Now my question: What damage can this script do? And how could I inspect it correctly? (The compressed version needs a password and the decompressed version doesn't work)
Edit: I found This tool
I recognize this webshell, as I've dealt with it many times over my years in the shared hosting world.
This is known as a webshell. This particular one, Filesman, has a slew of dangerous features one can execute. To name a few, they can view and download any file or directory in your webroot, change permissions (CHMOD) of files and directories, and open incoming ports so other servers can stream more malicious data to your webroot.
I recommend getting rid of this and patching the hole this was uploaded through ASAP!