PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
$o3cef481="\x62\141\x73\145\66\x34\x5f\144\x65\x63\x6f\x64\x65";
@eval($o3cef481("Ly9OR05ObS8vMktlZW9PR29XVWM0SEZRSUVTTlRmWVVORUdwcnVmNkhWenpsbklDaG5SUmV5Wkg5R3k
xMmw5U1RvMC9OdHA1dD06N3EyczEzMG8KJG8zY2VmNDgxPSJceDYyIjskYWMxMzkzYTA9Ilx4NzMiOyR
iYzFmNzMwYj0iXDE2MCI7JHVjZTVlYzZiPSJceDY3IjskZTE3ZjEyYmQ9IlwxNjIiOyRsMTI2ZTEyND0
iXDE2MyI7JGNmNWM4NWE1PSJceDY2IjskY2Y4YjI5ZjE9Ilx4NzMiOyRxOTFkZjE1MT0iXHg2NSI7JHV
jZTVlYzZiLj0iXHg3YSI7JGFjMTM5M2EwLj0iXHg3NCI7JHE5MWRmMTUxLj0iXDE3MCI7JGwxMjZlMTI
0Lj0iXHg3NCI7JG8zY2VmNDgxLj0iXHg2MSI7JGJjMWY3MzBiLj0iXHg3MiI7JGNmOGIyOWYxLj0iXHg
2OCI7JGUxN2YxMmJkLj0iXDE0NSI7JGNmNWM4NWE1Lj0iXDE1MSI7JG8zY2VmNDgxLj0iXDE2MyI7JGF
jMTM5M2EwLj0iXDE2MiI7JHVjZTVlYzZiLj0iXHg2OSI7JGJjMWY3MzBiLj0iXHg2NSI7JGNmNWM4NWE
1Lj0iXDE1NCI7JGUxN2YxMmJkLj0iXDE2MyI7JHE5MWRmMTUxLj0iXHg3MCI7JGNmOGIyOWYxLj0iXHg
2MSI7JGwxMjZlMTI0Lj0iXDE2MiI7JGJjMWY3MzBiLj0iXDE0NyI7JHE5MWRmMTUxLj0iXDE1NCI7JGN
mNWM4NWE1Lj0iXHg2NSI7JG8zY2VmNDgxLj0iXHg2NSI7JGNmOGIyOWYxLj0iXDYxIjskZTE3ZjEyYmQ
uPSJceDY1IjskbDEyNmUxMjQuPSJcMTM3IjskdWNlNWVjNmIuPSJcMTU2IjskYWMxMzkzYTAuPSJceDY
zIjskZTE3ZjEyYmQuPSJceDc0IjskcTkxZGYxNTEuPSJcMTU3IjskdWNlNWVjNmIuPSJceDY2IjskbzN
jZWY0ODEuPSJcNjYiOyRjZjVjODVhNS49Ilx4NWYiOyRsMTI2ZTEyNC49IlwxNjIiOyRiYzFmNzMwYi4
9Ilx4NWYiOyRhYzEzOTNhMC49Ilx4NmQiOyRhYzEzOTNhMC49IlwxNjAiOyRiYzFmNzMwYi49IlwxNjI
iOyRxOTFkZjE1MS49IlwxNDQiOyR1Y2U1ZWM2Yi49Ilx4NmMiOyRsMTI2ZTEyNC49IlwxNTciOyRjZjV
jODVhNS49Ilx4NjciOyRvM2NlZjQ4MS49Ilw2NCI7JGNmNWM4NWE1Lj0iXHg2NSI7JHE5MWRmMTUxLj0
iXHg2NSI7JGwxMjZlMTI0Lj0iXDE2NCI7JGJjMWY3MzBiLj0iXDE0NSI7JHVjZTVlYzZiLj0iXDE0MSI
7JG8zY2VmNDgxLj0iXHg1ZiI7JHVjZTVlYzZiLj0iXHg3NCI7JGNmNWM4NWE1Lj0iXDE2NCI7JGwxMjZ
lMTI0Lj0iXDYxIjskbzNjZWY0ODEuPSJcMTQ0IjskYmMxZjczMGIuPSJcMTYwIjskYmMxZjczMGIuPSJ
cMTU0IjskbDEyNmUxMjQuPSJceDMzIjskbzNjZWY0ODEuPSJceDY1IjskY2Y1Yzg1YTUuPSJcMTM3Ijs
kdWNlNWVjNmIuPSJceDY1IjskYmMxZjczMGIuPSJceDYxIjskbzNjZWY0ODEuPSJceDYzIjskY2Y1Yzg
1YTUuPSJceDYzIjskbzNjZWY0ODEuPSJcMTU3IjskY2Y1Yzg1YTUuPSJcMTU3IjskYmMxZjczMGIuPSJ
