[GET] I think I founded a virus in a Premium Nulled Plugin - Help!

Hi, I was looking for the latest thrive leads version to download for free and I found this website, downloaded it and opened the plugin folder. Inside the main folder I had found these 2 files that looks pretty sketchy:

I have checked the zip file using virustotal and it was clean.

rms-script-mu-plugin.php
rms-script-ini.php

Because I have written some programs using Python I have a rough idea what it says but I'm a beginner. Can somebody more experienced explain to me if this is a virus and what it exactly does. I'm going to share the whole plugin so you can check it yourself.

Btw I downloaded 2 more plugins from the same website and they too have the same 2 files included.

Here's the file:
https://www.mediafire.com/file/hkt7lyag90j5qb5/thrive-leads.zip/file

VirusTotal:
https://www.virustotal.com/gui/file/a4937401e17564dc03e0e250691d31e8cd6236c08a470c0b87310463c54eb3cd/detection

If you can clean it please reupload the plugin and I will edit this post so everybody can use it.

Please DON'T use until the viruses are removed!

I also found these exact files from using a nulled theme, in the theme's main folder.

In themes, the php files are executed from the theme's "functions.php" file.

the best way to prevent this script to be executed is to check a theme's "functions.php" after downloading a nulled theme, and make sure it doesn't execute those 2 scripts