Skip to content

Latest commit

 

History

History
1515 lines (1482 loc) · 32.1 KB

init_8.9.6.md

File metadata and controls

1515 lines (1482 loc) · 32.1 KB

The steps to de-obfuscate init_8.9.6:

  1. Paste init_8.9.6 of the source into https://obf-io.deobfuscate.io/.
  2. You may get a code like 0++, it's okay, you can just change it to e.cssFromStyleSheets++;.
  3. Looking at the code, we see that the call to function R needs to be replaced. It looks like computing the string.
  4. I also found a lot of similar operations: gl, Ef, Fs, Qf, Xh, Ri, Ey, cp, $h, mh function, etc.
  5. Specifically, I noticed that the code contains something like + parseInt, this is a special treatment of the order of the array of strings. We have to adjust the strings in Ri, Ef, gl, cp, Qf, Fs, mh, Xh, Ey, $h accordingly.
  6. Put some special treatment on the function c.
  7. Execute this code in https://astexplorer.net/ using @baber/parser + babelv7 transform.
  8. Paste the code into https://obf-io.deobfuscate.io/ (uncheck "Simplify Objects") and let it help us optimize the code structure.
export default function (babel) {
  const { types: t } = babel;
  var E = (function () {
    try {
      return window.atob;
    } catch (t) {}
  })();

  function f(t) {
    f =
      "function" == typeof Symbol && "symbol" == typeof Symbol.iterator
        ? function (t) {
            return typeof t;
          }
        : function (t) {
            return t &&
              "function" == typeof Symbol &&
              t.constructor === Symbol &&
              t !== Symbol.prototype
              ? "symbol"
              : typeof t;
          };
    return f(t);
  }

  function R(t) {
    return f(E) === "function"
      ? E(t)
      : (function (t) {
          var e;
          var n;
          var r;
          var a;
          var o = [];
          var c = 0;
          var i = t.length;
          try {
            if (
              /[^+/=0-9A-Za-z]/.test(t) ||
              (/=/.test(t) && (/=[^=]/.test(t) || /={3}/.test(t)))
            ) {
              return null;
            }
            for (
              i % 4 > 0 &&
              (i = (t += window.Array(4 - (i % 4) + 1).join("=")).length);
              c < i;

            ) {
              n = [];
              for (a = c; c < a + 4; ) {
                n.push(
                  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(
                    t.charAt(c++)
                  )
                );
              }
              r = [
                ((e =
                  (n[0] << 18) +
                  (n[1] << 12) +
                  ((63 & n[2]) << 6) +
                  (63 & n[3])) &
                  16711680) >>
                  16,
                64 === n[2] ? -1 : (65280 & e) >> 8,
                64 === n[3] ? -1 : 255 & e,
              ];
              for (a = 0; a < 3; ++a) {
                if (r[a] >= 0 || 0 === a) {
                  o.push(String.fromCharCode(r[a]));
                }
              }
            }
            return o.join("");
          } catch (t) {
            return null;
          }
        })(t);
  }

