Deobfuscation of strange php code?

Question

PHP

Good time of the day. I accidentally noticed a folder on the server in the WordPress template that was not there. It turned out that this was an exploit or something like that ... in general, I myself got free access to the server ... But I could not understand what this code does and how it works, because it is encrypted in an incomprehensible way. Please help identify and help decipher this piece of code. But the problem is, it is ~19000 characters, and here the limit is 10000, so I uploaded it to a file-sharing hosting.
Download

Answer 1

You can deobfuscate here: phpdecoder
What it is: WSO Version 2.5 (web shell)
Description:
- Authorization
- Server information
- File manager (Copy, rename, move, delete, chmod, touch, create files and folders)
- View, hexview, editing, downloading, uploading files
- Working with zip archives (packing, unpacking)
- Console
- SQL manager (MySql, PostgreSql)
- PHP code execution
- Working with strings + hash search in online databases
- Bindport and back-connect (Perl)
- Search for text in files
- * nix / Windows
From chips
- Anti-search engine (checked by User-Agent, if search engine, then a 404 error is returned)
- The console remembers the entered commands. (you can navigate through them using the up and down arrows when focusing on the input field)
- You can use AJAX
- Lightweight (22.8 KB)
- Select the encoding in which the shell works.

Answer 2

Yes, it is not encrypted.
- cut out the second argument of preg_replace, which is a long hex string, feed it to echo
- see the most banal eval, replace it with echo, execute it again and see the original script
Everything.

Answer 3

everything is simple here -
the "e" modifier means that the line needs to be executed. We remove it and substitute it at the beginning of echo
We get the line
And again we display what we need (eval occurs 2 times in that line)
Here is the source code in a more understandable version (view with disabled JS in the browser).
pastebin.com/2GiCK2PY