I got bored again so I figured it would be fun to do a writeup on how you can study and deobfuscate FOPO.

First off it is a good idea to obtain a known script, and since FOPO is 'free' it is easy to just encode a simple "Hello World" application.

The standard code sample:

<?php
echo "Hello World";
?>

The obfuscated code sample:

<?php
/*
Obfuscation provided by FOPO - Free Online PHP Obfuscator: http://www.fopo.com.ar/
This code was created on Friday, March 9th, 2018 at 11:25 UTC from IP <yeah... no>
Checksum: dcd573cfee603b2699d1b1cc43ea4e72f3600a78
*/
$hcbeaa07="\x62\141\163\145\x36\x34\x5f\144\x65\x63\157\x64\x65";@eval($hcbeaa07(
"Ly9yNnQxWnNyZmtTeWllZGxzKzhYYWtXOEM1eVRpSm9DVVo1M0U5Q25RQ2RLcUhqUj06ci9tQSs4dTh0
M3NpTkQ9PTo3bzI1cTFucAokeTgwYjM0ZDc9Ilx4NjUiOyRwMjcyNjI2OD0iXDE2MiI7JGNiNDRmNzAwP
SJcMTYwIjskZjZiYWQxMmQ9IlwxNjMiOyRoZDg0NGQ5NT0iXHg3MyI7JHE5OTcxMjVjPSJceDczIjskcW
Q4YzM3N2M9Ilx4NjYiOyRtMjAxNzBkYT0iXDE0NyI7JGhjYmVhYTA3PSJcMTQyIjskcTk5NzEyNWMuPSJ
cMTY0IjskY2I0NGY3MDAuPSJceDcyIjskcDI3MjYyNjguPSJcMTQ1IjskbTIwMTcwZGEuPSJceDdhIjsk
aGQ4NDRkOTUuPSJceDc0IjskcWQ4YzM3N2MuPSJcMTUxIjskeTgwYjM0ZDcuPSJcMTcwIjskZjZiYWQxM
mQuPSJcMTUwIjskaGNiZWFhMDcuPSJcMTQxIjskcWQ4YzM3N2MuPSJcMTU0IjskcDI3MjYyNjguPSJceD
czIjskY2I0NGY3MDAuPSJcMTQ1IjskaGQ4NDRkOTUuPSJceDcyIjskcTk5NzEyNWMuPSJceDcyIjskZjZ
iYWQxMmQuPSJceDYxIjskeTgwYjM0ZDcuPSJcMTYwIjskaGNiZWFhMDcuPSJceDczIjskbTIwMTcwZGEu
PSJcMTUxIjskaGNiZWFhMDcuPSJcMTQ1IjskaGQ4NDRkOTUuPSJcMTQzIjskbTIwMTcwZGEuPSJceDZlI
jskcTk5NzEyNWMuPSJceDVmIjskY2I0NGY3MDAuPSJceDY3IjskeTgwYjM0ZDcuPSJcMTU0IjskZjZiYW
QxMmQuPSJcNjEiOyRxZDhjMzc3Yy49IlwxNDUiOyRwMjcyNjI2OC49Ilx4NjUiOyRjYjQ0ZjcwMC49Ilw
xMzciOyR5ODBiMzRkNy49Ilx4NmYiOyRxOTk3MTI1Yy49Ilx4NzIiOyRoZDg0NGQ5NS49IlwxNTUiOyRt
MjAxNzBkYS49Ilx4NjYiOyRwMjcyNjI2OC49IlwxNjQiOyRxZDhjMzc3Yy49IlwxMzciOyRoY2JlYWEwN
y49Ilw2NiI7JHFkOGMzNzdjLj0iXDE0NyI7JHk4MGIzNGQ3Lj0iXHg2NCI7JGNiNDRmNzAwLj0iXDE2Mi
I7JGhjYmVhYTA3Lj0iXHgzNCI7JHE5OTcxMjVjLj0iXHg2ZiI7JGhkODQ0ZDk1Lj0iXDE2MCI7JG0yMDE
3MGRhLj0iXDE1NCI7JHk4MGIzNGQ3Lj0iXDE0NSI7JHE5OTcxMjVjLj0iXHg3NCI7JG0yMDE3MGRhLj0i
XDE0MSI7JGhjYmVhYTA3Lj0iXHg1ZiI7JHFkOGMzNzdjLj0iXHg2NSI7JGNiNDRmNzAwLj0iXHg2NSI7J
G0yMDE3MGRhLj0iXHg3NCI7JGhjYmVhYTA3Lj0iXDE0NCI7JHE5OTcxMjVjLj0iXHgzMSI7JHFkOGMzNz
djLj0iXDE2NCI7JGNiNDRmNzAwLj0iXHg3MCI7JHE5OTcxMjVjLj0iXHgzMyI7JGhjYmVhYTA3Lj0iXHg
2NSI7JHFkOGMzNzdjLj0iXDEzNyI7JG0yMDE3MGRhLj0iXHg2NSI7JGNiNDRmNzAwLj0iXHg2YyI7JGNi
NDRmNzAwLj0iXHg2MSI7JHFkOGMzNzdjLj0iXHg2MyI7JGhjYmVhYTA3Lj0iXDE0MyI7JGhjYmVhYTA3L
j0iXHg2ZiI7JHFkOGMzNzdjLj0iXDE1NyI7JGNiNDRmNzAwLj0iXDE0MyI7JGhjYmVhYTA3Lj0iXDE0NC
I7JHFkOGMzNzdjLj0iXHg2ZSI7JGNiNDRmNzAwLj0iXDE0NSI7JGhjYmVhYTA3Lj0iXDE0NSI7JHFkOGM
zNzdjLj0iXHg3NCI7JHFkOGMzNzdjLj0iXDE0NSI7JHFkOGMzNzdjLj0iXHg2ZSI7JHFkOGMzNzdjLj0i
XDE2NCI7JHFkOGMzNzdjLj0iXDE2MyI7JGFkNzBkMDRlPSR5ODBiMzRkNygiXDUwIixfX0ZJTEVfXyk7Q
GV2YWwoJGhkODQ0ZDk1KCRmNmJhZDEyZCgkY2I0NGY3MDAoIlw1N1x4NWNcNTBcMTM0XDQyXHgyZVw1Ml
x4NWNceDIyXDEzNFx4MjlcNTciLCJcNTBcNDJcNDJceDI5IiwkY2I0NGY3MDAoIlw1N1x4ZFwxNzRceGF
cNTciLCIiLCRxZDhjMzc3YygkcDI3MjYyNjgoJGFkNzBkMDRlKSkpKSksIlwxNDNceDM3XHg2NFw2Mlw2
NVx4NjRceDYyXHg2NVwxNDZceDYzXHg2NVw2Mlx4MzBceDM0XDE0NFx4MzBceDM1XDYyXHgzOFwxNDZcN
jNcNjJceDM3XDE0M1w2MVw2MVw2MFx4MzRcMTQ1XHgzNFw2Mlw2NlwxNDJcMTQzXHgzOVw2MFw2NVw3MV
x4NjJcNzAiKT8kbTIwMTcwZGEoJGhjYmVhYTA3KCRxOTk3MTI1YygiQ0lDTXdkQVZSQ2xLMXdtMHZ0cUd
MTmNEbjZEU3RteFpoUVIzOHRpelpldjRvNzUrQ25CcVhGeElUTXpYdlNXVzlyWk1DOVZiamh6c1UzcWpX
QTRTN3ZnQTN5cVYzSXBGM2hVa1F4dzZHcTk0Y0E1UzN0VTF5Mzk4L250VlVBTzRSaTNKMDNxTmltMmJna
