#!/usr/bin/env php
<?php

define('VARIABLE_NAME', 'REXISTHEDOG4FBI');

function decode_sc($key, $coded) {
    $source = '';
    $counter = 0;
    $key_len = strlen($key);
    $activechar = hexdec('&H' . substr($coded,0,2));

    for ($i = 2; $i < strlen($coded); $i +=2) {
        $nextchar = hexdec(trim(substr($coded, $i, 2)));
        $counter = (($counter < $key_len) ? $counter + 1:1);
        $tmpchar = $nextchar ^ ord(substr($key, $counter-1, 1));

        if ($tmpchar <= $activechar)
            $tmpchar = 255 + $tmpchar - $activechar;
        else
            $tmpchar = $tmpchar - $activechar;

        $source = $source . chr($tmpchar);
        $activechar = $nextchar;
    }

    return substr($source, 2);
}


$help = 'Usage: ' . $_SERVER['SCRIPT_FILENAME'] . " -f encoded_filename\n";

$options = getopt('f:');
if (!isset($options['f'])) {
    print($help);
    exit(1);
}

if (!$data = @file_get_contents($options['f'])) {
    print("Could not read file\n");
    exit(1);
}

$pattern = '/\$' . VARIABLE_NAME . '\=\'[A-F0-9 ]+\'\;/';
$match_num = preg_match($pattern, $data, $matches, PREG_OFFSET_CAPTURE);

$coded = substr($matches[0][0], 18, -2);
$decoded = '';

if ($match_num > 0) {
    $pattern = '/eval\([\w]+\(\'[A-F0-9]+\'/';
    $match_num = preg_match($pattern, $data, $matches, PREG_OFFSET_CAPTURE);

    if ($match_num > 0) {
        $key = substr($matches[0][0], -19, -1);
        $decoded = decode_sc($key, $coded);
    }
}

if ($decoded != '')
    if (!file_put_contents($options['f'], $decoded)) {
        print("Could not write file\n");
        exit(1);
    }

?>