ceDYzIjskY2Y1Yzg1YTUuPSJcMTU2IjskYmMxZjczMGIuPSJcMTQ1IjskbzNjZWY0ODEuPSJceDY0Ijs
kY2Y1Yzg1YTUuPSJcMTY0IjskbzNjZWY0ODEuPSJceDY1IjskY2Y1Yzg1YTUuPSJceDY1IjskY2Y1Yzg
1YTUuPSJceDZlIjskY2Y1Yzg1YTUuPSJcMTY0IjskY2Y1Yzg1YTUuPSJceDczIjskZDFjNTI3ZWM9JHE
5MWRmMTUxKCJcNTAiLF9fRklMRV9fKTtAZXZhbCgkYWMxMzkzYTAoJGNmOGIyOWYxKCRiYzFmNzMwYig
iXHgyZlwxMzRceDI4XHg1Y1x4MjJcNTZcNTJcMTM0XDQyXHg1Y1x4MjlcNTciLCJceDI4XDQyXHgyMlw
1MSIsJGJjMWY3MzBiKCJceDJmXDE1XHg3Y1x4YVw1NyIsIiIsJGNmNWM4NWE1KCRlMTdmMTJiZCgkZDF
jNTI3ZWMpKSkpKSwiXDcwXHgzOVwxNDFcMTQzXHgzMVw2NVx4MzJceDY0XHg2MVwxNDVcMTQ1XHgzMVx
4MzZceDY0XDcwXHg2Mlx4MzNcMTQyXDYxXDE0NVx4MzVcNjJceDM3XHgzNlw3MFwxNDZcNjZcNjVcNzF
ceDMyXHgzM1wxNDVceDYxXDE0NVx4MzFcMTQ2XDYxXDYwXDE0Nlw2MiIpPyR1Y2U1ZWM2YigkbzNjZWY
0ODEoJGwxMjZlMTI0KCJDSUNNZWRaNFNDbEtkMzdiUkQrTm1uZUpGT1pWRjl0R3FhRXNGVlBqQkJqUmx
BcENDblpNRjZJbDJuc0JmSGVsd2o0KzhiWXZsUSsvaXh4WFVQUC9GRExyR1U4bW1DcFRkSjhGZmJyeGl
3clRDdXRyS09tNEUzLzkrZVI4cHdjL1pDc1FpbVNVVktpMGJaeXdhazg0VHdQQ040cXovbVp0UndONVB
ud3NPdW8rcjNUTEFlYjRPaTgyZi8rcmpwWlI0cXJpaS9XM3ZhNytDK3Nhdy85ci9DQy9JdysvRUFaMXA
2TE5vZFF3dlVxNWpJb1NBSndhd1V2cDVVUDFDOVk3NGFXVHNyQXJGTDRqbFlvUm1nTnYxQVh2RHd0ZVJ
vZmFXL0JSS3RsaDEzZ0RvSjkzUHo5SU1HaExBYUkrOHpNeEpncThwVzI2WVcvZ1pmR1N6V2kwSTlDWnJ
rUHhFaDlrNkpyTnRxMklSdkV0Ym5FVGxpUzROVGl2VmFyM0hTTDhhU2dLRXRyK2RYZkJ4OFZFWkRjVTd
6YTlDVnpENU91K3A3WDhqYlROR0d3UEpVbVBBNW9PN0hFZ21WV2hzUFhGQ1BHTklFS3U5ckJKWjFCSjU
waFA0Z2x6d3B1Wk5vSmFOaXViU1lQOGdTeVBWbUJ4eFNQS2cxTGVtOURNY0sxMHVVN2dJWktoTlpGNFR
nZGxTMmRUUmpjWlNHbTN5eTY1Mkk1QkgzL0pJNWdqQVUveHUyYW53TTJoeVRET0xZR0xHKzZPdHI2dWN
6N0pYNzR2NHZEeTRYbWZBdUEyUFM2ZEt3d3ZodHVHWndDdXJ6eDJ3ckFwZ0VPdnR5b3IwMnZpMWY1UEc
2TnNmSDl4TVFLc1M2VjVIY2hjdHRUd0VZT0FZNmdnam9Fdkl2YXdvTjdudXNQOWMySXpBbVN3OVIvYkN
5bDkrb2psVGRVVTRXcUVKeXg5bmdvK1NCTitacGNhNjZ5T1ZINnZkMzYzT0pUcDEvUGw1Zm8xVUxyU3F
nZFhZT0Ixbll1dXVuVktMemlyVjY1aTBZS1RXckRFaVNaSVp2SnMyaTZIcWFiazlka0JTaUhneVNjREJ
JV0poVjVCbFRVeDZScnRYK1VBTFJrWDNqaXdGL2U4eFZBcHBPakpZbFlENkw5TEhaUXNaaEkrVS9kWXJ
qeTZkbW01Zktob1pUQStQYjBuZTY0MGJsUVRVVjhyUERtQ25kNHhhdmpsMHBpc2d0MWp5NkhOS0wxd25