nFaM2tsK1pzN3M4NCt0TDF4blJTRzhTaWpCK2VKTmtVMnlmYXMvRWN3OWFkMHhoUkNsNCtpc3FWN0Q1OS
tMbWs5L1lpbTUxK2FtNDZEUitjV2p6YXh2WWlXUGxlQ0VScS9zUHJOWjRxZm11MGtHeVM2MWJNUk1mdGl
NOXZFUThRbXdhTUFVUHVBais5UFl0cnpVdEtNNVVwd2NvT1NVYzIvcUY3L0c1bmlGNEh1WWRIcVRpYnM1
SnFUS3NHR2padjA2WVFNanp3WlNhejZzbFZOYkh5QmY4Y1cvaHZxOVVJTzQ0cG9RK1hOSzFIQ3dyelBmN
E9FV1hlcTBUMHhtK2VBK0xFdFEyZHhLZEtOdFAvWW9Ha1lmcEFkakxLdDFUWUxIUHBHUVY4L1BJaXByei
tNc1hvYWpOdU9Bc0h4eXhmMmt4TzRXYVBXeUI3THBmNkVIb0dJZnMraXdEVG92WXVqb0pVcVBWN3Jva0F
kdzFqeFV6NGJkUnJUQlRKcWhuSjVvNG5UMTI0MDYvc0hEeHdhdjRHSFpyVzRGZXo0OEVqTFB5WWFpVHJ1
c2hVVVhnNURuSitGUHJjRlo4Umw0bDZMOWF4b1VCc08xZUhnc2V4T1hBL0srTlZXdDNKR1lkSWo2SzNtc
m40Rnd1RGVJWkdXU1I3OUFIckRhdmZGaHhxMGFKdlp1TU5LbjZoR3FtWUZBZjdobTVNS29sTnhueUlIVy
ttZHlOV0tMZHluSlF4ZXBXSnBLNVg0MnVEOXlidDc5bG1MRXlDU1RZWVd5b3ZsM1N6ZUZaM21sdnZ0MXh
XMll6ZXhENzQ4SUQ1RjZ0Q1hRK3R2VzAzNHlRYkxtYTI4b1hUNUNMd2Y5ZjdrZ00yNHYrOXl5N0ZIaS9X
aGN2YTNMNTVtV0xCQWV0OVRRMEdIU1gwRG8wb3VqYVFXdUFTZWRWUTBNbkQxS0pRMWlhVnNGa2tiMXU3Q
mEyWkRiVUxEeTR2OGhSbnBLOU1FbWVVRDF3bnUvZ05GY0x2OFptQ1Z4dnhzWEY2ZkFEL3VkWWVwQWJKUj
cyd0FabG13WFQ1QUNYczlqcXJoTkpXeDliaUZvNVhDaTFuZXh3Y3c2VkhJQ0FVWmh4ZWQ5cnBGRlU4eEN
sS0tXaVh0dWpIWnNxOWlPckFYRlV2ZDVuRnc1WjFvZFhGdU5kS3dJRGVYNnB1SzhhRGx6RVlLRzlNTWlk
K1FWTTUxdUtWeUVld3FBQi9TaEExc3A0VEtsbHB5bXJJOTJCTHU4bGlNWSt1WUp1VGZ4UjNIQXBsYXJRe
lFTSXlsa1VwQVE3SUVtNWFzUGJzSWZjZ0QyM2pvWTFFME9CM2ZmdS9paEJLT3VBT0JnSk9KTU5GNGZTK1
I4bTZrU0lna3RaaDJrMVdRUm1wWGlCL0cwNDNhbHd1WFA4L0JubXR5TWRZdUtmYVI2N1IycWlaVmxBSkh
5V0xqRStYM2t6U21ubHFRbnBYR0l4cFRGZ3M3Z1hYUFNaMHBvZy9FU2lTRStlck1UWkcyVFhKRlBpSWVJ
U29QRFZrZGFxWExTRkV4WWRlbjhUR3hpdSsrQ21zWElVODhvVXlYcElrcEhlMHRYNFJZYisyVktXYWY0U
HBZZjkwTCtSNGhKVWd4UUpsbExKczc4K3NVQyszbTlPaj09IikpKTokbTIwMTcwZGEoJGhjYmVhYTA3KC
RxOTk3MTI1YygiQ0lVVXdoQUxRQ2xLa3VrNmJMQWxEekJOeUZJbzRGeWFQNzRibDFuMGZpSzE0NTdxVER
WUkhGRmV2dE8vSVR6RmttU1AvL2w0YkRHMkdpRjIwL3VnYzh3b3d5WjN2ZXdnTUNUVGtCOEpGYWxDL2Za
YkRLNTgvSnRrT1hKRVlVN21xNGQrYkdHMmVoakFXbmEzandnVzRhL0FDNERhbDlWYkVkb3N1WXBFK2QxU
mlMMWsrYXM5SWkvaEhydkFqdysrL2YzS2hDYTg2L1k1NDgrOWEzK1NDdzk0U3FuMmVQTnBUOE5jUlhuZn
hYbVFCVEZ5RmFHMUdTZ2hWVk82OWYzTnM5R0R5UzBpSXFNYjN4NWJTU2VQSUFtenF2MWhzVmpHUWwyU3F
wMHMvUHRuaHlvbkJoMit6OE05UTdCR3NLKzF1dVhpa2tKQkE0ZE9yTUhqd0NJKzhIdlgxUnNnVnN6d3FI
MExTbGVhRkkvbDRKUmx3MlM1SlZCTWpZY2FkcUJwcmJqQXUvYlJkNHBEZUQ4c0JzdnB1eFc2RVBQNDRuU
GNvSlJ2dHZwUnptanZaVjRZRDl4NVhjbDNuc3FSeGppa1NaOEx4dXFsTG4vN3JsdEpXSVpjUDJPcmxwV0
1XSytqWWkwbEZTa054ZWtpZ0tqaUtKalprdXh4cFZnc0xmMlRZOURqY1YrR0twRVJKek1LeWIwbmNQSUl
xV1RtUVJsdUE5bW82RHRVdVJsZCtheDlubDQxeVA3YmRYM0l1dUh2SHAyU09zMnAxYzBKZnBRRU02VEht
YUtNdWRjOHc3U2R1VE9BTk1Od3ZZdWF5NDFzWkZySjFJZHhlTHFnTVF1djI4bjN6bFRFOVhVWWh6bEp0W
jhDckxtVUwxSjJ4bi9rVUVxOEYzemdPa2dWWmU3T3FtYWVGelBwWHpmSlZjSkptNWloaFlKZGFJT29DZE
g1dWtZdjAyL3BScCtBbVlSR08zdzhmU3BBdXgxNVI0Nzc1dFA0MS9naEpsY1l3NXNRVVYya1NXS1lmcit
WbDNVaHBJN2I2TGNXYWgxTm96dE1hdWxDd3hyL3NOdGdoTERxSlFPQkVDYUZyOElBKzRjTElLVzFXU09x
d2VqdlJJcTBFaTh5RGtUbjBaVncweVVQQXduM0R6RFEwcWVuNzhtUjUzWCthNUh1bnVkNkZxQjYwZlZ1R
XRDNm9RVitSMmdKYlFON1FobTRDWHlhV25abFk4Y0Z6cDBTZEpxblNNdG5TcnYrWFBubDBkUXh4V0o0Vn
k3bTVuVFVWYlo1YlFybnYrbXQyWk9XNEtaWm9waDhnWjFNNFdTTFZrRGxqVXptYnNUbGJZQnE4Wjc0RGx
2YnRVREJvK2pOQXRTZGlFcHUzN0NNc1NXcExjVTZQeCthYU5aNmN5N2I1djVjTzRMZ1VYZ0JuNVVCQ0tI
QVN3VHJOZW0yZkhhbkQ3ZkM0SDZmZnZ6djB4U2IrMHBreTdha1dXK2lKc0RxenNuN0liL04wOEJuT2V1M
ytReXpOdE5VU1NrREo1QmxWR2I4bm9qbnJyZDduWXJUOXJOTUVFTCtXRXd2a1QxZjlWNWpobGZiQTNPdn
hPcVNvZ2YwQzFxc3JzOWFaamluazA5cnhNZ0pDNWRWOEFicU12R0R4MlpwaE5xY2xQSmtKSER3cXp4STk
0ZTJyVEx2YllhNCtzVUNCNzUrTkQ9PSIpKSkpOw=="));
?>