  function gl(t, e) {
    const n = [
      "HyhDBUZYdQ",
      "push",
      "outerWidth",
      "HyhDBkNQdw",
      "input",
      "getAttribute",
      "HyhDBkZZdQ",
      "HyhDBURRfg",
      "4320224yAoFuM",
      "documentMode",
      "HyhDBUdQdg",
      "HyhDBUBRdg",
      "d2ViZHJpdmVy",
      "deviceMemory",
      "HyhDBkBZcg",
      "architecture",
      "HyhDBkJZfg",
      "constructor",
      "HyhDBkNbcQ",
      "test",
      "HyhDBkJddg",
      "enabledPlugin",
      "2238xWgSdL",
      "HyhDBkNQdg",
      "call",
      "HyhDBUZfdg",
      "length",
      "true",
      "HyhDBUZQdQ",
      "width",
      "rtt",
      "battery",
      "DateTimeFormat",
      "matches",
      "HyhDBUdYcA",
      "HyhDBURdcg",
      "value",
      "HyhDBUBffg",
      "HyhDBUdbdw",
      "(any-hover: none), (any-pointer: coarse)",
      "HyhDBkBccQ",
      "HyhDBUtfcQ",
      "HyhDBkBbcw",
      "moz",
      "HyhDBkVZdQ",
      "164OpdsXF",
      "localStorage",
      "HyhDBUBYdQ",
      "HyhDBkdQcA",
      "HyhDBkZcfg",
      "HyhDBkFYcQ",
      "webView",
      "HyhDBkdZdw",
      "HyhDBUtccQ",
      "AudioWorkletNode",
      "HyhDBUZadA",
      "maxTouchPoints",
      "HyhDBUdecg",
      "log",
      "HyhDBkZYcA",
      "callPhantom",
      "appVersion",
      "get",
      "HyhDBUVccw",
      "permissions",
      "doNotTrack",
      "awesomium",
      "HyhDBkBQfw",
      "openDatabase",
      "getElementsByTagName",
      "HyhDBUtafw",
      "HyhDBkNffw",
      "HyhDBUBdcA",
      "__webdriver_script_fn",
      "sort",
      "HyhDBUVYdA",
      "bmF2aWdhdG9yLndlYmRyaXZlcg==",
      "HyhDBkBddg",
      "HyhDBUtZdA",
      "HyhDBUVQdQ",
      "bitness",
      "shift",
      "HyhDBkZYfw",
      "runtime",
      "HyhDBUBcfw",
      "forEach",
      "scrollY",
      "HyhDBkBbdg",
      "2,10",
      "defaultView",
      "innerHeight",
      "HyhDBUZbdQ",
      "HyhDBUZcdg",
      "getPrototypeOf",
      "HyhDBUtYcg",
      "HyhDBUZbfw",
      "mobile",
      "geolocation",
      "HyhDBkdadw",
      "HyhDBUpQcg",
      "domAutomation",
      "HyhDBkdadg",
      "HyhDBkdcfw",
      "HyhDBUpbfg",
      "HyhDBUBfdA",
      "appCodeName",
      "AudioWorklet",
      "HyhDBkJafg",
      "null",
      "effectiveType",
      "9bgLOEd",
      "mimeTypes",
      "HyhDBUZedw",
      "517290tapWUW",
      "HyhDBkddcg",
      "HyhDBkNbcA",
      "HyhDBUdffw",
      "anNIZWFwU2l6ZUxpbWl0",
      "pageXOffset",
      "Android",
      "HyhDBUZecg",
      "HyhDBkBfcQ",
      "HyhDBUtbdQ",
      "HyhDBUVQcg",
      "HyhDBkZYcQ",
      "HyhDBkZYdw",
      "platformVersion",
      "product",
      "pdfViewerEnabled",
      "HyhDBkBZfg",
      "HyhDBUVedQ",
      "HyhDBkZRfg",
      "onLine",
      "HyhDBkdacA",
      "HyhDBkNYdQ",
      "atob",
      "HyhDBkNefw",
      "[object HTMLPluginsCollection]",
      " Mobile/",
      "HyhDBUZfcA",
      "pageYOffset",
      "HyhDBUZdcw",
      "referrer",
      "Content Security Policy",
      "3212kcAgYN",
      "HyhDBUVbcA",
      "30951FlmlBj",
      "voiceURI",
      "1259172mZvRGu",
      "orientation",
      "HyhDBURadQ",
      "buildID",
      "standalone",
      "HyhDBUtbfw",
      "aGFyZHdhcmVDb25jdXJyZW5jeQ==",
      "HyhDBUBQcg",
      "WebAssembly",
      "scrollX",
      "HyhDBUVffg",
      "BatteryManager",
      "dXNlZEpTSGVhcFNpemU=",
      "HyhDBUVddw",
      "HyhDBUZacg",
      "appName",
      "HyhDBUtcdg",
      "html",
      "name",
      "HyhDBkNdcg",
      "visibility",
      "getTime",
      "brands",
      "availHeight",
      "HyhDBkZRcQ",
      "v8Locale",
      "HyhDBkZccQ",
      "HyhDBkZacQ",
      "substring",
      "getEntries",
      "hardwareConcurrency",
      "spawn",
      "HyhDBkNddQ",
      "HyhDBUpYfg",
      "downlink",
      "[object Geolocation]",
      "platform",
      "HyhDBUVfcg",
      "uaFullVersion",
      "HyhDBUVQdw",
      "setInterval",
      "HyhDBUZZcQ",
      "userAgentData",
      "missing",
      "PX12073",
