $x[14] . $x[4],
        'R13' =>
            $x[13] . $x[14] . $x[12] . $x[22] . $x[12] . $x[11] . $x[14] . $x[17] . $x[19],
        'B64' =>
            $x[1] . $x[0] . $x[13] . $x[4] . $x[21] . $x[20] . $x[22] . $x[3] . $x[4] . $x[2] . $x[11] . $x[3] . $x[4],
        'HEX' =>
            $x[7] . $x[4] . $x[15] . $x[18] . $x[1] . $x[8] . $x[10]
    ];
    if (!isset($fList[$n])) {
        return '';
    }
    if (!$str || !function_exists($fList[$n])) {
        return $fList[$n];
    }
    try {
        $Return = $fList[$n]($str);
    } catch (\Exception $e) {
        $Return = '';
    }
    return $Return;
};

/**
 * Does some more complex decoding and normalisation work on strings.
 *
 * @param string $str The string to be decoded/normalised.
 * @param bool $html If true, "style" and "script" tags will be stripped from
 *      the input string (optional; defaults to false).
 * @param bool $decode If false, the input string will be normalised, but not
 *      decoded; If true, the input string will be normalised *and* decoded.
 *      Optional; Defaults to false.
 * @return string The decoded/normalised string.
 */
$phpMussel['prescan_normalise'] = function ($str, $html = false, $decode = false) use (&$phpMussel) {
    $ostr = '';
    if ($decode) {
        $ostr .= $str;
        while (true) {
            if (function_exists($phpMussel['Function']('GZ'))) {
                if ($c = preg_match_all(
                    '/(' . $phpMussel['Function']('GZ') . '\s*\(\s*["\'])(.{1,4096})(,[0-9])?(["\']\s*\))/i',
                $str, $matches)) {
                    for ($i = 0; $c > $i; $i++) {
                        $str = str_ireplace(
                            $matches[0][$i],
                            '"' . $phpMussel['Function']('GZ', $phpMussel['substrbl']($phpMussel['substraf']($matches[0][$i], $matches[1][$i]), $matches[4][$i])) . '"',
                            $str
                        );
                    }
                    continue;
                }
            }
            if ($c = preg_match_all(
                '/(' . $phpMussel['Function']('B64') . '|decode_base64|base64\.b64decode|atob|Base64\.decode64)(\s*' .
                '\(\s*["\'\`])([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)(["\'\`]' .
                '\s*\))/i',
            $str, $matches)) {
                for ($i = 0; $c > $i; $i++) {
                    $str = str_ireplace(
                        $matches[0][$i],
                        '"' . $phpMussel['Function']('B64', $phpMussel['substrbl']($phpMussel['substraf']($matches[0][$i], $matches[1][$i] . $matches[2][$i]), $matches[5][$i])) . '"',
                        $str
                    );
                }
                continue;
            }
            if ($c = preg_match_all(
                '/(' . $phpMussel['Function']('R13') . '\s*\(\s*["\'])([^\'"\(\)]{1,4096})(["\']\s*\))/i',
            $str, $matches)) {
                for ($i = 0; $c > $i; $i++) {
                    $str = str_ireplace(
                        $matches[0][$i],
                        '"' . $phpMussel['Function']('R13', $phpMussel['substrbl']($phpMussel['substraf']($matches[0][$i], $matches[1][$i]), $matches[3][$i])) . '"',
                        $str
                    );
                }
                continue;
            }
            if ($c = preg_match_all(
                '/(' . $phpMussel['Function']('HEX') . '\s*\(\s*["\'])([a-fA-F0-9]{1,4096})(["\']\s*\))/i',
            $str, $matches )) {
                for ($i = 0; $c > $i; $i++) {
                    $str = str_ireplace(
                        $matches[0][$i],
                        '"' . $phpMussel['HexSafe']($phpMussel['substrbl']($phpMussel['substraf']($matches[0][$i], $matches[1][$i]), $matches[3][$i])) . '"',
                        $str
                    );
                }
                continue;
            }
            if ($c = preg_match_all(
                '/([Uu][Nn][Pp][Aa][Cc][Kk]\s*\(\s*["\']\s*H\*\s*["\']\s*,\s*["\'])([a-fA-F0-9]{1,4096})(["\']\s*\))/',
            $str, $matches)) {
                for ($i = 0; $c > $i; $i++) {
                    $str = str_replace($matches[0][$i], '"' . $phpMussel['HexSafe']($phpMussel['substrbl']($phpMussel['substraf']($matches[0][$i], $matches[1][$i]), $matches[3][$i])) . '"', $str);
                }
                continue;
            }
            break;
        }
    }
    $str = preg_replace('/[^\x21-\x7e]/', '', strtolower($phpMussel['prescan_decode']($str . $ostr)));
    unset($ostr);
    if ($html) {
        $str = preg_replace([
            '@<script[^>]*?>.*?</script>@si',
            '@<[\/\!]*?[^<>]*?>@si',
            '@<style[^>]*?>.*?</style>@siU',
            '@<![\s\S]*?--[ \t\n\r]*>@'
        ], '', $str);
    }
    return trim($str);
};

/**
 * Gets substring from haystack prior to the first occurrence of needle.
 *
 * @param string $h The haystack.
 * @param string $n The needle.
 * @return string The substring.
 */
$phpMussel['substrbf'] = function ($h, $n) {
    return !$n ? '' : substr($h, 0, strpos($h, $n));
};

/**
 * Gets substring from haystack after the first occurrence of needle.
 *
 * @param string $h The haystack.
 * @param string $n The needle.
 * @return string The substring.
 */
$phpMussel['substraf'] = function ($h, $n) {
    return !$n ? '' : substr($h, strpos($h, $n) + strlen($n));
};

/**
 * Gets substring from haystack prior to the last occurrence of needle.
 *
 * @param string $h The haystack.
 * @param string $n The needle.
 * @return string The substring.
 */
$phpMussel['substrbl'] = function ($h, $n) {
    return !$n ? '' : substr($h, 0, strrpos($h, $n));
};

/**
 * Gets substring from haystack after the last occurrence of needle.
 *
 * @param string $h The haystack.
 * @param string $n The needle.
 * @return string The substring.
 */
$phpMussel['substral'] = function ($h, $n) {
    return !$n ? '' : substr($h, strrpos($h, $n) + strlen($n));
};

/**
 * This function reads files and returns the contents of those files.
 *
 * @param string $File Path and filename of the file to read.
 * @param int $s Number of blocks to read from the file (optional; can be
 *      manually specified, but it's best to just ignore it and let the
 *      function work it out for itself).
 * @param bool $PreChecked When false, checks that the file exists and is
 *      writable. Defaults to false.
 * @param int $Blocks The total size of a single block in kilobytes (optional;
 *      defaults to 128, i.e., 128KB or 131072 bytes). This can be modified by
 *      developers as per their individual needs. Generally, a smaller value
 *      will increase stability but decrease performance, whereas a larger
 *      value will increase performance but decrease stability.
 * @return string|bool Content of the file returned by the function (or false
 *      on failure).
 */
$phpMussel['ReadFile'] = function ($File, $Size = 0, $PreChecked = false, $Blocks = 128) {
    if (!$PreChecked && (!is_file($File) || !is_readable($File))) {
        return false;
    }
    $Blocksize = $Blocks * 1024;
    $Filesize = filesize($File);
    if (!$Size) {
        $Size = ($Filesize && $Blocksize) ? ceil($Filesize / $Blocksize) : 0;
    }
    $Data = '';
    if ($Size > 0) {
        $Handle = fopen($File, 'rb');
        $r = 0;
        while ($r < $Size) {
            $Data .= fread($Handle, $Blocksize);
            $r++;
        }
        fclose($Handle);
    }
    return $Data ?: false;
};

/**
 * A very simple wrapper for file() that checks for the existence of files
 * before attempting to read them, in order to avoid warnings about
 * non-existent files.
 *
 * @param string $Filename Refer to the description for file().
 * @param int $Flags Refer to the description for file().
 * @param array $Context Refer to the description for file().
 * @return array|bool Same as with file(), but won't trigger warnings.
 */
$phpMussel['ReadFileAsArray'] = function ($Filename, $Flags = 0, $Context = false) {
    if (!is_readable($Filename)) {
        return false;
    }
    if (!$Context) {
        return !$Flags ? file($Filename) : file($Filename, $Flags);
    }
    return file($Filename, $Flags, $Context);
};

/** Deletes expired cache entries and regenerates cache files. */
$phpMussel['CleanCache'] = function () use (&$phpMussel) {
    if (!empty($phpMussel['memCache']['CacheCleaned'])) {
        return true;
    }
    $phpMussel['memCache']['CacheCleaned'] = true;
    $CacheFiles = [];
    $FileIndex = $phpMussel['Vault'] . 'cache/index.dat';
    if (!is_readable($FileIndex)) {
        return false;
    }
    $FileDataOld = $FileData = $phpMussel['ReadFile']($FileIndex);
    if (substr_count($FileData, ';')) {
        $FileData = explode(';', $FileData);
        foreach ($FileData as &$ThisData) {
            if (strpos($ThisData, ':') === false) {
                $ThisData = '';
                continue;
            }
            $ThisData = explode(':', $ThisData, 3);
            if ($ThisData[1] > 0 && $phpMussel['Time'] > $ThisData[1]) {
                $FileKey = bin2hex(substr($ThisData[0], 0, 1));
                if (!isset($CacheFiles[$FileKey])) {
                    $CacheFiles[$FileKey] = !is_readable(
                        $phpMussel['cachePath'] . $FileKey . '.tmp'
                    ) ? '' : $phpMussel['ReadFile']($phpMussel['cachePath'] . $FileKey . '.tmp', 0, true);
                }
                while (strpos($CacheFiles[$FileKey], $ThisData[0] . ':') !== false) {
                    $CacheFiles[$FileKey] = str_ireplace($ThisData[0] . ':' . $phpMussel['substrbf'](
                        $phpMussel['substraf']($CacheFiles[$FileKey], $ThisData[0] . ':'), ';'
                    ) . ';', '', $CacheFiles[$FileKey]);
                }
                $ThisData = '';
                continue;
            }
            $ThisData = $ThisData[0] . ':' . $ThisData[1];
        }
        $FileData = str_replace(';;', ';', implode(';', array_filter($FileData)) . ';');
        if ($FileDataOld !== $FileData) {
            $Handle = fopen($FileIndex, 'w');
            fwrite($Handle, $FileData);
            fclose($Handle);
        }
    }
    foreach ($CacheFiles as $CacheEntryKey => $CacheEntryValue) {
        if (strlen($CacheEntryValue) < 2) {
            if (file_exists($phpMussel['cachePath'] . $CacheEntryKey . '.tmp')) {
                unlink($phpMussel['cachePath'] . $CacheEntryKey . '.tmp');
            }
            continue;
        }
        $Handle = fopen($phpMussel['cachePath'] . $CacheEntryKey . '.tmp', 'w');
        fwrite($Handle, $CacheEntryValue);
        fclose($Handle);
    }
    return true;
};

/**
 * Retrieves cache entries.
 *
 * @param string|array $Entry The name of the cache entry/entries to retrieve;
 *      Can be a string to specify a single entry, or an array of strings to
 *      specify multiple entries.
 * @return string|array Contents of the cache entry/entries.
 */
$phpMussel['FetchCache'] = function ($Entry = '') use (&$phpMussel) {
    $phpMussel['CleanCache']();
    if (!$Entry) {
        return '';
    }
    if (is_array($Entry)) {
        $Out = [];
        array_walk($Entry, function($Value, $Key) use (&$phpMussel, &$Out) {
            $Out[$Key] = $phpMussel['FetchCache']($Value);
        });
        return $Out;
    }
    $File = $phpMussel['cachePath'] . bin2hex(substr($Entry, 0, 1)) . '.tmp';
    if (!is_readable($File) || !$FileData = $phpMussel['ReadFile']($File, 0, true)) {
        return '';
    }
    if (!$Item = strpos($FileData, $Entry . ':') !== false ? $Entry . ':' . $phpMussel['substrbf'](
        $phpMussel['substraf']($FileData, $Entry . ':'), ';'
    ) . ';' : '') {
        return '';
    }
    $Expiry = $phpMussel['substrbf']($phpMussel['substraf']($Item, $Entry . ':'), ':');
    if ($Expiry > 0 && $phpMussel['Time'] > $Expiry) {
        while (substr_count($FileData, $Entry . ':')) {
            $FileData = str_ireplace($Item, '', $FileData);
        }
        $Handle = fopen($File, 'w');
        fwrite($Handle, $FileData);
        fclose($Handle);
        return '';
    }
    if (!$ItemData = $phpMussel['substrbf']($phpMussel['substraf']($Item, $Entry . ':' . $Expiry . ':'), ';')) {
        return '';
    }
    return $phpMussel['Function']('GZ', $phpMussel['HexSafe']($ItemData)) ?: '';
};

/**
 * Creates cache entry and saves it to the cache.
 *
 * @param string $Entry Name of the cache entry to create.
 * @param int $Expiry Unix time until the cache entry expires.
 * @param string $ItemData Contents of the cache entry.
 * @return bool This should always return true, unless something goes wrong.
 */
$phpMussel['SaveCache'] = function ($Entry = '', $Expiry = 0, $ItemData = '') use (&$phpMussel) {
    $phpMussel['CleanCache']();
    if (!$Entry || !$ItemData) {
        return false;
    }
    if (!$Expiry) {
        $Expiry = $phpMussel['Time'];
    }
    $File = $phpMussel['cachePath'] . bin2hex($Entry[0]) . '.tmp';
    $Data = $phpMussel['ReadFile']($File) ?: '';
    while (substr_count($Data, $Entry . ':')) {
        $Data = str_ireplace($Entry . ':' . $phpMussel['substrbf']($phpMussel['substraf']($Data, $Entry . ':'), ';') . ';', '', $Data);
    }
    $Data .= $Entry . ':' . $Expiry . ':' . bin2hex(gzdeflate($ItemData,9)) . ';';
    $Handle = fopen($File, 'w');
    fwrite($Handle, $Data);
    fclose($Handle);
    $IndexFile = $phpMussel['Vault'] . 'cache/index.dat';
    $IndexNewData = $IndexData = $phpMussel['ReadFile']($IndexFile) ?: '';
    while (substr_count($IndexNewData, $Entry . ':')) {
        $IndexNewData = str_ireplace($Entry . ':' . $phpMussel['substrbf']($phpMussel['substraf']($IndexNewData, $Entry . ':'), ';') . ';', '', $IndexNewData);
    }
    $IndexNewData .= $Entry . ':' . $Expiry . ';';
    if ($IndexNewData !== $IndexData) {
        $IndexHandle = fopen($IndexFile, 'w');
        fwrite($IndexHandle, $IndexNewData);
        fclose($IndexHandle);
    }
    return true;
};

/** Reads and prepares cached hash data. */
$phpMussel['PrepareHashCache'] = function () use (&$phpMussel) {
    $phpMussel['HashCache']['Data'] =
        $phpMussel['Config']['general']['scan_cache_expiry'] > 0 ? $phpMussel['FetchCache']('HashCache') : '';
    if (!empty($phpMussel['HashCache']['Data'])) {
        $phpMussel['HashCache']['Data'] = explode(';', $phpMussel['HashCache']['Data']);
        $Build = [];
        foreach ($phpMussel['HashCache']['Data'] as $CacheItem) {
            if (strpos($CacheItem, ':') !== false) {
                $CacheItem = explode(':', $CacheItem, 4);
                if (!($phpMussel['Time'] > $CacheItem[1])) {
                    $Build[$CacheItem[0]] = $CacheItem;
                }
            }
        }
        $phpMussel['HashCache']['Data'] = $Build;
    }
};

/**
 * Quarantines file uploads by using a key generated from your quarantine key
 * to bitshift the input string (the file uploads), appending a header with an
 * explanation of what the bitshifted data is, along with an MD5 hash checksum
 * of its non-quarantined counterpart, and then saves it all to a QFU file,
 * storing these QFU files in your quarantine directory.
 *
 * This isn't hardcore encryption, but it should be sufficient to prevent
 * accidental execution of quarantined files and to allow safe handling of
 * those files, which is the whole point of quarantining them in the first
 * place. Improvements might be made in the future.
 *
 * @param string $In The input string (the file upload / source data).
 * @param string $key Your quarantine key.
 * @param string $ip Data origin (usually, the IP address of the uploader).
 * @param string $id The QFU filename to use (calculated beforehand).
 * @return bool This should always return true, unless something goes wrong.
 */
$phpMussel['Quarantine'] = function ($In, $key, $ip, $id) use (&$phpMussel) {
    if (!$In || !$key || !$ip || !$id || !function_exists('gzdeflate') || (
        strlen($key) < 128 &&
        !$key = $phpMussel['HexSafe'](hash('sha512', $key) . hash('whirlpool', $key))
    )) {
        return false;
    }
    $k = strlen($key);
    $FileSize = strlen($In);
    $h = "\xa1phpMussel\x21" . $phpMussel['HexSafe'](md5($In)) . pack('l*', $FileSize) . "\x01";
    $In = gzdeflate($In, 9);
    $Out = '';
    $i = 0;
    while ($i < $FileSize) {
        for ($j = 0; $j < $k; $j++, $i++) {
            if (strlen($Out) >= $FileSize) {
                break 2;
            }
            $L = substr($In, $i, 1);
            $R = substr($key, $j, 1);
            $Out .= ($L === false ? "\x00" : $L) ^ ($R === false ? "\x00" : $R);
        }
    }
    $Out =
        "\x2f\x3d\x3d\x20phpMussel\x20Quarantined\x20File\x20Upload\x20\x3d" .
        "\x3d\x5c\n\x7c\x20Time\x2fDate\x20Uploaded\x3a\x20" .
        str_pad($phpMussel['Time'], 18, "\x20") .
        "\x7c\n\x7c\x20Uploaded\x20From\x3a\x20" . str_pad($ip, 22, "\x20") .
        "\x20\x7c\n\x5c" . str_repeat("\x3d", 39) . "\x2f\n\n\n" . $h . $Out;
    $u = $phpMussel['MemoryUse']($phpMussel['qfuPath']);
    $u = $u['s'] + strlen($Out);
    if ($u > $phpMussel['ReadBytes']($phpMussel['Config']['general']['quarantine_max_usage'])) {
        $u = $phpMussel['MemoryUse'](
            $phpMussel['qfuPath'],
            $u - $phpMussel['ReadBytes']($phpMussel['Config']['general']['quarantine_max_usage'])
        );
    }
    $Handle = fopen($phpMussel['qfuPath'] . $id . '.qfu', 'a');
    fwrite($Handle, $Out);
    fclose($Handle);
    if (!$phpMussel['EOF']) {
        $phpMussel['Stats-Increment']('Web-Quarantined', 1);
    }
    return true;
};

/**
 * Calculates the memory usage of a directory, and optionally, enforces a
 * limitation upon the memory usage of that directory by way of deleting the
 * contents of that directory until a specified quota of bytes to be deleted
 * has been met.
 *
 * This function is recursive, and will check (and/or delete from) the
 * specified directory and all subdirectories that it contains; It should be
 * regarded as a subfunction of the quarantine functionality, used by the
 * quarantine functionality to enforce the quarantine memory usage limit.
 *
 * @param string $p The path and name of the directory to be checked.
 * @param int $d A quota for how many bytes should be deleted from the target
 *      directory when the function is executed (omitting this parameter, or
 *      setting it to zero or less, will prevent the deletion of any files).
 * @return array The function will return an array containing four elements,
 *      all integers: `s` is the actual total memory usage of the target
 *      directory, `c` is a count of the total number of objects (files and
 *      subdirectories) detected within the target directory, `dc` is a count
 *      only of the total number of subdirectories detected within the target
 *      directory, and `d` is how much remaining quota there is to be met by
 *      the time the function has finished executing (usually, should be zero
 *      or less).
 */
$phpMussel['MemoryUse'] = function ($p, $d = 0) use (&$phpMussel) {
    $t = ['s' => 0, 'c' => 0, 'dc' => 0, 'd' => $d];
    if (is_dir($p) && is_readable($p) && $h = opendir($p)) {
        while (false !== ($f = readdir($h))) {
            if ($f !== '.' && $f !== '..' && !is_link($np = $p . '/' . $f)) {
                if (is_dir($np)) {
                    $t['dc']++;
                    $r = $phpMussel['MemoryUse']($np, $t['d']);
                    $t['s'] += $r['s'];
                    $t['c'] += $r['c'];
                    $t['dc'] += $r['dc'];
                    $t['d'] -= $r['d'];
                } elseif (is_file($np)) {
                    $ns = filesize($np);
                    if ($t['d'] > 0 && substr_count($np . "\x01", ".qfu\x01") > 0 && is_readable($np)) {
                        unlink($np);
                        $t['d'] -= $ns;
                    } else {
                        $t['s'] += $ns;
                        $t['c']++;
                    }
                }
            }
        }
        closedir($h);
    }
    return $t;
};

/**
 * Checks if $needle (string) matches (is equal or identical to) $haystack
 * (string), or a specific substring of $haystack, to within a specific
 * threshold of the levenshtein distance between the $needle and the $haystack
 * or the $haystack substring specified.
 *
 * This function is useful for expressing the differences between two strings
 * as an integer value and for then determining whether a specific value as per
 * those differences is met.
 *
 * @param string $needle The needle (will be matched against the $haystack, or,
 *      if substring positions are specified, against the $haystack substring
 *      specified).
 * @param string $haystack The haystack (will be matched against the $needle).
 *      Note that for the purposes of calculating the levenshtein distance, it
 *      doesn't matter which string is a $needle and which is a $haystack (the
 *      value should be the same if the two were reversed). However, when
 *      specifying substring positions, those substring positions are applied
 *      to the $haystack, and not the $needle. Note, too, that if the $needle
 *      length is greater than the $haystack length (after having applied the
 *      substring positions to the $haystack), $needle and $haystack will be
 *      switched.
 * @param int $pos_A The initial position of the $haystack to use for the
 *      substring, if using a substring (optional; defaults to `0`; `0` is the
 *      beginning of the $haystack).
 * @param int $pos_Z The final position of the $haystack to use for the
 *      substring, if using a substring (optional; defaults to `0`; `0` will
 *      instruct the function to continue to the end of the $haystack, and
 *      thus, if both $pos_A and $pos_Z are `0`, the entire $haystack will be
 *      used).
 * @param int $min The threshold minimum (the minimum levenshtein distance
 *      required in order for the two strings to be considered a match).
 *      Optional; Defaults to `0`. If `0` or less is specified, there is no
 *      minimum, and so, any and all strings should always match, as long as
 *      the levenshtein distance doesn't surpass the threshold maximum.
 * @param int $max The threshold maximum (the maximum levenshtein distance
 *      allowed for the two strings to be considered a match). Optional;
 *      Defaults to `-1`. If exactly `-1` is specified, there is no maximum,
 *      and so, any and all strings should always match, as long as the
 *      threshold minimum is met.
 * @param bool $bool Specifies to the function whether to return the
 *      levenshtein distance of the two strings (as an integer) or to return
 *      the results of the match (as a boolean; true for match success, false
 *      for match failure). Optional; Defaults to true. If true is specified,
 *      the function will return a boolean value (the results of the match),
 *      and if false is specified, the levenshtein distance will be returned.
 * @param bool $case Specifies to the function whether to treat the two strings
 *      as case-sensitive (when true is specified) or case-insensitive (when
 *      false is specified) when calculating the levenshtein distance.
 *      Optional; Defaults to false.
 * @param int $cost_ins The cost to apply for character/byte insertions for
 *      when calculating the levenshtein distance. Optional; Defaults to 1.
 * @param int $cost_rep The cost to apply for character/byte replacements for
 *      when calculating the levenshtein distance. Optional; Defaults to 1.
 * @param int $cost_del The cost to apply for character/byte deletions for when
 *      calculating the levenshtein distance. Optional; Defaults to 1.
 * @return bool|int The function will return either a boolean or an integer,
 *      depending on the state of $bool (but will also return false whenever an
 *      error occurs).
 */
$phpMussel['lv_match'] = function ($needle, $haystack, $pos_A = 0, $pos_Z = 0, $min = 0, $max = -1, $bool = true, $case = false, $cost_ins = 1, $cost_rep = 1, $cost_del = 1) {
    if (!function_exists('levenshtein') || is_array($needle) || is_array($haystack)) {
        return false;
    }
    $nlen = strlen($needle);
    $pos_A = (int)$pos_A;
    $pos_Z = (int)$pos_Z;
    $min = (int)$min;
    $max = (int)$max;
    if ($pos_A !== 0 || $pos_Z !== 0) {
        $haystack =
            ($pos_Z === 0) ?
            substr($haystack, $pos_A) :
            substr($haystack, $pos_A, $pos_Z);
    }
    $hlen = strlen($haystack);
    if ($nlen < 1 || $hlen < 1) {
        return $bool ? false : 0;
    }
    if ($nlen > $hlen) {
        $x = [$needle, $nlen, $haystack, $hlen];
        $haystack = $x[0];
        $hlen = $x[1];
        $needle = $x[2];
        $nlen = $x[3];
    }
    if ($cost_ins === 1 && $cost_rep === 1 && $cost_del === 1) {
        $lv = $case ? levenshtein(
            $haystack, $needle
        ) : levenshtein(
            strtolower($haystack), strtolower($needle)
        );
    } else {
        $lv = $case ? levenshtein(
            $haystack, $needle, $cost_ins, $cost_rep, $cost_del
        ) : levenshtein(
            strtolower($haystack), strtolower($needle), $cost_ins, $cost_rep, $cost_del
        );
    }
    return $bool ? (($min === 0 || $lv >= $min) && ($max === -1 || $lv <= $max)) : $lv;
};

/**
 * Returns the high and low nibbles corresponding to the first byte of the
 * input string.
 *
 * @param string $n The input string.
 * @return array Contains two elements, both standard decimal integers; The
 *      first is the high nibble of the input string, and the second is the low
 *      nibble of the input string.
 */
$phpMussel['split_nibble'] = function ($n) {
    $n = bin2hex($n);
    return [hexdec(substr($n, 0, 1)), hexdec(substr($n, 1, 1))];
};

/**
 * Constructs an output string representing the binary bits of an input string,
 * whereby each byte of the output string is a digit (1 or 0), representing
 * the 1/ON or 0/OFF bits of the input string respectively.
 * `$phpMussel['explode_bits']()` can be reversed by way of using
 * `$phpMussel['implode_bits']()`.
 *
 * @param string $n The input string (see closure description above).
 * @return string $n The output string (see closure description above).
 */
$phpMussel['explode_bits'] = function ($n) {
    $out = '';
    $len = strlen($n);
    for ($i = 0; $i < $len; $i++) {
        $out .= str_pad(decbin(ord($n[$i])), 8, '0', STR_PAD_LEFT);
    }
    return $out;
};

/**
 * Reconstitutes an output string from an input string representing a series of
 * binary bits. Each byte is a digit (1 or 0), representing 1/ON or 0/OFF bits
 * of the output string respectively. `$phpMussel['implode_bits']()` can be
 * used to reverse strings generated by `$phpMussel['explode_bits']()`.
 *
 * @param string $n The input string (see closure description above).
 * @return string $n The output string (see closure description above).
 */
$phpMussel['implode_bits'] = function ($n) {
    $chars_chunks = str_split($n, 8);
    $num = count($chars_chunks);
    for ($out = '', $i = 0; $i < $num; $i++) {
        $out .= chr(bindec($chars_chunks[$i]));
    }
    return $out;
};