Throw the code into a PHP formatter and we get something more readable:

<?php
$hcbeaa07 = "\x62\141\163\145\x36\x34\x5f\144\x65\x63\157\x64\x65";
@eval($hcbeaa07("Ly9yNnQxWnNyZmtTeWllZGxzKzhYYWtXOEM1eVRpSm9DVVo1M0U5Q25RQ2RLcUhqUj06ci9tQSs4dTh0
M3NpTkQ9PTo3bzI1cTFucAokeTgwYjM0ZDc9Ilx4NjUiOyRwMjcyNjI2OD0iXDE2MiI7JGNiNDRmNzAwP
SJcMTYwIjskZjZiYWQxMmQ9IlwxNjMiOyRoZDg0NGQ5NT0iXHg3MyI7JHE5OTcxMjVjPSJceDczIjskcW
Q4YzM3N2M9Ilx4NjYiOyRtMjAxNzBkYT0iXDE0NyI7JGhjYmVhYTA3PSJcMTQyIjskcTk5NzEyNWMuPSJ
cMTY0IjskY2I0NGY3MDAuPSJceDcyIjskcDI3MjYyNjguPSJcMTQ1IjskbTIwMTcwZGEuPSJceDdhIjsk
aGQ4NDRkOTUuPSJceDc0IjskcWQ4YzM3N2MuPSJcMTUxIjskeTgwYjM0ZDcuPSJcMTcwIjskZjZiYWQxM
mQuPSJcMTUwIjskaGNiZWFhMDcuPSJcMTQxIjskcWQ4YzM3N2MuPSJcMTU0IjskcDI3MjYyNjguPSJceD
czIjskY2I0NGY3MDAuPSJcMTQ1IjskaGQ4NDRkOTUuPSJceDcyIjskcTk5NzEyNWMuPSJceDcyIjskZjZ
iYWQxMmQuPSJceDYxIjskeTgwYjM0ZDcuPSJcMTYwIjskaGNiZWFhMDcuPSJceDczIjskbTIwMTcwZGEu
PSJcMTUxIjskaGNiZWFhMDcuPSJcMTQ1IjskaGQ4NDRkOTUuPSJcMTQzIjskbTIwMTcwZGEuPSJceDZlI
jskcTk5NzEyNWMuPSJceDVmIjskY2I0NGY3MDAuPSJceDY3IjskeTgwYjM0ZDcuPSJcMTU0IjskZjZiYW
QxMmQuPSJcNjEiOyRxZDhjMzc3Yy49IlwxNDUiOyRwMjcyNjI2OC49Ilx4NjUiOyRjYjQ0ZjcwMC49Ilw
xMzciOyR5ODBiMzRkNy49Ilx4NmYiOyRxOTk3MTI1Yy49Ilx4NzIiOyRoZDg0NGQ5NS49IlwxNTUiOyRt
MjAxNzBkYS49Ilx4NjYiOyRwMjcyNjI2OC49IlwxNjQiOyRxZDhjMzc3Yy49IlwxMzciOyRoY2JlYWEwN
y49Ilw2NiI7JHFkOGMzNzdjLj0iXDE0NyI7JHk4MGIzNGQ3Lj0iXHg2NCI7JGNiNDRmNzAwLj0iXDE2Mi
I7JGhjYmVhYTA3Lj0iXHgzNCI7JHE5OTcxMjVjLj0iXHg2ZiI7JGhkODQ0ZDk1Lj0iXDE2MCI7JG0yMDE
3MGRhLj0iXDE1NCI7JHk4MGIzNGQ3Lj0iXDE0NSI7JHE5OTcxMjVjLj0iXHg3NCI7JG0yMDE3MGRhLj0i
XDE0MSI7JGhjYmVhYTA3Lj0iXHg1ZiI7JHFkOGMzNzdjLj0iXHg2NSI7JGNiNDRmNzAwLj0iXHg2NSI7J
G0yMDE3MGRhLj0iXHg3NCI7JGhjYmVhYTA3Lj0iXDE0NCI7JHE5OTcxMjVjLj0iXHgzMSI7JHFkOGMzNz
djLj0iXDE2NCI7JGNiNDRmNzAwLj0iXHg3MCI7JHE5OTcxMjVjLj0iXHgzMyI7JGhjYmVhYTA3Lj0iXHg
2NSI7JHFkOGMzNzdjLj0iXDEzNyI7JG0yMDE3MGRhLj0iXHg2NSI7JGNiNDRmNzAwLj0iXHg2YyI7JGNi
NDRmNzAwLj0iXHg2MSI7JHFkOGMzNzdjLj0iXHg2MyI7JGhjYmVhYTA3Lj0iXDE0MyI7JGhjYmVhYTA3L
j0iXHg2ZiI7JHFkOGMzNzdjLj0iXDE1NyI7JGNiNDRmNzAwLj0iXDE0MyI7JGhjYmVhYTA3Lj0iXDE0NC
I7JHFkOGMzNzdjLj0iXHg2ZSI7JGNiNDRmNzAwLj0iXDE0NSI7JGhjYmVhYTA3Lj0iXDE0NSI7JHFkOGM
zNzdjLj0iXHg3NCI7JHFkOGMzNzdjLj0iXDE0NSI7JHFkOGMzNzdjLj0iXHg2ZSI7JHFkOGMzNzdjLj0i
XDE2NCI7JHFkOGMzNzdjLj0iXDE2MyI7JGFkNzBkMDRlPSR5ODBiMzRkNygiXDUwIixfX0ZJTEVfXyk7Q
GV2YWwoJGhkODQ0ZDk1KCRmNmJhZDEyZCgkY2I0NGY3MDAoIlw1N1x4NWNcNTBcMTM0XDQyXHgyZVw1Ml
x4NWNceDIyXDEzNFx4MjlcNTciLCJcNTBcNDJcNDJceDI5IiwkY2I0NGY3MDAoIlw1N1x4ZFwxNzRceGF
cNTciLCIiLCRxZDhjMzc3YygkcDI3MjYyNjgoJGFkNzBkMDRlKSkpKSksIlwxNDNceDM3XHg2NFw2Mlw2
NVx4NjRceDYyXHg2NVwxNDZceDYzXHg2NVw2Mlx4MzBceDM0XDE0NFx4MzBceDM1XDYyXHgzOFwxNDZcN
jNcNjJceDM3XDE0M1w2MVw2MVw2MFx4MzRcMTQ1XHgzNFw2Mlw2NlwxNDJcMTQzXHgzOVw2MFw2NVw3MV
x4NjJcNzAiKT8kbTIwMTcwZGEoJGhjYmVhYTA3KCRxOTk3MTI1YygiQ0lDTXdkQVZSQ2xLMXdtMHZ0cUd
MTmNEbjZEU3RteFpoUVIzOHRpelpldjRvNzUrQ25CcVhGeElUTXpYdlNXVzlyWk1DOVZiamh6c1UzcWpX
QTRTN3ZnQTN5cVYzSXBGM2hVa1F4dzZHcTk0Y0E1UzN0VTF5Mzk4L250VlVBTzRSaTNKMDNxTmltMmJna
nFaM2tsK1pzN3M4NCt0TDF4blJTRzhTaWpCK2VKTmtVMnlmYXMvRWN3OWFkMHhoUkNsNCtpc3FWN0Q1OS
tMbWs5L1lpbTUxK2FtNDZEUitjV2p6YXh2WWlXUGxlQ0VScS9zUHJOWjRxZm11MGtHeVM2MWJNUk1mdGl
NOXZFUThRbXdhTUFVUHVBais5UFl0cnpVdEtNNVVwd2NvT1NVYzIvcUY3L0c1bmlGNEh1WWRIcVRpYnM1
SnFUS3NHR2padjA2WVFNanp3WlNhejZzbFZOYkh5QmY4Y1cvaHZxOVVJTzQ0cG9RK1hOSzFIQ3dyelBmN
E9FV1hlcTBUMHhtK2VBK0xFdFEyZHhLZEtOdFAvWW9Ha1lmcEFkakxLdDFUWUxIUHBHUVY4L1BJaXByei
tNc1hvYWpOdU9Bc0h4eXhmMmt4TzRXYVBXeUI3THBmNkVIb0dJZnMraXdEVG92WXVqb0pVcVBWN3Jva0F
kdzFqeFV6NGJkUnJUQlRKcWhuSjVvNG5UMTI0MDYvc0hEeHdhdjRHSFpyVzRGZXo0OEVqTFB5WWFpVHJ1
c2hVVVhnNURuSitGUHJjRlo4Umw0bDZMOWF4b1VCc08xZUhnc2V4T1hBL0srTlZXdDNKR1lkSWo2SzNtc
m40Rnd1RGVJWkdXU1I3OUFIckRhdmZGaHhxMGFKdlp1TU5LbjZoR3FtWUZBZjdobTVNS29sTnhueUlIVy
ttZHlOV0tMZHluSlF4ZXBXSnBLNVg0MnVEOXlidDc5bG1MRXlDU1RZWVd5b3ZsM1N6ZUZaM21sdnZ0MXh
XMll6ZXhENzQ4SUQ1RjZ0Q1hRK3R2VzAzNHlRYkxtYTI4b1hUNUNMd2Y5ZjdrZ00yNHYrOXl5N0ZIaS9X
aGN2YTNMNTVtV0xCQWV0OVRRMEdIU1gwRG8wb3VqYVFXdUFTZWRWUTBNbkQxS0pRMWlhVnNGa2tiMXU3Q
mEyWkRiVUxEeTR2OGhSbnBLOU1FbWVVRDF3bnUvZ05GY0x2OFptQ1Z4dnhzWEY2ZkFEL3VkWWVwQWJKUj
cyd0FabG13WFQ1QUNYczlqcXJoTkpXeDliaUZvNVhDaTFuZXh3Y3c2VkhJQ0FVWmh4ZWQ5cnBGRlU4eEN
sS0tXaVh0dWpIWnNxOWlPckFYRlV2ZDVuRnc1WjFvZFhGdU5kS3dJRGVYNnB1SzhhRGx6RVlLRzlNTWlk
K1FWTTUxdUtWeUVld3FBQi9TaEExc3A0VEtsbHB5bXJJOTJCTHU4bGlNWSt1WUp1VGZ4UjNIQXBsYXJRe
lFTSXlsa1VwQVE3SUVtNWFzUGJzSWZjZ0QyM2pvWTFFME9CM2ZmdS9paEJLT3VBT0JnSk9KTU5GNGZTK1
I4bTZrU0lna3RaaDJrMVdRUm1wWGlCL0cwNDNhbHd1WFA4L0JubXR5TWRZdUtmYVI2N1IycWlaVmxBSkh
5V0xqRStYM2t6U21ubHFRbnBYR0l4cFRGZ3M3Z1hYUFNaMHBvZy9FU2lTRStlck1UWkcyVFhKRlBpSWVJ
U29QRFZrZGFxWExTRkV4WWRlbjhUR3hpdSsrQ21zWElVODhvVXlYcElrcEhlMHRYNFJZYisyVktXYWY0U
HBZZjkwTCtSNGhKVWd4UUpsbExKczc4K3NVQyszbTlPaj09IikpKTokbTIwMTcwZGEoJGhjYmVhYTA3KC
RxOTk3MTI1YygiQ0lVVXdoQUxRQ2xLa3VrNmJMQWxEekJOeUZJbzRGeWFQNzRibDFuMGZpSzE0NTdxVER
WUkhGRmV2dE8vSVR6RmttU1AvL2w0YkRHMkdpRjIwL3VnYzh3b3d5WjN2ZXdnTUNUVGtCOEpGYWxDL2Za
YkRLNTgvSnRrT1hKRVlVN21xNGQrYkdHMmVoakFXbmEzandnVzRhL0FDNERhbDlWYkVkb3N1WXBFK2QxU
mlMMWsrYXM5SWkvaEhydkFqdysrL2YzS2hDYTg2L1k1NDgrOWEzK1NDdzk0U3FuMmVQTnBUOE5jUlhuZn
hYbVFCVEZ5RmFHMUdTZ2hWVk82OWYzTnM5R0R5UzBpSXFNYjN4NWJTU2VQSUFtenF2MWhzVmpHUWwyU3F
wMHMvUHRuaHlvbkJoMit6OE05UTdCR3NLKzF1dVhpa2tKQkE0ZE9yTUhqd0NJKzhIdlgxUnNnVnN6d3FI
MExTbGVhRkkvbDRKUmx3MlM1SlZCTWpZY2FkcUJwcmJqQXUvYlJkNHBEZUQ4c0JzdnB1eFc2RVBQNDRuU
GNvSlJ2dHZwUnptanZaVjRZRDl4NVhjbDNuc3FSeGppa1NaOEx4dXFsTG4vN3JsdEpXSVpjUDJPcmxwV0
1XSytqWWkwbEZTa054ZWtpZ0tqaUtKalprdXh4cFZnc0xmMlRZOURqY1YrR0twRVJKek1LeWIwbmNQSUl
xV1RtUVJsdUE5bW82RHRVdVJsZCtheDlubDQxeVA3YmRYM0l1dUh2SHAyU09zMnAxYzBKZnBRRU02VEht
YUtNdWRjOHc3U2R1VE9BTk1Od3ZZdWF5NDFzWkZySjFJZHhlTHFnTVF1djI4bjN6bFRFOVhVWWh6bEp0W
jhDckxtVUwxSjJ4bi9rVUVxOEYzemdPa2dWWmU3T3FtYWVGelBwWHpmSlZjSkptNWloaFlKZGFJT29DZE
g1dWtZdjAyL3BScCtBbVlSR08zdzhmU3BBdXgxNVI0Nzc1dFA0MS9naEpsY1l3NXNRVVYya1NXS1lmcit
WbDNVaHBJN2I2TGNXYWgxTm96dE1hdWxDd3hyL3NOdGdoTERxSlFPQkVDYUZyOElBKzRjTElLVzFXU09x
d2VqdlJJcTBFaTh5RGtUbjBaVncweVVQQXduM0R6RFEwcWVuNzhtUjUzWCthNUh1bnVkNkZxQjYwZlZ1R
XRDNm9RVitSMmdKYlFON1FobTRDWHlhV25abFk4Y0Z6cDBTZEpxblNNdG5TcnYrWFBubDBkUXh4V0o0Vn
k3bTVuVFVWYlo1YlFybnYrbXQyWk9XNEtaWm9waDhnWjFNNFdTTFZrRGxqVXptYnNUbGJZQnE4Wjc0RGx
2YnRVREJvK2pOQXRTZGlFcHUzN0NNc1NXcExjVTZQeCthYU5aNmN5N2I1djVjTzRMZ1VYZ0JuNVVCQ0tI
QVN3VHJOZW0yZkhhbkQ3ZkM0SDZmZnZ6djB4U2IrMHBreTdha1dXK2lKc0RxenNuN0liL04wOEJuT2V1M
ytReXpOdE5VU1NrREo1QmxWR2I4bm9qbnJyZDduWXJUOXJOTUVFTCtXRXd2a1QxZjlWNWpobGZiQTNPdn
hPcVNvZ2YwQzFxc3JzOWFaamluazA5cnhNZ0pDNWRWOEFicU12R0R4MlpwaE5xY2xQSmtKSER3cXp4STk
0ZTJyVEx2YllhNCtzVUNCNzUrTkQ9PSIpKSkpOw=="));

So there is an obvious fact, the code is run using eval(), but before that it calls a function defined in the variable $hcbeaa07.

