Please help with code from hacked server

I need help figuring what the code in the following repo does.
it was retrieved from a hacked server
https://github.com/cyriliser/code

Comments

[Konstantin Bogomolov]

It helps to download/upload files to the server, get permissions, etc. Actually it allows to control the server by malicious user. The main question is how these files got to the server.

[Junxiao Shi]

unphp.net/decode/b9f13c3f0221dd6a6...