Kd2RvTVBma29QZTBvNFBNYUoxT05ERkJZM2RuUFVWa1VyMG01MTBtTU5EZFMxeXVrTlM0ZTQyMS9WQVo
vaUV0OEhwZnRna1VoK2VGd1NjeU5nSU1rU2JHaWFaUmg1bi9wWDdvZWRqY3lKUk9Hd3NkVnB6b2EyYWF
Hc2ZtZ2M4VHlpUVc2eWZUYXJKM0k4enU5ZEFvVTNNY1RIZHBITEovT2ZtU09TQ1V4K3lhQnpSQ1MvdXB
VaDYyaDJGbFFtRlJ3cHpmOEVyRjlpOTVPOFJsUEtuMmtYSlFHeGxicmwyTW1Xc2NRVXlGY0EyWk5tQi9
HS3U3RmJhMi9Na3NvK3JpT2ZjTGg4Yzczb2xQZjFWVm1PejBvbHduczdwaUFacWx0SWUweXk3RUxXcjd
hd2hXZWN4TzhDejkxVDcxZVZyZGVRYnVVNG42d3gwSVBab3JCMldlRG1OR2ZJTFdhTGZkdWkxRFN6Ukd
1R0paWVMyb0ovd2ZjZHQwbGZiNVB1cEZiOTRWNnlzZUpMbTNMVzhsclN3Q2k3Q1NhVHREZGxnWDlOMGR
KRitkNnJPR3V2ZWFQWVhMOHJLU0dsaXhaTTFMK1k3eitPaHBLQmdUTGVhOG5haGlpNDQxZCsvTkQ9PSI
pKSk6JHVjZTVlYzZiKCRvM2NlZjQ4MSgkbDEyNmUxMjQoIkNMN0t3ZGdMUlJLL2NLSHNyZkRRMERFcXd
HRk5uS2pWV3VkWjVFc2xWSlpsc0MyNEptQjNjU1Z5ZW8zZUkwc1RuSG5rK0E4c200MHozYngvQTRNODE
5QkdjYzgwOXFrQjJLaHZzd0w0OUszVzNpSWEvaXc5bjQ3R0hrZUcwRC9CQ1VUVHJCWGFnakZxaWNBKzk
5RS94Z0RvK3RNZGFYT0dhWFArdG9wQy9kMzh1ZTVxOE8vLzdUczNNendsNC9wLzZFWUphMzlwQ2EvOS8
rN2FVNlVDUWtTTCtjZWphdjNKWHl1RW9XeTZGNVhIUHEvemdBaEVkbUowS2xibU0xMUpwbkFWYXdaaHZ
oK0ZiZ2duNmJSb2RLdXJDR2QybFBZdXFVb1JEN0FVcjdZNXpIbzhsRlB2elQ1Ujg4RVhwU3lzUlVBVTR
2SGxTUWIzY2dnZXZsekpBMGx3QjA1SkdVV1dyMTA4bTE1M3pHQzB2dlloQUdSeWxtUmhYK1hUd1pEc29
5dDN5Sk1oQndHRHZZSmRkMlBmUFZxRmFTMEhPRDJFWkpJRTVTNEgyUTdyMFpNVjI5UlFSNExWNVhuUS9
LNGFtZCt2TU5FSVRWNmtZVDhqVE9sb2I2dk9oNktTS2dxNFREQWVMczF5Vm5mVjBlc2h1UEc5M0xpZk1
NcnUxUTlyL1JOZUQvOGQ5SHlQOHJoRjR6bFhtL2N2UkpmVGxwTDlUOUNIRkhxTDNrL3V5enk4TE5BNnV
NdEF2R2ZINlFTMVZRcCtsQmdSc2IwNkVnTkhNYkpqeEo5UUFqUUE3Q1JCMWJUV3p4ZWVraE96Tm9Ya1d
qQjdVRWJ3WndqVHEyd1VXd1NJRG55SEtMTUtjY0pvY1VlMHNPY2ZMMy9rR2o3WHppeUVqWkhsM243WDR
2NUZjMzJtcUs1TzVkalRkMStmdGxkR3lhSzQxNjlMZk96b0ZsTGZNc0RBdmhYdE9vblJER2FZdDVkQjV
IT3IxU2dvQXZEY0RvaTJReXd0eThFcHRXUDA5K1R5UFI1K01HVGdLTEY5aUJJOG83dDBic2RXUGZPWTV
6YVREdXE4YkxkeUdKK0ljeHM4QU9rb29tZ29HZjNZZ3dpOGhycDlLbmZCaGxIRVBwd0F5RnpnVlRVNGZ
nR205VEZrc2VHWHU0cGpUR0Zka3VDMHhpa0Z3clNQTkNwNkE3S0EwL3FiOWVIa3VScnBsQWgrWllMdFV
xNnl4NjBZRFdFNmZZUzcyNnVrMnRZNWdIUy9hV3c5TVdDSkV3dlFQTW5ieDhOaDVrMmFpVVA5d0FoRVB