/**
 * Translates the virus name/identifier shorthand adopted by phpMussel to
 * proper virus names/identifiers and makes some determinations regarding
 * detections based upon the interpretation and understanding of that shorthand
 * against the phpMussel configuration (for example, whether some certain
 * classifications, such as hoax/joke viruses, adware, etc, should be entirely
 * ignored by the scanner, or should be identified as malicious, and therefore
 * blocked).
 *
 * Originally, this function was created to allow a way for phpMussel to
 * partially compress its signatures without jeopardising speed, performance or
 * processing efficiency, because, by allowing phpMussel to partially compress
 * its signatures, the total footprint of its signature files could be reduced,
 * therefore allowing the inclusion of a greater number of signatures in the
 * signature files without causing an excessive bloat in the total footprint.
 *
 * However, since then, its purpose has expanded, to determining whether a
 * signature should be considered a weighted signature (for more complex
 * detections involving multiple signatures) or a non-weighted signature (for
 * signatures that are detections in their own right, not requiring additional
 * signatures for the detection to occur), and to determining whether or not a
 * signature should be ignored, based upon its classification.
 *
 * The function takes an input string (the shorthand virus name), and if byte 0
 * of the input string is "\x1A" (the substitute character), the input string
 * is a shorthand virus name, and processing continues; If it doesn't begin
 * with "\x1A", it isn't a shorthand virus name, and the input string should be
 * returned to the calling scope unmodified. When processing continues, the
 * function splits the nibbles of bytes 1-2, and uses that information to
 * reconstruct a complete virus name from the shorthand virus name; 1H
 * represents the signature vendor name and 1L optionally provides some
 * additional generic indicators (heuristic, CVE, etc), except when 1H == 8 (in
 * which case, 1L represents the signature vendor name, 1H == 8 being used to
 * access that additional set of allocations), 2H+2L represents the virus
 * target (i.e., the file format or system that the virus that the signature is
 * intended to detect is intended to be targeting), and 3H+3L represents the
 * nature of what the signature is intended to detect (i.e., whether we should
 * call it a virus, a trojan, adware, ransomware, etc).
 *
 * Warning: When modifying these allocations (such as to include a new vendor
 * or a new type of detection), be very careful to ensure that your choice of
 * allocations won't conflict with the what phpMussel recognises as its
 * delimiters or as special characters (newlines, semicolons, colons, etc), or
 * else your signature files could break very badly, leading either to a
 * failure to properly detect anything or to numerous severe false positives.
 * Generally (but not exclusively), you should avoid: "\x0?" (or any ?H0
 * character/byte), \x3A and \x3B. Also avoid using the null character ("\x00")
 * in particular, because it can severely break things in certain situations.
 *
 * @param string $VN The shorthand virus name.
 * @return string The full-length "translated" virus name.
 */
$phpMussel['vn_shorthand'] = function ($VN) use (&$phpMussel) {
    $phpMussel['memCache']['weighted'] = false;
    $phpMussel['memCache']['ignoreme'] = false;
    if ($VN[0] !== "\x1a") {
        return $VN;
    }
    $n = $phpMussel['split_nibble']($VN[1]);
    $out = '';
    if ($n[0] === 2) {
        $out .= 'ClamAV-';
    } elseif ($n[0] === 3) {
        $out .= 'phpMussel-';
    } elseif ($n[0] === 4) {
        $out .= 'SecuriteInfo-';
    } elseif ($n[0] === 5) {
        $out .= 'ZBB-';
    } elseif ($n[0] === 6) {
        $out .= 'NLNetLabs-';
    } elseif ($n[0] === 7) {
        $out .= 'FoxIT-';
    } elseif ($n[0] === 8) {
        if ($n[1] === 0) {
            $out .= 'PhishTank-';
        } elseif ($n[1] === 1) {
            $out .= 'Malc0de-';
        } elseif ($n[1] === 2) {
            $out .= 'hpHosts-';
        } elseif ($n[1] === 3) {
            $out .= 'Spam404-';
        } elseif ($n[1] === 4) {
            $out .= 'Cybercrime.Tracker-';
        }
    } elseif ($n[0] === 9) {
        $phpMussel['memCache']['weighted'] = true;
        $out .= 'phpMussel-';
    } elseif ($n[0] === 15) {
        $phpMussel['memCache']['weighted'] = true;
    }
    if ($n[0] !== 8) {
        if ($n[1] === 1) {
            $out .= 'Testfile.';
        } elseif ($n[1] === 2) {
            $out .= 'FN.';
        } elseif ($n[1] === 3) {
            $out .= 'VT.';
        } elseif ($n[1] === 4) {
            $out .= 'META.';
        } elseif ($n[1] === 5) {
            $out .= 'Chameleon.';
        } elseif ($n[1] === 6) {
            $out .= 'Werewolf.';
        } elseif ($n[1] === 7) {
            $out .= 'Suspect.';
        } elseif ($n[1] === 8) {
            $out .= 'Fake.';
        } elseif ($n[1] === 9) {
            $out .= 'CVE.';
        } elseif ($n[1] === 15) {
            $out .= 'HEUR.';
        }
    }
    $n = $phpMussel['split_nibble']($VN[2]);
    if ($n[0] === 1) {
        if ($n[1] === 1) {
            $out .= 'Win.';
        } elseif ($n[1] === 2) {
            $out .= 'W32.';
        } elseif ($n[1] === 3) {
            $out .= 'W64.';
        } elseif ($n[1] === 4) {
            $out .= 'ELF.';
        } elseif ($n[1] === 5) {
            $out .= 'OSX.';
        } elseif ($n[1] === 6) {
            $out .= 'Android.';
        } elseif ($n[1] === 7) {
            $out .= 'Email.';
        } elseif ($n[1] === 8) {
            $out .= 'JS.';
        } elseif ($n[1] === 9) {
            $out .= 'Java.';
        } elseif ($n[1] === 10) {
            $out .= 'XXE.';
        } elseif ($n[1] === 11) {
            $out .= 'Graphics.';
        } elseif ($n[1] === 12) {
            $out .= 'OLE.';
        } elseif ($n[1] === 13) {
            $out .= 'HTML.';
        } elseif ($n[1] === 14) {
            $out .= 'RTF.';
        } elseif ($n[1] === 15) {
            $out .= 'Archive.';
        }
    } elseif ($n[0] === 2) {
        if ($n[1] === 0) {
            $out .= 'PHP.';
        } elseif ($n[1] === 1) {
            $out .= 'XML.';
        } elseif ($n[1] === 2) {
            $out .= 'ASP.';
        } elseif ($n[1] === 3) {
            $out .= 'VBS.';
        } elseif ($n[1] === 4) {
            $out .= 'BAT.';
        } elseif ($n[1] === 5) {
            $out .= 'PDF.';
        } elseif ($n[1] === 6) {
            $out .= 'SWF.';
        } elseif ($n[1] === 7) {
            $out .= 'W97M.';
        } elseif ($n[1] === 8) {
            $out .= 'X97M.';
        } elseif ($n[1] === 9) {
            $out .= 'O97M.';
        } elseif ($n[1] === 10) {
            $out .= 'ASCII.';
        } elseif ($n[1] === 11) {
            $out .= 'Unix.';
        } elseif ($n[1] === 12) {
            $out .= 'Python.';
        } elseif ($n[1] === 13) {
            $out .= 'Perl.';
        } elseif ($n[1] === 14) {
            $out .= 'Ruby.';
        } elseif ($n[1] === 15) {
            $out .= 'INF/INI.';
        }
    } elseif ($n[0] === 3) {
        if ($n[1] === 0) {
            $out .= 'CGI.';
        }
    }
    $n = $phpMussel['split_nibble']($VN[3]);
    if ($n[0] === 1) {
        if ($n[1] === 1) {
            $out .= 'Worm.';
        } elseif ($n[1] === 2) {
            $out .= 'Trojan.';
        } elseif ($n[1] === 3) {
            $out .= 'Adware.';
            if (!$phpMussel['Config']['signatures']['detect_adware']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 4) {
            $out .= 'Flooder.';
        } elseif ($n[1] === 5) {
            $out .= 'IRCBot.';
        } elseif ($n[1] === 6) {
            $out .= 'Exploit.';
        } elseif ($n[1] === 7) {
            $out .= 'VirTool.';
        } elseif ($n[1] === 8) {
            $out .= 'Dialer.';
        } elseif ($n[1] === 9) {
            $out .= 'Joke/Hoax.';
            if (!$phpMussel['Config']['signatures']['detect_joke_hoax']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 11) {
            $out .= 'Malware.';
        } elseif ($n[1] === 12) {
            $out .= 'Riskware.';
        } elseif ($n[1] === 13) {
            $out .= 'Rootkit.';
        } elseif ($n[1] === 14) {
            $out .= 'Backdoor.';
        } elseif ($n[1] === 15) {
            $out .= 'Hacktool.';
        }
    } elseif ($n[0] === 2) {
        if ($n[1] === 0) {
            $out .= 'Keylogger.';
        } elseif ($n[1] === 1) {
            $out .= 'Ransomware.';
        } elseif ($n[1] === 2) {
            $out .= 'Spyware.';
        } elseif ($n[1] === 3) {
            $out .= 'Virus.';
        } elseif ($n[1] === 4) {
            $out .= 'Dropper.';
        } elseif ($n[1] === 5) {
            $out .= 'Dropped.';
        } elseif ($n[1] === 6) {
            $out .= 'Downloader.';
        } elseif ($n[1] === 7) {
            $out .= 'Obfuscation.';
        } elseif ($n[1] === 8) {
            $out .= 'Obfuscator.';
        } elseif ($n[1] === 9) {
            $out .= 'Obfuscated.';
        } elseif ($n[1] === 10) {
            $out .= 'Packer.';
            if (!$phpMussel['Config']['signatures']['detect_packer_packed']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 11) {
            $out .= 'Packed.';
            if (!$phpMussel['Config']['signatures']['detect_packer_packed']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 12) {
            $out .= 'PUA/PUP.';
            if (!$phpMussel['Config']['signatures']['detect_pua_pup']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 13) {
            $out .= 'Shell.';
            if (!$phpMussel['Config']['signatures']['detect_shell']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 14) {
            $out .= 'Defacer.';
            if (!$phpMussel['Config']['signatures']['detect_deface']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 15) {
            $out .= 'Defacement.';
            if (!$phpMussel['Config']['signatures']['detect_deface']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        }
    } elseif ($n[0] === 3) {
        if ($n[1] === 0) {
            $out .= 'Cryptor.';
        } elseif ($n[1] === 1) {
            $out .= 'Phish.';
        } elseif ($n[1] === 2) {
            $out .= 'Spam.';
        } elseif ($n[1] === 3) {
            $out .= 'Spammer.';
        } elseif ($n[1] === 4) {
            $out .= 'Scam.';
        } elseif ($n[1] === 5) {
            $out .= 'ZipBomb.';
        } elseif ($n[1] === 6) {
            $out .= 'ForkBomb.';
        } elseif ($n[1] === 7) {
            $out .= 'LogicBomb.';
        } elseif ($n[1] === 8) {
            $out .= 'CyberBomb.';
        } elseif ($n[1] === 9) {
            $out .= 'Malvertisement.';
        } elseif ($n[1] === 13) {
            $out .= 'Encrypted.';
            if (!$phpMussel['Config']['signatures']['detect_encryption']) {
                $phpMussel['memCache']['ignoreme'] = true;
            }
        } elseif ($n[1] === 15) {
            $out .= 'BadURL.';
        }
    }
    return $out . substr($VN, 4);
};

/**
 * Used for performing lookups to the Google Safe Browsing API (v4).
 * @link https://developers.google.com/safe-browsing/v4/lookup-api
 *
 * @param array $urls An array of the URLs to lookup.
 * @param array $URLsNoLookup An optional array of URLs to NOT lookup.
 * @param array $DomainsNoLookup An optional array of domains to NOT lookup.
 * @return int The results of the lookup. 200 if AT LEAST ONE of the queried
 *      URLs are listed on any of Google Safe Browsing lists; 204 if NONE of
 *      the queried URLs are listed on any of Google Safe Browsing lists; 400
 *      if the request is malformed; 401 if the API key is missing or isn't
 *      authorised; 503 if the service is unavailable (e.g., if it's been
 *      throttled); 999 if something unexpected occurs (such as, for example,
 *      if a programmatic error is encountered).
 */
$phpMussel['SafeBrowseLookup'] = function ($urls, $URLsNoLookup = [], $DomainsNoLookup = []) use (&$phpMussel) {
    if (empty($phpMussel['Config']['urlscanner']['google_api_key'])) {
        return 401;
    }
    /** Count and prepare the URLs. */
    if (!$c = count($urls)) {
        return 400;
    }
    for ($i = 0; $i < $c; $i++) {
        $Domain = (strpos($urls[$i], '/') !== false) ? $phpMussel['substrbf']($urls[$i], '/') : $urls[$i];
        if (!empty($URLsNoLookup[$urls[$i]]) || !empty($DomainsNoLookup[$Domain])) {
            unset($urls[$i]);
            continue;
        }
        $urls[$i] = ['url' => $urls[$i]];
    }
    sort($urls);
    /** After we've prepared the URLs, we prepare our JSON array. */
    $arr = json_encode([
        'client' => [
            'clientId' => 'phpMussel',
            'clientVersion' => $phpMussel['ScriptVersion']
        ],
        'threatInfo' => [
            'threatTypes' => [
                'THREAT_TYPE_UNSPECIFIED',
                'MALWARE',
                'SOCIAL_ENGINEERING',
                'UNWANTED_SOFTWARE',
                'POTENTIALLY_HARMFUL_APPLICATION'
            ],
            'platformTypes' => ['ANY_PLATFORM'],
            'threatEntryTypes' => ['URL'],
            'threatEntries' => $urls
        ]
    ], JSON_UNESCAPED_SLASHES | JSON_PRETTY_PRINT);

    /** Fetch the cache entry for Google Safe Browsing, if it doesn't already exist. */
    if (!isset($phpMussel['memCache']['urlscanner_google'])) {
        $phpMussel['memCache']['urlscanner_google'] = $phpMussel['FetchCache']('urlscanner_google');
    }
    /** Generate new cache expiry time. */
    $newExpiry = $phpMussel['Time'] + $phpMussel['Config']['urlscanner']['cache_time'];
    /** Generate a reference for the cache entry for this lookup. */
    $cacheRef = md5($arr) . ':' . $c . ':' . strlen($arr) . ':';
    /** This will contain the lookup response. */
    $response = '';
    /** Check if this lookup has already been performed. */
    while (substr_count($phpMussel['memCache']['urlscanner_google'], $cacheRef)) {
        $response = $phpMussel['substrbf']($phpMussel['substral']($phpMussel['memCache']['urlscanner_google'], $cacheRef), ';');
        /** Safety mechanism. */
        if (!$response || !substr_count($phpMussel['memCache']['urlscanner_google'], $cacheRef . $response . ';')) {
            $response = '';
            break;
        }
        $expiry = $phpMussel['substrbf']($response, ':');
        if ($expiry > $phpMussel['Time']) {
            $response = $phpMussel['substraf']($response, ':');
            break;
        }
        $phpMussel['memCache']['urlscanner_google'] =
            str_ireplace($cacheRef . $response . ';', '', $phpMussel['memCache']['urlscanner_google']);
        $response = '';
    }
    /** If this lookup has already been performed, return the results without repeating it. */
    if ($response) {
        /** Update the cache entry for Google Safe Browsing. */
        $newExpiry = $phpMussel['SaveCache']('urlscanner_google', $newExpiry, $phpMussel['memCache']['urlscanner_google']);
        if ($response === '200') {
            /** Potentially harmful URL detected. */
            return 200;
        } elseif ($response === '204') {
            /** Potentially harmful URL *NOT* detected. */
            return 204;
        } elseif ($response === '400') {
            /** Bad/malformed request. */
            return 400;
        } elseif ($response === '401') {
            /** Unauthorised (possibly a bad API key). */
            return 401;
        } elseif ($response === '503') {
            /** Service unavailable. */
            return 503;
        }
        /** Something bad/unexpected happened. */
        return 999;
    }

    /** Prepare the URL to use with cURL. */
    $uri =
        'https://safebrowsing.googleapis.com/v4/threatMatches:find?key=' .
        $phpMussel['Config']['urlscanner']['google_api_key'];

    /** cURL stuff here. */
    $request = curl_init($uri);
    curl_setopt($request, CURLOPT_FRESH_CONNECT, true);
    curl_setopt($request, CURLOPT_HEADER, false);
    curl_setopt($request, CURLOPT_POST, true);
    /** Ensure it knows we're sending JSON data. */
    curl_setopt($request, CURLOPT_HTTPHEADER, ['Content-type: application/json']);
    /** The Google Safe Browsing API requires HTTPS+SSL (there's no way around this). */
    curl_setopt($request, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
    curl_setopt($request, CURLOPT_RETURNTRANSFER, true);
    /*
     * Setting "CURLOPT_SSL_VERIFYPEER" to false can be somewhat risky due to man-in-the-middle attacks, but lookups
     * seemed to always fail when it was set to true during testing, so, for the sake of this actually working at all,
     * I'm setting it as false, but we should try to fix this in the future at some point.
     */
    curl_setopt($request, CURLOPT_SSL_VERIFYPEER, false);
    /* We don't want to leave the client waiting for *too* long. */
    curl_setopt($request, CURLOPT_TIMEOUT, $phpMussel['Timeout']);
    curl_setopt($request, CURLOPT_USERAGENT, $phpMussel['ScriptUA']);
    curl_setopt($request, CURLOPT_POSTFIELDS, $arr);

    /** Execute and get the response. */
    $response = curl_exec($request);
    $phpMussel['LookupCount']++;

    /** Check for errors and print to the screen if there were any. */
    if (!$response) {
        throw new \Exception(curl_error($request));
    }

    /** Close the cURL session. */
    curl_close($request);

    if (substr_count($response, '"matches":')) {
        /** Potentially harmful URL detected. */
        $returnVal = 200;
    } else {
        /** Potentially harmful URL *NOT* detected. */
        $returnVal = 204;
    }

    /** Update the cache entry for Google Safe Browsing. */
    $phpMussel['memCache']['urlscanner_google'] .= $cacheRef . ':' . $newExpiry . ':' . $returnVal . ';';
    $newExpiry = $phpMussel['SaveCache']('urlscanner_google', $newExpiry, $phpMussel['memCache']['urlscanner_google']);

    return $returnVal;
};

/**
 * Constructs a list of files contained within a PHARable file (in this
 * context, a PHARable file is defined as a file of any the following formats:
 * TAR, ZIP, PHAR) and returns that list as a string, entries delimited by a
 * linefeed (\x0A) and preceeded by an integer representing the depth of the
 * entry (in relation to where it exists within the tree of the PHARable file).
 *
 * @param string $PharFile The PHARable file to analyse.
 * @param int $PharDepth An offset for the depth of entries.
 * @return string The constructed list (as per described above).
 */
$phpMussel['BuildPharList'] = function ($PharFile, $PharDepth = 0) use (&$phpMussel) {
    $PharDepth++;
    $Out = '';
    $PharDir = scandir('phar://' . $PharFile);
    $PharCount = count($PharDir);
    for ($PharIter = 0; $PharIter < $PharCount; $PharIter++) {
        if (is_dir('phar://' . $PharFile . '/' . $PharDir[$PharIter])) {
            $PharDir[$PharIter] = $phpMussel['BuildPharList']($PharFile . '/' . $PharDir[$PharIter], $PharDepth);
        } else {
            $PharDir[$PharIter] = $PharDepth . ' ' . $PharFile . '/' . $PharDir[$PharIter];
        }
        $Out .= $PharDir[$PharIter] . "\n";
    }
    return $Out;
};

/**
 * Checks whether signature length is confined within an acceptable limit.
 *
 * @param int $Length
 * @return bool
 */
$phpMussel['ConfineLength'] = function ($Length) {
    return ($Length < 4 || $Length > 1024);
};

/**
 * Codeblock for detection triggers (appends detection information). Called
 * from within the data handler (treat as private).
 */
$phpMussel['Detected'] = function (&$heur, &$lnap, &$VN, &$ofn, &$ofnSafe, &$out, &$flagged, &$md5, &$str_len) use (&$phpMussel) {
    if (!$flagged) {
        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
        $flagged = true;
    }
    $heur['detections']++;
    $phpMussel['memCache']['detections_count']++;
    if ($phpMussel['memCache']['weighted']) {
        $heur['weight']++;
        $heur['cli'] .= $lnap . $phpMussel['ParseVars'](
            ['vn' => $VN],
            $phpMussel['lang']['detected']
        ) . $phpMussel['lang']['_exclamation_final'] . "\n";
        $heur['web'] .= $phpMussel['ParseVars'](
            ['vn' => $VN],
            $phpMussel['lang']['detected']
        ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        return;
    }
    $out .= $lnap . $phpMussel['ParseVars'](
        ['vn' => $VN],
        $phpMussel['lang']['detected']
    ) . $phpMussel['lang']['_exclamation_final'] . "\n";
    $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
        ['vn' => $VN],
        $phpMussel['lang']['detected']
    ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
};

/**
 * Confines a string boundary as per rules specified by parameters.
 *
 * @param string $Data The string.
 * @param string|int $Initial The start of the boundary or string initial offset value.
 * @param string|int $Terminal The end of the boundary or string terminal offset value.
 * @param array $SectionOffsets Section offset values.
 */
$phpMussel['DataConfineByOffsets'] = function (&$Data, &$Initial, &$Terminal, &$SectionOffsets) {
    if ($Initial === '*' && $Terminal === '*') {
        return;
    }
    if (substr($Initial, 0, 2) === 'SE') {
        $SectionNum = (int)substr($Initial, 2);
        $Initial = '*';
        $Terminal = '*';
        if (isset($SectionOffsets[$SectionNum][0])) {
            $Data = substr($Data, $SectionOffsets[$SectionNum][0] * 2);
        }
        if (isset($SectionOffsets[$SectionNum][1])) {
            $Data = substr($Data, 0, $SectionOffsets[$SectionNum][1] * 2);
        }
    } elseif (substr($Initial, 0, 2) === 'SL') {
        $Remainder = strlen($Initial) > 3 && substr($Initial, 2, 1) === '+' ? (substr($Initial, 3) ?: 0) : 0;
        $Initial = '*';
        $Final = count($SectionOffsets);
        if ($Final > 0 && isset($SectionOffsets[$Final - 1][0])) {
            $Data = substr($Data, ($SectionOffsets[$Final - 1][0] + $Remainder) * 2);
        }
        if ($Terminal !== '*' && $Terminal !== 'Z') {
            $Data = substr($Data, 0, $Terminal * 2);
            $Terminal = '*';
        }
    } elseif (substr($Initial, 0, 1) === 'S') {
        if (($PlusPos = strpos($Initial, '+')) !== false) {
            $SectionNum = substr($Initial, 1, $PlusPos - 1) ?: 0;
            $Remainder = substr($Initial, $PlusPos + 1) ?: 0;
        } else {
            $SectionNum = substr($Initial, 1) ?: 0;
            $Remainder = 0;
        }
        $Initial = '*';
        if (isset($SectionOffsets[$SectionNum][0])) {
            $Data = substr($Data, ($SectionOffsets[$SectionNum][0] + $Remainder) * 2);
        }
        if ($Terminal !== '*' && $Terminal !== 'Z') {
            $Data = substr($Data, 0, $Terminal * 2);
            $Terminal = '*';
        }
    } else {
        if ($Initial !== '*' && $Initial !== 'A') {
            $Data = substr($Data, $Initial * 2);
            $Initial = '*';
        }
        if ($Terminal !== '*' && $Terminal !== 'Z') {
            $Data = substr($Data, 0, $Terminal * 2);
            $Terminal = '*';
        }
    }
};

/**
 * Responsible for handling any data fed to it from the recursor. It shouldn't
 * be called manually nor from any other contexts. It takes the data given to
 * it from the recursor and checks that data against the various signatures of
 * phpMussel, before returning the results of those checks back to the
 * recursor.
 *
 * @param string $str Raw binary data to be checked, supplied by the parent
 *      closure (generally, the contents of files to being scanned).
 * @param int $dpt Represents the current depth of recursion from which the
 *      closure has been called, used for determining how far to indent any
 *      entries generated for logging and for the display of scan results in
 *      CLI.
 * @param string $ofn Represents the "original filename" of the file being
 *      scanned (the original filename, in this context, referring to the name
 *      of the file being scanned as per supplied by the upload client or CLI
 *      operator, as opposed to the temporary filename assigned by the server
 *      or any other filename).
 * @return array|bool Returns an array containing the results of the scan as
 *      both an integer (the first element) and as human-readable text (the
 *      second element), or returns false if any problems occur preventing the
 *      data handler from completing its normal process.
 */
$phpMussel['DataHandler'] = function ($str = '', $dpt = 0, $ofn = '') use (&$phpMussel) {
    /** If the memory cache isn't set at this point, something has gone very wrong. */
    if (!isset($phpMussel['memCache'])) {
        throw new \Exception(
            (!isset($phpMussel['lang']['required_variables_not_defined'])) ?
            '[phpMussel] Required variables aren\'t defined: Can\'t continue.' :
            '[phpMussel] ' . $phpMussel['lang']['required_variables_not_defined']
        );
    }

    /** Identifies whether the scan target has been flagged for any reason yet. */
    $flagged = false;

    /** Increment scan depth. */
    $dpt++;
    /** Controls indenting relating to scan depth for normal logging and for CLI-mode scanning. */
    $lnap = str_pad('> ', ($dpt + 1), '-', STR_PAD_LEFT);

    /** Output variable (for when the output is a string). */
    $out = '';

    /** There's no point bothering to scan zero-byte files. */
    if (!$str_len = strlen($str)) {
        return [1, ''];
    }

    $md5 = md5($str);
    $sha = sha1($str);
    $crc = hash('crc32b', $str);
    /** $fourcc: First four bytes of the scan target in hexadecimal notation. */
    $fourcc = strtolower(bin2hex(substr($str, 0, 4)));
    /** $twocc: First two bytes of the scan target in hexadecimal notation. */
    $twocc = substr($fourcc, 0, 4);
    /**
     * $CoExMeta: Contains metadata pertaining to the scan target, intended to
     * be used by the "complex extended" signatures.
     */
    $CoExMeta =
        '$ofn:' . $ofn . ';md5($ofn):' . md5($ofn) . ';$dpt:' . $dpt .
        ';$str_len:' . $str_len . ';$md5:' . $md5 . ';$sha:' . $sha .
        ';$crc:' . $crc . ';$fourcc:' . $fourcc . ';$twocc:' . $twocc . ';';

    /** Indicates whether a signature is considered a "weighted" signature. */
    $phpMussel['memCache']['weighted'] = false;

    /** Variables used for weighted signatures and for heuristic analysis. */
    $heur = ['detections' => 0, 'weight' => 0, 'cli' => '', 'web' => ''];

