Not sure, "define" only appears 10 times but "function" appears 19 times. It's probably because 'e' is more popular in the code and "define" has two of them. Looking at the decrypted code there are much better strings to try; "function_exists" gives the right key first time too.

It could have been made a lot harder by using comments at the end of each line to pad the code with extra characters to equal out the frequency distribution and make this kind of frequency analysis impossible.