text: First, the $IDFX variable uses XOR operation (see character ^) to decode the string “create_function”, then the resulting base64 string is decoded to @eval($_REQUEST['ec_ver2update']); which is the backdoor’s code.