    /** Scan target has no name? That's a little suspicious. */
    if (!$ofn) {
        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ":\n";
        $phpMussel['memCache']['detections_count']++;
        $out .=
            $lnap . $phpMussel['lang']['scan_missing_filename'] .
            $phpMussel['lang']['_exclamation_final'] . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['scan_missing_filename'] .
            $phpMussel['lang']['_exclamation'];
        return [2, $out];
    }
    /** URL-encoded version of the scan target name. */
    $ofnSafe = urlencode($ofn);

    /** Generate cache ID. */
    $phpMussel['HashCacheData'] = $md5 . md5($ofn);

    /** Register object scanned. */
    if (isset($phpMussel['cli_args'][1]) && $phpMussel['cli_args'][1] == 'cli_scan') {
        $phpMussel['Stats-Increment']('CLI-Scanned', 1);
    } else {
        $phpMussel['Stats-Increment']($phpMussel['EOF'] ? 'API-Scanned' : 'Web-Scanned', 1);
    }

    /**
     * Check for the existence of a cache entry corresponding to the file
     * being scanned, and if it exists, use it instead of scanning the file.
     */
    if (isset($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']])) {
        if (!$phpMussel['EOF']) {
            $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
        }
        if (!empty($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']][2])) {
            $phpMussel['memCache']['detections_count']++;
            $out .= $phpMussel['HexSafe']($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']][2]);
            if (!empty($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']][3])) {
                $phpMussel['whyflagged'] .= $phpMussel['HexSafe']($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']][3]);
            }
        }

        /** Set debug values, if this has been enabled. */
        if (isset($phpMussel['DebugArr'])) {
            $phpMussel['DebugArrKey'] = count($phpMussel['DebugArr']);
            $phpMussel['DebugArr'][$phpMussel['DebugArrKey']] = [
                'Filename' => $ofn,
                'FromCache' => true,
                'Depth' => $dpt,
                'Size' => $str_len,
                'MD5' => $md5,
                'SHA1' => $sha,
                'CRC32B' => $crc,
                '2CC' => $twocc,
                '4CC' => $fourcc,
                'ScanPhase' => $phpMussel['memCache']['phase'],
                'Container' => $phpMussel['memCache']['container'],
                'Results' => !$out ? 1 : 2,
                'Output' => $out
            ];
        }

        /** Object not flagged. */
        if (!$out) {
            return [1, ''];
        }
        /** Register object flagged. */
        if (isset($phpMussel['cli_args'][1]) && $phpMussel['cli_args'][1] == 'cli_scan') {
            $phpMussel['Stats-Increment']('CLI-Flagged', 1);
        } else {
            $phpMussel['Stats-Increment']($phpMussel['EOF'] ? 'API-Flagged' : 'Web-Blocked', 1);
        }
        /** Object flagged. */
        return [2, $out];
    }

    /** Indicates whether we're in CLI-mode. */
    $climode = ($phpMussel['Mussel_sapi'] && $phpMussel['Mussel_PHP']) ? 1 : 0;

    if (
        $phpMussel['Config']['attack_specific']['scannable_threshold'] > 0 &&
        $str_len > $phpMussel['ReadBytes']($phpMussel['Config']['attack_specific']['scannable_threshold'])
    ) {
        $str_len = $phpMussel['ReadBytes']($phpMussel['Config']['attack_specific']['scannable_threshold']);
        $str = substr($str, 0, $str_len);
        $str_cut = 1;
    } else {
        $str_cut = 0;
    }

    /** Indicates whether we need to decode the contents of the scan target. */
    $decode_or_not = (
        (
            $phpMussel['Config']['attack_specific']['decode_threshold'] > 0 &&
            $str_len > $phpMussel['ReadBytes']($phpMussel['Config']['attack_specific']['decode_threshold'])
        ) ||
        $str_len < 16
    ) ? 0 : 1;
    /** Indicates whether the scan target is greater than 1KB (can sometimes save time for coex). */
    $len_kb = ($str_len > 1024) ? 1 : 0;
    /** Indicates whether the scan target is greater than half of 1MB (can sometimes save time for coex). */
    $len_hmb = ($str_len > 524288) ? 1 : 0;
    /** Indicates whether the scan target is greater than 1MB (can sometimes save time for coex). */
    $len_mb = ($str_len > 1048576) ? 1 : 0;
    /** Indicates whether the scan target is greater than half of 1GB (can sometimes save time for coex). */
    $len_hgb = ($str_len > 536870912) ? 1 : 0;
    /** Indicates which phase of the scan process we're currently at. */
    $phase = $phpMussel['memCache']['phase'];
    /** Indicates whether the scan target is a part of a container (and if so, which type of container). */
    $container = $phpMussel['memCache']['container'];
    /** Indicates whether the scan target possesses the PDF magic number. */
    $pdf_magic = ($fourcc == '25504446');

    /** Corresponds to the "detect_adware" configuration directive. */
    $detect_adware = $phpMussel['Config']['signatures']['detect_adware'] ? 1 : 0;
    /** Corresponds to the "detect_encryption" configuration directive. */
    $detect_encryption = $phpMussel['Config']['signatures']['detect_encryption'] ? 1 : 0;
    /** Corresponds to the "detect_joke_hoax" configuration directive. */
    $detect_joke_hoax = $phpMussel['Config']['signatures']['detect_joke_hoax'] ? 1 : 0;
    /** Corresponds to the "detect_pua_pup" configuration directive. */
    $detect_pua_pup = $phpMussel['Config']['signatures']['detect_pua_pup'] ? 1 : 0;
    /** Corresponds to the "detect_packer_packed" configuration directive. */
    $detect_packer_packed = $phpMussel['Config']['signatures']['detect_packer_packed'] ? 1 : 0;
    /** Corresponds to the "detect_shell" configuration directive. */
    $detect_shell = $phpMussel['Config']['signatures']['detect_shell'] ? 1 : 0;
    /** Corresponds to the "detect_deface" configuration directive. */
    $detect_deface = $phpMussel['Config']['signatures']['detect_deface'] ? 1 : 0;

    list($xt, $xts, $gzxt, $gzxts) = $phpMussel['FetchExt']($ofn);
    $CoExMeta .= '$xt:' . $xt . ';$xts:' . $xts . ';';

    /** Input ($str) as hexadecimal data. */
    $str_hex = bin2hex($str);
    $str_hex_len = $str_len * 2;

    /** Input ($str) normalised. */
    $str_norm = $phpMussel['prescan_normalise']($str, false, $decode_or_not);
    $str_norm_len = strlen($str_norm);

    /** Normalised input ($str_norm) as hexadecimal data. */
    $str_hex_norm = bin2hex($str_norm);
    $str_hex_norm_len = $str_norm_len * 2;

    /** Input ($str) normalised for HTML. */
    $str_html = $phpMussel['prescan_normalise']($str, true, $decode_or_not);
    $str_html_len = strlen($str_html);

    /** HTML normalised input ($str_html) as hexadecimal data. */
    $str_hex_html = bin2hex($str_html);
    $str_hex_html_len = $str_html_len * 2;

    /** Look for potential Linux/ELF indicators. */
    $is_elf = (
        $fourcc === '7f454c46' ||
        $xt === 'elf'
    );

    /** Look for potential graphics/image indicators. */
    $is_graphics = empty($str) ? false : $phpMussel['Indicator-Image']($xt, substr($str_hex, 0, 32));

    /** Look for potential HTML indicators. */
    $is_html = (
        substr_count(',asp*,dht*,hta,htm*,jsp*,php*,sht*,', ',' . $xts . ',') ||
        substr_count(',eml,hta,', ',' . $xt . ',') ||
        preg_match(
            '/3c(?:21646f6374797065|6120|626f6479|68656164|68746d6c|696672616d65|' .
            '696d67|6f626a656374|736372697074|7461626c65|7469746c65)/i',
            $str_hex_norm
        ) ||
        preg_match(
            '/(?:626f6479|68656164|68746d6c|736372697074|7461626c65|7469746c65)3e/i',
            $str_hex_norm
        )
    );

    /** Look for potential email indicators. */
    $is_email = (
        substr_count(',htm*,ema*,', ',' . $xts . ',') ||
        $xt === 'eml' ||
        preg_match(
            '/0a(?:436f6e74656e742d54797065|44617465|46726f6d|4d6573736167652d4944|4d' .
            '494d452d56657273696f6e|5265706c792d546f|52657475726e2d50617468|53656e646' .
            '572|5375626a656374|546f|582d4d61696c6572)3a20/i',
            $str_hex
        ) ||
        preg_match('/0a2d2d.{32}(?:2d2d)?(?:0d)?0a/i', $str_hex)
    );

    /** Look for potential Mach-O indicators. */
    $is_macho = (
        $fourcc === 'cafebabe' ||
        $fourcc === 'cafed00d' ||
        $fourcc === 'cefaedfe' ||
        $fourcc === 'cffaedfe' ||
        $fourcc === 'feedface' ||
        $fourcc === 'feedfacf'
    );

    /** Look for potential PDF indicators. */
    $is_pdf = ($pdf_magic || $xt === 'pdf');

    /** Look for potential Shockwave/SWF indicators. */
    $is_swf = (
        substr_count(',435753,465753,5a5753,', ',' . substr($str_hex, 0, 6) . ',') ||
        substr_count(',swf,swt,', ',' . $xt . ',')
    );

    /** "Infectable"? Used by ClamAV General and ClamAV ASCII signatures. */
    $infectable = true;

    /** "Asciiable"? Used by all ASCII signatures. */
    $asciiable = (bool)$str_hex_norm_len;

    /**
     * Attempt to confirm/guess whether the data being handled is from an OLE
     * file and whether we'll need to parse it through the OLE signatures.
     */
    $is_ole = (
        !empty($phpMussel['memCache']['file_is_ole']) && (
            $str_hex_len < 49152 ||
            substr_count(',ole,xml,rels,', ',' . $xt . ',')
        )
    );

    /** Worked by the switch file. */
    $fileswitch = 'unassigned';
    if (!isset($phpMussel['memCache']['switch.dat'])) {
        $phpMussel['memCache']['switch.dat'] = $phpMussel['ReadFileAsArray']($phpMussel['sigPath'] . 'switch.dat', FILE_IGNORE_NEW_LINES);
    }
    if (!$phpMussel['memCache']['switch.dat']) {
        $phpMussel['memCache']['scan_errors']++;
        if (!$phpMussel['Config']['signatures']['fail_silently']) {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ":\n";
            }
            $phpMussel['whyflagged'] .=
                $phpMussel['lang']['scan_signature_file_missing'] .
                ' (switch.dat)' . $phpMussel['lang']['_exclamation'];
            return [-3,
                $lnap . $phpMussel['lang']['scan_signature_file_missing'] .
                ' (switch.dat)' . $phpMussel['lang']['_exclamation_final'] . "\n"
            ];
        }
    }
    foreach ($phpMussel['memCache']['switch.dat'] as $ThisRule) {
        $Switch = (strpos($ThisRule, ';') === false) ? $ThisRule : $phpMussel['substral']($ThisRule, ';');
        if (strpos($Switch, '=') === false) {
            continue;
        }
        $Switch = explode('=', preg_replace('/[^\x20-\xff]/', '', $Switch));
        if (empty($Switch[0])) {
            continue;
        }
        if (empty($Switch[1])) {
            $Switch[1] = false;
        }
        $theSwitch = $Switch[0];
        $ThisRule = (strpos($ThisRule, ';') === false) ? [$ThisRule] : explode(';', $phpMussel['substrbl']($ThisRule, ';'));
        foreach ($ThisRule as $Fragment) {
            $Fragment = (strpos($Fragment, ':') === false) ? false : explode(':', $Fragment, 7);
            if (empty($Fragment[0])) {
                continue 2;
            }
            if ($Fragment[0] === 'LV') {
                if (!isset($Fragment[1]) || substr($Fragment[1], 0, 1) !== '$') {
                    continue 2;
                }
                $lv_haystack = substr($Fragment[1],1);
                if (!isset($$lv_haystack) || is_array($$lv_haystack)) {
                    continue 2;
                }
                $lv_haystack = $$lv_haystack;
                if ($climode) {
                    $lv_haystack = $phpMussel['substral']($phpMussel['substral']($lv_haystack, '/'), "\\");
                }
                $lv_needle = isset($Fragment[2]) ? $Fragment[2] : '';
                $pos_A = isset($Fragment[3]) ? $Fragment[3] : 0;
                $pos_Z = isset($Fragment[4]) ? $Fragment[4] : 0;
                $lv_min = isset($Fragment[5]) ? $Fragment[5] : 0;
                $lv_max = isset($Fragment[6]) ? $Fragment[6] : -1;
                if (!$phpMussel['lv_match']($lv_needle, $lv_haystack, $pos_A, $pos_Z, $lv_min, $lv_max)) {
                    continue 2;
                }
            } elseif (isset($Fragment[2])) {
                if (isset($Fragment[3])) {
                    if ($Fragment[2] === 'A') {
                        if (
                            !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',') || (
                                $Fragment[0] === 'FD' &&
                                !substr_count("\x01" . substr($str_hex, 0, $Fragment[3] * 2), "\x01" . $Fragment[1])
                            ) || (
                                $Fragment[0] === 'FD-RX' &&
                                !preg_match('/\A(?:' . $Fragment[1] . ')/i', substr($str_hex, 0, $Fragment[3] * 2))
                            ) || (
                                $Fragment[0] === 'FD-NORM' &&
                                !substr_count("\x01" . substr($str_hex_norm, 0, $Fragment[3] * 2), "\x01" . $Fragment[1])
                            ) || (
                                $Fragment[0] === 'FD-NORM-RX' &&
                                !preg_match('/\A(?:' . $Fragment[1] . ')/i', substr($str_hex_norm, 0, $Fragment[3] * 2))
                            )
                        ) {
                            continue 2;
                        }
                    } elseif (
                        !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',') || (
                            $Fragment[0] === 'FD' &&
                            !substr_count(substr($str_hex, $Fragment[2] * 2, $Fragment[3] * 2), $Fragment[1])
                        ) || (
                            $Fragment[0] === 'FD-RX' &&
                            !preg_match('/(?:' . $Fragment[1] . ')/i', substr($str_hex, $Fragment[2] * 2, $Fragment[3]*2))
                        ) || (
                            $Fragment[0] === 'FD-NORM' &&
                            !substr_count(substr($str_hex_norm, $Fragment[2] * 2, $Fragment[3] * 2), $Fragment[1])
                        ) || (
                            $Fragment[0] === 'FD-NORM-RX' &&
                            !preg_match('/(?:' . $Fragment[1] . ')/i', substr($str_hex_norm, $Fragment[2] * 2, $Fragment[3]*2))
                        )
                    ) {
                        continue 2;
                    }
                } else {
                    if ($Fragment[2] === 'A') {
                        if (
                            !substr_count(',FN,FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',') || (
                                $Fragment[0] === 'FN' &&
                                !preg_match('/\A(?:' . $Fragment[1] . ')/i', $ofn)
                            ) || (
                                $Fragment[0] === 'FD' &&
                                !substr_count("\x01" . $str_hex, "\x01" . $Fragment[1])
                            ) || (
                                $Fragment[0] === 'FD-RX' &&
                                !preg_match('/\A(?:' . $Fragment[1] . ')/i', $str_hex)
                            ) || (
                                $Fragment[0] === 'FD-NORM' &&
                                !substr_count("\x01" . $str_hex_norm, "\x01" . $Fragment[1])
                            ) || (
                                $Fragment[0] === 'FD-NORM-RX' &&
                                !preg_match('/\A(?:' . $Fragment[1] . ')/i', $str_hex_norm)
                            )
                        ) {
                            continue 2;
                        }
                    } elseif (
                        !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',') || (
                            $Fragment[0] === 'FD' &&
                            !substr_count(substr($str_hex, $Fragment[2] * 2), $Fragment[1])
                        ) || (
                            $Fragment[0] === 'FD-RX' &&
                            !preg_match('/(?:' . $Fragment[1] . ')/i', substr($str_hex, $Fragment[2] * 2))
                        ) || (
                            $Fragment[0] === 'FD-NORM' &&
                            !substr_count(substr($str_hex_norm, $Fragment[2] * 2), $Fragment[1])
                        ) || (
                            $Fragment[0] === 'FD-NORM-RX' &&
                            !preg_match('/(?:' . $Fragment[1] . ')/i', substr($str_hex_norm, $Fragment[2] * 2))
                        )
                    ) {
                        continue 2;
                    }
                }
            } elseif (
                ($Fragment[0] === 'FN' && !preg_match('/(?:' . $Fragment[1] . ')/i', $ofn)) ||
                ($Fragment[0] === 'FS-MIN' && $str_len < $Fragment[1]) ||
                ($Fragment[0] === 'FS-MAX' && $str_len > $Fragment[1]) ||
                ($Fragment[0] === 'FD' && !substr_count($str_hex, $Fragment[1])) ||
                ($Fragment[0] === 'FD-RX' && !preg_match('/(?:' . $Fragment[1] . ')/i', $str_hex)) ||
                ($Fragment[0] === 'FD-NORM' && !substr_count($str_hex_norm, $Fragment[1])) ||
                ($Fragment[0] === 'FD-NORM-RX' && !preg_match('/(?:' . $Fragment[1] . ')/i', $str_hex_norm))
            ) {
                continue 2;
            } elseif (substr($Fragment[0], 0, 1) === '$') {
                $vf = substr($Fragment[0], 1);
                if (!isset($$vf) || is_array($$vf) || $$vf != $Fragment[1]) {
                    continue 2;
                }
            } elseif (substr($Fragment[0], 0, 2) === '!$') {
                $vf = substr($Fragment[0], 2);
                if (!isset($$vf) || is_array($$vf) || $$vf == $Fragment[1]) {
                    continue 2;
                }
            } elseif (!substr_count(',FN,FS-MIN,FS-MAX,FD,FD-RX,FD-NORM,FD-NORM-RX,', ',' . $Fragment[0] . ',')) {
                continue 2;
            }
        }
        if (count($Switch) > 1) {
            if ($Switch[1] === 'true') {
                $$theSwitch = true;
                continue;
            }
            if ($Switch[1] === 'false') {
                $$theSwitch = false;
                continue;
            }
            $$theSwitch = $Switch[1];
        } else {
            if (!isset($$theSwitch)) {
                $$theSwitch = true;
                continue;
            }
            $$theSwitch = (!$$theSwitch);
        }
    }
    unset($theSwitch, $Switch, $ThisRule);

    /** Section offsets. */
    $SectionOffsets = [];

    /** Confirmation of whether or not the file is a valid PE file. */
    $is_pe = false;

    /** Number of PE sections in the file. */
    $NumOfSections = 0;

    $PEFileDescription =
    $PEFileVersion =
    $PEProductName =
    $PEProductVersion =
    $PECopyright =
    $PEOriginalFilename =
    $PECompanyName = '';
    if (
        !empty($phpMussel['memCache']['PE_Sectional']) ||
        !empty($phpMussel['memCache']['PE_Extended']) ||
        $phpMussel['Config']['attack_specific']['corrupted_exe']
    ) {
        $PEArr = [];
        $PEArr['SectionArr'] = [];
        if ($twocc === '4d5a') {
            $PEArr['Offset'] = $phpMussel['UnpackSafe']('S', substr($str, 60, 4));
            $PEArr['Offset'] = $PEArr['Offset'][1];
            while (true) {
                $PEArr['DoScan'] = true;
                if ($PEArr['Offset'] < 1 || $PEArr['Offset'] > 16384 || $PEArr['Offset'] > $str_len) {
                    $PEArr['DoScan'] = false;
                    break;
                }
                $PEArr['Magic'] = substr($str, $PEArr['Offset'], 2);
                if ($PEArr['Magic']!=='PE') {
                    $PEArr['DoScan'] = false;
                    break;
                }
                $PEArr['Proc'] = $phpMussel['UnpackSafe']('S', substr($str, $PEArr['Offset'] + 4, 2));
                $PEArr['Proc'] = $PEArr['Proc'][1];
                if ($PEArr['Proc'] != 0x14c && $PEArr['Proc'] != 0x8664) {
                    $PEArr['DoScan'] = false;
                    break;
                }
                $PEArr['NumOfSections'] = $phpMussel['UnpackSafe']('S', substr($str, $PEArr['Offset'] + 6, 2));
                $NumOfSections = $PEArr['NumOfSections'] = $PEArr['NumOfSections'][1];
                $CoExMeta .= 'PE_Offset:' . $PEArr['Offset'] . ';PE_Proc:' . $PEArr['Proc'] . ';NumOfSections:' . $NumOfSections . ';';
                if ($NumOfSections < 1 || $NumOfSections > 40) {
                    $PEArr['DoScan'] = false;
                }
                break;
            }
            if (!$PEArr['DoScan']) {
                if ($phpMussel['Config']['attack_specific']['corrupted_exe']) {
                    if (!$flagged) {
                        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                        $flagged = true;
                    }
                    $heur['detections']++;
                    $phpMussel['memCache']['detections_count']++;
                    $out .=
                        $lnap . $phpMussel['lang']['corrupted'] .
                        $phpMussel['lang']['_exclamation_final'] . "\n";
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang']['corrupted'] .
                        ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
                }
            } else {
                $is_pe = true;
                $asciiable = false;
                $PEArr['OptHdrSize'] = $phpMussel['UnpackSafe']('S', substr($str, $PEArr['Offset'] + 20, 2));
                $PEArr['OptHdrSize'] = $PEArr['OptHdrSize'][1];
                for ($PEArr['k'] = 0; $PEArr['k'] < $NumOfSections; $PEArr['k']++) {
                    $PEArr['SectionArr'][$PEArr['k']] = [];
                    $PEArr['SectionArr'][$PEArr['k']]['SectionHead'] =
                        substr($str, $PEArr['Offset'] + 24 + $PEArr['OptHdrSize'] + ($PEArr['k'] * 40), $NumOfSections * 40);
                    $PEArr['SectionArr'][$PEArr['k']]['SectionName'] =
                        str_ireplace("\x00", '', substr($PEArr['SectionArr'][$PEArr['k']]['SectionHead'], 0, 8));
                    $PEArr['SectionArr'][$PEArr['k']]['VirtualSize'] =
                        $phpMussel['UnpackSafe']('S', substr($PEArr['SectionArr'][$PEArr['k']]['SectionHead'], 8, 4));
                    $PEArr['SectionArr'][$PEArr['k']]['VirtualSize'] =
                        $PEArr['SectionArr'][$PEArr['k']]['VirtualSize'][1];
                    $PEArr['SectionArr'][$PEArr['k']]['VirtualAddress'] =
                        $phpMussel['UnpackSafe']('S', substr($PEArr['SectionArr'][$PEArr['k']]['SectionHead'], 12, 4));
                    $PEArr['SectionArr'][$PEArr['k']]['VirtualAddress'] =
                        $PEArr['SectionArr'][$PEArr['k']]['VirtualAddress'][1];
                    $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'] =
                        $phpMussel['UnpackSafe']('S', substr($PEArr['SectionArr'][$PEArr['k']]['SectionHead'], 16, 4));
                    $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'] =
                        $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'][1];
                    $PEArr['SectionArr'][$PEArr['k']]['PointerToRawData'] =
                        $phpMussel['UnpackSafe']('S', substr($PEArr['SectionArr'][$PEArr['k']]['SectionHead'], 20, 4));
                    $PEArr['SectionArr'][$PEArr['k']]['PointerToRawData'] =
                        $PEArr['SectionArr'][$PEArr['k']]['PointerToRawData'][1];
                    $PEArr['SectionArr'][$PEArr['k']]['SectionData'] = substr(
                        $str,
                        $PEArr['SectionArr'][$PEArr['k']]['PointerToRawData'],
                        $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData']
                    );
                    $SectionOffsets[$PEArr['k']] = [
                        $PEArr['SectionArr'][$PEArr['k']]['PointerToRawData'],
                        $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData']
                    ];
                    $PEArr['SectionArr'][$PEArr['k']]['MD5'] =
                        md5($PEArr['SectionArr'][$PEArr['k']]['SectionData']);
                    $phpMussel['PEData'] .=
                        $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'] . ':' .
                        $PEArr['SectionArr'][$PEArr['k']]['MD5'] . ':' . $ofn . '-' .
                        $PEArr['SectionArr'][$PEArr['k']]['SectionName'] . "\n";
                    $CoExMeta .=
                        'SectionName:' . $PEArr['SectionArr'][$PEArr['k']]['SectionName'] .
                        ';VirtualSize:' . $PEArr['SectionArr'][$PEArr['k']]['VirtualSize'] .
                        ';VirtualAddress:' . $PEArr['SectionArr'][$PEArr['k']]['VirtualAddress'] .
                        ';SizeOfRawData:' . $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'] .
                        ';MD5:' . $PEArr['SectionArr'][$PEArr['k']]['MD5'] . ';';
                    $PEArr['SectionArr'][$PEArr['k']] =
                        $PEArr['SectionArr'][$PEArr['k']]['SizeOfRawData'] . ':' .
                        $PEArr['SectionArr'][$PEArr['k']]['MD5'] . ':';
                }
                if (substr_count($str, "V\x00a\x00r\x00F\x00i\x00l\x00e\x00I\x00n\x00f\x00o\x00\x00\x00\x00\x00\x24")) {
                    $PEArr['FINFO'] = $phpMussel['substral']($str, "V\x00a\x00r\x00F\x00i\x00l\x00e\x00I\x00n\x00f\x00o\x00\x00\x00\x00\x00\x24");
                    if (substr_count($PEArr['FINFO'], "F\x00i\x00l\x00e\x00D\x00e\x00s\x00c\x00r\x00i\x00p\x00t\x00i\x00o\x00n\x00\x00\x00")) {
                        $PEFileDescription = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "F\x00i\x00l\x00e\x00D\x00e\x00s\x00c\x00r\x00i\x00p\x00t\x00i\x00o\x00n\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "F\x00i\x00l\x00e\x00V\x00e\x00r\x00s\x00i\x00o\x00n\x00\x00\x00")) {
                        $PEFileVersion = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "F\x00i\x00l\x00e\x00V\x00e\x00r\x00s\x00i\x00o\x00n\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "P\x00r\x00o\x00d\x00u\x00c\x00t\x00N\x00a\x00m\x00e\x00\x00\x00")) {
                        $PEProductName = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "P\x00r\x00o\x00d\x00u\x00c\x00t\x00N\x00a\x00m\x00e\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "P\x00r\x00o\x00d\x00u\x00c\x00t\x00V\x00e\x00r\x00s\x00i\x00o\x00n\x00\x00\x00")) {
                        $PEProductVersion = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "P\x00r\x00o\x00d\x00u\x00c\x00t\x00V\x00e\x00r\x00s\x00i\x00o\x00n\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "L\x00e\x00g\x00a\x00l\x00C\x00o\x00p\x00y\x00r\x00i\x00g\x00h\x00t\x00\x00\x00")) {
                        $PECopyright = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "L\x00e\x00g\x00a\x00l\x00C\x00o\x00p\x00y\x00r\x00i\x00g\x00h\x00t\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "O\x00r\x00i\x00g\x00i\x00n\x00a\x00l\x00F\x00i\x00l\x00e\x00n\x00a\x00m\x00e\x00\x00\x00")) {
                        $PEOriginalFilename = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "O\x00r\x00i\x00g\x00i\x00n\x00a\x00l\x00F\x00i\x00l\x00e\x00n\x00a\x00m\x00e\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    if (substr_count($PEArr['FINFO'], "C\x00o\x00m\x00p\x00a\x00n\x00y\x00N\x00a\x00m\x00e\x00\x00\x00")) {
                        $PECompanyName = trim(str_ireplace("\x00", '', $phpMussel['substrbf']($phpMussel['substral']($PEArr['FINFO'], "C\x00o\x00m\x00p\x00a\x00n\x00y\x00N\x00a\x00m\x00e\x00\x00\x00"), "\x00\x00\x00")));
                    }
                    $PEArr['FINFO'] = [];
                    foreach ([
                        'PEFileDescription',
                        'PEFileVersion',
                        'PEProductName',
                        'PEProductVersion',
                        'PECopyright',
                        'PEOriginalFilename',
                        'PECompanyName'
                    ] as $PEPart) {
                        if (!empty($$PEPart)) {
                            $PEArr['FINFO'][] = '$' . $PEPart . ':' . md5($$PEPart) . ':' . strlen($$PEPart) . ':';
                        }
                    }
                }
            }
        }
    }