$hcbeaa07 = "\x62\141\163\145\x36\x34\x5f\144\x65\x63\157\x64\x65"; is a simple mixed character encoding so convert it to ascii and you get this: $hcbeaa07 = "base64_decode". So the very last layer of the obfuscation (deobfuscation is like peeling an onion, you see the final effects (outer layer) first) is to eval base64 code.

The base64 decoded is as follows (from this point on all code is formatted already):

<?php
//r6t1ZsrfkSyiedls+8XakW8C5yTiJoCUZ53E9CnQCdKqHjR=:r/mA+8u8t3siND==:7o25q1np
$y80b34d7 = "\x65";
$p2726268 = "\162";
$cb44f700 = "\160";
$f6bad12d = "\163";
$hd844d95 = "\x73";
$q997125c = "\x73";
$qd8c377c = "\x66";
$m20170da = "\147";
$hcbeaa07 = "\142";
$q997125c .= "\164";
$cb44f700 .= "\x72";
$p2726268 .= "\145";
$m20170da .= "\x7a";
$hd844d95 .= "\x74";
$qd8c377c .= "\151";
$y80b34d7 .= "\170";
$f6bad12d .= "\150";
$hcbeaa07 .= "\141";
$qd8c377c .= "\154";
$p2726268 .= "\x73";
$cb44f700 .= "\145";
$hd844d95 .= "\x72";
$q997125c .= "\x72";
$f6bad12d .= "\x61";
$y80b34d7 .= "\160";
$hcbeaa07 .= "\x73";
$m20170da .= "\151";
$hcbeaa07 .= "\145";
$hd844d95 .= "\143";
$m20170da .= "\x6e";
$q997125c .= "\x5f";
$cb44f700 .= "\x67";
$y80b34d7 .= "\154";
$f6bad12d .= "\61";
$qd8c377c .= "\145";
$p2726268 .= "\x65";
$cb44f700 .= "\137";
$y80b34d7 .= "\x6f";
$q997125c .= "\x72";
$hd844d95 .= "\155";
$m20170da .= "\x66";
$p2726268 .= "\164";
$qd8c377c .= "\137";
$hcbeaa07 .= "\66";
$qd8c377c .= "\147";
$y80b34d7 .= "\x64";
$cb44f700 .= "\162";
$hcbeaa07 .= "\x34";
$q997125c .= "\x6f";
$hd844d95 .= "\160";
$m20170da .= "\154";
$y80b34d7 .= "\145";
$q997125c .= "\x74";
$m20170da .= "\141";
$hcbeaa07 .= "\x5f";
$qd8c377c .= "\x65";
$cb44f700 .= "\x65";
$m20170da .= "\x74";
$hcbeaa07 .= "\144";
$q997125c .= "\x31";
$qd8c377c .= "\164";
$cb44f700 .= "\x70";
$q997125c .= "\x33";
$hcbeaa07 .= "\x65";
$qd8c377c .= "\137";
$m20170da .= "\x65";
$cb44f700 .= "\x6c";
$cb44f700 .= "\x61";
$qd8c377c .= "\x63";
$hcbeaa07 .= "\143";
$hcbeaa07 .= "\x6f";
$qd8c377c .= "\157";
$cb44f700 .= "\143";
$hcbeaa07 .= "\144";
$qd8c377c .= "\x6e";
$cb44f700 .= "\145";
$hcbeaa07 .= "\145";
$qd8c377c .= "\x74";
$qd8c377c .= "\145";
$qd8c377c .= "\x6e";
$qd8c377c .= "\164";
$qd8c377c .= "\163";
$ad70d04e = $y80b34d7("\50", __FILE__);
@eval($hd844d95($f6bad12d($cb44f700("\57\x5c\50\134\42\x2e\52\x5c\x22\134\x29\57", "\50\42\42\x29", $cb44f700("\57\xd\174\xa\57", "", $qd8c377c($p2726268($ad70d04e))))), "\143\x37\x64\62\65\x64\x62\x65\146\x63\x65\62\x30\x34\144\x30\x35\62\x38\146\63\62\x37\143\61\61\60\x34\145\x34\62\66\142\143\x39\60\65\71\x62\70") ? $m20170da($hcbeaa07($q997125c("CICMwdAVRClK1wm0vtqGLNcDn6DStmxZhQR38tizZev4o75+CnBqXFxITMzXvSWW9rZMC9VbjhzsU3qjWA4S7vgA3yqV3IpF3hUkQxw6Gq94cA5S3tU1y398/ntVUAO4Ri3J03qNim2bgjqZ3kl+Zs7s84+tL1xnRSG8SijB+eJNkU2yfas/Ecw9ad0xhRCl4+isqV7D59+Lmk9/Yim51+am46DR+cWjzaxvYiWPleCERq/sPrNZ4qfmu0kGyS61bMRMftiM9vEQ8QmwaMAUPuAj+9PYtrzUtKM5UpwcoOSUc2/qF7/G5niF4HuYdHqTibs5JqTKsGGjZv06YQMjzwZSaz6slVNbHyBf8cW/hvq9UIO44poQ+XNK1HCwrzPf4OEWXeq0T0xm+eA+LEtQ2dxKdKNtP/YoGkYfpAdjLKt1TYLHPpGQV8/PIiprz+MsXoajNuOAsHxyxf2kxO4WaPWyB7Lpf6EHoGIfs+iwDTovYujoJUqPV7rokAdw1jxUz4bdRrTBTJqhnJ5o4nT12406/sHDxwav4GHZrW4Fez48EjLPyYaiTrushUUXg5DnJ+FPrcFZ8Rl4l6L9axoUBsO1eHgsexOXA/K+NVWt3JGYdIj6K3mrn4FwuDeIZGWSR79AHrDavfFhxq0aJvZuMNKn6hGqmYFAf7hm5MKolNxnyIHW+mdyNWKLdynJQxepWJpK5X42uD9ybt79lmLEyCSTYYWyovl3SzeFZ3mlvvt1xW2YzexD748ID5F6tCXQ+tvW034yQbLma28oXT5CLwf9f7kgM24v+9yy7FHi/Whcva3L55mWLBAet9TQ0GHSX0Do0oujaQWuASedVQ0MnD1KJQ1iaVsFkkb1u7Ba2ZDbULDy4v8hRnpK9MEmeUD1wnu/gNFcLv8ZmCVxvxsXF6fAD/udYepAbJR72wAZlmwXT5ACXs9jqrhNJWx9biFo5XCi1nexwcw6VHICAUZhxed9rpFFU8xClKKWiXtujHZsq9iOrAXFUvd5nFw5Z1odXFuNdKwIDeX6puK8aDlzEYKG9MMid+QVM51uKVyEewqAB/ShA1sp4TKllpymrI92BLu8liMY+uYJuTfxR3HAplarQzQSIylkUpAQ7IEm5asPbsIfcgD23joY1E0OB3ffu/ihBKOuAOBgJOJMNF4fS+R8m6kSIgktZh2k1WQRmpXiB/G043alwuXP8/BnmtyMdYuKfaR67R2qiZVlAJHyWLjE+X3kzSmnlqQnpXGIxpTFgs7gXXPSZ0pog/ESiSE+erMTZG2TXJFPiIeISoPDVkdaqXLSFExYden8TGxiu++CmsXIU88oUyXpIkpHe0tX4RYb+2VKWaf4PpYf90L+R4hJUgxQJllLJs78+sUC+3m9Oj=="))) : $m20170da($hcbeaa07($q997125c("CIUUwhALQClKkuk6bLAlDzBNyFIo4FyaP74bl1n0fiK1457qTDVRHFFevtO/ITzFkmSP//l4bDG2GiF20/ugc8wowyZ3vewgMCTTkB8JFalC/fZbDK58/JtkOXJEYU7mq4d+bGG2ehjAWna3jwgW4a/AC4Dal9VbEdosuYpE+d1RiL1k+as9Ii/hHrvAjw++/f3KhCa86/Y548+9a3+SCw94Sqn2ePNpT8NcRXnfxXmQBTFyFaG1GSghVVO69f3Ns9GDyS0iIqMb3x5bSSePIAmzqv1hsVjGQl2Sqp0s/PtnhyonBh2+z8M9Q7BGsK+1uuXikkJBA4dOrMHjwCI+8HvX1RsgVszwqH0LSleaFI/l4JRlw2S5JVBMjYcadqBprbjAu/bRd4pDeD8sBsvpuxW6EPP44nPcoJRvtvpRzmjvZV4YD9x5Xcl3nsqRxjikSZ8LxuqlLn/7rltJWIZcP2OrlpWMWK+jYi0lFSkNxekigKjiKJjZkuxxpVgsLf2TY9DjcV+GKpERJzMKyb0ncPIIqWTmQRluA9mo6DtUuRld+ax9nl41yP7bdX3IuuHvHp2SOs2p1c0JfpQEM6THmaKMudc8w7SduTOANMNwvYuay41sZFrJ1IdxeLqgMQuv28n3zlTE9XUYhzlJtZ8CrLmUL1J2xn/kUEq8F3zgOkgVZe7OqmaeFzPpXzfJVcJJm5ihhYJdaIOoCdH5ukYv02/pRp+AmYRGO3w8fSpAux15R4775tP41/ghJlcYw5sQUV2kSWKYfr+Vl3UhpI7b6LcWah1NoztMaulCwxr/sNtghLDqJQOBECaFr8IA+4cLIKW1WSOqwejvRIq0Ei8yDkTn0ZVw0yUPAwn3DzDQ0qen78mR53X+a5Hunud6FqB60fVuEtC6oQV+R2gJbQN7Qhm4CXyaWnZlY8cFzp0SdJqnSMtnSrv+XPnl0dQxxWJ4Vy7m5nTUVbZ5bQrnv+mt2ZOW4KZZoph8gZ1M4WSLVkDljUzmbsTlbYBq8Z74DlvbtUDBo+jNAtSdiEpu37CMsSWpLcU6Px+aaNZ6cy7b5v5cO4LgUXgBn5UBCKHASwTrNem2fHanD7fC4H6ffvzv0xSb+0pky7akWW+iJsDqzsn7Ib/N08BnOeu3+QyzNtNUSSkDJ5BlVGb8nojnrrd7nYrT9rNMEEL+WEwvkT1f9V5jhlfbA3OvxOqSogf0C1qsrs9aZjink09rxMgJC5dV8AbqMvGDx2ZphNqclPJkJHDwqzxI94e2rTLvbYa4+sUCB75+ND=="))));