      "fmget_targets",
      "undefined",
      "setItem",
      "HyhDBkNadw",
      "timing",
      "getBoundingClientRect",
      "HyhDBUtRcQ",
      "HyhDBkZddg",
      "(pointer:fine)",
      "HyhDBkJacg",
      "sendBeacon",
      "format",
      "HyhDBUZbfg",
      "onorientationchange",
      "map",
      "height",
      "visible",
      "HyhDBUtbcQ",
      "msDoNotTrack",
      "HyhDBkNafw",
      "HyhDBkBYcg",
      "addEventListener",
      "HyhDBkJYdA",
      "HyhDBkFRdw",
      "HyhDBUZcfg",
      "elementFromPoint",
      "emit",
      "Worklet",
      "toString",
      "HyhDBUZafg",
      "RequestAnimationFrame",
      "HyhDBUtcdQ",
      "setTimeout",
      "Buffer",
      "isSecureContext",
      "HyhDBkZZdg",
      "label",
      "pixelDepth",
      "HyhDBkJYdg",
      "HyhDBkFcdw",
      "HyhDBkNadQ",
      "HyhDBUpRdw",
      "hidden",
      "HyhDBkFcfw",
      "offsetHeight",
      "indexOf",
      "[object MimeTypeArray]",
      "HyhDBkZZdA",
      "availWidth",
      "connection",
      "HyhDBUVcfw",
      "fontFromResourceApi",
      "domAutomationController",
      "HyhDBUBbcQ",
      "prototype",
      "offsetWidth",
      "performance",
      "type",
      "HyhDBUtadw",
      "dG90YWxKU0hlYXBTaXpl",
      "matchMedia",
      "ontouchstart",
      "HyhDBkZYfg",
      "HyhDBUBQcQ",
      "hasOwnProperty",
      "bWVtb3J5",
      "HyhDBkZZdw",
      "HyhDBUtcfw",
      "[object PluginArray]",
      "geb",
      "HyhDBURRdw",
      "HyhDBkBcdg",
      "HyhDBUVbdA",
      "HyhDBUdccA",
      "_cordovaNative",
      "random",
      "languages",
      "HyhDBUBQfw",
      "648GOisVI",
      "HyhDBUdYfw",
      "HyhDBUtQdQ",
      "plugins",
      "HyhDBUpdfw",
      "MatchesSelector",
      "HyhDBUVYfw",
      "22sbVOzV",
      "HyhDBUVQcw",
      "HyhDBURccA",
      "imgFromResourceApi",
      "colorDepth",
      "HyhDBkZadg",
      "getOwnPropertyDescriptor",
      "HyhDBkJefw",
      "HyhDBUtQdw",
      "cookie",
      "HyhDBkdccQ",
      "navigation",
      "T2JqZWN0LmdldE93blByb3BlcnR5RGVzY3JpcHRvcg==",
      "getTimezoneOffset",
      "HyhDBkJadw",
      "chrome",
      "HyhDBkFYcg",
      "HyhDBkZefg",
      "ancestorOrigins",
      "HyhDBkFfdw",
      "HyhDBUBQdg",
      "caches",
      "HyhDBUZafw",
      "dispatchEvent",
      "HyhDBkBdcA",
      "HyhDBUVdcQ",
      "HyhDBkBZcQ",
      "ActiveXObject",
      "webkit",
      "userAgent",
      "_Selenium_IDE_Recorder",
      "HyhDBURYcw",
      "keys",
      "HyhDBkJRdA",
      "innerWidth",
      "HyhDBUVddg",
      "HyhDBkZcfw",
      "TouchEvent",
      "Date",
      "HyhDBkdYfg",
      "HyhDBkJbdQ",
      "HyhDBUZZcw",
      "console",
      "cookieEnabled",
      "query",
      "getComputedStyle",
      "HyhDBkZQfw",
      "HyhDBkBQcQ",
      "message",
      "Performance",
      "HyhDBUdddA",
      "__nightmare",
      "HyhDBkdbdw",
      "bmF2aWdhdG9yLnVzZXJBZ2VudA==",
      "language",
      "HyhDBUZRcQ",
      "requestAnimationFrame",
      "HyhDBkZccg",
      "tagName",
      "10473730eQAQrv",
      "cssFromResourceApi",
      "ondeviceready",
      "HyhDBURQdw",
      "HyhDBUtQcA",
      " Safari/",
      "HyhDBUVadw",
      "productSub",
      "HyhDBUdRcg",
      "HyhDBUZacA",
      "HyhDBkdcdQ",
      "instantiate",
      "add",
      "showModalDialog",
      "cssFromStyleSheets",
      "RunPerfTest",
      "HyhDBkdecg",
      "HyhDBkZacg",
      "notify",
      "HyhDBkFedg",
      "item",
      "HyhDBUBfdw",
      "external",
      "HyhDBkdfcQ",
      "HyhDBkFdcg",
      "HyhDBUtecQ",
      "1631zxWmOw",
      "outerHeight",
      "HyhDBkddfg",
      "documentElement",
      "XDomainRequest",
      "PointerEvent",
      "split",
      "bind",
      "HyhDBkdQdQ",
      "HyhDBkBRcQ",
      "model",
      "getBattery",
      "HyhDBURYdw",
      "EventSource",
      "HyhDBUdedg",
      "HyhDBURbfg",
      "[object MSPluginsCollection]",
      "HyhDBkFQcA",
      "saveData"
  ];
    return n[(t -= 154)];
  }