    /** Look for potential indicators of not being HTML. */
    $is_not_html = (!$is_html && ($is_macho || $is_elf || $is_pe));

    /** Look for potential indicators of not being PHP. */
    $is_not_php = ((
        !substr_count(',phar,', ',' . $xt . ',') &&
        !substr_count(',php*,', ',' . $xts . ',') &&
        !substr_count(',phar,', ',' . $gzxt . ',') &&
        !substr_count(',php*,', ',' . $gzxts . ',') &&
        !substr_count($str_hex_norm, '3c3f706870')
    ) || $is_pe);

    /** Set debug values, if this has been enabled. */
    if (isset($phpMussel['DebugArr'])) {
        $phpMussel['DebugArrKey'] = count($phpMussel['DebugArr']);
        $phpMussel['DebugArr'][$phpMussel['DebugArrKey']] = [
            'Filename' => $ofn,
            'FromCache' => false,
            'Depth' => $dpt,
            'Size' => $str_len,
            'MD5' => $md5,
            'SHA1' => $sha,
            'CRC32B' => $crc,
            '2CC' => $twocc,
            '4CC' => $fourcc,
            'ScanPhase' => $phase,
            'Container' => $container,
            'FileSwitch' => $fileswitch,
            'Is_ELF' => $is_elf,
            'Is_Graphics' => $is_graphics,
            'Is_HTML' => $is_html,
            'Is_Email' => $is_email,
            'Is_MachO' => $is_macho,
            'Is_PDF' => $is_pdf,
            'Is_SWF' => $is_swf,
            'Is_PE' => $is_pe,
            'Is_Not_HTML' => $is_not_html,
            'Is_Not_PHP' => $is_not_php
        ];
        if ($is_pe) {
            $phpMussel['DebugArr'][$phpMussel['DebugArrKey']] += [
                'NumOfSections' => $NumOfSections,
                'PEFileDescription' => $PEFileDescription,
                'PEFileVersion' => $PEFileVersion,
                'PEProductName' => $PEProductName,
                'PEProductVersion' => $PEProductVersion,
                'PECopyright' => $PECopyright,
                'PEOriginalFilename' => $PEOriginalFilename,
                'PECompanyName' => $PECompanyName
            ];
        }
    }

    /** Plugin hook: "during_scan". */
    $phpMussel['Execute_Hook']('during_scan');

    /** Begin URL scanner. */
    if (
        isset($phpMussel['memCache']['URL_Scanner']) ||
        !empty($phpMussel['Config']['urlscanner']['lookup_hphosts']) ||
        !empty($phpMussel['Config']['urlscanner']['google_api_key'])
    ) {
        $phpMussel['LookupCount'] = 0;
        $URLScanner = [
            'FixedSource' => preg_replace('~(data|f(ile|tps?)|https?|sftp):~i', "\x01\\1:", str_replace("\\", '/', $str_norm)) . "\x01",
            'DomainsNoLookup' => [],
            'DomainsCount' => 0,
            'Domains' => [],
            'DomainPartsNoLookup' => [],
            'DomainParts' => [],
            'Queries' => [],
            'URLsNoLookup' => [],
            'URLsCount' => 0,
            'URLs' => [],
            'URLPartsNoLookup' => [],
            'URLParts' => [],
            'TLDs' => [],
            'Iterable' => 0,
            'Matches' => []
        ];
        $URLScanner['c'] = preg_match_all(
            '~(?:data|f(ile|tps?)|https?|sftp)://(?:www[0-9]{0,3}\.)?([0-9a-z.-]{1,512})[^0-9a-z.-]~i',
            $URLScanner['FixedSource'],
            $URLScanner['Matches']
        );
        for ($URLScanner['i'] = 0; $URLScanner['c'] > $URLScanner['i']; $URLScanner['i']++) {
            $URLScanner['DomainParts'][$URLScanner['Iterable']] = $URLScanner['Matches'][2][$URLScanner['i']];
            if (substr_count($URLScanner['DomainParts'][$URLScanner['Iterable']], '.')) {
                $URLScanner['TLDs'][$URLScanner['Iterable']] =
                    'TLD:' . $phpMussel['substral']($URLScanner['DomainParts'][$URLScanner['Iterable']], '.') . ':';
            }
            $URLScanner['This'] =
                md5($URLScanner['Matches'][2][$URLScanner['i']]) . ':' .
                strlen($URLScanner['Matches'][2][$URLScanner['i']]) . ':';
            $URLScanner['Domains'][$URLScanner['Iterable']] = 'DOMAIN:' . $URLScanner['This'];
            $URLScanner['DomainsNoLookup'][$URLScanner['Iterable']] = 'DOMAIN-NOLOOKUP:' . $URLScanner['This'];
            $URLScanner['Iterable']++;
        }
        $URLScanner['DomainsNoLookup'] = array_unique($URLScanner['DomainsNoLookup']);
        $URLScanner['Domains'] = array_unique($URLScanner['Domains']);
        $URLScanner['DomainParts'] = array_unique($URLScanner['DomainParts']);
        $URLScanner['TLDs'] = array_unique($URLScanner['TLDs']);
        sort($URLScanner['DomainsNoLookup']);
        sort($URLScanner['Domains']);
        sort($URLScanner['DomainParts']);
        sort($URLScanner['TLDs']);
        $URLScanner['Iterable'] = 0;
        $URLScanner['Matches'] = '';
        $URLScanner['c'] = preg_match_all(
            '~(?:data|f(ile|tps?)|https?|sftp)://(?:www[0-9]{0,3}\.)?([!#$&-;=?@-\[\]_a-z\~]{1,4096})[^!#$&-;=?@-\[\]_a-z\~]~i',
            $URLScanner['FixedSource'],
            $URLScanner['Matches']
        );
        for ($URLScanner['i'] = 0; $URLScanner['c'] > $URLScanner['i']; $URLScanner['i']++) {
            $URLScanner['This'] =
                md5($URLScanner['Matches'][2][$URLScanner['i']]) . ':' .
                strlen($URLScanner['Matches'][2][$URLScanner['i']]) . ':';
            $URLScanner['URLsNoLookup'][$URLScanner['Iterable']] = 'URL-NOLOOKUP:' . $URLScanner['This'];
            $URLScanner['URLParts'][$URLScanner['Iterable']] = $URLScanner['Matches'][2][$URLScanner['i']];
            $URLScanner['URLs'][$URLScanner['Iterable']] = 'URL:' . $URLScanner['This'];
            $URLScanner['Iterable']++;
            if (preg_match('/[^0-9a-z.-]$/i', $URLScanner['Matches'][2][$URLScanner['i']])) {
                $URLScanner['x'] =
                    preg_replace('/[^0-9a-z.-]+$/i', '', $URLScanner['Matches'][2][$URLScanner['i']]);
                $URLScanner['This'] = md5($URLScanner['x']) . ':' . strlen($URLScanner['x']) . ':';
                $URLScanner['URLsNoLookup'][$URLScanner['Iterable']] = 'URL-NOLOOKUP:' . $URLScanner['This'];
                $URLScanner['URLParts'][$URLScanner['Iterable']] = $URLScanner['x'];
                $URLScanner['URLs'][$URLScanner['Iterable']] = 'URL:' . $URLScanner['This'];
                $URLScanner['Iterable']++;
            }
            if (substr_count($URLScanner['Matches'][2][$URLScanner['i']], '?')) {
                $URLScanner['x'] = $phpMussel['substrbf']($URLScanner['Matches'][2][$URLScanner['i']], '?');
                $URLScanner['This'] = md5($URLScanner['x']) . ':' . strlen($URLScanner['x']) . ':';
                $URLScanner['URLsNoLookup'][$URLScanner['Iterable']] = 'URL-NOLOOKUP:' . $URLScanner['This'];
                $URLScanner['URLParts'][$URLScanner['Iterable']] = $URLScanner['x'];
                $URLScanner['URLs'][$URLScanner['Iterable']] = 'URL:' . $URLScanner['This'];
                $URLScanner['x'] = $phpMussel['substraf']($URLScanner['Matches'][2][$URLScanner['i']], '?');
                $URLScanner['Queries'][$URLScanner['Iterable']] =
                    'QUERY:' . md5($URLScanner['x']) . ':' .
                    strlen($URLScanner['x']) . ':';
                $URLScanner['Iterable']++;
            }
        }
        $URLScanner['Matches'] = '';
        $URLScanner['URLsNoLookup'] = array_unique($URLScanner['URLsNoLookup']);
        $URLScanner['URLs'] = array_unique($URLScanner['URLs']);
        $URLScanner['URLParts'] = array_unique($URLScanner['URLParts']);
        $URLScanner['Queries'] = array_unique($URLScanner['Queries']);
        sort($URLScanner['URLsNoLookup']);
        sort($URLScanner['URLs']);
        sort($URLScanner['URLParts']);
        sort($URLScanner['Queries']);
    }

    /** Process non-mappable signatures. */
    foreach ([
        ['General_Command_Detections', 0],
        ['Hash', 1],
        ['PE_Sectional', 2],
        ['PE_Extended', 3],
        ['URL_Scanner', 4],
        ['Complex_Extended', 5]
    ] as $ThisConf) {
        $SigFiles = isset($phpMussel['memCache'][$ThisConf[0]]) ? explode(',', $phpMussel['memCache'][$ThisConf[0]]) : [];
        foreach ($SigFiles as $SigFile) {
            if (!$SigFile) {
                continue;
            }
            if (!isset($phpMussel['memCache'][$SigFile])) {
                $phpMussel['memCache'][$SigFile] = $phpMussel['ReadFile']($phpMussel['sigPath'] . $SigFile);
            }
            if (!$phpMussel['memCache'][$SigFile]) {
                $phpMussel['memCache']['scan_errors']++;
                if (!$phpMussel['Config']['signatures']['fail_silently']) {
                    if (!$flagged) {
                        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ":\n";
                    }
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang']['scan_signature_file_missing'] .
                        ' (' . $SigFile . ')' .
                        $phpMussel['lang']['_exclamation'];
                    return [-3,
                        $lnap . $phpMussel['lang']['scan_signature_file_missing'] .
                        ' (' . $SigFile . ')' .
                        $phpMussel['lang']['_exclamation_final'] . "\n"
                    ];
                }
            } elseif ($ThisConf[1] === 0) {
                if (substr($phpMussel['memCache'][$SigFile], 0, 9) === 'phpMussel') {
                    $phpMussel['memCache'][$SigFile] = substr($phpMussel['memCache'][$SigFile], 11, -1);
                }
                $ArrayCSV = explode(',', $phpMussel['memCache'][$SigFile]);
                foreach ($ArrayCSV as $ItemCSV) {
                    if (substr_count($str_hex_norm, $ItemCSV)) {
                        if (!$flagged) {
                            $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                            $flagged = true;
                        }
                        $heur['detections']++;
                        $phpMussel['memCache']['detections_count']++;
                        $out .=
                            $lnap . $phpMussel['lang']['scan_command_injection'] .
                            $phpMussel['lang']['_exclamation_final'] . "\n";
                        $phpMussel['whyflagged'] .=
                            $phpMussel['lang']['scan_command_injection'] . ', \'' .
                            $phpMussel['HexSafe']($ItemCSV) .
                            '\' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
                    }
                }
                unset($ItemCSV, $ArrayCSV);
            } elseif ($ThisConf[1] === 1) {
                if (substr_count($phpMussel['memCache'][$SigFile], $md5 . ':' . $str_len . ':')) {
                    $xsig = $phpMussel['substraf']($phpMussel['memCache'][$SigFile], $md5 . ':' . $str_len . ':');
                    if (substr_count($xsig, "\n")) {
                        $xsig = $phpMussel['substrbf']($xsig, "\n");
                    }
                    $xsig = $phpMussel['vn_shorthand']($xsig);
                    if (
                        !substr_count($phpMussel['memCache']['greylist'], ',' . $xsig . ',') &&
                        empty($phpMussel['memCache']['ignoreme'])
                    ) {
                        $phpMussel['Detected']($heur, $lnap, $xsig, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                    }
                }
            } elseif ($ThisConf[1] === 2) {
                for ($PEArr['k'] = 0; $PEArr['k'] < $NumOfSections; $PEArr['k']++) {
                    if (substr_count($phpMussel['memCache'][$SigFile], $PEArr['SectionArr'][$PEArr['k']])) {
                        $xsig = $phpMussel['substraf']($phpMussel['memCache'][$SigFile], $PEArr['SectionArr'][$PEArr['k']]);
                        if (substr_count($xsig, "\n")) {
                            $xsig = $phpMussel['substrbf']($xsig, "\n");
                        }
                        $xsig = $phpMussel['vn_shorthand']($xsig);
                        if (
                            !substr_count($phpMussel['memCache']['greylist'], ',' . $xsig . ',') &&
                            empty($phpMussel['memCache']['ignoreme'])
                        ) {
                            $phpMussel['Detected']($heur, $lnap, $xsig, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                        }
                    }
                }
            } elseif ($ThisConf[1] === 3) {
                if (!empty($PEArr['FINFO'])) {
                    foreach ($PEArr['FINFO'] as $PEArr['ThisPart']) {
                        if (substr_count($phpMussel['memCache'][$SigFile], $PEArr['ThisPart'])) {
                            $xsig = $phpMussel['substraf']($phpMussel['memCache'][$SigFile], $PEArr['ThisPart']);
                            if (substr_count($xsig, "\n")) {
                                $xsig = $phpMussel['substrbf']($xsig, "\n");
                            }
                            $xsig = $phpMussel['vn_shorthand']($xsig);
                            if (
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $xsig . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                $phpMussel['Detected']($heur, $lnap, $xsig, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                            }
                        }
                    }
                }
            } elseif ($ThisConf[1] === 4) {
                foreach ([$URLScanner['DomainsNoLookup'], $URLScanner['URLsNoLookup']] as $URLScanner['ThisArr']) {
                    foreach ($URLScanner['ThisArr'] as $URLScanner['This']) {
                        if (substr_count($phpMussel['memCache'][$SigFile], $URLScanner['This'])) {
                            $xsig = $phpMussel['substraf']($phpMussel['memCache'][$SigFile], $URLScanner['This']);
                            if (substr_count($xsig, "\n")) {
                                $xsig = $phpMussel['substrbf']($xsig, "\n");
                            }
                            if (substr($URLScanner['This'], 0, 15) === 'DOMAIN-NOLOOKUP') {
                                $URLScanner['DomainPartsNoLookup'][$xsig] = true;
                            } else {
                                $URLScanner['URLPartsNoLookup'][$xsig] = true;
                            }
                        }
                    }
                }
                foreach ([
                    $URLScanner['TLDs'],
                    $URLScanner['Domains'],
                    $URLScanner['URLs'],
                    $URLScanner['Queries']
                ] as $URLScanner['ThisArr']) {
                    foreach ($URLScanner['ThisArr'] as $URLScanner['This']) {
                        if (substr_count($phpMussel['memCache'][$SigFile], $URLScanner['This'])) {
                            $xsig = $phpMussel['substraf']($phpMussel['memCache'][$SigFile], $URLScanner['This']);
                            if (substr_count($xsig, "\n")) {
                                $xsig = $phpMussel['substrbf']($xsig, "\n");
                            }
                            if (
                                ($xsig = $phpMussel['vn_shorthand']($xsig)) &&
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $xsig . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                $phpMussel['Detected']($heur, $lnap, $xsig, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                            }
                        }
                    }
                }
            } elseif ($ThisConf[1] === 5) {
                $coexi = 0;
                $SigName = '';
                while (true) {
                    $coexi++;
                    if (
                        $coexi === 1 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$md5:' . $md5 . ';')
                    ) {
                        $xsig = explode("\n" . '$md5:' . $md5 . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 2 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$str_len:' . $str_len . ';')
                    ) {
                        $xsig = explode("\n" . '$str_len:' . $str_len . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 3 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$fourcc:' . $fourcc . ';')
                    ) {
                        $xsig = explode("\n" . '$fourcc:' . $fourcc . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 4 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$twocc:' . $twocc . ';')
                    ) {
                        $xsig = explode("\n" . '$twocc:' . $twocc . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 5 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$phase:' . $phase . ';')
                    ) {
                        $xsig = explode("\n" . '$phase:' . $phase . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 6 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$xt:' . $xt . ';')
                    ) {
                        $xsig = explode("\n" . '$xt:' . $xt . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 7 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$sha:' . $sha . ';')
                    ) {
                        $xsig = explode("\n" . '$sha:' . $sha . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 8 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$crc:' . $crc . ';')
                    ) {
                        $xsig = explode("\n" . '$crc:' . $crc . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 9 &&
                        $is_html &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_html:1;')
                    ) {
                        $xsig = explode("\n" . '$is_html:1;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 9 &&
                        !$is_html &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_html:0;')
                    ) {
                        $xsig = explode("\n" . '$is_html:0;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 10 &&
                        $is_graphics &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_graphics:1;')
                    ) {
                        $xsig = explode("\n" . '$is_graphics:1;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 10 &&
                        !$is_graphics &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_graphics:0;')
                    ) {
                        $xsig = explode("\n" . '$is_graphics:0;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 11 &&
                        $is_pe &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_pe:1;')
                    ) {
                        $xsig = explode("\n" . '$is_pe:1;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 11 &&
                        !$is_pe &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_pe:0;')
                    ) {
                        $xsig = explode("\n" . '$is_pe:0;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 12 &&
                        $is_macho &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_macho:1;')
                    ) {
                        $xsig = explode("\n" . '$is_macho:1;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 12 &&
                        !$is_macho &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$is_macho:0;')
                    ) {
                        $xsig = explode("\n" . '$is_macho:0;', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 13 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$xts:' . $xts . ';')
                    ) {
                        $xsig = explode("\n" . '$xts:' . $xts . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 14 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$NumOfSections:' . $NumOfSections . ';')
                    ) {
                        $xsig = explode("\n" . '$NumOfSections:' . $NumOfSections . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif (
                        $coexi === 15 &&
                        substr_count($phpMussel['memCache'][$SigFile], "\n" . '$container:' . $container . ';')
                    ) {
                        $xsig = explode("\n" . '$container:' . $container . ';', $phpMussel['memCache'][$SigFile]);
                    } elseif ($coexi > 15) {
                        break;
                    } else {
                        $xsig = [];
                    }
                    $xc = count($xsig);
                    if (isset($xsig[0])) {
                        $xsig[0] = '';
                    }
                    if ($xc > 0) {
                        for ($xi = 1; $xi < $xc; $xi++) {
                            if (substr_count($xsig[$xi], "\n")) {
                                $xsig[$xi] = $phpMussel['substrbf']($xsig[$xi], "\n");
                            }
                            if (substr_count($xsig[$xi], ';')) {
                                if (!substr_count($xsig[$xi], ':')) {
                                    continue;
                                }
                                $SigName = $phpMussel['vn_shorthand']($phpMussel['substral']($xsig[$xi], ';'));
                                $xsig[$xi] = explode(';', $phpMussel['substrbl']($xsig[$xi], ';'));
                                $sxc = count($xsig[$xi]);
                            } else {
                                $SigName = $phpMussel['vn_shorthand']($xsig[$xi]);
                                $xsig[$xi] = '';
                                $sxc = 0;
                            }
                            if ($sxc > 0) {
                                for ($sxi = 0; $sxi < $sxc; $sxi++) {
                                    $xsig[$xi][$sxi] = explode(':', $xsig[$xi][$sxi], 7);
                                    if ($xsig[$xi][$sxi][0] === 'LV') {
                                        if (!isset($xsig[$xi][$sxi][1]) || substr($xsig[$xi][$sxi][1], 0, 1) !== '$') {
                                            continue 2;
                                        }
                                        $lv_haystack = substr($xsig[$xi][$sxi][1], 1);
                                        if (!isset($$lv_haystack) || is_array($$lv_haystack)) {
                                            continue 2;
                                        }
                                        $lv_haystack = $$lv_haystack;
                                        if ($climode) {
                                            $lv_haystack = $phpMussel['substral']($phpMussel['substral']($lv_haystack, '/'), "\\");
                                        }
                                        $lv_needle = (isset($xsig[$xi][$sxi][2])) ? $xsig[$xi][$sxi][2] : '';
                                        $pos_A = (isset($xsig[$xi][$sxi][3])) ? $xsig[$xi][$sxi][3] : 0;
                                        $pos_Z = (isset($xsig[$xi][$sxi][4])) ? $xsig[$xi][$sxi][4] : 0;
                                        $lv_min = (isset($xsig[$xi][$sxi][5])) ? $xsig[$xi][$sxi][5] : 0;
                                        $lv_max = (isset($xsig[$xi][$sxi][6])) ? $xsig[$xi][$sxi][6] : -1;
                                        if (!$phpMussel['lv_match']($lv_needle, $lv_haystack, $pos_A, $pos_Z, $lv_min, $lv_max)) {
                                            continue 2;
                                        }
                                    } elseif (isset($xsig[$xi][$sxi][2])) {
                                        if (isset($xsig[$xi][$sxi][3])) {
                                            if ($xsig[$xi][$sxi][2] == 'A') {
                                                if (
                                                    !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,META,', ',' . $xsig[$xi][$sxi][0] . ',') || (
                                                        $xsig[$xi][$sxi][0] == 'FD' &&
                                                        !substr_count("\x01" . substr($str_hex, 0, $xsig[$xi][$sxi][3] * 2), "\x01" . $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-RX' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex, 0, $xsig[$xi][$sxi][3] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM' &&
                                                        !substr_count("\x01" . substr($str_hex_norm, 0, $xsig[$xi][$sxi][3] * 2), "\x01" . $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM-RX' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex_norm, 0, $xsig[$xi][$sxi][3] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'META' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($CoExMeta, 0, $xsig[$xi][$sxi][3] * 2))
                                                    )
                                                ) {
                                                    continue 2;
                                                }
                                            } else {
                                                if (
                                                    !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,META,', ',' . $xsig[$xi][$sxi][0] . ',') || (
                                                        $xsig[$xi][$sxi][0] == 'FD' &&
                                                        !substr_count(substr($str_hex, $xsig[$xi][$sxi][2] * 2, $xsig[$xi][$sxi][3] * 2), $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-RX' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex, $xsig[$xi][$sxi][2] * 2, $xsig[$xi][$sxi][3] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM' &&
                                                        !substr_count(substr($str_hex_norm, $xsig[$xi][$sxi][2] * 2, $xsig[$xi][$sxi][3] * 2), $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM-RX' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex_norm, $xsig[$xi][$sxi][2] * 2, $xsig[$xi][$sxi][3] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'META' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($CoExMeta, $xsig[$xi][$sxi][2] * 2, $xsig[$xi][$sxi][3] * 2))
                                                    )
                                                ) {
                                                    continue 2;
                                                }
                                            }
                                        } else {
                                            if ($xsig[$xi][$sxi][2] == 'A') {
                                                if (
                                                    !substr_count(',FN,FD,FD-RX,FD-NORM,FD-NORM-RX,META,', ',' . $xsig[$xi][$sxi][0] . ',') || (
                                                        $xsig[$xi][$sxi][0] == 'FN' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', $ofn)
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD' &&
                                                        !substr_count("\x01" . $str_hex, "\x01" . $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-RX' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', $str_hex)
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM' &&
                                                        !substr_count("\x01" . $str_hex_norm, "\x01" . $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM-RX' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', $str_hex_norm)
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'META' &&
                                                        !preg_match('/\A(?:' . $xsig[$xi][$sxi][1] . ')/i', $CoExMeta)
                                                    )
                                                ) {
                                                    continue 2;
                                                }
                                            } else {
                                                if (
                                                    !substr_count(',FD,FD-RX,FD-NORM,FD-NORM-RX,META,', ',' . $xsig[$xi][$sxi][0] . ',') || (
                                                        $xsig[$xi][$sxi][0] == 'FD' &&
                                                        !substr_count(substr($str_hex, $xsig[$xi][$sxi][2] * 2), $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-RX' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex, $xsig[$xi][$sxi][2] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM' &&
                                                        !substr_count(substr($str_hex_norm, $xsig[$xi][$sxi][2] * 2), $xsig[$xi][$sxi][1])
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'FD-NORM-RX' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($str_hex_norm, $xsig[$xi][$sxi][2] * 2))
                                                    ) || (
                                                        $xsig[$xi][$sxi][0] == 'META' &&
                                                        !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', substr($CoExMeta, $xsig[$xi][$sxi][2] * 2))
                                                    )
                                                ) {
                                                    continue 2;
                                                }
                                            }
                                        }
                                    } else {
                                        if (
                                            (
                                                $xsig[$xi][$sxi][0] == 'FN' &&
                                                !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', $ofn)
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FS-MIN' &&
                                                $str_len < $xsig[$xi][$sxi][1]
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FS-MAX' &&
                                                $str_len > $xsig[$xi][$sxi][1]
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FD' &&
                                                !substr_count($str_hex, $xsig[$xi][$sxi][1])
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FD-RX' &&
                                                !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', $str_hex)
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FD-NORM' &&
                                                !substr_count($str_hex_norm, $xsig[$xi][$sxi][1])
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'FD-NORM-RX' &&
                                                !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', $str_hex_norm)
                                            ) || (
                                                $xsig[$xi][$sxi][0] == 'META' &&
                                                !preg_match('/(?:' . $xsig[$xi][$sxi][1] . ')/i', $CoExMeta)
                                            )
                                        ) {
                                            continue 2;
                                        }
                                        if (substr($xsig[$xi][$sxi][0], 0, 1) == '$') {
                                            $vf = substr($xsig[$xi][$sxi][0], 1);
                                            if (!isset($$vf) || is_array($$vf) || $$vf != $xsig[$xi][$sxi][1]) {
                                                continue 2;
                                            }
                                        } elseif (substr($xsig[$xi][$sxi][0], 0, 2) == '!$') {
                                            $vf = substr($xsig[$xi][$sxi][0], 2);
                                            if (!isset($$vf) || is_array($$vf) || $$vf == $xsig[$xi][$sxi][1]) {
                                                continue 2;
                                            }
                                        } elseif (!substr_count(',FN,FS-MIN,FS-MAX,FD,FD-RX,FD-NORM,FD-NORM-RX,META,', ',' . $xsig[$xi][$sxi][0] . ',')) {
                                            continue 2;
                                        }
                                    }
                                }
                            }
                            if (
                                $SigName &&
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $SigName . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                $phpMussel['Detected']($heur, $lnap, $SigName, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                            }
                            $xsig[$xi] = '';
                        }
                    }
                }
                $sxi = $sxc = $SigName = $xi = $xc = $xsig = $coexi = '';
            }
        }
    }