Again we have an eval, but there are several affixed functions. A quick way to decode and concatenate them is to pop the variables into a sandbox and print them.

The code I use is as follows:

<?php
$y80b34d7 = "\x65";
$p2726268 = "\162";
$cb44f700 = "\160";
$f6bad12d = "\163";
$hd844d95 = "\x73";
$q997125c = "\x73";
$qd8c377c = "\x66";
$m20170da = "\147";
$hcbeaa07 = "\142";
$q997125c .= "\164";
$cb44f700 .= "\x72";
$p2726268 .= "\145";
$m20170da .= "\x7a";
$hd844d95 .= "\x74";
$qd8c377c .= "\151";
$y80b34d7 .= "\170";
$f6bad12d .= "\150";
$hcbeaa07 .= "\141";
$qd8c377c .= "\154";
$p2726268 .= "\x73";
$cb44f700 .= "\145";
$hd844d95 .= "\x72";
$q997125c .= "\x72";
$f6bad12d .= "\x61";
$y80b34d7 .= "\160";
$hcbeaa07 .= "\x73";
$m20170da .= "\151";
$hcbeaa07 .= "\145";
$hd844d95 .= "\143";
$m20170da .= "\x6e";
$q997125c .= "\x5f";
$cb44f700 .= "\x67";
$y80b34d7 .= "\154";
$f6bad12d .= "\61";
$qd8c377c .= "\145";
$p2726268 .= "\x65";
$cb44f700 .= "\137";
$y80b34d7 .= "\x6f";
$q997125c .= "\x72";
$hd844d95 .= "\155";
$m20170da .= "\x66";
$p2726268 .= "\164";
$qd8c377c .= "\137";
$hcbeaa07 .= "\66";
$qd8c377c .= "\147";
$y80b34d7 .= "\x64";
$cb44f700 .= "\162";
$hcbeaa07 .= "\x34";
$q997125c .= "\x6f";
$hd844d95 .= "\160";
$m20170da .= "\154";
$y80b34d7 .= "\145";
$q997125c .= "\x74";
$m20170da .= "\141";
$hcbeaa07 .= "\x5f";
$qd8c377c .= "\x65";
$cb44f700 .= "\x65";
$m20170da .= "\x74";
$hcbeaa07 .= "\144";
$q997125c .= "\x31";
$qd8c377c .= "\164";
$cb44f700 .= "\x70";
$q997125c .= "\x33";
$hcbeaa07 .= "\x65";
$qd8c377c .= "\137";
$m20170da .= "\x65";
$cb44f700 .= "\x6c";
$cb44f700 .= "\x61";
$qd8c377c .= "\x63";
$hcbeaa07 .= "\143";
$hcbeaa07 .= "\x6f";
$qd8c377c .= "\157";
$cb44f700 .= "\143";
$hcbeaa07 .= "\144";
$qd8c377c .= "\x6e";
$cb44f700 .= "\145";
$hcbeaa07 .= "\145";
$qd8c377c .= "\x74";
$qd8c377c .= "\145";
$qd8c377c .= "\x6e";
$qd8c377c .= "\164";
$qd8c377c .= "\163";
$ad70d04e = $y80b34d7("\50", __FILE__);
print_r(get_defined_vars());

Which retuns:

Array
(
    [_GET] => Array
        (
        )

    [_POST] => Array
        (
        )

    [_COOKIE] => Array
        (
        )

    [_FILES] => Array
        (
        )

    [y80b34d7] => explode
    [p2726268] => reset
    [cb44f700] => preg_replace
    [f6bad12d] => sha1
    [hd844d95] => strcmp
    [q997125c] => str_rot13
    [qd8c377c] => file_get_contents
    [m20170da] => gzinflate
    [hcbeaa07] => base64_decode
    [ad70d04e] => Array
        (
            [0] => [...][...]
        )

)

Better than going print($y80b34d7);print($p2726268); no?

So in plain english, the code now looks like this:

<?php
//r6t1ZsrfkSyiedls+8XakW8C5yTiJoCUZ53E9CnQCdKqHjR=:r/mA+8u8t3siND==:7o25q1np
@eval(strcmp(sha1(preg_replace("/\(\".*\"\)/", "(\"\")", preg_replace("/|/", "", file_get_contents(reset(explode("(", __FILE__)))))), "c7d25dbefce204d0528f327c1104e426bc9059b8") ? gzinflate(base64_decode(str_rot13("CICMwdAVRClK1wm0vtqGLNcDn6DStmxZhQR38tizZev4o75+CnBqXFxITMzXvSWW9rZMC9VbjhzsU3qjWA4S7vgA3yqV3IpF3hUkQxw6Gq94cA5S3tU1y398/ntVUAO4Ri3J03qNim2bgjqZ3kl+Zs7s84+tL1xnRSG8SijB+eJNkU2yfas/Ecw9ad0xhRCl4+isqV7D59+Lmk9/Yim51+am46DR+cWjzaxvYiWPleCERq/sPrNZ4qfmu0kGyS61bMRMftiM9vEQ8QmwaMAUPuAj+9PYtrzUtKM5UpwcoOSUc2/qF7/G5niF4HuYdHqTibs5JqTKsGGjZv06YQMjzwZSaz6slVNbHyBf8cW/hvq9UIO44poQ+XNK1HCwrzPf4OEWXeq0T0xm+eA+LEtQ2dxKdKNtP/YoGkYfpAdjLKt1TYLHPpGQV8/PIiprz+MsXoajNuOAsHxyxf2kxO4WaPWyB7Lpf6EHoGIfs+iwDTovYujoJUqPV7rokAdw1jxUz4bdRrTBTJqhnJ5o4nT12406/sHDxwav4GHZrW4Fez48EjLPyYaiTrushUUXg5DnJ+FPrcFZ8Rl4l6L9axoUBsO1eHgsexOXA/K+NVWt3JGYdIj6K3mrn4FwuDeIZGWSR79AHrDavfFhxq0aJvZuMNKn6hGqmYFAf7hm5MKolNxnyIHW+mdyNWKLdynJQxepWJpK5X42uD9ybt79lmLEyCSTYYWyovl3SzeFZ3mlvvt1xW2YzexD748ID5F6tCXQ+tvW034yQbLma28oXT5CLwf9f7kgM24v+9yy7FHi/Whcva3L55mWLBAet9TQ0GHSX0Do0oujaQWuASedVQ0MnD1KJQ1iaVsFkkb1u7Ba2ZDbULDy4v8hRnpK9MEmeUD1wnu/gNFcLv8ZmCVxvxsXF6fAD/udYepAbJR72wAZlmwXT5ACXs9jqrhNJWx9biFo5XCi1nexwcw6VHICAUZhxed9rpFFU8xClKKWiXtujHZsq9iOrAXFUvd5nFw5Z1odXFuNdKwIDeX6puK8aDlzEYKG9MMid+QVM51uKVyEewqAB/ShA1sp4TKllpymrI92BLu8liMY+uYJuTfxR3HAplarQzQSIylkUpAQ7IEm5asPbsIfcgD23joY1E0OB3ffu/ihBKOuAOBgJOJMNF4fS+R8m6kSIgktZh2k1WQRmpXiB/G043alwuXP8/BnmtyMdYuKfaR67R2qiZVlAJHyWLjE+X3kzSmnlqQnpXGIxpTFgs7gXXPSZ0pog/ESiSE+erMTZG2TXJFPiIeISoPDVkdaqXLSFExYden8TGxiu++CmsXIU88oUyXpIkpHe0tX4RYb+2VKWaf4PpYf90L+R4hJUgxQJllLJs78+sUC+3m9Oj=="))) : gzinflate(base64_decode(str_rot13("CIUUwhALQClKkuk6bLAlDzBNyFIo4FyaP74bl1n0fiK1457qTDVRHFFevtO/ITzFkmSP//l4bDG2GiF20/ugc8wowyZ3vewgMCTTkB8JFalC/fZbDK58/JtkOXJEYU7mq4d+bGG2ehjAWna3jwgW4a/AC4Dal9VbEdosuYpE+d1RiL1k+as9Ii/hHrvAjw++/f3KhCa86/Y548+9a3+SCw94Sqn2ePNpT8NcRXnfxXmQBTFyFaG1GSghVVO69f3Ns9GDyS0iIqMb3x5bSSePIAmzqv1hsVjGQl2Sqp0s/PtnhyonBh2+z8M9Q7BGsK+1uuXikkJBA4dOrMHjwCI+8HvX1RsgVszwqH0LSleaFI/l4JRlw2S5JVBMjYcadqBprbjAu/bRd4pDeD8sBsvpuxW6EPP44nPcoJRvtvpRzmjvZV4YD9x5Xcl3nsqRxjikSZ8LxuqlLn/7rltJWIZcP2OrlpWMWK+jYi0lFSkNxekigKjiKJjZkuxxpVgsLf2TY9DjcV+GKpERJzMKyb0ncPIIqWTmQRluA9mo6DtUuRld+ax9nl41yP7bdX3IuuHvHp2SOs2p1c0JfpQEM6THmaKMudc8w7SduTOANMNwvYuay41sZFrJ1IdxeLqgMQuv28n3zlTE9XUYhzlJtZ8CrLmUL1J2xn/kUEq8F3zgOkgVZe7OqmaeFzPpXzfJVcJJm5ihhYJdaIOoCdH5ukYv02/pRp+AmYRGO3w8fSpAux15R4775tP41/ghJlcYw5sQUV2kSWKYfr+Vl3UhpI7b6LcWah1NoztMaulCwxr/sNtghLDqJQOBECaFr8IA+4cLIKW1WSOqwejvRIq0Ei8yDkTn0ZVw0yUPAwn3DzDQ0qen78mR53X+a5Hunud6FqB60fVuEtC6oQV+R2gJbQN7Qhm4CXyaWnZlY8cFzp0SdJqnSMtnSrv+XPnl0dQxxWJ4Vy7m5nTUVbZ5bQrnv+mt2ZOW4KZZoph8gZ1M4WSLVkDljUzmbsTlbYBq8Z74DlvbtUDBo+jNAtSdiEpu37CMsSWpLcU6Px+aaNZ6cy7b5v5cO4LgUXgBn5UBCKHASwTrNem2fHanD7fC4H6ffvzv0xSb+0pky7akWW+iJsDqzsn7Ib/N08BnOeu3+QyzNtNUSSkDJ5BlVGb8nojnrrd7nYrT9rNMEEL+WEwvkT1f9V5jhlfbA3OvxOqSogf0C1qsrs9aZjink09rxMgJC5dV8AbqMvGDx2ZphNqclPJkJHDwqzxI94e2rTLvbYa4+sUCB75+ND=="))));