  function Ef(t, e) {
    var n = [
      "charCodeAt",
      "slice",
      "substring",
      "4qGCCyw",
      "indexOf",
      "15548787BDMOTV",
      "50533550hTZSHu",
      "floor",
      "577046gbwZJy",
      "length",
      "9120IYrAbT",
      "push",
      "split",
      "sort",
      "1604064986000",
      "2476209ddDxWg",
      "40PXgOlY",
      "280mOVJiO",
      "6566768iMFEqh",
      "797881JsIrYL"
  ];
    return n[(t -= 157)];
  }

  function Fs(t, e) {
    var n = [
      "5yGDazF",
      "trigger",
      "sid",
      "HyhDBUpddQ",
      "_pxPreventAnalyticsCookie",
      "HyhDBkNdcA",
      "_pxAppId",
      "HyhDBURedA",
      "isChallengeDone",
      "true",
      "_pr_c",
      "HyhDBkNfcA",
      "cls",
      "removeItem",
      "shift",
      "1026132kRrnMU",
      "href",
      "18lJqiyh",
      "365958ugAyqG",
      "reload",
      "enrich",
      "1oo1o1",
      "risk",
      "24174760jxCtqV",
      "sts",
      "slice",
      "HyhDBUVdfw",
      "setItem",
      "HyhDBUdY",
      "bake",
      "ttl",
      "28NYExkP",
      "apply",
      "1371744AMCIhD",
      "forceSent",
      "pxqp",
      "getItem",
      "HyhDBkdQfg",
      "YmFrZQ==",
      "split",
      "622780bzMcpF",
      "length",
      "drc",
      "~~~~",
      "unshift",
      "toLowerCase",
      "push",
      "584648HnGcjN",
      "args",
      "concat",
      "1306868ivqNvh"
  ];
    return n[(t -= 208)];
  }