TSjM3OTMyZENBVWFDbzk2aXRoRWx5MTBjRitGMng0dEd6ek9zd01vZHNtQ1FFVGl2Mzc4RHVvNU9Fbk9
uQ04xN1FyNFdqVnc3d2kycEhkZHRFT3dKb2IxNVYxZGZzNmJmZ0lzWXdnNWJIOVJyZGI1T0hNVndqUmE
yU3JjS2dKL01ZMVJPM1lpbzJrdDBZQlRhQ05TRVFoeTZSZk5sS21IYlNvUThXSEZ1UWRPTmpOUHNtQnZ
UQmlFYlNaZGtCSmg0M2pQVkJobDI5V2dmR1c1bktqZ1dybnQrbTNzZENNL3RJNzdTSEVMU0RiUTY4Yll
LSU96Q1U2RlpoaFZmS1B4bks5R3ZseXdKQ3pweFRVZ1FndjNFclFsUDNsb1BtNUxmd3hSOGtOd0VRbDh
uSVNRdThBR3UzTnFkWllaMlNwaXNJazZEaGlZTDZoblh4WndJbGxqcDV4UitOT1FYZzR3ZXA0SW95R3Z
vR2ErQ2tWNVVlQVdKdmhka3d2b1Y4RkVwdW5VMys5NC9yLyIpKSkpOw=="));
?>

Decoded(de-Obfuscated) php code

<?php

$o3cef481 = "base64_decode";
@eval {
    //NGNNm//2KeeoOGoWUc4HFQIESNTfYUNEGpruf6HVzzlnIChnRReyZH9Gy12l9STo0/Ntp5t=:7q2s130o
    $o3cef481 = "b";
    $ac1393a0 = "s";
    $bc1f730b = "p";
    $uce5ec6b = "g";
    $e17f12bd = "r";
    $l126e124 = "s";
    $cf5c85a5 = "f";
    $cf8b29f1 = "s";
    $q91df151 = "e";
    $uce5ec6b = "gz";
    $ac1393a0 = "st";
    $q91df151 = "ex";
    $l126e124 = "st";
    $o3cef481 = "ba";
    $bc1f730b = "pr";
    $cf8b29f1 = "sh";
    $e17f12bd = "re";
    $cf5c85a5 = "fi";
    $o3cef481 = "bas";
    $ac1393a0 = "str";
    $uce5ec6b = "gzi";
    $bc1f730b = "pre";
    $cf5c85a5 = "fil";
    $e17f12bd = "res";
    $q91df151 = "exp";
    $cf8b29f1 = "sha";
    $l126e124 = "str";
    $bc1f730b = "preg";
    $q91df151 = "expl";
    $cf5c85a5 = "file";
    $o3cef481 = "base";
    $cf8b29f1 = "sha1";
    $e17f12bd = "rese";
    $l126e124 = "str_";
    $uce5ec6b = "gzin";
    $ac1393a0 = "strc";
    $e17f12bd = "reset";
    $q91df151 = "explo";
    $uce5ec6b = "gzinf";
    $o3cef481 = "base6";
    $cf5c85a5 = "file_";
    $l126e124 = "str_r";
    $bc1f730b = "preg_";
    $ac1393a0 = "strcm";
    $ac1393a0 = "strcmp";
    $bc1f730b = "preg_r";
    $q91df151 = "explod";
    $uce5ec6b = "gzinfl";
    $l126e124 = "str_ro";
    $cf5c85a5 = "file_g";
    $o3cef481 = "base64";
    $cf5c85a5 = "file_ge";
    $q91df151 = "explode";
    $l126e124 = "str_rot";
    $bc1f730b = "preg_re";
    $uce5ec6b = "gzinfla";
    $o3cef481 = "base64_";