So it basically does an integrity check and runs 1 of 2 code pieces depending on the result.

The first code block is this one:

gzinflate(base64_decode(str_rot13("CICMwdAVRClK1wm0vtqGLNcDn6DStmxZhQR38tizZev4o75+CnBqXFxITMzXvSWW9rZMC9VbjhzsU3qjWA4S7vgA3yqV3IpF3hUkQxw6Gq94cA5S3tU1y398/ntVUAO4Ri3J03qNim2bgjqZ3kl+Zs7s84+tL1xnRSG8SijB+eJNkU2yfas/Ecw9ad0xhRCl4+isqV7D59+Lmk9/Yim51+am46DR+cWjzaxvYiWPleCERq/sPrNZ4qfmu0kGyS61bMRMftiM9vEQ8QmwaMAUPuAj+9PYtrzUtKM5UpwcoOSUc2/qF7/G5niF4HuYdHqTibs5JqTKsGGjZv06YQMjzwZSaz6slVNbHyBf8cW/hvq9UIO44poQ+XNK1HCwrzPf4OEWXeq0T0xm+eA+LEtQ2dxKdKNtP/YoGkYfpAdjLKt1TYLHPpGQV8/PIiprz+MsXoajNuOAsHxyxf2kxO4WaPWyB7Lpf6EHoGIfs+iwDTovYujoJUqPV7rokAdw1jxUz4bdRrTBTJqhnJ5o4nT12406/sHDxwav4GHZrW4Fez48EjLPyYaiTrushUUXg5DnJ+FPrcFZ8Rl4l6L9axoUBsO1eHgsexOXA/K+NVWt3JGYdIj6K3mrn4FwuDeIZGWSR79AHrDavfFhxq0aJvZuMNKn6hGqmYFAf7hm5MKolNxnyIHW+mdyNWKLdynJQxepWJpK5X42uD9ybt79lmLEyCSTYYWyovl3SzeFZ3mlvvt1xW2YzexD748ID5F6tCXQ+tvW034yQbLma28oXT5CLwf9f7kgM24v+9yy7FHi/Whcva3L55mWLBAet9TQ0GHSX0Do0oujaQWuASedVQ0MnD1KJQ1iaVsFkkb1u7Ba2ZDbULDy4v8hRnpK9MEmeUD1wnu/gNFcLv8ZmCVxvxsXF6fAD/udYepAbJR72wAZlmwXT5ACXs9jqrhNJWx9biFo5XCi1nexwcw6VHICAUZhxed9rpFFU8xClKKWiXtujHZsq9iOrAXFUvd5nFw5Z1odXFuNdKwIDeX6puK8aDlzEYKG9MMid+QVM51uKVyEewqAB/ShA1sp4TKllpymrI92BLu8liMY+uYJuTfxR3HAplarQzQSIylkUpAQ7IEm5asPbsIfcgD23joY1E0OB3ffu/ihBKOuAOBgJOJMNF4fS+R8m6kSIgktZh2k1WQRmpXiB/G043alwuXP8/BnmtyMdYuKfaR67R2qiZVlAJHyWLjE+X3kzSmnlqQnpXGIxpTFgs7gXXPSZ0pog/ESiSE+erMTZG2TXJFPiIeISoPDVkdaqXLSFExYden8TGxiu++CmsXIU88oUyXpIkpHe0tX4RYb+2VKWaf4PpYf90L+R4hJUgxQJllLJs78+sUC+3m9Oj==")))

The second code block is this one:

gzinflate(base64_decode(str_rot13("CIUUwhALQClKkuk6bLAlDzBNyFIo4FyaP74bl1n0fiK1457qTDVRHFFevtO/ITzFkmSP//l4bDG2GiF20/ugc8wowyZ3vewgMCTTkB8JFalC/fZbDK58/JtkOXJEYU7mq4d+bGG2ehjAWna3jwgW4a/AC4Dal9VbEdosuYpE+d1RiL1k+as9Ii/hHrvAjw++/f3KhCa86/Y548+9a3+SCw94Sqn2ePNpT8NcRXnfxXmQBTFyFaG1GSghVVO69f3Ns9GDyS0iIqMb3x5bSSePIAmzqv1hsVjGQl2Sqp0s/PtnhyonBh2+z8M9Q7BGsK+1uuXikkJBA4dOrMHjwCI+8HvX1RsgVszwqH0LSleaFI/l4JRlw2S5JVBMjYcadqBprbjAu/bRd4pDeD8sBsvpuxW6EPP44nPcoJRvtvpRzmjvZV4YD9x5Xcl3nsqRxjikSZ8LxuqlLn/7rltJWIZcP2OrlpWMWK+jYi0lFSkNxekigKjiKJjZkuxxpVgsLf2TY9DjcV+GKpERJzMKyb0ncPIIqWTmQRluA9mo6DtUuRld+ax9nl41yP7bdX3IuuHvHp2SOs2p1c0JfpQEM6THmaKMudc8w7SduTOANMNwvYuay41sZFrJ1IdxeLqgMQuv28n3zlTE9XUYhzlJtZ8CrLmUL1J2xn/kUEq8F3zgOkgVZe7OqmaeFzPpXzfJVcJJm5ihhYJdaIOoCdH5ukYv02/pRp+AmYRGO3w8fSpAux15R4775tP41/ghJlcYw5sQUV2kSWKYfr+Vl3UhpI7b6LcWah1NoztMaulCwxr/sNtghLDqJQOBECaFr8IA+4cLIKW1WSOqwejvRIq0Ei8yDkTn0ZVw0yUPAwn3DzDQ0qen78mR53X+a5Hunud6FqB60fVuEtC6oQV+R2gJbQN7Qhm4CXyaWnZlY8cFzp0SdJqnSMtnSrv+XPnl0dQxxWJ4Vy7m5nTUVbZ5bQrnv+mt2ZOW4KZZoph8gZ1M4WSLVkDljUzmbsTlbYBq8Z74DlvbtUDBo+jNAtSdiEpu37CMsSWpLcU6Px+aaNZ6cy7b5v5cO4LgUXgBn5UBCKHASwTrNem2fHanD7fC4H6ffvzv0xSb+0pky7akWW+iJsDqzsn7Ib/N08BnOeu3+QyzNtNUSSkDJ5BlVGb8nojnrrd7nYrT9rNMEEL+WEwvkT1f9V5jhlfbA3OvxOqSogf0C1qsrs9aZjink09rxMgJC5dV8AbqMvGDx2ZphNqclPJkJHDwqzxI94e2rTLvbYa4+sUCB75+ND==")))

The first block decoded is:

<?php
$hcbeaa07 = "\142\141\x73\x65\x36\64\137\x64\145\143\157\x64\145";
$m20170da = "\147\172\151\x6e\146\x6c\141\x74\145";
$q997125c = "\x73\x74\162\x5f\x72\x6f\x74\x31\63";
@eval($m20170da($hcbeaa07($q997125c("CIYMwdALQC2KHw3HvNq2PPd1ANDPWQsfLIIrJT6NfNHV69pCH61hF0qUgaI8YAzsrEYQXZYLKk/3uFS24UrpVKrz7jkmM6t7GeW3aXW+XfirjrasBH7EU9+sALUuYWMTC3Y2ieQEmgjBhVCMxslZKAt/tb7wJWltx/8SYCaGJAwqy378Mhnk++81purE5Zs3i3PXdd+/Cy+ssko++wid60Z4B96pMWbyLXO5HiWY1aurj5dGTA967t2053HTcSUQj5JLxNTXyrcYH8cqZto6nqDoHpyG9TtWqD/T5amEl0UQcfVjQyyiWlxqzNnehF0qGQt0ZOZYBB5DOVcvaNl15Qzzf1rk0NCgye5tplV1ntGNZF2VwyLbhNqAU6kOnjXHm1e7onzb1DDSRHSUmV7gwXBWoD4SliJUNfILEPQEEBu53+OaTrdLoGllSYLxUgqv8poUzVvSWjytADL5fmd9kCe1lj+xJmSM1j0V3vV1gVLuZbIu5/rkTQl6H0oEifwvoSVnDn3WNX3Ol5JYHUKJfV60r4m82jMDlg/JbZ2CzO2/NUvFRy1iRh2yChfgppvAu3rvV9TwgiXRQJErZrgAQ8+tky6ab8MLI+iETl70D4ufDtNp5/Gh8GxZx6mhRAWlebxao/FWIT2tG/DwaBKV2ceKJCgA9GOQNarbp23J+k+1vHuEE45Wemy+l0xQwRyllsy4Tv6ejcagoQBe5X/OVnY2x8za5MRGXlPxSmHq2urselhlvAVlGqzobcGXaHbGVV3gin62B6X0VpsNh7GMZIgQNIghcInuYi1jIWmw39MIODXz3YudJTexRgyxDUHFM88VG8IORLLCBVqvmAsWfHCUggHzwzHYaX5TXj7KZn2VNdu5OZgGcy/1x+x0ITUNWlpunAQPdAlxFQe5yvRsSVMUD+FW9A0XVFYV6av2pEmifN1K9Aa0BB8xifiR6duzcGo32RS0Oz6WM4FuW4Gl6vhOevd3iJ0Wj9ceszondkZjeQHIe2Nt1XpNbuV7UflxoA3Sq3YwfpXR4DlwAQtT0SMwEKmXnJgNiubsuZ8YzmxJx196A2oUjUuwlGf91mpjRNgBHZras9BmXcvy0Z5AWni5BIGI1AZ6XXEqZdzZuDDvXrNgv2wLe49/9iw+Qj=="))));

The second:

<?
$hcbeaa07 = "\142\141\x73\x65\x36\64\x5f\x64\x65\143\x6f\x64\145";
$m20170da = "\x67\172\x69\156\146\154\141\x74\145";
$q997125c = "\x73\164\162\137\162\x6f\164\61\63";
@eval($m20170da($hcbeaa07($q997125c("CL/Mwdf4SRK/cKDsdfHQzOzIJhbNLE7QTWDKktVPWVjk+sdYFhdlMUx4M61g/6ameRkGwCa34jMc/NMVpVZZpnmHwnMixPOixXdBRiymOJavzY/aw68/CL4OOviFU565NrMjHVrQYb8T+gtsNuepjP8jpujQpPb/NUQLstcU8R/XNs/LzDZvjV0zCe7+X7r0+/lA+smm/4Z/s02sU4WOzF86Re1DEwsxUGPAX3c3d85CDeDxkoiXGfg8hJuK8ybuAQgCz9T7yO53D0beomMexgT2rWrtKb/m3FaMR/F6ppcjBRfa4cgdY99Zl0m5L1uIddKsXUpimszXp05bhkqYEMT6pgTKn6wmMpv+51MT/DNEcknMZ9KSNtDgHEkgmXLIia2hr+/MJK+SDG3URglVh8B99Mm0mkpwr8A4wwr0m5OH57zNINIPgKCezIrarzvJwrCk3x3DVQJyvz9WHI3w/iIdngKOBhQtDZL7IEwNSTkLMB1RIBceA14GqVlTr3eOdSRbSKUCpxhl22selXrxwSK/oNonwuhQNauzPrOrgGJFzxx0TAATzEu7sY2HURS+TXQOUIarSU7yV+1gAb9p9Krs4gyNoJTcoh4vL5vSHKhFzeh50TGSrVyI+Z1b7DjZN14ROwTh0IO0MmkVnPbVAeCotJpZll7lcckhMXpa1W7EP8V8aMQWJ8x3KRaEsLEJd6dUZdcI9eDHo8mLKPM6WNVGGbIJl15pdg3JGYeujNXG82SKoOlFIS32pAHXqrXRQPFmlEDC0aM4J5W3CPl73gf7dx4UE3jDf6W5SzUrnK2sK6vifXCo9dtBJT4uHoh3cseAKN2LF7liHMz22uA9Lsvfcto6YWuGasW3kV2sHxXRoX/nGhdsZ6cpDmojftgeOq5qytGVSI7VnmNZKqU2llKTi/qrdDKKz+WF1RMHdpZzUHrYOecVT1nvXkpUOfdXqH/+AGwrlNn4TnYKgwKB80y65wwstqvVJXQOwPf7V3BUfePQorP0DyxS8r41BSOz3U+M0FbR90M4xHvGxh7UC8s4+tf="))));

Interesting that the routines are the same (ie $hcbeaa07, etc).

Anyway let's focus on cleaning up block 1 for now, since it is going to be the same methods for block 2.

Run this in a sandbox to decode them

<?php
$hcbeaa07 = "\142\141\x73\x65\x36\64\137\x64\145\143\157\x64\145";
$m20170da = "\147\172\151\x6e\146\x6c\141\x74\145";
$q997125c = "\x73\x74\162\x5f\x72\x6f\x74\x31\63";
print_r(get_defined_vars());
Array
(
    [_GET] => Array
        (
        )

    [_POST] => Array
        (
        )

    [_COOKIE] => Array
        (
        )

    [_FILES] => Array
        (
        )

    [hcbeaa07] => base64_decode
    [m20170da] => gzinflate
    [q997125c] => str_rot13
)

So applying the cleaning process and executing the first code block, the result is as follows:

<?php
$hcbeaa07 = "\x62\x61\163\x65\66\64\137\144\x65\x63\157\144\145";
$m20170da = "\x67\x7a\x69\x6e\x66\x6c\x61\x74\145";
$q997125c = "\x73\x74\x72\x5f\x72\x6f\164\x31\x33";
@eval($m20170da($hcbeaa07($q997125c("CIUWwcgNRC0Knj4GpGNAAN0nEDbTr9tKNjLwK3Pme8L2v+seDlMXFvd9Jg6eXdarPakA45uRCmrKunIJOksN0viPP8grScd5YQP7NVo5Yv1eP0Q0Y998iYHHPEPMkA96qSyDiOYNTdpenE3N4uKKUQRe/uRZCV8NOsRsNnY/AgoStRM/RnYi2aeUDgBow1/cSQsi/9r8i/07+C3/cCrAXPAwGeO0SPfgdeo31bmDit1ub2bCj3KeluYh6yUrF7XmpXYFTivRLzKCWxFn5N0+G400ItBisW5qHuDSJGDwQ4N24ycseRsWhHJClqRsyu5VBaXTzK/4XzyYohB0SbpKKj3F5mzF5WdX7WxbZ9u8tcO+afmRhc7YGAHQmzOZIKm0pEBN6RLRfrPVeXZe+zCYKUUEtr1wZZcgmq+3RULcWGz5E3MSKOv5fZwGaRznpumXnlfQZ21U4ImQmx67ocD44B96dLh1Th3PKuccJhAbvsJyH9QowS6yFXyY8a4CmrGExfh2yK2Fp4v8opAhyy+xDFxvvgt44HlVvkQK+nSWpLSVu/5PGbKWJogBgyZC0xTkNl/V5fUM19AtRLMKC0HT9lsxm+JaS3Y4qF9Sw+A4bYiZZfewZDbAmcBq/uooNv977i15luRbZyudl2iKMhaekEgOLOEQUn4iPej9F+/YoeakzFaFEXRPG8H6A/Z+j+rqyee+CGMuIS111q0z1HOwQW9WEDtkcRq4ny4zVBqe/wKVk1g2POc2HprlC5llVoTzc67SyhI6oLUY67RvipYs2MjCKak0B8QckoVxXUhPfyec69PPkP96K5RnRaAd9NyY3pnXKZjJ7gUR6hJrVb7uYPt0ctdImTKs2x124BjXTOglYwFZShQHgmAwZMMdWNqeCdqcvM6R+YD3C1o7+N0="))));

Urgh.... Again... Same variables same functions. I've gone through each iteration as you can see below

<?php
// 1
$hcbeaa07="\x62\x61\163\x65\66\x34\x5f\144\x65\x63\157\144\x65";$m20170da="\x67\x7a\151\x6e\146\x6c\141\x74\145";$q997125c="\x73\x74\162\137\162\157\x74\61\x33";@eval($m20170da($hcbeaa07($q997125c("CH7MwdcDRCjKZj/rmNZ7EmX5lJKsMSSkjOArJRHEDHQx8CImMcV7aIE6d+edglcYvlDujq9IGYS0CCAHCNZT11mZ8mUCkuDQpZsvQLsOLWDL7Qqw9sUJ0PDSlQmO8cxUJWetYZDHk2ZPw+if5lG1X3tVNdObYifJLW8M4NJCsoalW1Zp+WaAQC6QLILs/4bchn1/sqMi/k9r/55ne2DQgT0nhahMgAxHvwfDKIRqibmH1NemuAYk5nPennuD81UBoDnaKk7BXoDu33K83D6UDVWoP4Lje7Iki0rrXNdsm0x/mHU08Q+gmmXnwHy0M2IC7Z6ad8N5chXckgFlech70Q3z7Qjc0wKbvPQkqDFIPWTWfwqQEkvqO+MTktC4coV7UwiGTX8cyriCT8891LS4xuHuRZXM8THQopaPA9HTSrtVg71hf5iKxyBmfeyy9MWWMhqkXArJWTE63Einxp9fNC3+hJ1TJcL8w9U49gnKeSUraN5ZjbLJS/djq3cc5tdj+Aa53u5VlyN10wbgzqHRpfFWl6xJuioFVfqdOvtLKaOOSTmhcibRj0ThUBP8U1y9ZpF5vy6601io+2OmDzFm1dUhoUIDl0c8JZG5iLPcIHhwOco7v6LiE2+RXwAI3c2hJ0gHUOBvPWQBh5aMHgAl4KWceUPfMxMxju0qOwYeei7t+CtP"))));