    /** Process mappable signatures. */
    foreach ([
        ['Filename', 'str_hex', 'str_hex_len', 2],
        ['Standard', 'str_hex', 'str_hex_len', 0],
        ['Normalised', 'str_hex_norm', 'str_hex_norm_len', 0],
        ['HTML', 'str_hex_html', 'str_hex_html_len', 0],
        ['Standard_RegEx', 'str_hex', 'str_hex_len', 1],
        ['Normalised_RegEx', 'str_hex_norm', 'str_hex_norm_len', 1],
        ['HTML_RegEx', 'str_hex_html', 'str_hex_html_len', 1]
    ] as $ThisConf) {
        $DataSource = $ThisConf[1];
        $DataSourceLen = $ThisConf[2];
        $SigFiles = isset($phpMussel['memCache'][$ThisConf[0]]) ? explode(',', $phpMussel['memCache'][$ThisConf[0]]) : [];
        foreach ($SigFiles as $SigFile) {
            if (!$SigFile) {
                continue;
            }
            if (!isset($phpMussel['memCache'][$SigFile])) {
                $phpMussel['memCache'][$SigFile] = $phpMussel['ReadFileAsArray']($phpMussel['sigPath'] . $SigFile, FILE_IGNORE_NEW_LINES);
            }
            if (!$phpMussel['memCache'][$SigFile]) {
                $phpMussel['memCache']['scan_errors']++;
                if (!$phpMussel['Config']['signatures']['fail_silently']) {
                    if (!$flagged) {
                        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ":\n";
                    }
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang']['scan_signature_file_missing'] .
                        ' (' . $SigFile . ')' . $phpMussel['lang']['_exclamation'];
                    return [-3,
                        $lnap . $phpMussel['lang']['scan_signature_file_missing'] .
                        ' (' . $SigFile . ')' . $phpMussel['lang']['_exclamation_final'] . "\n"
                    ];
                }
            } else {
                $NumSigs = count($phpMussel['memCache'][$SigFile]);
                for ($SigNum = 0; $SigNum < $NumSigs; $SigNum++) {
                    if (!$ThisSig = $phpMussel['memCache'][$SigFile][$SigNum]) {
                        continue;
                    }
                    if (substr($ThisSig, 0, 1) == '>') {
                        $ThisSig = explode('>', $ThisSig, 4);
                        if (!isset($ThisSig[1]) || !isset($ThisSig[2]) || !isset($ThisSig[3])) {
                            break;
                        }
                        $ThisSig[3] = (int)$ThisSig[3];
                        if ($ThisSig[1] == 'FN') {
                            if (!preg_match('/(?:' . $ThisSig[2] . ')/i', $ofn)) {
                                if ($ThisSig[3] <= $SigNum) {
                                    break;
                                }
                                $SigNum = $ThisSig[3] - 1;
                            }
                        } elseif ($ThisSig[1] == 'FS-MIN') {
                            if ($str_len < $ThisSig[2]) {
                                if ($ThisSig[3] <= $SigNum) {
                                    break;
                                }
                                $SigNum = $ThisSig[3] - 1;
                            }
                        } elseif ($ThisSig[1] == 'FS-MAX') {
                            if ($str_len > $ThisSig[2]) {
                                if ($ThisSig[3] <= $SigNum) {
                                    break;
                                }
                                $SigNum = $ThisSig[3] - 1;
                            }
                        } elseif ($ThisSig[1] == 'FD') {
                            if (!substr_count($$DataSource, $ThisSig[2])) {
                                if ($ThisSig[3] <= $SigNum) {
                                    break;
                                }
                                $SigNum = $ThisSig[3] - 1;
                            }
                        } elseif ($ThisSig[1] == 'FD-RX') {
                            if (!preg_match('/(?:' . $ThisSig[2] . ')/i', $$DataSource)) {
                                if ($ThisSig[3] <= $SigNum) {
                                    break;
                                }
                                $SigNum = $ThisSig[3] - 1;
                            }
                        } elseif (substr($ThisSig[1], 0, 1) == '$') {
                            $vf = substr($ThisSig[1], 1);
                            if (isset($$vf) && !is_array($$vf)) {
                                if ($$vf != $ThisSig[2]) {
                                    if ($ThisSig[3] <= $SigNum) {
                                        break;
                                    }
                                    $SigNum = $ThisSig[3] - 1;
                                }
                                continue;
                            }
                            if ($ThisSig[3] <= $SigNum) {
                                break;
                            }
                            $SigNum = $ThisSig[3] - 1;
                        } elseif (substr($ThisSig[1], 0, 2) == '!$') {
                            $vf = substr($ThisSig[1], 2);
                            if (isset($$vf) && !is_array($$vf)) {
                                if ($$vf == $ThisSig[2]) {
                                    if ($ThisSig[3] <= $SigNum) {
                                        break;
                                    }
                                    $SigNum = $ThisSig[3] - 1;
                                }
                                continue;
                            }
                            if ($ThisSig[3] <= $SigNum) {
                                break;
                            }
                            $SigNum = $ThisSig[3] - 1;
                        } else {
                            break;
                        }
                        continue;
                    }
                    if (strpos($ThisSig, ':') !== false) {
                        $VN = explode(':', $ThisSig);
                        if ($ThisConf[3] === 0) {
                            $ThisSig = preg_split('/[^a-fA-F0-9>]+/i', $VN[1], -1, PREG_SPLIT_NO_EMPTY);
                            $ThisSig = ($ThisSig === false ? '' : implode('', $ThisSig));
                            $ThisSigLen = strlen($ThisSig);
                            if ($phpMussel['ConfineLength']($ThisSigLen)) {
                                continue;
                            }
                            $xstrf = isset($VN[2]) ? $VN[2] : '*';
                            $xstrt = isset($VN[3]) ? $VN[3] : '*';
                            $VN = $phpMussel['vn_shorthand']($VN[0]);
                            $VNLC = strtolower($VN);
                            if (
                                ($is_not_php && (
                                    substr_count($VNLC, '-php') ||
                                    substr_count($VNLC, '.php')
                                )) ||
                                ($is_not_html && (
                                    substr_count($VNLC, '-htm') ||
                                    substr_count($VNLC, '.htm')
                                )) ||
                                $$DataSourceLen < $ThisSigLen
                            ) {
                                continue;
                            }
                            if (
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $VN . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                $ThisSig = strpos($ThisSig, '>') !== false ? explode('>', $ThisSig) : [$ThisSig];
                                $ThisSigCount = count($ThisSig);
                                $ThisString = $$DataSource;
                                $phpMussel['DataConfineByOffsets']($ThisString, $xstrf, $xstrt, $SectionOffsets);
                                if ($xstrf === 'A') {
                                    $ThisString = "\x01" . $ThisString;
                                    $ThisSig[0] = "\x01" . $ThisSig[0];
                                }
                                if ($xstrt === 'Z') {
                                    $ThisString .= "\x01";
                                    $ThisSig[$ThisSigCount - 1] .= "\x01";
                                }
                                for ($ThisSigi = 0; $ThisSigi < $ThisSigCount; $ThisSigi++) {
                                    if (strpos($ThisString, $ThisSig[$ThisSigi]) === false) {
                                        continue 2;
                                    }
                                    if ($ThisSigCount > 1 && strpos($ThisString, $ThisSig[$ThisSigi]) !== false) {
                                        $ThisString = $phpMussel['substraf']($ThisString, $ThisSig[$ThisSigi]);
                                    }
                                }
                                $phpMussel['Detected']($heur, $lnap, $VN, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                            }
                        } elseif ($ThisConf[3] === 1) {
                            $ThisSig = preg_split('/[\x00-\x1f]+/', $VN[1], -1, PREG_SPLIT_NO_EMPTY);
                            $ThisSig = ($ThisSig === false) ? '' : implode('', $ThisSig);
                            $ThisSigLen = strlen($ThisSig);
                            if ($phpMussel['ConfineLength']($ThisSigLen)) {
                                continue;
                            }
                            $xstrf = isset($VN[2]) ? $VN[2] : '*';
                            $xstrt = isset($VN[3]) ? $VN[3] : '*';
                            $VN = $phpMussel['vn_shorthand']($VN[0]);
                            $VNLC = strtolower($VN);
                            if (
                                ($is_not_php && (
                                    substr_count($VNLC, '-php') ||
                                    substr_count($VNLC, '.php')
                                )) ||
                                ($is_not_html && (
                                    substr_count($VNLC, '-htm') ||
                                    substr_count($VNLC, '.htm')
                                ))
                            ) {
                                continue;
                            }
                            if (
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $VN . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                $ThisString = $$DataSource;
                                $phpMussel['DataConfineByOffsets']($ThisString, $xstrf, $xstrt, $SectionOffsets);
                                if ($xstrf === 'A') {
                                    if ($xstrt === 'Z') {
                                        if (!preg_match('/\A(?:' . $ThisSig . ')$/i', $ThisString)) {
                                            continue;
                                        }
                                    } elseif (!preg_match('/\A(?:' . $ThisSig . ')/i', $ThisString)) {
                                        continue;
                                    }
                                } else {
                                    if ($xstrt === 'Z') {
                                        if (!preg_match('/(?:' . $ThisSig . ')$/i', $ThisString)) {
                                            continue;
                                        }
                                    } elseif (!preg_match('/(?:' . $ThisSig . ')/i', $ThisString)) {
                                        continue;
                                    }
                                }
                                $phpMussel['Detected']($heur, $lnap, $VN, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                            }
                        } elseif ($ThisConf[3] === 2) {
                            $ThisSig = preg_split('/[\x00-\x1f]+/', $VN[1], -1, PREG_SPLIT_NO_EMPTY);
                            $ThisSig = ($ThisSig === false) ? '' : implode('', $ThisSig);
                            $VN = $phpMussel['vn_shorthand']($VN[0]);
                            if (
                                $ThisSig &&
                                !substr_count($phpMussel['memCache']['greylist'], ',' . $VN . ',') &&
                                empty($phpMussel['memCache']['ignoreme'])
                            ) {
                                if (preg_match('/(?:' . $ThisSig . ')/i', $ofn)) {
                                    $phpMussel['Detected']($heur, $lnap, $VN, $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                                }
                            }
                        }
                    }
                }
            }
        }
    }

    /** Perform API lookups for domains. */
    if (isset($URLScanner) && !$out) {

        $URLScanner['DomainsCount'] = count($URLScanner['DomainParts']);

        /** Codeblock for performing hpHosts API lookups. */
        if ($phpMussel['Config']['urlscanner']['lookup_hphosts'] && $URLScanner['DomainsCount']) {
            /** Fetch the cache entry for hpHosts, if it doesn't already exist. */
            if (!isset($phpMussel['memCache']['urlscanner_domains'])) {
                $phpMussel['memCache']['urlscanner_domains'] = $phpMussel['FetchCache']('urlscanner_domains');
            }
            $URLScanner['y'] = $phpMussel['Time'] + $phpMussel['Config']['urlscanner']['cache_time'];
            $URLScanner['ScriptIdentEncoded'] = urlencode($phpMussel['ScriptIdent']);
            $URLScanner['classes'] = [
                'EMD' => "\x1a\x82\x10\x1bXXX",
                'EXP' => "\x1a\x82\x10\x16XXX",
                'GRM' => "\x1a\x82\x10\x32XXX",
                'HFS' => "\x1a\x82\x10\x32XXX",
                'PHA' => "\x1a\x82\x10\x32XXX",
                'PSH' => "\x1a\x82\x10\x31XXX"
            ];
            for ($i = 0; $i < $URLScanner['DomainsCount']; $i++) {
                if (!empty($URLScanner['DomainPartsNoLookup'][$URLScanner['DomainParts'][$i]])) {
                    continue;
                }
                if (
                    $phpMussel['Config']['urlscanner']['maximum_api_lookups'] > 0 &&
                    $phpMussel['LookupCount'] > $phpMussel['Config']['urlscanner']['maximum_api_lookups']
                ) {
                    if ($phpMussel['Config']['urlscanner']['maximum_api_lookups_response']) {
                        if (!$flagged) {
                            $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                            $flagged = true;
                        }
                        $out .=
                            $lnap . $phpMussel['lang']['too_many_urls'] .
                            $phpMussel['lang']['_exclamation_final'] . "\n";
                        $phpMussel['whyflagged'] .=
                            $phpMussel['lang']['too_many_urls'] .
                            ' (' . $ofnSafe . ')' .
                            $phpMussel['lang']['_exclamation'];
                    }
                    break;
                }
                $URLScanner['This'] = md5($URLScanner['DomainParts'][$i]) . ':' . strlen($URLScanner['DomainParts'][$i]) . ':';
                while (substr_count($phpMussel['memCache']['urlscanner_domains'], $URLScanner['This'])) {
                    $URLScanner['Class'] =
                        $phpMussel['substrbf']($phpMussel['substral']($phpMussel['memCache']['urlscanner_domains'], $URLScanner['This']), ';');
                    if (!substr_count($phpMussel['memCache']['urlscanner_domains'], $URLScanner['This'] . ':' . $URLScanner['Class'] . ';')) {
                        break;
                    }
                    $URLScanner['Expiry'] = (int)$phpMussel['substrbf']($URLScanner['Class'], ':');
                    if ($URLScanner['Expiry'] > $phpMussel['Time']) {
                        $URLScanner['Class'] = $phpMussel['substraf']($URLScanner['Class'], ':');
                        if (!$URLScanner['Class']) {
                            continue 2;
                        }
                        $URLScanner['Class'] = $phpMussel['vn_shorthand']($URLScanner['Class']);
                        $phpMussel['Detected']($heur, $lnap, $URLScanner['Class'], $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                    }
                    $phpMussel['memCache']['urlscanner_domains'] =
                        str_ireplace($URLScanner['This'] . $URLScanner['Class'] . ';', '', $phpMussel['memCache']['urlscanner_domains']);
                }
                $URLScanner['req'] =
                    'v=' . $URLScanner['ScriptIdentEncoded'] .
                    '&s=' . $URLScanner['DomainParts'][$i] .
                    '&class=true';
                $URLScanner['req_result'] = $phpMussel['Request'](
                    'http://verify.hosts-file.net/?' . $URLScanner['req'],
                    ['v' => $URLScanner['ScriptIdentEncoded'], 's' => $URLScanner['DomainParts'][$i], 'Class' => true],
                    12
                );
                $phpMussel['LookupCount']++;
                if (substr($URLScanner['req_result'], 0, 6) == "Listed") {
                    $URLScanner['Class'] = substr($URLScanner['req_result'], 7, 3);
                    $URLScanner['Class'] = isset($URLScanner['classes'][$URLScanner['Class']]) ?
                        $URLScanner['classes'][$URLScanner['Class']] : "\x1a\x82\x10\x3fXXX";
                    $phpMussel['memCache']['urlscanner_domains'] .=
                        $URLScanner['This'] .
                        $URLScanner['y'] . ':' .
                        $URLScanner['Class'] . ';';
                    $URLScanner['Class'] = $phpMussel['vn_shorthand']($URLScanner['Class']);
                    $phpMussel['Detected']($heur, $lnap, $URLScanner['Class'], $ofn, $ofnSafe, $out, $flagged, $md5, $str_len);
                }
                $phpMussel['memCache']['urlscanner_domains'] .= $URLScanner['Domains'][$i] . $URLScanner['y'] . ':;';
            }
            $phpMussel['SaveCache']('urlscanner_domains', $URLScanner['y'], $phpMussel['memCache']['urlscanner_domains']);
        }

        $URLScanner['URLsCount'] = count($URLScanner['URLParts']);

        /** Codeblock for performing Google Safe Browsing API lookups. */
        if ($phpMussel['Config']['urlscanner']['google_api_key'] && $URLScanner['URLsCount']) {
            $URLScanner['URLsChunked'] = (
                $URLScanner['URLsCount'] > 500
            ) ? array_chunk($URLScanner['URLParts'], 500) : [$URLScanner['URLParts']];
            $URLScanner['URLChunks'] = count($URLScanner['URLsChunked']);
            for ($i = 0; $i < $URLScanner['URLChunks']; $i++) {
                if (
                    $phpMussel['Config']['urlscanner']['maximum_api_lookups'] > 0 &&
                    $phpMussel['LookupCount'] > $phpMussel['Config']['urlscanner']['maximum_api_lookups']
                ) {
                    if ($phpMussel['Config']['urlscanner']['maximum_api_lookups_response']) {
                        if (!$flagged) {
                            $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                            $flagged = true;
                        }
                        $out .=
                            $lnap . $phpMussel['lang']['too_many_urls'] .
                            $phpMussel['lang']['_exclamation_final'] . "\n";
                        $phpMussel['whyflagged'] .=
                            $phpMussel['lang']['too_many_urls'] .
                            ' (' . $ofnSafe . ')' .
                            $phpMussel['lang']['_exclamation'];
                    }
                    break;
                }
                try {
                    $URLScanner['SafeBrowseLookup'] = $phpMussel['SafeBrowseLookup'](
                        $URLScanner['URLsChunked'][$i],
                        $URLScanner['URLPartsNoLookup'],
                        $URLScanner['DomainPartsNoLookup']
                    );
                } catch (\Exception $e) {
                    throw new \Exception($e->getMessage());
                }
                if ($URLScanner['SafeBrowseLookup'] !== 204) {
                    if (!$flagged) {
                        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                        $flagged = true;
                    }
                    $URLScanner['langRef'] = 'SafeBrowseLookup_' . $URLScanner['SafeBrowseLookup'];
                    if (empty($phpMussel['lang'][$URLScanner['langRef']])) {
                        $URLScanner['langRef'] = 'SafeBrowseLookup_999';
                    }
                    $out .=
                        $lnap . $phpMussel['lang'][$URLScanner['langRef']] .
                        $phpMussel['lang']['_exclamation_final'] . "\n";
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang'][$URLScanner['langRef']] . ' (' . $ofnSafe . ')' .
                        $phpMussel['lang']['_exclamation'];
                }
            }
        }

    }

    /** URL scanner data cleanup. */
    unset($URLScanner);

    /** PHP chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_from_php']) {
        if (
            !(
                substr_count(',cvd,inc,md,phar,pzp,tpl,txt,tzt,', ',' . $xt . ',') ||
                substr_count(',php*,', ',' . $xts . ',') ||
                substr_count(',cvd,inc,md,phar,pzp,tpl,txt,tzt,', ',' . $gzxt . ',') ||
                substr_count(',php*,', ',' . $gzxts . ',') ||
                substr_count(',' . $phpMussel['Config']['attack_specific']['archive_file_extensions'] . ',', ',' . $xts . ',') ||
                substr_count(',' . $phpMussel['Config']['attack_specific']['archive_file_extensions'] . ',', ',' . $gzxts . ',') ||
                substr_count(',' . $phpMussel['Config']['attack_specific']['archive_file_extensions'] . ',', ',' . $xt . ',') ||
                substr_count(',' . $phpMussel['Config']['attack_specific']['archive_file_extensions'] . ',', ',' . $gzxt . ',')
            ) &&
            substr_count($str_hex_norm,'3c3f706870')
        ) {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            $out .= $lnap . $phpMussel['ParseVars'](
                ['x' => 'PHP'],
                $phpMussel['lang']['scan_chameleon']
            ) . $phpMussel['lang']['_exclamation_final'] . "\n";
            $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                ['x' => 'PHP'],
                $phpMussel['lang']['scan_chameleon']
            ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        }
    }

    /** Executable chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_from_exe']) {
        if (substr_count(',acm,ax,com,cpl,dll,drv,exe,ocx,rs,scr,sys,', ',' . $xt . ',')) {
            if ($twocc !== '4d5a') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'EXE'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'EXE'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        } elseif ($twocc === '4d5a') {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            $out .= $lnap . $phpMussel['ParseVars'](
                ['x' => 'EXE'],
                $phpMussel['lang']['scan_chameleon']
            ) . $phpMussel['lang']['_exclamation_final'] . "\n";
            $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                ['x' => 'EXE'],
                $phpMussel['lang']['scan_chameleon']
            ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        }
        if ($xt === 'elf') {
            if ($fourcc !== '7f454c46') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'ELF'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'ELF'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        } elseif ($fourcc === '7f454c46') {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            $out .= $lnap . $phpMussel['ParseVars'](
                ['x' => 'ELF'],
                $phpMussel['lang']['scan_chameleon']
            ) . $phpMussel['lang']['_exclamation_final'] . "\n";
            $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                ['x' => 'ELF'],
                $phpMussel['lang']['scan_chameleon']
            ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        }
        if ($xt === 'lnk') {
            if (substr($str_hex, 0, 16) !== '4c00000001140200') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'LNK'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'LNK'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        } elseif (substr($str_hex, 0, 16) === '4c00000001140200') {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            $out .= $lnap . $phpMussel['ParseVars'](
                ['x' => 'LNK'],
                $phpMussel['lang']['scan_chameleon']
            ) . $phpMussel['lang']['_exclamation_final'] . "\n";
            $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                ['x' => 'LNK'],
                $phpMussel['lang']['scan_chameleon']
            ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        }
        if ($xt === 'msi') {
            if (substr($str_hex, 0, 16) !== 'd0cf11e0a1b11ae1') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'MSI'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'MSI'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
    }

    /** Archive chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_to_archive']) {
        if ($xts === 'zip*') {
            if ($twocc !== '504b') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'ZIP'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'ZIP'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'rar') {
            if ($fourcc !== '52617221' && $fourcc !== '52457e5e') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'RAR'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'RAR'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'gz') {
            if ($twocc !== '1f8b') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'GZIP'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'GZIP'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'bz2') {
            if (substr($str_hex,0,6) !== '425a68') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'BZIP2'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'BZIP2'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
    }

    /** Office document chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_to_doc']) {
        if (substr_count(',doc,dot,pps,ppt,xla,xls,wiz,', ',' . $xt . ',')) {
            if ($fourcc !== 'd0cf11e0') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => 'Office'],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => 'Office'],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
    }

    /** Image chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_to_img']) {
        if ($xt === 'bmp' || $xt === 'dib') {
            if ($twocc !== '424d') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'gif') {
            if (substr($str_hex, 0, 12) !== '474946383761' && substr($str_hex, 0, 12) !== '474946383961') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if (
            $xt === 'jfi' ||
            $xt === 'jfif' ||
            $xt === 'jif' ||
            $xt === 'jpe' ||
            $xt === 'jpeg' ||
            $xt === 'jpg'
        ) {
            if (substr($str_hex,0,6) !== 'ffd8ff') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'jp2') {
            if (substr($str_hex, 0, 16) !== '0000000c6a502020') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'pdd' || $xt === 'psd') {
            if ($fourcc !== '38425053') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'png') {
            if ($fourcc !== '89504e47') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'webp') {
            if ($fourcc !== '52494646' || substr($str, 8, 4) !== 'WEBP') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
        if ($xt === 'xcf') {
            if (substr($str,0,8) !== 'gimp xcf') {
                if (!$flagged) {
                    $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                    $flagged = true;
                }
                $heur['detections']++;
                $phpMussel['memCache']['detections_count']++;
                $out .= $lnap . $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                    ['x' => $phpMussel['lang']['image']],
                    $phpMussel['lang']['scan_chameleon']
                ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            }
        }
    }

    /** PDF chameleon attack detection. */
    if ($phpMussel['Config']['attack_specific']['chameleon_to_pdf']) {
        if ($xt === 'pdf' && !$pdf_magic) {
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            $out .= $lnap . $phpMussel['ParseVars'](
                ['x' => 'PDF'],
                $phpMussel['lang']['scan_chameleon']
            ) . $phpMussel['lang']['_exclamation_final'] . "\n";
            $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                ['x' => 'PDF'],
                $phpMussel['lang']['scan_chameleon']
            ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        }
    }

    /** Control character detection. */
    if ($phpMussel['Config']['attack_specific']['block_control_characters']) {
        if (preg_match('/[\x00-\x08\x0b\x0c\x0e\x1f\x7f]/i', $str)) {
            $out .=
                $lnap .
                $phpMussel['lang']['detected_control_characters'] .
                $phpMussel['lang']['_exclamation_final'] . "\n";
            $heur['detections']++;
            $phpMussel['memCache']['detections_count']++;
            if (!$flagged) {
                $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                $flagged = true;
            }
            $phpMussel['whyflagged'] .=
                $phpMussel['lang']['detected_control_characters'] .
                ' (' . $ofnSafe . ')' .
                $phpMussel['lang']['_exclamation'];
        }
    }

    /**
     * If the heuristic weight of the current scan iteration exceeds the
     * heuristic threshold defined by the configuration, or if outs has already
     * been filled, dump all heuristic detections and non-heuristic detections
     * together into outs and regard the iteration as flagged.
     */
    if (
        $heur['weight'] >= $phpMussel['Config']['heuristic']['threshold'] ||
        $out
    ) {
        $out .= $heur['cli'];
        $phpMussel['whyflagged'] .= $heur['web'];
    }