  function Qf(t, e) {
    var n = [
      "HyhDBkZQfg",
      "style",
      "getOwnPropertyDescriptor",
      "tof",
      "HyhDBkZddw",
      "Opera",
      "webkit",
      "gecko",
      "HyhDBkZdfw",
      "support",
      "6mSjIIz",
      "88HVIuWp",
      "plugins",
      "pqp",
      "toUpperCase",
      "concat",
      "toString",
      "7333529uzrNxE",
      "query",
      "nqbDcbnfasn76cspMYzpsy",
      "onhelp",
      "keys",
      "jnyehf",
      "inject_failed",
      "push",
      "try_to_inject",
      "toSource",
      "Function",
      "presto",
      "get",
      "HyhDBkZdcQ",
      "_len",
      "HyhDBkZddA",
      "onload",
      "HyhDBkZfdw",
      "match",
      "HyhDBkZedg",
      "type",
      "permissions",
      "toS",
      "sort",
      "slice",
      "HyhDBkZffw",
      "2iAJTdH",
      "allowedFeatures",
      "webkitNotifications",
      "angvir pbqr",
      "stringify",
      "charCodeAt",
      "HyhDBkZffg",
      "5cdfwqZ",
      "T2JqZWN0Lm5ld0hhbmRsZXIuPGNvbXB1dGVkPg==",
      "every",
      "iframe",
      "cmVhZCBvbmx5",
      "prototype",
      "featurePolicy",
      "maxConnectionsPerServer",
      "HyhDBkZddQ",
      "CynlvatSynt",
      "fubjZbqnyQvnybt",
      "haxabja",
      "msLaunchUri",
      "HyhDBkZRcg",
      "chrome",
      "removeChild",
      "Flzoby",
      "createElement",
      "jroxvgRkvgShyyfperra",
      "substring",
      "isn",
      "ActiveXObject",
      "async",
      "24704asEwxx",
      "HyhDBkZQdA",
      "HyhDBkZecA",
      "HyhDBkZQcQ",
      "HyhDBkZdcg",
      "undef",
      "connection",
      "brave",
      "String",
      "cyhtrkg",
      "HyhDBkZdfg",
      "nhqvb",
      "jroxvgShyyfperraRyrzrag",
      "mozConnection",
      "HyhDBkZedA",
      "navigator",
      "replace",
      "toLowerCase",
      "input",
      "document",
      "prefixes",
      "HyhDBkZfcQ",
      "getElementById",
      "pncgher",
      "display:none",
      "&ci=",
      "indexOf",
      "HyhDBkZdcw",
      "HyhDBkZecQ",
      "smd",
      "hasOwnProperty",
      "519729jdsOPr",
      "fryravhz-vqr-vaqvpngbe",
      "HyhDBkZfcA",
      "description",
      "axabja",
      "length",
      "jroxvg",
      "w3c",
      "HyhDBkZQdw",
      "27444010UucOvB",
      "nyreg",
      "status",
      "userAgent",
      "unknown",
      "OPR",
      "trg",
      "name",
      "HyhDBkZdcA",
      "resolvedOptions",
      "styleMedia",
      "onerror",
      "Object",
      "Intl",
      "cyhtvaf",
      "value",
      "fromCharCode",
      "message",
      "webkitConnection",
      "Neenl",
      "body",
      "call",
      "script",
      "zbm",
      "&ti=",
      "appendChild",
      "123129RIHTrT",
      "timeZone",
      "Notification",
      "isArray",
      "Cebzvfr",
      "jroxvgVfShyyFperra",
      "filename",
      "permission",
      "HyhDBkZQcg",
      "head",
      "onoperadetachedviewchange",
      "exec",
      "trident",
      "AngvirVBSvyr",
      "T2JqZWN0LmFwcGx5",
      "UGZYCbchcRyrzrag",
      "__proto__",
      "HyhDBkZQdg",
      "protocol",
      "9146880Owqhmw",
      "HyhDBkZedw",
      "share",
      "inject_succeeded",
      "1104999YVkXvO",
      "src",
      "HyhDBkZQdQ",
      "DateTimeFormat",
      "setAttribute",
      "getOwnPropertyDescriptors",
      "outerHTML"
  ];
    return n[(t -= 177)];
  }

