I'm at work otherwise I would be wasting a good few hours deobfuscating that code. So far I've decoded two files which for the most part seem the same but the line counts are different

Edit: So far php_display seems to allow the attacker the ability to download a file. In common.php at at least.

Edit : https://github.com/icambridge/help_me_clear_this_up/blob/mas... what I've deobfuscated.