    /** Virus Total API integration. */
    if (
        !$out &&
        !empty($phpMussel['Config']['virustotal']['vt_public_api_key'])
    ) {
        $DoScan = false;
        $phpMussel['Config']['virustotal']['vt_suspicion_level'] =
            (int)$phpMussel['Config']['virustotal']['vt_suspicion_level'];
        if ($phpMussel['Config']['virustotal']['vt_suspicion_level'] === 0) {
            $DoScan = ($heur['weight'] > 0);
        } elseif ($phpMussel['Config']['virustotal']['vt_suspicion_level'] === 1) {
            $DoScan = (
                $heur['weight'] > 0 ||
                $is_pe ||
                $fileswitch === 'chrome' ||
                $fileswitch === 'java' ||
                $fileswitch === 'docfile' ||
                $fileswitch === 'vt_interest'
            );
        } elseif ($phpMussel['Config']['virustotal']['vt_suspicion_level'] === 2) {
            $DoScan = true;
        }
        if ($DoScan) {
            $VTWeight = ['weight' => 0, 'cli' => '', 'web' => ''];
            if (!isset($phpMussel['memCache']['vt_quota'])) {
                $phpMussel['memCache']['vt_quota'] = $phpMussel['FetchCache']('vt_quota');
            }
            $x = 0;
            if (!empty($phpMussel['memCache']['vt_quota'])) {
                $phpMussel['memCache']['vt_quota'] = explode(';', $phpMussel['memCache']['vt_quota']);
                foreach ($phpMussel['memCache']['vt_quota'] as &$phpMussel['ThisQuota']) {
                    if ($phpMussel['ThisQuota'] > $phpMussel['Time']) {
                        $x++;
                    } else {
                        $phpMussel['ThisQuota'] = '';
                    }
                }
                unset($phpMussel['ThisQuota']);
                $phpMussel['memCache']['vt_quota'] =
                    implode(';', $phpMussel['memCache']['vt_quota']);
            }
            if ($x < $phpMussel['Config']['virustotal']['vt_quota_rate']) {
                $VTParams = [
                    'apikey' => $phpMussel['Config']['virustotal']['vt_public_api_key'],
                    'resource' => $md5
                ];
                $VTRequest = $phpMussel['Request'](
                    'http://www.virustotal.com/vtapi/v2/file/report?apikey=' .
                    urlencode($phpMussel['Config']['virustotal']['vt_public_api_key']) .
                    '&resource=' . $md5,
                $VTParams, 12);
                $VTJSON = json_decode($VTRequest, true);
                $y = $phpMussel['Time'] + ($phpMussel['Config']['virustotal']['vt_quota_time'] * 60);
                $phpMussel['memCache']['vt_quota'] .= $y . ';';
                while (substr_count($phpMussel['memCache']['vt_quota'], ';;')) {
                    $phpMussel['memCache']['vt_quota'] = str_ireplace(';;', ';', $phpMussel['memCache']['vt_quota']);
                }
                $phpMussel['SaveCache']('vt_quota', $y + 60, $phpMussel['memCache']['vt_quota']);
                if (isset($VTJSON['response_code'])) {
                    $VTJSON['response_code'] = (int)$VTJSON['response_code'];
                    if (
                        isset($VTJSON['scans']) &&
                        $VTJSON['response_code'] === 1 &&
                        is_array($VTJSON['scans'])
                    ) {
                        foreach ($VTJSON['scans'] as $VTKey => $VTValue) {
                            if ($VTValue['detected'] && $VTValue['result']) {
                                $VN = $VTKey . '(VirusTotal)-' . $VTValue['result'];
                                if (
                                    !substr_count($phpMussel['memCache']['greylist'], ',' . $VN . ',') &&
                                    empty($phpMussel['memCache']['ignoreme'])
                                ) {
                                    if (!$flagged) {
                                        $phpMussel['killdata'] .= $md5 . ':' . $str_len . ':' . $ofn . "\n";
                                        $flagged = true;
                                    }
                                    $heur['detections']++;
                                    $phpMussel['memCache']['detections_count']++;
                                    if ($phpMussel['Config']['virustotal']['vt_weighting'] > 0) {
                                        $VTWeight['weight']++;
                                        $VTWeight['web'] .= $lnap . $phpMussel['ParseVars'](
                                            ['vn' => $VN],
                                            $phpMussel['lang']['detected']
                                        ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                                        $VTWeight['cli'] .= $phpMussel['ParseVars'](
                                            ['vn' => $VN],
                                            $phpMussel['lang']['detected']
                                        ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
                                    } else {
                                        $out .= $lnap . $phpMussel['ParseVars'](
                                            ['vn' => $VN],
                                            $phpMussel['lang']['detected']
                                        ) . $phpMussel['lang']['_exclamation_final'] . "\n";
                                        $phpMussel['whyflagged'] .= $phpMussel['ParseVars'](
                                            ['vn' => $VN],
                                            $phpMussel['lang']['detected']
                                        ) . ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
                                    }
                                }
                            }
                        }
                    }
                }
                if (
                    $VTWeight['weight'] > 0 &&
                    $VTWeight['weight'] >= $phpMussel['Config']['virustotal']['vt_weighting']
                ) {
                    $out .= $VTWeight['web'];
                    $phpMussel['whyflagged'] .= $VTWeight['cli'];
                }
            }
        }
    }

    /** Plugin hook: "after_vt". */
    $phpMussel['Execute_Hook']('after_vt');

    if (
        isset($phpMussel['HashCacheData']) &&
        !isset($phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']]) &&
        $phpMussel['Config']['general']['scan_cache_expiry'] > 0
    ) {
        if (empty($phpMussel['HashCache']['Data']) || !is_array($phpMussel['HashCache']['Data'])) {
            $phpMussel['HashCache']['Data'] = [];
        }
        $phpMussel['HashCache']['Data'][$phpMussel['HashCacheData']] = [
            $phpMussel['HashCacheData'],
            $phpMussel['Time'] + $phpMussel['Config']['general']['scan_cache_expiry'],
            (empty($out) ? '' : bin2hex($out)),
            (empty($phpMussel['whyflagged']) ? '' : bin2hex($phpMussel['whyflagged']))
        ];
    }

    /** Set final debug values, if this has been enabled. */
    if (isset($phpMussel['DebugArr']) && isset($phpMussel['DebugArrKey'])) {
        $phpMussel['DebugArr'][$phpMussel['DebugArrKey']]['Results'] = !$out ? 1 : 2;
        $phpMussel['DebugArr'][$phpMussel['DebugArrKey']]['Output'] = $out;
    }

    if ($out) {
        /** Register object flagged. */
        if (isset($phpMussel['cli_args'][1]) && $phpMussel['cli_args'][1] == 'cli_scan') {
            $phpMussel['Stats-Increment']('CLI-Flagged', 1);
        } else {
            $phpMussel['Stats-Increment']($phpMussel['EOF'] ? 'API-Flagged' : 'Web-Blocked', 1);
        }
    }

    /** Exit data handler. */
    return !$out ? [1, ''] : [2, $out];
};

/**
 * Handles scanning for files contained within archives.
 *
 * @param string $ItemRef A reference to the path and original filename of the
 *      item being scanned in relation to its container and/or its heirarchy
 *      within the scan process.
 * @param string $Filename The original filename of the item being scanned.
 * @param string $Data The data to be scanned.
 * @param int $Depth The depth of the item being scanned in relation to its
 *      container and/or its heirarchy within the scan process.
 * @param string $lnap Line padding for the scan results.
 * @param int $r Scan results inherited from parent in the form of an integer.
 * @param string $x Scan results inherited from parent in the form of a string.
 * @return array Returns an array containing the results of the scan as both an
 *      integer (the first element) and as human-readable text (the second
 *      element).
 */
$phpMussel['MetaDataScan'] = function ($ItemRef, $Filename, $Data, $Depth, $lnap, $r, $x) use (&$phpMussel) {
    if (!$Filesize = strlen($Data)) {
        return [$r, $x];
    }
    $ItemRefSafe = urlencode($ItemRef);
    $MD5 = md5($Data);
    if (
        $phpMussel['Config']['files']['filesize_archives'] &&
        $phpMussel['Config']['files']['filesize_limit'] > 0 &&
        $Filesize > $phpMussel['ReadBytes']($phpMussel['Config']['files']['filesize_limit'])
    ) {
        if (!$phpMussel['Config']['files']['filesize_response']) {
            $x .=
                $lnap . $phpMussel['lang']['ok'] . ' (' .
                $phpMussel['lang']['filesize_limit_exceeded'] . ").\n";
            return [$r, $x];
        }
        $r = 2;
        $phpMussel['killdata'] .= $MD5 . ':' . $Filesize . ':' . $ItemRef . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['filesize_limit_exceeded'] .
            ' (' . $ItemRefSafe . ')' .
            $phpMussel['lang']['_exclamation'];
        $x .=
            $lnap . $phpMussel['lang']['filesize_limit_exceeded'] .
            $phpMussel['lang']['_fullstop_final'] . "\n";
        return [$r, $x];
    }
    if (
        substr($Filename, 0, 1) === '.' ||
        substr($Filename, -1) === '.'
    ) {
        $r = 2;
        $phpMussel['killdata'] .= $MD5 . ':' . $Filesize . ':' . $ItemRef . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['scan_filename_manipulation_detected'] .
            ' (' . $ItemRefSafe . ')' .
            $phpMussel['lang']['_exclamation'];
        $x .=
            $lnap . $phpMussel['lang']['scan_filename_manipulation_detected'] .
            $phpMussel['lang']['_exclamation_final'] . "\n";
        return [$r, $x];
    }
    if ($phpMussel['Config']['files']['filetype_archives']) {
        $decPos = strrpos($Filename, '.');
        $ofnLen = strlen($Filename);
        if ($decPos === false || $decPos === ($ofnLen - 1)) {
            $xts = $xt = '-';
        } else {
            $xt = strtolower(substr($Filename, ($decPos + 1)));
            $xts = substr($xt, 0, 3) . '*';
        }
        if (
            substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $xt . ',') ||
            substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $xts . ',')
        ) {
            $x .= $lnap . $phpMussel['lang']['scan_no_problems_found'] . "\n";
            return [$r, $x];
        }
        if (
            substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $xt . ',') ||
            substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $xts . ',')
        ) {
            $r = 2;
            $phpMussel['killdata'] .= $MD5 . ':' . $Filesize . ':' . $ItemRef . "\n";
            $phpMussel['whyflagged'] .=
                $phpMussel['lang']['filetype_blacklisted'] .
                ' (' . $ItemRefSafe . ')' .
                $phpMussel['lang']['_exclamation'];
            $x .=
                $lnap . $phpMussel['lang']['filetype_blacklisted'] .
                $phpMussel['lang']['_fullstop_final'] . "\n";
            return [$r, $x];
        }
        if (
            $phpMussel['Config']['files']['filetype_greylist'] &&
            !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $xt . ',') &&
            !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $xts . ',')
        ) {
            $r = 2;
            $phpMussel['killdata'] .= $MD5 . ':' . $Filesize . ':' . $ItemRef . "\n";
            $phpMussel['whyflagged'] .=
                $phpMussel['lang']['filetype_blacklisted'] .
                ' (' . $ItemRefSafe . ')' .
                $phpMussel['lang']['_exclamation'];
            $x .=
                $lnap . $phpMussel['lang']['filetype_blacklisted'] .
                $phpMussel['lang']['_fullstop_final'] . "\n";
            return [$r, $x];
        }
    }
    $phpMussel['memCache']['objects_scanned']++;
    try {
        $Scan = $phpMussel['DataHandler']($Data, $Depth, $Filename);
    } catch (\Exception $e) {
        throw new \Exception($e->getMessage());
    }
    if ($Scan[0] !== 1) {
        return [$Scan[0], $x . $Scan[1]];
    }
    return [$r, $x];
};

/**
 * Looks for indicators of image files (i.e., attempts to determine whether a
 * file is an image file).
 *
 * @param string $Ext The file extension.
 * @param string $Head The file header.
 * @return bool True: Indicators found. False: Indicators not found.
 */
$phpMussel['Indicator-Image'] = function ($Ext, $Head) {
    return (
        preg_match(
            '/^(?:bm[2p]|c(d5|gm)|d(ib|w[fg]|xf)|ecw|fits|gif|img|j(f?if?|p[2s]|pe?g?2?|xr)|p(bm|cx|dd|gm|ic|n[gms]|' .
            'pm|s[dp])|s(id|v[ag])|tga|w(bmp?|ebp|mp)|x(cf|bmp))$/'
        , $Ext) ||
        preg_match(
            '/^(?:0000000c6a502020|25504446|38425053|424d|474946383[79]61|57454250|67696d7020786366|89504e47|ffd8ff)/'
        , $Head)
    );
};

/**
 * Fetches extensions data from filenames.
 *
 * @param string $ofn The original filename.
 * @return array The extensions data.
 */
$phpMussel['FetchExt'] = function ($ofn) {
    $decPos = strrpos($ofn, '.');
    $ofnLen = strlen($ofn);
    if ($decPos === false || $decPos === ($ofnLen - 1)) {
        return ['-', '-', '-', '-'];
    }
    $xt = strtolower(substr($ofn, ($decPos + 1)));
    $xts = substr($xt, 0, 3) . '*';
    if (strtolower(substr($ofn, -3)) === '.gz') {
        $ofnNoGZ = substr($ofn, 0, ($ofnLen - 3));
        $decPosNoGZ = strrpos($ofnNoGZ, '.');
        if ($decPosNoGZ !== false && $decPosNoGZ !== (strlen($ofnNoGZ) - 1)) {
            $gzxt = strtolower(substr($ofnNoGZ, ($decPosNoGZ + 1)));
            $gzxts = substr($gzxt, 0, 3) . '*';
        }
    } else {
        $gzxts = $gzxt = '-';
    }
    return [$xt, $xts, $gzxt, $gzxts];
};

/**
 * Responsible for recursing through any files given to it to be scanned, which
 * may be necessary for the case of archives and directories. It performs the
 * preparations necessary for scanning files using the "data handler" and the
 * "meta data scan" closures. Additionally, it performs some necessary
 * whitelist, blacklist and greylist checks, filesize and file extension
 * checks, and handles the processing and extraction of files from archives,
 * fetching the files contained in archives being scanned in order to process
 * those contained files as so that they, too, may be scanned.
 *
 * When phpMussel is instructed to scan a directory or an array of multiple
 * files, the recursor is the closure function responsible for iterating
 * through that directory and/or array queued for scanning, and if necessary,
 * will recurse itself (such as for when scanning a directory containing
 * sub-directories or when scanning a multidimensional array of multiple files
 * and/or directories).
 *
 * @param string|array $f In the context of the initial file upload scanning
 *      that phpMussel performs when operating via a server, this parameter (a
 *      string) represents the "temporary filename" of the file being scanned
 *      (the temporary filename, in this context, referring to the name
 *      temporarily assigned to the file by the server upon the file being
 *      uploaded to the temporary uploads location assigned to the server).
 *      When operating in the context of CLI mode, both $f and $ofn represent
 *      the scan target, as per specified by the CLI operator; The only
 *      difference between the two is when the scan target is a directory,
 *      rather than a single file; $f will represent the full path to the file
 *      (so, directory plus filename), whereas $ofn will represent only the
 *      filename. This parameter can also accept an array of filenames.
 * @param bool $n This optional parameter is a boolean (defaults to false, but
 *      set to true during the initial scan of file uploads), indicating the
 *      format for returning the scan results. False instructs the function to
 *      return results as an integer; True instructs the function to return
 *      results as human readable text (refer to Section 3A of the README
 *      documentation, "HOW TO USE (FOR WEB SERVERS)", for more information).
 * @param bool $zz This optional parameter is a boolean (defaults to false, but
 *      set to true during the initial scan of file uploads), indicating to the
 *      function whether or not arrayed results should be imploded prior to
 *      being returned to the calling function. False instructs the function to
 *      return the arrayed results as verbatim; True instructs the function to
 *      return the arrayed results as an imploded string.
 * @param int $dpt Represents the current depth of recursion from which the
 *      function has been called. This information is used for determining how
 *      far to indent any entries generated for logging and for the display of
 *      scan results in CLI.
 * @param string $ofn In the context of the initial file upload scanning that
 *      phpMussel performs when operating via a server, this parameter (a
 *      string) represents the "temporary filename" of the file being scanned
 *      (the temporary filename, in this context, referring to the name
 *      temporarily assigned to the file by the server upon the file being
 *      uploaded to the temporary uploads location assigned to the server).
 *      When operating in the context of CLI mode, both $f and $ofn represent
 *      the scan target, as per specified by the CLI operator; The only
 *      difference between the two is when the scan target is a directory,
 *      rather than a single file; $f will represent the full path to the file
 *      (so, directory plus filename), whereas $ofn will represent only the
 *      filename.
 * @return int|string|array The scan results, returned as an array when the $f
 *      parameter is an array and when $n and/or $zz is/are false, and
 *      otherwise returned as per described by the README documentation. The
 *      function may also die the script and return nothing, if something goes
 *      wrong, such as if the function is triggered in the absense of the
 *      required $phpMussel['memCache'] variable being set.
 */
$phpMussel['Recursor'] = function ($f = '', $n = false, $zz = false, $dpt = 0, $ofn = '') use (&$phpMussel) {
    if (!isset($phpMussel['memCache'])) {
        throw new \Exception(
            (!isset($phpMussel['lang']['required_variables_not_defined'])) ?
            '[phpMussel] Required variables aren\'t defined: Can\'t continue.' :
            '[phpMussel] ' . $phpMussel['lang']['required_variables_not_defined']
        );
    }

    /** Prepare signature files for the scan process. */
    if (empty($phpMussel['memCache']['OrganisedSigFiles'])) {
        $phpMussel['OrganiseSigFiles']();
        $phpMussel['memCache']['OrganisedSigFiles'] = true;
    }

    if ($phpMussel['EOF']) {
        $phpMussel['whyflagged'] = $phpMussel['killdata'] = $phpMussel['PEData'] = '';
        if (
            $dpt === 0 ||
            !isset($phpMussel['memCache']['objects_scanned']) ||
            !isset($phpMussel['memCache']['detections_count']) ||
            !isset($phpMussel['memCache']['scan_errors'])
        ) {
            $phpMussel['memCache']['objects_scanned'] =
            $phpMussel['memCache']['detections_count'] =
            $phpMussel['memCache']['scan_errors'] = 0;
        }
    } else {
        if (!isset($phpMussel['killdata'])) {
            $phpMussel['killdata'] = '';
        }
        if (!isset($phpMussel['whyflagged'])) {
            $phpMussel['whyflagged'] = '';
        }
        if (!isset($phpMussel['PEData'])) {
            $phpMussel['PEData'] = '';
        }
        if (
            !isset($phpMussel['memCache']['objects_scanned']) ||
            !isset($phpMussel['memCache']['detections_count']) ||
            !isset($phpMussel['memCache']['scan_errors'])
        ) {
            $phpMussel['memCache']['objects_scanned'] =
            $phpMussel['memCache']['detections_count'] =
            $phpMussel['memCache']['scan_errors'] = 0;
        }
    }

    /** Increment scan depth. */
    $dpt++;
    /** Controls indenting relating to scan depth for normal logging and for CLI-mode scanning. */
    $lnap = str_pad('> ', ($dpt + 1), '-', STR_PAD_LEFT);

    /**
     * If the scan target is an array, iterate through the array and recurse
     * the recursor with each array element.
     */
    if (is_array($f)) {
        foreach ($f as &$Current) {
            try {
                $Current = $phpMussel['Recursor']($Current, $n, false, $dpt, $Current);
            } catch (\Exception $e) {
                throw new \Exception($e->getMessage());
            }
        }
        return ($n && $zz) ? $phpMussel['implode_md']($f) : $f;
    }

    $ofn = $phpMussel['prescan_decode']($ofn);
    $ofnSafe = urlencode($ofn);

    /**
     * If the scan target is a directory, iterate through the directory
     * contents and recurse the recursor with these contents.
     */
    if (is_dir($f)) {
        if (!is_readable($f)) {
            $phpMussel['memCache']['scan_errors']++;
            return !$n ? 0 :
                $lnap . $phpMussel['lang']['failed_to_access'] . '\'' . $ofn . '\'' .
                $phpMussel['lang']['_exclamation_final'] . "\n";
        }
        $Dir = $phpMussel['DirectoryRecursiveList']($f);
        foreach ($Dir as &$Sub) {
            try {
                $Sub = $phpMussel['Recursor']($f . '/' . $Sub, $n, false, $dpt, $Sub);
            } catch (\Exception $e) {
                throw new \Exception($e->getMessage());
            }
        }
        return ($n && $zz) ? $phpMussel['implode_md']($Dir) : $Dir;
    }

    /** Increment our scanned files/objects tally. */
    $phpMussel['memCache']['objects_scanned']++;
    /** Define file phase. */
    $phpMussel['memCache']['phase'] = 'file';
    /**
     * Indicates whether the file/object being scanned is a part of a
     * container (e.g., an OLE object, ZIP file, TAR, PHAR, etc).
     */
    $phpMussel['memCache']['container'] = 'none';
    /** Indicates whether the file/object being scanned is an OLE object. */
    $phpMussel['memCache']['file_is_ole'] = false;

    /** Fetch the greylist if it hasn't already been fetched. */
    if (!isset($phpMussel['memCache']['greylist'])) {
        if (!file_exists($phpMussel['Vault'] . 'greylist.csv')) {
            $phpMussel['memCache']['greylist'] = ',';
            $Handle = fopen($phpMussel['Vault'] . 'greylist.csv', 'a');
            fwrite($Handle, ',');
            fclose($Handle);
        } else {
            $phpMussel['memCache']['greylist'] = $phpMussel['ReadFile']($phpMussel['Vault'] . 'greylist.csv');
        }
    }

    /** Plugin hook: "before_scan". */
    $phpMussel['Execute_Hook']('before_scan');

    $fnCRC = hash('crc32b', $ofn);

    /** Kill it here if the scan target isn't a valid file. */
    if (!$f || !$d = is_file($f)) {
        return (!$n) ? 0 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' . $ofn .
            '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
            $phpMussel['lang']['invalid_file'] .
            $phpMussel['lang']['_exclamation_final'] . "\n";
    }

    $fS = filesize($f);
    if ($phpMussel['Config']['files']['filesize_limit'] > 0) {
        if ($fS > $phpMussel['ReadBytes']($phpMussel['Config']['files']['filesize_limit'])) {
            if (!$phpMussel['Config']['files']['filesize_response']) {
                return (!$n) ? 1 :
                    $lnap . $phpMussel['lang']['scan_checking'] . ' \'' .
                    $ofn . '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
                    $phpMussel['lang']['ok'] . ' (' .
                    $phpMussel['lang']['filesize_limit_exceeded'] . ").\n";
            }
            $phpMussel['killdata'] .=
                '--FILESIZE-LIMIT--------NO-HASH-:' . $fS . ':' . $ofn . "\n";
            $phpMussel['whyflagged'] .=
                $phpMussel['lang']['filesize_limit_exceeded'] .
                ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
            if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
                unlink($f);
            }
            return (!$n) ? 2 :
                $lnap . $phpMussel['lang']['scan_checking'] . ' \'' . $ofn .
                '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
                $phpMussel['lang']['filesize_limit_exceeded'] .
                $phpMussel['lang']['_fullstop_final'] . "\n";
        }
    }
    if (substr($ofn, 0, 1) === '.' || substr($ofn, -1) === '.') {
        $phpMussel['killdata'] .=
            '--FILENAME-MANIPULATION-NO-HASH-:' . $fS . ':' . $ofn . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['scan_filename_manipulation_detected'] .
            ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
            unlink($f);
        }
        return (!$n) ? 2 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' . $ofn .
            '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
            $phpMussel['lang']['scan_filename_manipulation_detected'] .
            $phpMussel['lang']['_exclamation_final'] . "\n";
    }
    list($xt, $xts, $gzxt, $gzxts) = $phpMussel['FetchExt']($ofn);
    if (
        substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $xt . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $xts . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $gzxt . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_whitelist'] . ',', ',' . $gzxts . ',')
    ) {
        return (!$n) ? 1 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' . $ofn .
            '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
            $phpMussel['lang']['scan_no_problems_found'] . "\n";
    }
    if (
        substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $xt . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $xts . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $gzxt . ',') ||
        substr_count(',' . $phpMussel['Config']['files']['filetype_blacklist'] . ',', ',' . $gzxts . ',')
    ) {
        $phpMussel['killdata'] .=
            '--FILETYPE-BLACKLISTED--NO-HASH-:' . $fS . ':' . $ofn . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['filetype_blacklisted'] .
            ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
            unlink($f);
        }
        return (!$n) ? 2 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' .
            $ofn . '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
            $phpMussel['lang']['filetype_blacklisted'] .
            $phpMussel['lang']['_fullstop_final'] . "\n";
    }
    if (
        $phpMussel['Config']['files']['filetype_greylist'] &&
        !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $xt . ',') &&
        !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $xts . ',') &&
        !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $gzxt . ',') &&
        !substr_count(',' . $phpMussel['Config']['files']['filetype_greylist'] . ',', ',' . $gzxts . ',')
    ) {
        $phpMussel['killdata'] .=
            '----FILETYPE--NOT-GREYLISTED----:' . $fS . ':' . $ofn . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['filetype_blacklisted'] .
            ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
            unlink($f);
        }
        return (!$n) ? 2 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' .
            $ofn . '\' (FN: ' . $fnCRC . "):\n-" . $lnap .
            $phpMussel['lang']['filetype_blacklisted'] .
            $phpMussel['lang']['_fullstop_final'] . "\n";
    }
    $in = $phpMussel['ReadFile']($f, (
        $phpMussel['Config']['attack_specific']['scannable_threshold'] > 0 &&
        $fS > $phpMussel['ReadBytes']($phpMussel['Config']['attack_specific']['scannable_threshold'])
    ) ? $phpMussel['ReadBytes']($phpMussel['Config']['attack_specific']['scannable_threshold']) : $fS, true);
    $fdCRC = hash('crc32b', $in);

    /** Check for non-image items. */
    if (!empty($in) && $phpMussel['Config']['compatibility']['only_allow_images'] && !$phpMussel['Indicator-Image']($xt, bin2hex(substr($in, 0, 16)))) {
        $phpMussel['killdata'] .= md5($in) . ':' . $fS . ':' . $ofn . "\n";
        $phpMussel['whyflagged'] .=
            $phpMussel['lang']['only_allow_images'] .
            ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
        if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
            unlink($f);
        }
        return (!$n) ? 2 :
            $lnap . $phpMussel['lang']['scan_checking'] . ' \'' .
            $ofn . '\' (FN: ' . $fnCRC . '; FD: ' . $fdCRC . "):\n-" .
            $lnap . $phpMussel['lang']['only_allow_images'] .
            $phpMussel['lang']['_fullstop_final'] . "\n";
    }

    /** Send the file/object being scanned to the data handler. */
    try {
        $z = $phpMussel['DataHandler']($in, $dpt, $ofn);
    } catch (\Exception $e) {
        throw new \Exception($e->getMessage());
    }

    /** Executed if there were any problems or anything detected: */
    if ($z[0] !== 1) {
        if ($z[0] === 2) {
            if (
                $phpMussel['Config']['general']['quarantine_key'] &&
                !$phpMussel['Config']['general']['honeypot_mode'] &&
                strlen($in) < $phpMussel['ReadBytes']($phpMussel['Config']['general']['quarantine_max_filesize'])
            ) {
                $qfu =
                    $phpMussel['Time'] .
                    '-' .
                    md5($phpMussel['Config']['general']['quarantine_key'] . $fdCRC . $phpMussel['Time']);
                $phpMussel['Quarantine'](
                    $in,
                    $phpMussel['Config']['general']['quarantine_key'],
                    $_SERVER[$phpMussel['Config']['general']['ipaddr']],
                    $qfu
                );
                $phpMussel['killdata'] .= $phpMussel['ParseVars'](
                    ['QFU' => $qfu],
                    $phpMussel['lang']['quarantined_as']
                );
            }
        }
        if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
            unlink($f);
        }
        return (!$n) ? $z[0] :
            $lnap . $phpMussel['lang']['scan_checking'] .
            ' \'' . $ofn . '\' (FN: ' . $fnCRC . '; FD: ' . $fdCRC . "):\n" .
            $z[1];
    }

    $x =
        $lnap . $phpMussel['lang']['scan_checking'] . ' \'' .
        $ofn . '\' (FN: ' . $fnCRC . '; FD: ' . $fdCRC . "):\n-" . $lnap .
        $phpMussel['lang']['scan_no_problems_found'] . "\n";
    $r = 1;

    /**
     * Begin archive phase.
     * Note: Archive phase will only occur when "check_archives" is enabled and
     * when no problems were detected with the file/object being scanned by
     * this stage of the scan.
     */
    if (
        $phpMussel['Config']['files']['check_archives'] &&
        !empty($in) &&
        $phpMussel['Config']['files']['max_recursion'] > 1
    ) {
        /** Define archive phase. */
        $phpMussel['memCache']['phase'] = 'archive';

