code: private function decrypt($encrypted, $appId)
      {
          try {
              $key = $this->getAESKey();
              $ciphertext = base64_decode($encrypted, true);
              $iv = substr($key, 0, 16);
  
              $decrypted = openssl_decrypt($ciphertext, 'aes-256-cbc', $key, OPENSSL_RAW_DATA | OPENSSL_NO_PADDING, $iv);
          } catch (BaseException $e) {
              throw new EncryptionException($e->getMessage(), EncryptionException::ERROR_DECRYPT_AES);
          }
  
          try {
              $result = $this->decode($decrypted);
  
              if (strlen($result) < 16) {
                  return '';
              }
  
              $content = substr($result, 16, strlen($result));
              $listLen = unpack('N', substr($content, 0, 4));
              $xmlLen = $listLen[1];
              $xml = substr($content, 4, $xmlLen);
              $fromAppId = trim(substr($content, $xmlLen + 4));
          } catch (BaseException $e) {
              throw new EncryptionException($e->getMessage(), EncryptionException::ERROR_INVALID_XML);
          }
  
          if ($fromAppId !== $appId) {
              throw new EncryptionException('Invalid appId.', EncryptionException::ERROR_INVALID_APPID);
          }
  
          $dataSet = json_decode($xml, true);
          if ($dataSet && (JSON_ERROR_NONE === json_last_error())) {
              // For mini-program JSON formats.
              // Convert to XML if the given string can be decode into a data array.
              $xml = XML::build($dataSet);
          }
  
          return $xml;
      }
docs: Decrypt message.
  
  @param string $encrypted
  @param string $appId
  
  @return string
  
  @throws EncryptionException