DeObfuscator class

[flakka2022]

class DeObfuscator {

/** @var string */
private $sName;

/** @var string */
private $sData;

/** @var string */
private $sPreOutput;

/** @var string */
private $sOutput;

/**
 * @param string $sData Obfuscated code.
 * @param string $sName The name of the original code that was obfuscated.
 */
public function __construct($sData, $sName) {
    $this->sName = $sName;
    $this->sData = $sData;
    $this->decrypt();
}

public function getDecryptedCode() {
    return base64_decode(gzuncompress(base64_decode($this->sPreOutput)));
}

private function decrypt() {
    $this->sOutput = base64_decode(str_replace('[BREAK]', "\n", $this->sData));
    preg_match('/Loading\s(.+)/', $this->sOutput, $matches);
    $this->sName = isset($matches[1]) ? $matches[1] : '';

    preg_match('/base64_decode\((.+)\);/', $this->sOutput, $matches);
    $this->sPreOutput = isset($matches[1]) ? eval("return {$matches[1]};") : '';

    $this->sPreOutput = str_replace('$__', 'base64_decode', $this->sPreOutput);
    $this->sPreOutput = preg_replace('/\$(\w+)\s*=\s*\'(.+)\'\s*;\s*/', '\$$1=$2;', $this->sPreOutput);
}

}