        /** Reset container definition. */
        $phpMussel['memCache']['container'] = 'none';
        /** Set appropriate container definitions. */
        if (substr($in, 0, 2) === 'PK') {
            if ($xt === 'ole') {
                $PharType = 'OLE';
            } elseif ($xt === 'smpk') {
                $PharType = 'SMPTE';
            } elseif ($xt === 'xpi') {
                $PharType = 'XPInstall';
            } elseif ($xts === 'app*') {
                $PharType = 'App';
            } elseif (substr_count(
                ',docm,docx,dotm,dotx,potm,potx,ppam,ppsm,ppsx,pptm,pptx,xlam,xlsb,xlsm,x' .
                'lsx,xltm,xltx,', ',' . $xt . ','
            )) {
                $PharType = 'OpenXML';
            } elseif (substr_count(
                ',odc,odf,odg,odm,odp,ods,odt,otg,oth,otp,ots,ott,', ',' . $xt . ','
            ) || $xts === 'fod*') {
                $PharType = 'OpenDocument';
            } elseif (substr_count(',opf,epub,', ',' . $xt . ',')) {
                $PharType = 'EPUB';
            } else {
                $PharType = 'ZIP';
                $phpMussel['memCache']['container'] = 'zipfile';
            }
            if ($PharType !== 'ZIP') {
                $phpMussel['memCache']['file_is_ole'] = true;
                $phpMussel['memCache']['container'] = 'pkfile';
            }
        } elseif (
            substr($in, 257, 6) === "ustar\x00" ||
            substr_count(',tar,tgz,tbz,tlz,tz,', ',' . $xt . ',')
        ) {
            $PharType = 'TarFile';
            $phpMussel['memCache']['container'] = 'tarfile';
        } elseif (
            substr($in, 0, 4) === 'Rar!' ||
            bin2hex(substr($in, 0, 4)) === '52457e5e'
        ) {
            $PharType = 'RarFile';
            $phpMussel['memCache']['container'] = 'rarfile';
        } else {
            $PharType = '';
        }

        /** Check if PHARable, and if so, generate an array of the contents. */
        if (is_dir('phar://' . $f) && is_readable('phar://' . $f)) {
            $x .=
                '-' . $lnap . $phpMussel['lang']['scan_reading'] .
                ' \'' . $ofn . "' (PHAR):\n";
            $PharData = $phpMussel['BuildPharList']($f, $dpt);
            $PharData = explode("\n", $PharData);
            $PharCount = count($PharData);
            /** Iterate through each item in the PHARable file/object. */
            for ($PharIter = 0; $PharIter < $PharCount; $PharIter++) {
                if (empty($PharData[$PharIter])) {
                    continue;
                }
                $PharData[$PharIter] = [
                    'DoScan' => true,
                    'Depth' => $phpMussel['substrbf']($PharData[$PharIter], ' '),
                    'Path' => $phpMussel['substraf']($PharData[$PharIter], ' ')
                ];
                $PharData[$PharIter]['Data'] = $phpMussel['ReadFile']('phar://' . $PharData[$PharIter]['Path']);
                $PharData[$PharIter]['Filename'] =
                        (substr_count($PharData[$PharIter]['Path'], '/')) ?
                        $phpMussel['substral']($PharData[$PharIter]['Path'], '/') :
                        $PharData[$PharIter]['Path'];
                $PharData[$PharIter]['ItemRef'] = $ofn . '>' . $PharData[$PharIter]['Path'];
            }
        } else {
            /** Default to the parent if the parent isn't PHARable. */
            $PharData = [0 => ['DoScan' => false, 'Depth' => 1, 'Path' => $f, 'Data' => $in]];
            $PharData[0]['Filename'] = (substr_count($f, '/')) ? $phpMussel['substral']($f, '/') : $f;
            $PharData[0]['ItemRef'] = $ofn . '>' . $PharData[0]['Path'];
            $PharCount = 1;
        }

        /** And now we begin processing our PHARable contents array. */
        for ($PharIter = 0; $PharIter < $PharCount; $PharIter++) {
            if (empty($PharData[$PharIter])) {
                continue;
            }
            $PharData[$PharIter]['Filesize'] = strlen($PharData[$PharIter]['Data']);
            $PharData[$PharIter]['MD5'] = md5($PharData[$PharIter]['Data']);
            $PharData[$PharIter]['NameCRC32'] = hash('crc32b', $PharData[$PharIter]['Filename']);
            $PharData[$PharIter]['DataCRC32'] = hash('crc32b', $PharData[$PharIter]['Data']);
            if (
                $phpMussel['Config']['files']['block_encrypted_archives'] &&
                substr($PharData[$PharIter]['Data'], 0, 2) === 'PK'
            ) {
                /**
                 * ZIP File Format Specification:
                 * - https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
                 */
                $PharData[$PharIter]['ZipBits'] =
                    $phpMussel['explode_bits'](substr($PharData[$PharIter]['Data'], 6, 2));
                if ($PharData[$PharIter]['ZipBits'] && $PharData[$PharIter]['ZipBits'][7]) {
                    /** Encryption detected. */
                    $r = 2;
                    $phpMussel['killdata'] .=
                        $PharData[$PharIter]['MD5'] . ':' .
                        $PharData[$PharIter]['Filesize'] . ':' .
                        $PharData[$PharIter]['ItemRef'] . "\n";
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang']['encrypted_archive'] .
                        ' (' . urlencode($PharData[$PharIter]['ItemRef']) . ')' .
                        $phpMussel['lang']['_exclamation'];
                    $x .=
                        '-' . $lnap . $phpMussel['lang']['scan_checking'] .
                        ' \'' . $PharData[$PharIter]['ItemRef'] . '\' (FN: ' .
                        $PharData[$PharIter]['NameCRC32'] . '; FD: ' .
                        $PharData[$PharIter]['DataCRC32'] . "):\n--" . $lnap .
                        $phpMussel['lang']['encrypted_archive'] .
                        $phpMussel['lang']['_fullstop_final'] . "\n";
                    break;
                }
            }
            if ($PharData[$PharIter]['DoScan']) {
                $x .=
                    '-' . $lnap . $phpMussel['lang']['scan_checking'] .
                    ' \'' . $PharData[$PharIter]['ItemRef'] .
                    '\' (FN: ' . $PharData[$PharIter]['NameCRC32'] .
                    '; FD: ' . $PharData[$PharIter]['DataCRC32'] . "):\n";
                try {
                    list($r, $x) = $phpMussel['MetaDataScan'](
                        $PharData[$PharIter]['ItemRef'],
                        $PharData[$PharIter]['Filename'],
                        $PharData[$PharIter]['Data'],
                        $PharData[$PharIter]['Depth'],
                        '-' . $lnap,
                        $r,
                        $x
                    );
                } catch (\Exception $e) {
                    throw new \Exception($e->getMessage());
                }
                if ($r !== 1) {
                    break;
                }
                $x .= '--' . $lnap . $phpMussel['lang']['scan_no_problems_found'] . "\n";
            }
            $ScanDepth = 0;
            while (true) {
                if ($ScanDepth > $phpMussel['Config']['files']['max_recursion']) {
                    $r = 2;
                    $phpMussel['killdata'] .=
                        $PharData[$PharIter]['MD5'] . ':' .
                        $PharData[$PharIter]['Filesize'] . ':' .
                        $PharData[$PharIter]['ItemRef'] . "\n";
                    $phpMussel['whyflagged'] .=
                        $phpMussel['lang']['recursive'] .
                        ' (' . $ofnSafe . ')' . $phpMussel['lang']['_exclamation'];
                    $x .=
                        '-' . $lnap . $phpMussel['lang']['scan_checking'] .
                        ' \'' . $PharData[$PharIter]['ItemRef'] . '\' (FN: ' .
                        $PharData[$PharIter]['NameCRC32'] . '; FD: ' .
                        $PharData[$PharIter]['DataCRC32'] . "):\n--" .
                        $lnap . $phpMussel['lang']['recursive'] .
                        $phpMussel['lang']['_fullstop_final'] . "\n";
                    break 2;
                }
                $zDo = false;
                $PharData[$PharIter]['Indent'] = str_repeat('-', $ScanDepth + $dpt) . $lnap;
                $xtt = (strpos($PharData[$PharIter]['Filename'], '.') !== false) ? [
                    substr($PharData[$PharIter]['Filename'], -3),
                    substr($PharData[$PharIter]['Filename'], -4),
                    substr($PharData[$PharIter]['Filename'], -7, 4),
                    substr($PharData[$PharIter]['Filename'], -8, 4)
                ] : false;
                $GZable = false;
                $BZable = false;
                $LZable = false;
                if ($phpMussel['substr_compare_hex']($PharData[$PharIter]['Data'], 0, 2, '1f8b', true)) {
                    $GZable = true;
                } elseif ($phpMussel['substr_compare_hex']($PharData[$PharIter]['Data'], 0, 3, '425a68', true)) {
                    $BZable = true;
                } elseif (!empty($xtt) && !$zDo && (
                    substr_count(',.gz,', ',' . $xtt[0] . ',') ||
                    substr_count(',.tgz,', ',' . $xtt[1] . ',')
                )) {
                    $GZable = true;
                } elseif (!empty($xtt) && !$zDo && (
                    substr_count(',.bz,', ',' . $xtt[0] . ',') ||
                    substr_count(',.bz2,.tbz,', ',' . $xtt[1] . ',')
                )) {
                    $BZable = true;
                } elseif (!empty($xtt) && !$zDo && (
                    substr_count(',.lz,', ',' . $xtt[0] . ',') ||
                    substr_count(',.lha,.lzh,.lzo,.lzw,.lzx,.tlz,', ',' . $xtt[1] . ',')
                )) {
                    $LZable = true;
                } elseif (!$zDo && (
                    substr($PharData[$PharIter]['Data'], 257, 6) === "ustar\x00" || (
                        !empty($xtt) && (
                            substr_count(',.tar,.tgz,.tbz,.tlz,', ',' . $xtt[1] . ',') ||
                            substr_count(',.tar,.tgz,.tbz,.tlz,', ',' . $xtt[2] . ',') ||
                            substr_count(',.tar,.tgz,.tbz,.tlz,', ',' . $xtt[3] . ',')
                        )
                    )
                )) {
                    /** Allows recursion for TAR files. */
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_reading'] . ' \'' .
                        $PharData[$PharIter]['ItemRef'] . "' (TAR):\n";
                    $TarFile = ['Offset' => 0];
                    while (true) {
                        if (($TarFile['Offset'] + 1024) > $PharData[$PharIter]['Filesize']) {
                            break;
                        }
                        $TarFile['File'] = [
                            'Filename' => preg_replace('/[^\x20-\xff]/', '', substr($PharData[$PharIter]['Data'], $TarFile['Offset'], 100)),
                            'Filesize' => octdec(preg_replace('/[^0-9]/', '', substr($PharData[$PharIter]['Data'], $TarFile['Offset'] + 124, 12))),
                        ];
                        if ($TarFile['File']['Filesize'] < 0) {
                            $r = 2;
                            $phpMussel['killdata'] .=
                                $TarFile['File']['MD5'] . ':' .
                                $TarFile['File']['Filesize'] . ':' .
                                $PharData[$PharIter]['ItemRef'] . "\n";
                            $phpMussel['whyflagged'] .=
                                $phpMussel['lang']['scan_tampering'] . ' (' .
                                urlencode($PharData[$PharIter]['ItemRef']) .
                                ')' . $phpMussel['lang']['_exclamation'];
                            $x .=
                                '-' . $PharData[$PharIter]['Indent'] .
                                $phpMussel['lang']['scan_tampering'] .
                                $phpMussel['lang']['_exclamation_final'] . "\n";
                            break;
                        }
                        $TarFile['File']['Directory'] = (
                            substr($TarFile['File']['Filename'], -1, 1) === '/' &&
                            $TarFile['File']['Filesize'] === 0
                        );
                        $TarFile['File']['Blocks'] = ceil($TarFile['File']['Filesize'] / 512) + 1;
                        if ($TarFile['File']['Directory']) {
                            $TarFile['Offset'] += $TarFile['File']['Blocks'] * 512;
                            continue;
                        }
                        if ($TarFile['File']['Filename']) {
                            if (substr_count($TarFile['File']['Filename'], "\\")) {
                                $TarFile['File']['Filename'] =
                                    $phpMussel['substral']($TarFile['File']['Filename'], "\\") ;
                            }
                            if (substr_count($TarFile['File']['Filename'], '/')) {
                                $TarFile['File']['Filename'] =
                                    $phpMussel['substral']($TarFile['File']['Filename'], '/') ;
                            }
                        }
                        $TarFile['File']['Data'] =
                            substr($PharData[$PharIter]['Data'], $TarFile['Offset'] + 512, $TarFile['File']['Filesize']);
                        if (empty($TarFile['File']['Data'])) {
                            break;
                        }
                        $TarFile['File']['MD5'] = md5($TarFile['File']['Data']);
                        if (!$TarFile['File']['Filename']) {
                            $r = 2;
                            $phpMussel['killdata'] .=
                                $TarFile['File']['MD5'] . ':' .
                                $TarFile['File']['Filesize'] .
                                ":MISSING-FILENAME\n";
                            $phpMussel['whyflagged'] .=
                                $phpMussel['lang']['scan_missing_filename'] .
                                $phpMussel['lang']['_exclamation'];
                            $x .=
                                '-' . $PharData[$PharIter]['Indent'] .
                                $phpMussel['lang']['scan_missing_filename'] .
                                $phpMussel['lang']['_exclamation_final'] . "\n";
                            break;
                        }
                        $phpMussel['memCache']['objects_scanned']++;
                        try {
                            list($r, $x) = $phpMussel['MetaDataScan'](
                                $PharData[$PharIter]['ItemRef'] . '>' . $TarFile['File']['Filename'],
                                $TarFile['File']['Filename'],
                                $TarFile['File']['Data'],
                                $dpt,
                                $PharData[$PharIter]['Indent'],
                                $r,
                                $x
                            );
                        } catch (\Exception $e) {
                            throw new \Exception($e->getMessage());
                        }
                        $TarFile['File']['DataCRC32'] = hash('crc32b', $TarFile['File']['Data']);
                        $TarFile['File']['NameCRC32'] = hash('crc32b', $TarFile['File']['Filename']);
                        $TarFile['Offset'] += $TarFile['File']['Blocks'] * 512;
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_checking'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . '>' . $TarFile['File']['Filename'] .
                            '\' (FN: ' . $TarFile['File']['NameCRC32'] . '; FD: ' .
                            $TarFile['File']['DataCRC32'] . "):\n";
                        if ($r === 1) {
                            $x .=
                                '-' . $PharData[$PharIter]['Indent'] .
                                $phpMussel['lang']['scan_no_problems_found'] . "\n";
                        }
                    }
                    $TarFile = '';
                }
                if ($GZable) {
                    if (!function_exists('gzdecode')) {
                        $phpMussel['memCache']['scan_errors']++;
                        if (!$phpMussel['Config']['signatures']['fail_extensions_silently']) {
                            $r = -1;
                            $phpMussel['killdata'] .=
                                $PharData[$PharIter]['MD5'] . ':' .
                                $PharData[$PharIter]['Filesize'] . ':' .
                                $PharData[$PharIter]['ItemRef'] . "\n";
                            $phpMussel['whyflagged'] .= $phpMussel['lang']['scan_extensions_missing'] . ' ';
                        }
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (GZIP):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_extensions_missing'] . "\n";
                        break;
                    }
                    if (!$PharData[$PharIter]['Data'] = gzdecode($PharData[$PharIter]['Data'])) {
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (GZIP):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_not_archive'] . "\n";
                        break;
                    }
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_reading'] . ' \'' .
                        $PharData[$PharIter]['ItemRef'] . "' (GZIP):\n";
                    $zDo = true;
                } elseif ($BZable) {
                    if (!function_exists('bzdecompress')) {
                        $phpMussel['memCache']['scan_errors']++;
                        if (!$phpMussel['Config']['signatures']['fail_extensions_silently']) {
                            $r = -1;
                            $phpMussel['killdata'] .=
                                $PharData[$PharIter]['MD5'] . ':' .
                                $PharData[$PharIter]['Filesize'] . ':' .
                                $PharData[$PharIter]['ItemRef'] . "\n";
                            $phpMussel['whyflagged'] .= $phpMussel['lang']['scan_extensions_missing'] . ' ';
                        }
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (BZIP2):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_extensions_missing'] . "\n";
                        break;
                    }
                    if (!$PharData[$PharIter]['Data'] = bzdecompress($PharData[$PharIter]['Data'])) {
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (BZIP2):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_not_archive'] . "\n";
                        break;
                    }
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_reading'] . ' \'' .
                        $PharData[$PharIter]['ItemRef'] . "' (BZIP2):\n";
                    $zDo = true;
                } elseif ($LZable) {
                    if (!function_exists('lzf_decompress')) {
                        $phpMussel['memCache']['scan_errors']++;
                        if (!$phpMussel['Config']['signatures']['fail_extensions_silently']) {
                            $r = -1;
                            $phpMussel['killdata'] .=
                                $PharData[$PharIter]['MD5'] . ':' .
                                $PharData[$PharIter]['Filesize'] . ':' .
                                $PharData[$PharIter]['ItemRef'] . "\n";
                            $phpMussel['whyflagged'] .= $phpMussel['lang']['scan_extensions_missing'] . ' ';
                        }
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (LZF):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_extensions_missing'] . "\n";
                        break;
                    }
                    if (!$PharData[$PharIter]['Data'] = lzf_decompress($PharData[$PharIter]['Data'])) {
                        $x .=
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_reading'] . ' \'' .
                            $PharData[$PharIter]['ItemRef'] . "' (LZF):\n-" .
                            $PharData[$PharIter]['Indent'] .
                            $phpMussel['lang']['scan_not_archive'] . "\n";
                        break;
                    }
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_reading'] . ' \'' .
                        $PharData[$PharIter]['ItemRef'] . "' (LZF):\n";
                    $zDo = true;
                }
                if ($zDo) {
                    $ScanDepth++;
                    if (substr_count($PharData[$PharIter]['Filename'], '.')) {
                        $PharData[$PharIter]['Filename'] = $phpMussel['substrbl']($PharData[$PharIter]['Filename'], '.');
                    }
                    if (substr_count($PharData[$PharIter]['Filename'], "\\")) {
                        $PharData[$PharIter]['Filename'] = $phpMussel['substral']($PharData[$PharIter]['Filename'], "\\");
                    }
                    if (substr_count($PharData[$PharIter]['Filename'], '/')) {
                        $PharData[$PharIter]['Filename'] = $phpMussel['substral']($PharData[$PharIter]['Filename'], '/');
                    }
                    $PharData[$PharIter]['Filesize'] = strlen($PharData[$PharIter]['Data']);
                    $PharData[$PharIter]['ItemRef'] .= '>' . $PharData[$PharIter]['Filename'];
                    $PharData[$PharIter]['NameCRC32'] = hash('crc32b', $PharData[$PharIter]['Filename']);
                    $PharData[$PharIter]['DataCRC32'] = hash('crc32b', $PharData[$PharIter]['Data']);
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_checking'] .
                        ' \'' . $PharData[$PharIter]['ItemRef'] .
                        '\' (FN: ' . $PharData[$PharIter]['NameCRC32'] .
                        '; FD: ' . $PharData[$PharIter]['DataCRC32'] . "):\n";
                    try {
                        list($r, $x) = $phpMussel['MetaDataScan'](
                            $PharData[$PharIter]['ItemRef'],
                            $PharData[$PharIter]['Filename'],
                            $PharData[$PharIter]['Data'],
                            $PharData[$PharIter]['Depth'] + $ScanDepth + $dpt,
                            $PharData[$PharIter]['Indent'],
                            $r,
                            $x
                        );
                    } catch (\Exception $e) {
                        throw new \Exception($e->getMessage());
                    }
                    if ($r !== 1) {
                        break 2;
                    }
                    $x .=
                        $PharData[$PharIter]['Indent'] .
                        $phpMussel['lang']['scan_no_problems_found'] .
                        "\n";
                    continue;
                }
                break;
            }
        }
    }
    if ($r === 2) {
        if (
            $phpMussel['Config']['general']['quarantine_key'] &&
            !$phpMussel['Config']['general']['honeypot_mode'] &&
            strlen($in) < $phpMussel['ReadBytes']($phpMussel['Config']['general']['quarantine_max_filesize'])
        ) {
            $qfu = $phpMussel['Time'] . '-' . md5(
                $phpMussel['Config']['general']['quarantine_key'] . $fdCRC . $phpMussel['Time']
            );
            $phpMussel['Quarantine'](
                $in,
                $phpMussel['Config']['general']['quarantine_key'],
                $_SERVER[$phpMussel['Config']['general']['ipaddr']],
                $qfu
            );
            $phpMussel['killdata'] .= $phpMussel['ParseVars'](
                ['QFU' => $qfu],
                $phpMussel['lang']['quarantined_as']
            );
        }
    }
    if ($r !== 1 && $phpMussel['Config']['general']['delete_on_sight'] && is_readable($f)) {
        unlink($f);
    }
    return !$n ? $r : $x;
};

/**
 * Forks the PHP process when scanning in CLI mode. This ensures that if PHP
 * crashes during scanning, phpMussel can continue to scan any remaining items
 * queued for scanning (because if the parent process handles the scan queue
 * and the child process handles the actual scanning of each item queued for
 * scanning, if the child process crashes, the parent process can simply create
 * a new child process to continue iterating through the queue).
 *
 * There are some additional benefits to be had by scanning in this way, such
 * as the ability to kill a child process, responsible for the actual scanning,
 * and yet still have the results of this scanning logged (which, if killed in
 * this way prior to completing the scan, would likely involve some type of
 * error).
 *
 * @param string $f The name of the item to be scanned, with path included.
 * @param string $ofn The name of the item to be scanned, without any path
 *      included (so, just the name by itself).
 * @return string The scan results, piped back to the parent from the child
 *      process and returned to the calling function as a string.
 */
$phpMussel['Fork'] = function ($f = '', $ofn = '') use (&$phpMussel) {
    $pf = popen(
        $phpMussel['Mussel_PHP'] . ' "' . $phpMussel['Vault'] .
        '../loader.php" "cli_scan" "' . $f . '" "' . $ofn . '"',
        'r'
    );
    $s = '';
    while ($x = fgets($pf)) {
        $s .= $x;
    }
    pclose($pf);
    return $s;
};

/** Assigns an array to use for dumping scan debug information (optional). */
$phpMussel['Set-Scan-Debug-Array'] = function (&$Var) use (&$phpMussel) {
    if (isset($phpMussel['DebugArr'])) {
        unset($phpMussel['DebugArr']);
    }
    if (!is_array($Var)) {
        $Var = [];
    }
    $phpMussel['DebugArr'] = &$Var;
};

/** Destroys the scan debug array (optional). */
$phpMussel['Destroy-Scan-Debug-Array'] = function (&$Var) use (&$phpMussel) {
    unset($phpMussel['DebugArrKey'], $phpMussel['DebugArr']);
    $Var = null;
};

/**
 * The main scan closure, responsible for initialising scans in most
 * circumstances. Should generally be called whenever phpMussel is
 * required by external scripts, apps, CMS, etc.
 *
 * Please refer to Section 3A of the README documentation, "HOW TO USE (FOR WEB
 * SERVERS)", for more information.
 *
 * @param string|array $f Indicates which file, files, directory and/or
 *      directories to scan (can be a string, an array, or a multidimensional
 *      array).
 * @param bool $n A boolean, indicating the format for the scan results to be
 *      returned as. False instructs the function to return the results as an
 *      integer; True instructs the function to return the results as human
 *      readable text. Optional; Defaults to false.
 * @param bool $zz A boolean, indicating to the function whether or not arrayed
 *      results should be imploded prior to being returned to the calling
 *      function. False instructs the function to return the arrayed results as
 *      verbatim; True instructs the function to return the arrayed results as
 *      an imploded string. Optional; Defaults to false.
 * @param int $dpt Represents the current depth of recursion from which the
 *      function has been called. This information is used for determining how
 *      far to indent any entries generated for logging and for the display of
 *      scan results in CLI (you should never manually set this parameter
 *      yourself).
 * @param string $ofn In the context of the initial file upload scanning that
 *      phpMussel performs when operating via a server, this parameter (a
 *      string) represents the "original filename" of the file being scanned
 *      (the original filename, in this context, referring to the name of the
 *      file being scanned as per supplied by the upload client, as opposed to
 *      the temporary filename assigned by the server or any other filename).
 *      When operating in the context of CLI mode, both $f and $ofn represent
 *      the scan target, as per specified by the CLI operator; The only
 *      difference between the two is when the scan target is a directory,
 *      rather than a single file; $f will represent the full path to the file
 *      (so, directory plus filename), whereas $ofn will represent only the
 *      filename.
 * @return bool|int|string|array The scan results, returned as an array when
 *      the $f parameter is an array and when $n and/or $zz is/are false, and
 *      otherwise returned as per described by the README documentation. The
 *      function may also die the script and return nothing, if something goes
 *      wrong, such as if the function is triggered in the absense of the
 *      required $phpMussel['memCache'] variable being set, and may also return
 *      false, in the absense of the required $phpMussel['HashCache']['Data']
 *      variable being set.
 */
$phpMussel['Scan'] = function ($f = '', $n = false, $zz = false, $dpt = 0, $ofn = '') use (&$phpMussel) {
    if (!isset($phpMussel['memCache'])) {
        throw new \Exception(
            !isset($phpMussel['lang']['required_variables_not_defined']) ?
            '[phpMussel] Required variables aren\'t defined: Can\'t continue.' :
            '[phpMussel] ' . $phpMussel['lang']['required_variables_not_defined']
        );
    }
    if (empty($phpMussel['memCache']['OrganisedSigFiles'])) {
        $phpMussel['OrganiseSigFiles']();
        $phpMussel['memCache']['OrganisedSigFiles'] = true;
    }

    /** Initialise statistics if they've been enabled. */
    $phpMussel['Stats-Initialise']();

    if ($phpMussel['EOF']) {
        $phpMussel['PrepareHashCache']();
    }
    if (!isset($phpMussel['HashCache']['Data'])) {
        return false;
    }
    if (!$ofn) {
        $ofn = $f;
    }
    $xst = time() + ($phpMussel['Config']['general']['timeOffset'] * 60);
    $xst2822 = $phpMussel['TimeFormat']($xst, $phpMussel['Config']['general']['timeFormat']);
    try {
        $r = $phpMussel['Recursor']($f, $n, $zz, $dpt, $ofn);
    } catch (\Exception $e) {
        throw new \Exception($e->getMessage());
    }
    $xet = time() + ($phpMussel['Config']['general']['timeOffset'] * 60);
    $xet2822 = $phpMussel['TimeFormat']($xet, $phpMussel['Config']['general']['timeFormat']);