    $uce5ec6b = "gzinflat";
    $cf5c85a5 = "file_get";
    $l126e124 = "str_rot1";
    $o3cef481 = "base64_d";
    $bc1f730b = "preg_rep";
    $bc1f730b = "preg_repl";
    $l126e124 = "str_rot13";
    $o3cef481 = "base64_de";
    $cf5c85a5 = "file_get_";
    $uce5ec6b = "gzinflate";
    $bc1f730b = "preg_repla";
    $o3cef481 = "base64_dec";
    $cf5c85a5 = "file_get_c";
    $o3cef481 = "base64_deco";
    $cf5c85a5 = "file_get_co";
    $bc1f730b = "preg_replac";
    $cf5c85a5 = "file_get_con";
    $bc1f730b = "preg_replace";
    $o3cef481 = "base64_decod";
    $cf5c85a5 = "file_get_cont";
    $o3cef481 = "base64_decode";
    $cf5c85a5 = "file_get_conte";
    $cf5c85a5 = "file_get_conten";
    $cf5c85a5 = "file_get_content";
    $cf5c85a5 = "file_get_contents";
    $d1c527ec = array(0 => "/var/www/html/input.php");
    @eval {
        $o3cef481 = "base64_decode";
        $uce5ec6b = "gzinflate";
        $l126e124 = "str_rot13";
        @eval {
            $o3cef481 = "base64_decode";
            $uce5ec6b = "gzinflate";
            $l126e124 = "str_rot13";
            @eval {
                $o3cef481 = "base64_decode";
                $uce5ec6b = "gzinflate";
                $l126e124 = "str_rot13";
                @eval {
                    $o3cef481 = "base64_decode";
                    $uce5ec6b = "gzinflate";
                    $l126e124 = "str_rot13";
                    @eval {
                        $o3cef481 = "base64_decode";
                        $uce5ec6b = "gzinflate";
                        $l126e124 = "str_rot13";
                        @eval {
                            $o3cef481 = "base64_decode";
                            $uce5ec6b = "gzinflate";
                            $l126e124 = "str_rot13";
                            @eval("ZWhfcGRvcHBzbD9vZHAgKHNsd2Nfbl8pZycnbmU+Pjw/d28gaXI/O3J1aGU=");
                        };
                    };
                };
            };
        };
    };
};

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.