// 2
$hcbeaa07="\142\x61\x73\145\66\64\137\144\x65\x63\x6f\x64\145";$m20170da="\x67\x7a\x69\156\146\x6c\x61\164\145";$q997125c="\x73\x74\162\x5f\162\157\x74\x31\x33";@eval($m20170da($hcbeaa07($q997125c("CH7oobWNRC0K4bZAQ7XjykWwHbIFeIYybtwMyjIHEZFPyd58sMrzqMYWKZ6pp6nKWsTBZLJZWZdkFtRRyOAA9VuvGYxTXqPVJVfXxHvANxDR/QgYj95MIDOEHvo4NNdNZNUd4xvDBjTp/TaPGyZDXy0aDRIWM9tMqDOEXHq7PfDQUUpIHtjb1dGul65uEs/u0h/9/9g/PCHyL0ePIEmyeyUZLrGK48wzd1xD8lckzcBIpO5ydFzaW3rGOsot6cK7ZPruLmt2CBOO3F6olrf4HflMp7v982Az2SRMrBx5e7zPcgnoS01HEF0JYzcJmTCX5AzYk9soioyMJmsZ9HOTiy1ZmnIEu7sSChM7M+U4GzHAxhXwGMrJLnsK59XK4JSkpKEsEfhAqJ/g+eZbJkBtF7znw22iUOtZE3vhOn2koJADMIZyX70M+IcKBmo5WzimJWthx3A3WQ2WTC4N"))));

// 3
$hcbeaa07="\x62\141\x73\x65\66\x34\137\144\145\143\157\x64\145";$m20170da="\147\x7a\x69\156\x66\x6c\141\x74\x65";$q997125c="\x73\x74\x72\x5f\162\x6f\164\61\63";@eval($m20170da($hcbeaa07($q997125c("CH7YPbZjRClK4ZTrAZMxPIWbxqcQvkFcxxZhdD+dkRVhWM/sSnfYj7YQCQM4g6/rzOvBEAZ0DIQgtJxihCMZnWSdmjrx05HFGSZB202lLR5vPaSa0B8SbAstyvtFXRYj9W+5TMlHDOCrYtLfbxfQLQTQqF/clNzdOFCMds8nT+4gLoQ9T+5OVFyzMrplnzD15onPKAMSn/Ca6Z6K3WzCXzb1qhH0hnSI7uUqeaBw7UDilDRa+jR="))));

// 4
$hcbeaa07="\142\141\x73\x65\x36\64\x5f\144\x65\x63\157\144\x65";$m20170da="\x67\x7a\x69\156\146\154\141\x74\x65";$q997125c="\x73\164\x72\137\x72\157\164\61\63";@eval($m20170da($hcbeaa07($q997125c("FmXlmN/V9RjClR7C9UFclCTiqAECqanXFUXidNjjqfcXqP/KGmVXljLN"))));

It finally outputs the following string: b29oPiIgPkgiIDxlOyA/cCBXbGxyP3BjaGw/b2Vk... So that is clearly not what is wanted. So let's carry out the same process for the 2nd code block.

<?php
// 1
$hcbeaa07="\x62\141\x73\145\66\x34\x5f\x64\145\x63\x6f\x64\145";$m20170da="\x67\172\151\x6e\146\154\x61\164\145";$q997125c="\163\164\162\x5f\x72\x6f\x74\x31\63";@eval($m20170da($hcbeaa07($q997125c("CL5Mw6WDSVG/v+zU7iQDSkNhcACWtZdzfbAtsRRJY4Yf+68srvLmQ5KXlna6Hz8biZqONBQ35woEkPe8AxSlqrb2xsFA3g5jRg7j7rconuI5j6z/9keMsY29PVOQRNI/+hfQ/wQLIsRnbgsjG/TU+Drj+sbIQ0U+/e/2/iMijCgT9lzybEKwVUhsXFxv3kP9zKc4TERLbzxXsXv/mb+aKB9U4IC3IOcNpcfAhnitv9B2mQZ/UaMFfBj4DIuXmwwihIP0l1P21G2lICn1rUv0WNy3WeKulqYZ/qWnkaR05qCeHDybcNFOjpjPGAZeXITEMUJy2LnH1B7tUxyfjh+aMZWnLrv5M087rceFPCGoL1i2PGGvHBuBWJzMiocITyT5B8UIjxeIvQtG00N05yZaMyMt64f7SZNdTiqNy7xVUBD1L3quWndlE2UZ65UUvMly1SLntyDBMGav4lKZ5yb6t+7pPV7cjFTLQFHKT+6IffmxG/JfOrtdz0LvQ7WoZC7VrdJhGSXeIlvirKLPxd0GcnyHO2x45hemxuJdIr9Cb1ZsM7do4OPBOFGy2VelmSyl5hanPDo3sHJSN3Mk6Kysw/TH8qQjm/K189t4/OmOFhz7YLxcFBTJ5bJuOr6R7Bbh5n6ECMrhaBk+QXpFZ3V8mIOPaTEb5euV8USbR8NUSkGFCx9dSVBJxVVQDOTetX2gymHhCQSrXeDJq/HhViaqqN61KD6LNZKHRPxUHu0lpBwnPSq8U2MV/YjjLEsAFpc2Bl1XLW81Jxb9elLbQnedOUvn9JdHuCDkSi21Hs2TwMWuCUkiCw4+ia4Q"))));

// 2 
$hcbeaa07="\x62\x61\x73\x65\x36\64\137\144\145\143\157\144\x65";$m20170da="\x67\172\x69\x6e\146\154\141\x74\145";@eval($m20170da($hcbeaa07("PY5Jr6JQEIX/i3GhYQGXy5gXk2aQGRRFBcPmMgjIqDwF/PXN60734kvlVJ1zUss8jlKECHazCAFFzoAQMDAcGTocITNDhSN9mzX1dzffAM3Ovj968bWsSQKwRILmgpFhw5FF8+Rn0xxmfohnfkqpOTQHfqVvVK3+x1bLfx+sFvuAju6UPii6h0u4Ksouf7QecFtLo3SRuN4JrGJbUaZS+oNQdAR+O0dwlxtGkSaTPzVvn0SnrVE6olG0UhXrwtW9H5pTwFwlqwB12l95NsHvaiIcIIdBezckyqHM0tMrFURX7vayQJlGrAmi98xYxqyOahZIRQfIvIVn8Yw9XoPJxHsPphlqB9x0HTP2oRJpEHvKlNjWknNSqDLwUqKy6tx7vcwn73IeSdlkUzl8jVTf+7Dup5cv+WV6yDqwexkB7QYMqZ/KrUByd7pJut43+JhJAzrm+hz7CFkZVzoCrIXV6pUkbKcxo+Ql1ikhf2LI7Rl1G2BecT20Y0Whc6YB3O58hzc57v0hd9J04TPoq1Fj+BHnOs1VPtd3BCxMcOCl08ahe5vdJE3Nvk0Etsd1JYY7khG/W8ctdyfi9tCOdf7ukrOi5jZR0oQ5ptF7LyPpwHFigwnuZrNYr9dfvwE=")));

// 3
$hcbeaa07="\142\141\163\x65\x36\x34\x5f\x64\x65\x63\157\144\x65";$m20170da="\x67\x7a\x69\156\x66\x6c\x61\164\145";@eval($m20170da($hcbeaa07("PY5bj4IwFIT/C/GBDQ9SLq3EmCxCWC8sNYLiEl4KFkXwAip0/fVb3OhJJiedyXynvX2aUEJkNBJioClcIAZQjRnUY6ZCLi1mesZ97d/jGdAR38+3MOwdFRkgeUueABQDpPDA4KJcHABTrg76KlSGgYCip12ho3VBV+quwK6cPT3egaow/KQNKcX3FbH3+rD4BomCNUF4kYTe0lLmhTuuKr9Q8T24M2nlN9maGXTz7QzsDWhWyqDI1MsDa1Hf1JCsykEA28j5ndpsXJ9c6eY5c8sh+zAgkclIa17L+mGZ20MNnKbduBme0Dzc38P6GEY+TiZRoxl4aVgH1/MpXN9K88vz2OCyW9g3XGbnJXb8QNnZDVmja1L+AN3WpHxwpvKpyCynPodA7s/IFc3O26BtoNQkOU0fqHSmhvpdVFGhM0k50KxebvPDaCR88Bn+AQ==")));

// 4
$hcbeaa07="\142\141\163\x65\x36\x34\x5f\144\x65\x63\157\x64\x65";$m20170da="\147\172\x69\x6e\x66\x6c\x61\164\x65";$q997125c="\163\164\x72\x5f\162\x6f\164\61\63";@eval($m20170da($hcbeaa07($q997125c("CH7OPbWNRC2KkLBqqSk3OuTux+USvfVx9eXMF8DX1vU28kf3pzO4Z/A47030TT6wZFyIDxBrnL+tNFKCFahWTaZAxawAslrzCAdjr1FvwXLfOHeiWhuWrmWZSObHZv49OR9CjLNSe6VtlAGNNx8pgPDtOlfoROFST2gDvaV7sblY15D4+i8oe0nkfCFroW10/Jas7JodTwv6+vbiecz7lFI93MkqZk5x+2jefrRdij=="))));

// 5
$hcbeaa07="\142\x61\163\145\x36\64\137\144\145\x63\x6f\144\x65";$m20170da="\147\x7a\x69\156\x66\x6c\x61\x74\145";$q997125c="\x73\164\162\x5f\162\157\164\61\63";@eval($m20170da($hcbeaa07($q997125c("f7rmfF/VXSOVGp7VI1QlFZ3WlIpVml/XFITlIeP3NjN="))));

FINALLY we get the output of: ?><?php echo "Hello World"; ?>

So having manually deobfuscated the script, let's automate it. Because that was a pain to do.

So deobfuscation steps so far are as follows ($x is the code):

  1. eval(base64_decode($x));
  2. The second code block from the result of step 1 gzinflate(base64_decode(str_rot13($y)))
  3. Loop 6 (Initial + 5 recursive loops, but can it change?) times through gzinflate(base64_decode(str_rot13($y)))
  4. Profit?