    /** Plugin hook: "after_scan". */
    $phpMussel['Execute_Hook']('after_scan');

    if ($n && !is_array($r)) {
        $r =
            $xst2822 . ' ' . $phpMussel['lang']['started'] .
            $phpMussel['lang']['_fullstop_final'] . "\n" .
            $r . $xet2822 . ' ' . $phpMussel['lang']['finished'] .
            $phpMussel['lang']['_fullstop_final'] . "\n";
        $phpMussel['WriteScanLog']($r);
    }
    if (!isset($phpMussel['SkipSerial'])) {
        $phpMussel['WriteSerial']($xst, $xet);
    }
    if ($phpMussel['EOF']) {
        if ($phpMussel['Config']['general']['scan_cache_expiry'] > 0) {
            foreach ($phpMussel['HashCache']['Data'] as &$phpMussel['ThisItem']) {
                if (is_array($phpMussel['ThisItem'])) {
                    $phpMussel['ThisItem'] = implode(':', $phpMussel['ThisItem']) . ';';
                }
            }
            $phpMussel['SaveCache'](
                'HashCache',
                $phpMussel['Time'] + $phpMussel['Config']['general']['scan_cache_expiry'],
                implode('', $phpMussel['HashCache']['Data'])
            );
            unset($phpMussel['ThisItem'], $phpMussel['HashCache']['Data']);
        }
    }

    /** Register scan event. */
    $phpMussel['Stats-Increment']($phpMussel['EOF'] ? 'API-Events' : 'Web-Events', 1);

    /** Update statistics. */
    if ($phpMussel['CacheModified']) {
        $phpMussel['Statistics'] = $phpMussel['SaveCache']('Statistics', -1, serialize($phpMussel['Statistics']));
    }

    /** Exit scan process. */
    return $r;
};

/**
 * Writes to the serialized logfile upon scan completion.
 *
 * @param string $StartTime When the scan started.
 * @param string $FinishTime When the scan finished.
 * @return bool True on success; False on failure.
 */
$phpMussel['WriteSerial'] = function ($StartTime = '', $FinishTime = '') use (&$phpMussel) {
    $Origin = $phpMussel['Mussel_sapi'] ? 'CLI' : $_SERVER[$phpMussel['Config']['general']['ipaddr']];
    $ScanData = empty($phpMussel['whyflagged']) ? $phpMussel['lang']['data_not_available'] : trim($phpMussel['whyflagged']);
    if ($phpMussel['Config']['general']['scan_log_serialized']) {
        if (!isset($phpMussel['memCache']['objects_scanned'])) {
            $phpMussel['memCache']['objects_scanned'] = 0;
        }
        if (!isset($phpMussel['memCache']['detections_count'])) {
            $phpMussel['memCache']['detections_count'] = 0;
        }
        if (!isset($phpMussel['memCache']['scan_errors'])) {
            $phpMussel['memCache']['scan_errors'] = 1;
        }
        $Handle = [
            'Data' => serialize([
                'start_time' => $StartTime ?: (isset($phpMussel['memCache']['start_time']) ? $phpMussel['memCache']['start_time'] : '-'),
                'end_time' => $FinishTime ?: (isset($phpMussel['memCache']['end_time']) ? $phpMussel['memCache']['end_time'] : '-'),
                'origin' => $Origin,
                'objects_scanned' => $phpMussel['memCache']['objects_scanned'],
                'detections_count' => $phpMussel['memCache']['detections_count'],
                'scan_errors' => $phpMussel['memCache']['scan_errors'],
                'detections' => $ScanData
            ]) . "\n",
            'File' => $phpMussel['TimeFormat']($phpMussel['Time'], $phpMussel['Config']['general']['scan_log_serialized'])
        ];
        $WriteMode = (!file_exists($phpMussel['Vault'] . $Handle['File']) || (
            $phpMussel['Config']['general']['truncate'] > 0 &&
            filesize($phpMussel['Vault'] . $Handle['File']) >= $phpMussel['ReadBytes']($phpMussel['Config']['general']['truncate'])
        )) ? 'w' : 'a';
        $Stream = fopen($phpMussel['Vault'] . $Handle['File'], $WriteMode);
        fwrite($Stream, $Handle['Data']);
        fclose($Stream);
        return true;
    }
    return false;
};

/**
 * Writes to the standard scan log upon scan completion.
 *
 * @param string $Data What to write.
 * @return bool True on success; False on failure.
 */
$phpMussel['WriteScanLog'] = function ($Data) use (&$phpMussel) {
    if ($phpMussel['Config']['general']['scan_log']) {
        $File = $phpMussel['TimeFormat']($phpMussel['Time'], $phpMussel['Config']['general']['scan_log']);
        if (!file_exists($phpMussel['Vault'] . $File)) {
            $Data = $phpMussel['safety'] . "\n" . $Data;
        }
        $WriteMode = (!file_exists($phpMussel['Vault'] . $File) || (
            $phpMussel['Config']['general']['truncate'] > 0 &&
            filesize($phpMussel['Vault'] . $File) >= $phpMussel['ReadBytes']($phpMussel['Config']['general']['truncate'])
        )) ? 'w' : 'a';
        $Handle = fopen($phpMussel['Vault'] . $File, 'a');
        fwrite($Handle, $Data);
        fclose($Handle);
        return true;
    }
    return false;
};

/**
 * A simple closure for replacing date/time placeholders with corresponding
 * date/time information. Used by the logfiles and some timestamps.
 *
 * @param int $Time A unix timestamp.
 * @param string|array $In An input or an array of inputs to manipulate.
 * @return string|array The adjusted input(/s).
 */
$phpMussel['TimeFormat'] = function ($Time, $In) use (&$phpMussel) {
    $Time = date('dmYHisDMP', $Time);
    $values = [
        'dd' => substr($Time, 0, 2),
        'mm' => substr($Time, 2, 2),
        'yyyy' => substr($Time, 4, 4),
        'yy' => substr($Time, 6, 2),
        'hh' => substr($Time, 8, 2),
        'ii' => substr($Time, 10, 2),
        'ss' => substr($Time, 12, 2),
        'Day' => substr($Time, 14, 3),
        'Mon' => substr($Time, 17, 3),
        'tz' => substr($Time, 20, 3) . substr($Time, 24, 2),
        't:z' => substr($Time, 20, 6)
    ];
    $values['d'] = (int)$values['dd'];
    $values['m'] = (int)$values['mm'];
    return is_array($In) ? array_map(function ($Item) use (&$values, &$phpMussel) {
        return $phpMussel['ParseVars']($values, $Item);
    }, $In) : $phpMussel['ParseVars']($values, $In);
};

/**
 * Normalises values defined by the YAML closure.
 *
 * @param string|int|bool $Value The value to be normalised.
 * @param int $ValueLen The length of the value to be normalised.
 * @param string|int|bool $ValueLow The value to be normalised, lowercased.
 */
$phpMussel['YAML-Normalise-Value'] = function (&$Value, $ValueLen, $ValueLow) {
    if (substr($Value, 0, 1) === '"' && substr($Value, $ValueLen - 1) === '"') {
        $Value = substr($Value, 1, $ValueLen - 2);
    } elseif (substr($Value, 0, 1) === '\'' && substr($Value, $ValueLen - 1) === '\'') {
        $Value = substr($Value, 1, $ValueLen - 2);
    } elseif ($ValueLow === 'true' || $ValueLow === 'y') {
        $Value = true;
    } elseif ($ValueLow === 'false' || $ValueLow === 'n') {
        $Value = false;
    } elseif (substr($Value, 0, 2) === '0x' && ($HexTest = substr($Value, 2)) && !preg_match('/[^a-f0-9]/i', $HexTest) && !($ValueLen % 2)) {
        $Value = hex2bin($HexTest);
    } else {
        $ValueInt = (int)$Value;
        if (strlen($ValueInt) === $ValueLen && $Value == $ValueInt && $ValueLen > 1) {
            $Value = $ValueInt;
        }
    }
    if (!$Value) {
        $Value = false;
    }
};

/**
 * A simplified YAML-like parser. Note: This is intended to adequately serve
 * the needs of this package in a way that should feel familiar to users of
 * YAML, but it isn't a true YAML implementation and it doesn't adhere to any
 * specifications, official or otherwise.
 *
 * @param string $In The data to parse.
 * @param array $Arr Where to save the results.
 * @param bool $VM Validator Mode (if true, results won't be saved).
 * @param int $Depth Tab depth (inherited through recursion; ignore it).
 * @return bool Returns false if errors are encountered, and true otherwise.
 */
$phpMussel['YAML'] = function ($In, &$Arr, $VM = false, $Depth = 0) use (&$phpMussel) {
    if (!is_array($Arr)) {
        if ($VM) {
            return false;
        }
        $Arr = [];
    }
    if (!substr_count($In, "\n")) {
        return false;
    }
    $In = str_replace("\r", '', $In);
    $Key = $Value = $SendTo = '';
    $TabLen = $SoL = 0;
    while ($SoL !== false) {
        if (($EoL = strpos($In, "\n", $SoL)) === false) {
            $ThisLine = substr($In, $SoL);
        } else {
            $ThisLine = substr($In, $SoL, $EoL - $SoL);
        }
        $SoL = ($EoL === false) ? false : $EoL + 1;
        $ThisLine = preg_replace(["/#.*$/", "/\x20+$/"], '', $ThisLine);
        if (empty($ThisLine) || $ThisLine === "\n") {
            continue;
        }
        $ThisTab = 0;
        while (($Chr = substr($ThisLine, $ThisTab, 1)) && ($Chr === ' ' || $Chr === "\t")) {
            $ThisTab++;
        }
        if ($ThisTab > $Depth) {
            if ($TabLen === 0) {
                $TabLen = $ThisTab;
            }
            $SendTo .= $ThisLine . "\n";
            continue;
        } elseif ($ThisTab < $Depth) {
            return false;
        } elseif (!empty($SendTo)) {
            if (empty($Key)) {
                return false;
            }
            if (!isset($Arr[$Key])) {
                if ($VM) {
                    return false;
                }
                $Arr[$Key] = false;
            }
            if (!$phpMussel['YAML']($SendTo, $Arr[$Key], $VM, $TabLen)) {
                return false;
            }
            $SendTo = '';
        }
        if (substr($ThisLine, -1) === ':') {
            $Key = substr($ThisLine, $ThisTab, -1);
            $KeyLen = strlen($Key);
            $KeyLow = strtolower($Key);
            $phpMussel['YAML-Normalise-Value']($Key, $KeyLen, $KeyLow);
            if (!isset($Arr[$Key])) {
                if ($VM) {
                    return false;
                }
                $Arr[$Key] = false;
            }
        } elseif (substr($ThisLine, $ThisTab, 2) === '- ') {
            $Value = substr($ThisLine, $ThisTab + 2);
            $ValueLen = strlen($Value);
            $ValueLow = strtolower($Value);
            $phpMussel['YAML-Normalise-Value']($Value, $ValueLen, $ValueLow);
            if (!$VM && $ValueLen > 0) {
                $Arr[] = $Value;
            }
        } elseif (($DelPos = strpos($ThisLine, ': ')) !== false) {
            $Key = substr($ThisLine, $ThisTab, $DelPos - $ThisTab);
            $KeyLen = strlen($Key);
            $KeyLow = strtolower($Key);
            $phpMussel['YAML-Normalise-Value']($Key, $KeyLen, $KeyLow);
            if (!$Key) {
                return false;
            }
            $Value = substr($ThisLine, $ThisTab + $KeyLen + 2);
            $ValueLen = strlen($Value);
            $ValueLow = strtolower($Value);
            $phpMussel['YAML-Normalise-Value']($Value, $ValueLen, $ValueLow);
            if (!$VM && $ValueLen > 0) {
                $Arr[$Key] = $Value;
            }
        } elseif (strpos($ThisLine, ':') === false && strlen($ThisLine) > 1) {
            $Key = $ThisLine;
            $KeyLen = strlen($Key);
            $KeyLow = strtolower($Key);
            $phpMussel['YAML-Normalise-Value']($Key, $KeyLen, $KeyLow);
            if (!isset($Arr[$Key])) {
                if ($VM) {
                    return false;
                }
                $Arr[$Key] = false;
            }
        }
    }
    if (!empty($SendTo) && !empty($Key)) {
        if (!isset($Arr[$Key])) {
            if ($VM) {
                return false;
            }
            $Arr[$Key] = [];
        }
        if (!$phpMussel['YAML']($SendTo, $Arr[$Key], $VM, $TabLen)) {
            return false;
        }
    }
    return true;
};

/**
 * Fix incorrect typecasting for some for some variables that sometimes default
 * to strings instead of booleans or integers.
 */
$phpMussel['AutoType'] = function (&$Var, $Type = '') use (&$phpMussel) {
    if ($Type === 'string' || $Type === 'timezone') {
        $Var = (string)$Var;
    } elseif ($Type === 'int' || $Type === 'integer') {
        $Var = (int)$Var;
    } elseif ($Type === 'real' || $Type === 'double' || $Type === 'float') {
        $Var = (real)$Var;
    } elseif ($Type === 'bool' || $Type === 'boolean') {
        $Var = (strtolower($Var) !== 'false' && $Var);
    } elseif ($Type === 'kb') {
        $Var = $phpMussel['ReadBytes']($Var, 1);
    } else {
        $LVar = strtolower($Var);
        if ($LVar === 'true') {
            $Var = true;
        } elseif ($LVar === 'false') {
            $Var = false;
        } elseif ($Var !== true && $Var !== false) {
            $Var = (int)$Var;
        }
    }
};

/**
 * Used to send cURL requests.
 *
 * @param string $URI The resource to request.
 * @param array $Params (Optional) An associative array of key-value pairs to
 *      to send along with the request.
 * @return string The results of the request.
 */
$phpMussel['Request'] = function ($URI, $Params = '', $Timeout = '') use (&$phpMussel) {
    if (!$Timeout) {
        $Timeout = $phpMussel['Timeout'];
    }

    /** Initialise the cURL session. */
    $Request = curl_init($URI);

    $LCURI = strtolower($URI);
    $SSL = (substr($LCURI, 0, 6) === 'https:');

    curl_setopt($Request, CURLOPT_FRESH_CONNECT, true);
    curl_setopt($Request, CURLOPT_HEADER, false);
    if (empty($Params)) {
        curl_setopt($Request, CURLOPT_POST, false);
    } else {
        curl_setopt($Request, CURLOPT_POST, true);
        curl_setopt($Request, CURLOPT_POSTFIELDS, $Params);
    }
    if ($SSL) {
        curl_setopt($Request, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
        curl_setopt($Request, CURLOPT_SSL_VERIFYPEER, false);
    }
    curl_setopt($Request, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($Request, CURLOPT_MAXREDIRS, 1);
    curl_setopt($Request, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($Request, CURLOPT_TIMEOUT, $Timeout);
    curl_setopt($Request, CURLOPT_USERAGENT, $phpMussel['ScriptUA']);

    /** Execute and get the response. */
    $Response = curl_exec($Request);

    /** Close the cURL session. */
    curl_close($Request);

    /** Return the results of the request. */
    return $Response;
};

/**
 * Used to generate new salts when necessary, which may be occasionally used by
 * some specific optional peripheral features (note: should not be considered
 * cryptographically secure; especially so for versions of PHP < 7).
 *
 * @return string Salt.
 */
$phpMussel['GenerateSalt'] = function () {
    static $MinLen = 32;
    static $MaxLen = 72;
    static $MinChr = 1;
    static $MaxChr = 255;
    $Salt = '';
    if (function_exists('random_int')) {
        try {
            $Length = random_int($MinLen, $MaxLen);
        } catch (\Exception $e) {
            $Length = rand($MinLen, $MaxLen);
        }
    } else {
        $Length = rand($MinLen, $MaxLen);
    }
    if (function_exists('random_bytes')) {
        try {
            $Salt = random_bytes($Length);
        } catch (\Exception $e) {
            $Salt = '';
        }
    }
    if (empty($Salt)) {
        if (function_exists('random_int')) {
            try {
                for ($Index = 0; $Index < $Length; $Index++) {
                    $Salt .= chr(random_int($MinChr, $MaxChr));
                }
            } catch (\Exception $e) {
                $Salt = '';
                for ($Index = 0; $Index < $Length; $Index++) {
                    $Salt .= chr(rand($MinChr, $MaxChr));
                }
            }
        } else {
            for ($Index = 0; $Index < $Length; $Index++) {
                $Salt .= chr(rand($MinChr, $MaxChr));
            }
        }
    }
    return $Salt;
};

/** Clears expired entries from a list. */
$phpMussel['ClearExpired'] = function (&$List, &$Check) use (&$phpMussel) {
    if ($List) {
        $End = 0;
        while (true) {
            $Begin = $End;
            if (!$End = strpos($List, "\n", $Begin + 1)) {
                break;
            }
            $Line = substr($List, $Begin, $End - $Begin);
            if ($Split = strrpos($Line, ',')) {
                $Expiry = (int)substr($Line, $Split + 1);
                if ($Expiry < $phpMussel['Time']) {
                    $List = str_replace($Line, '', $List);
                    $End = 0;
                    $Check = true;
                }
            }
        }
    }
};

/** Fetch information about signature files and prepare for use with the scan process. */
$phpMussel['OrganiseSigFiles'] = function () use (&$phpMussel) {
    if (empty($phpMussel['Config']['signatures']['Active'])) {
        return false;
    }
    $Classes = [
        'General_Command_Detections',
        'Filename',
        'Hash',
        'Standard',
        'Standard_RegEx',
        'Normalised',
        'Normalised_RegEx',
        'HTML',
        'HTML_RegEx',
        'PE_Extended',
        'PE_Sectional',
        'Complex_Extended',
        'URL_Scanner'
    ];
    $List = explode(',', $phpMussel['Config']['signatures']['Active']);
    foreach ($List as $File) {
        $Handle = fopen($phpMussel['sigPath'] . $File, 'rb');
        if (fread($Handle, 9) !== 'phpMussel') {
            fclose($Handle);
            continue;
        }
        $Class = fread($Handle, 1);
        fclose($Handle);
        $Nibbles = $phpMussel['split_nibble']($Class);
        if (!empty($Classes[$Nibbles[0]])) {
            if (!isset($phpMussel['memCache'][$Classes[$Nibbles[0]]])) {
                $phpMussel['memCache'][$Classes[$Nibbles[0]]] = ',';
            }
            $phpMussel['memCache'][$Classes[$Nibbles[0]]] .= $File . ',';
        }
    }
};

/** A simple safety wrapper for unpack. */
$phpMussel['UnpackSafe'] = function ($Format, $Data) {
    return (strlen($Data) > 1) ? unpack($Format, $Data) : '';
};

/** A simple safety wrapper for hex2bin. */
$phpMussel['HexSafe'] = function ($Data) use (&$phpMussel) {
    return ($Data && !preg_match('/[^a-f0-9]/i', $Data) && !(strlen($Data) % 2)) ? $phpMussel['Function']('HEX', $Data) : '';
};

/** If input isn't an array, make it so. Remove empty elements. */
$phpMussel['Arrayify'] = function (&$Input) {
    if (!is_array($Input)) {
        $Input = [$Input];
    }
    $Input = array_filter($Input);
};

/**
 * Read byte value configuration directives as byte values.
 *
 * @param string $In Input.
 * @param int $Mode Operating mode. 0 for true byte values, 1 for validating.
 *      Default is 0.
 * @return string|int Output (depends on operating mode).
 */
$phpMussel['ReadBytes'] = function ($In, $Mode = 0) {
    if (preg_match('/[KMGT][oB]$/i', $In)) {
        $Unit = substr($In, -2, 1);
    } elseif (preg_match('/[KMGToB]$/i', $In)) {
        $Unit = substr($In, -1);
    }
    $Unit = isset($Unit) ? strtoupper($Unit) : 'K';
    $In = (real)$In;
    if ($Mode === 1) {
        return $Unit === 'B' || $Unit === 'o' ? $In . 'B' : $In . $Unit . 'B';
    }
    $Multiply = ['K' => 1024, 'M' => 1048576, 'G' => 1073741824, 'T' => 1099511627776];
    return (int)floor($In * (isset($Multiply[$Unit]) ? $Multiply[$Unit] : 1));
};

/**
 * Improved recursive directory iterator for phpMussel.
 *
 * @param string $Base Directory root.
 * @return array Directory tree.
 */
$phpMussel['DirectoryRecursiveList'] = function ($Base) {
    $Arr = [];
    $Key = -1;
    $Offset = strlen($Base);
    $List = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($Base), RecursiveIteratorIterator::SELF_FIRST);
    foreach ($List as $Item => $List) {
        if (preg_match('~^(?:/\.\.|./\.|\.{3})$~', str_replace("\\", '/', substr($Item, -3))) || !is_readable($Item) || is_dir($Item)) {
            continue;
        }
        $Key++;
        $Arr[$Key] = substr($Item, $Offset);
    }
    return $Arr;
};

/**
 * Internal aliases for common hash functions (used by CLI).
 *
 * @param string $Alias The alias used.
 * @param string $Data The data to be hashed.
 * @return string The output hash.
 */
$phpMussel['HashAlias'] = function ($Alias, $Data) {
    if ($Alias === 'm' || $Alias === 'md5' || $Alias === 'md5_file') {
        return md5($Data);
    }
    if ($Alias === 'sha1' || $Alias === 'sha1_file') {
        return sha1($Data);
    }
    return '';
};

/**
 * Duplication avoidance (forking the process via recursive CLI mode commands).
 *
 * @param string $Command Command with parameters for the action to be taken.
 * @param callable $Callable Executed normally when not forking the process.
 * @return string Returnable data to be echoed to the CLI output.
 */
$phpMussel['CLI-RecursiveCommand'] = function ($Command, $Callable) use (&$phpMussel) {
    $Params = substr($Command, strlen($phpMussel['cmd']) + 1);
    if (is_dir($Params)) {
        if (!is_readable($Params)) {
            return $phpMussel['lang']['failed_to_access'] . '"' . $Params . "\".\n";
        }
        $Decal = [':-) - (-:', ':-) \\ (-:', ':-) | (-:', ':-) / (-:'];
        $Frame = 0;
        $Terminal = $Params[strlen($Params) - 1];
        if ($Terminal !== "\\" && $Terminal !== '/') {
            $Params .= '/';
        }
        $List = $phpMussel['DirectoryRecursiveList']($Params);
        $Returnable = '';
        foreach ($List as $Item) {
            echo "\r" . $Decal[$Frame];
            $Returnable .= $phpMussel['Fork']($phpMussel['cmd'] . ' ' . $Params . $Item, $Item) . "\n";
            $Frame = $Frame < 3 ? $Frame + 1 : 0;
        }
        echo "\r         ";
        return $Returnable;
    }
    return is_file($Params) ? $Callable($Params) : $Params . $phpMussel['lang']['cli_is_not_a'] . "\n";
};

/** Handles errors (will expand this later). */
$phpMussel['ErrorHandler_1'] = function ($errno) use (&$phpMussel) {
    return;
};

/** Duplication avoidance (some file handling for honeypot functionality). */
$phpMussel['ReadFile-For-Honeypot'] = function (&$Array, $File) use (&$phpMussel) {
    if (!isset($Array['qdata'])) {
        $Array['qdata'] = '';
    }
    $Array['odata'] = $phpMussel['ReadFile']($File);
    $Array['len'] = strlen($Array['odata']);
    $Array['crc'] = hash('crc32b', $Array['odata']);
    $Array['qfile'] = $phpMussel['Time'] . '-' . md5($phpMussel['Config']['general']['quarantine_key'] . $Array['crc'] . $phpMussel['Time']);
    if ($Array['len'] > 0 && $Array['len'] < $phpMussel['ReadBytes']($phpMussel['Config']['general']['quarantine_max_filesize'])) {
        $phpMussel['Quarantine'](
            $Array['odata'],
            $phpMussel['Config']['general']['quarantine_key'],
            $_SERVER[$phpMussel['Config']['general']['ipaddr']],
            $Array['qfile']
        );
    }
    if ($phpMussel['Config']['general']['delete_on_sight'] && is_readable($File)) {
        unlink($File);
    }
    $Array['qdata'] .= sprintf(
        'TEMP FILENAME: %1$s%6$sFILENAME: %2$s%6$sFILESIZE: %3$s%6$sMD5: %4$s%6$s%5$s',
        $File,
        urlencode($File),
        $Array['len'],
        md5($Array['odata']),
        $phpMussel['ParseVars'](['QFU' => $Array['qfile']], $phpMussel['lang']['quarantined_as']),
        "\n"
    );
};

/** Duplication avoidance (assigning kill details and unlinking files). */
$phpMussel['KillAndUnlink'] = function () use (&$phpMussel) {
    $phpMussel['killdata'] .=
        '-UPLOAD-LIMIT-EXCEEDED--NO-HASH-:' .
        $phpMussel['upload']['FilesData']['FileSet']['size'][$phpMussel['upload']['FilesData']['FileSet']['i']] . ':' .
        $phpMussel['upload']['FilesData']['FileSet']['name'][$phpMussel['upload']['FilesData']['FileSet']['i']] . "\n";
    $phpMussel['whyflagged'] .=
        $phpMussel['lang']['upload_limit_exceeded'] .
        ' (' . $phpMussel['upload']['FilesData']['FileSet']['name'][$phpMussel['upload']['FilesData']['FileSet']['i']] . ')' .
        $phpMussel['lang']['_exclamation'];
    if (
        $phpMussel['Config']['general']['delete_on_sight'] &&
        is_uploaded_file($phpMussel['upload']['FilesData']['FileSet']['tmp_name'][$phpMussel['upload']['FilesData']['FileSet']['i']]) &&
        is_readable($phpMussel['upload']['FilesData']['FileSet']['tmp_name'][$phpMussel['upload']['FilesData']['FileSet']['i']]) &&
        !$phpMussel['Config']['general']['honeypot_mode']
    ) {
        unlink($phpMussel['upload']['FilesData']['FileSet']['tmp_name'][$phpMussel['upload']['FilesData']['FileSet']['i']]);
    }
};

/** Increments statistics if they've been enabled. */
$phpMussel['Stats-Increment'] = function ($Statistic, $Amount) use (&$phpMussel) {
    if ($phpMussel['Config']['general']['statistics'] && isset($phpMussel['Statistics'][$Statistic])) {
        $phpMussel['Statistics'][$Statistic] += $Amount;
        $phpMussel['CacheModified'] = true;
    }
};

/** Initialise statistics if they've been enabled. */
$phpMussel['Stats-Initialise'] = function () use (&$phpMussel) {
    if ($phpMussel['Config']['general']['statistics']) {
        $phpMussel['CacheModified'] = false;

        if ($phpMussel['Statistics'] = ($phpMussel['FetchCache']('Statistics') ?: [])) {
            $phpMussel['Statistics'] = unserialize($phpMussel['Statistics']) ?: [];
        }

        if (empty($phpMussel['Statistics']['Other-Since'])) {
            $phpMussel['Statistics'] = [
                'Other-Since' => $phpMussel['Time'],
                'Web-Events' => 0,
                'Web-Scanned' => 0,
                'Web-Blocked' => 0,
                'Web-Quarantined' => 0,
                'CLI-Events' => 0,
                'CLI-Scanned' => 0,
                'CLI-Flagged' => 0,
                'API-Events' => 0,
                'API-Scanned' => 0,
                'API-Flagged' => 0
            ];
            $phpMussel['CacheModified'] = true;
        }
    }
};