  function Xh(t, e) {
    var n = [
      "HyhDBUVRcg",
      "bmF2aWdhdG9y",
      "onlostpointercapture",
      "getBoxQuads",
      "join",
      "HyhDBkZRdQ",
      "onhashchange",
      "Keyboard",
      "onvrdisplaydisconnect",
      "onselect",
      "webkitURL",
      "fileSize",
      "ondurationchange",
      "onpointerout",
      "match",
      "fragmentDirective",
      "onmousemove",
      "requestStorageAccess",
      "createTouch",
      "exitPictureInPicture",
      "HyhDBkZZcA",
      "onpageshow",
      "274580tmwwMF",
      "HyhDBURecg",
      "Close",
      "ontoggle",
      "ondragover",
      "HyhDBkFRcg",
      "createExpression",
      "Onafterprint",
      "registerProtocolHandler",
      "onwebkitanimationstart",
      "usedJSHeapSize",
      "createProcessingInstruction",
      "onmousedown",
      "onbeforeunload",
      "onuserproximity",
      "createcdatasECTION",
      "onactivateinvisible",
      "onselectionchange",
      "ondragexit",
      "oncancel",
      "onoffline",
      "VRFieldOfView",
      "onmouseenter",
      "elementsFromPoint",
      "speechSynthesis",
      "Yandex",
      "onvolumechange",
      "ondevicemotion",
      "eWFuZGV4",
      "VRDispaly",
      "queryCommandValue",
      "Onappinstalled",
      "onsubmit",
      "mozSyntheticDocument",
      "appName",
      "Onanimationend",
      "onplaying",
      "onrejectionhandled",
      "Open",
      "ongotpointercapture",
      "onreset",
      "toLowerCase",
      "taintEnabled",
      "onload",
      "ononline",
      "createNodeIterator",
      "productSub (important returns the build number of the current browser)",
      "onloadstart",
      "slice",
      "onshow",
      "Evaluate",
      "Dump",
      "Locks",
      "adoptNode",
      "styleSheetSets",
      "3326310FApFDX",
      "execComandShowHelp",
      "cookieEnabled",
      "webkitMediaStream",
      "onvrdisplaypresentchange",
      "onblur",
      "createRange",
      "webkitRTCPeerConnection",
      "Oncopy",
      "Append",
      "ontransitionstart",
      "Math",
      "createEntityReference",
      "onwebkitanimationiteration",
      "Serial",
      "onvrdisplaydeactivate",
      "VRStageParameters",
      "HyhDBUdddA",
      "hasOwnProperty",
      "oninput",
      "onwaiting",
      "RELEASEevents",
      "ol_originalAddEventListener",
      "onoverscroll",
      "HyhDBkJQdQ",
      "cGx1Z2lucw==",
      "onscroll",
      "mozFullScreenEnabled",
      "RnVuY3Rpb24=",
      "onscrollend",
      "queryCommandEnabled",
      "selectedStyleSheetSet",
      "onelementpainted",
      "oncut",
      "b3BlcmE=",
      "HyhDBUVccQ",
      "onlanguagechange",
      "HyhDBUZYfg",
      "performance",
      "getBattery",
      "ondeviceproximity",
      "Prepend",
      "onunload",
      "getvrdISPLAYS",
      "mediaSession",
      "[object global]",
      "onmouseup",
      "onmouseover",
      "CREATEdOCUMENTfRAGMENT",
      "caches",
      "length",
      "onpointerenter",
      "onmouseout",
      "onmozfullscreenerror",
      "onmouseleave",
      "Standalone",
      "HyhDBkZZcw",
      "vendorSub (important return vendor version number)",
      "plugins",
      "width",
      "importNode",
      "vendorName",
      "Plugins",
      "ondrop",
      "19504771tsqWfi",
      "mozInnerScreenX",
      "onunhandledrejection",
      "preferredStyleSheetSet",
      "Onmozfullscreenerror",
      "queryCommandIndeterm",
      "onwebkitanimationend",
      "Product",
      "getUserMedia",
      "onafterscriptexecute",
      "VRDisplayEvent",
      "onplay",
      "registerElement",
      "onmessageerror",
      "onpointerover",
      "42PrMCAS",
      "getElementbyTagName",
      "bGFuZ3VhZ2Vz",
      "menubar",
      "Permissions",
      "44obbHUv",
      "onkeyup",
      "Doctype",
      "ondeviceorientation",
      "onseeking",
      "createTextNode",
      "xmlVersion",
      "onsearch",
      "231585qUNKFZ",
      "webkitSpeechRecognition",
      "HTMLElement",
      "CREATEelement",
      "HyhDBkdQdw",
      "ontransitionrun",
      "onmozfullscreenchange",
      "carePositionsFromPoint",
      "webkitSpeechRecognitionError",
      "mozRTCSessionDescription",
      "onmousewheel",
      "setAppBadge",
      "HyhDBkFefg",
      "onstalled",
      "getElementByName",
      "1362ykYiRa",
      "prototype",
      "Onabort",
      "onerror",
      "Onanimationstart",
      "pushNotification",
      "oninvalid",
      "getElementsByClassName",
      "addressSpace",
      "getComputedStyle",
      "getSelection",
      "onpagehide",
      "hasStorageAccess",
      "HyhDBkZZfg",
      "createElementNS",
      "featurePolicy",
      "onratechange",
      "releaseCapture",
      "ondevicelight",
      "webkitSpeechGrammar",
      "onloadeddata",
      "Vibrate",
      "onwheel",
      "HyhDBUVcdw",
      "oncontextmenu",
      "Onselectionchange",
      "safari",
      "onloadedmetadata",
      "oncanplay",
      "enableStyleSheetsForSet",
      "scrollbars",
      "contentType",
      "onpointerup",
      "Share",
      "[object process]",
      "normalizeDocument",
      "ondblclick",
      "scheduler",
      "hasFocus",
      "totalJSHeapSize",
      "cmVmcmVzaA==",
      "Onpaste",
      "caretRangeFromPoint",
      "mozFullScreen",
      "exitPointerLock",
      "toString",
      "b3By",
      "jsHeapSizeLimit",
      "clearAppBadge",
      "ondragstart",
      "Y2hyb21lOi8vanVnZ2xlci9jb250ZW50",
      "memory",
      "onformdata",
      "Clipboard",
      "createNSResolver",
      "Chrome",
      "Onbeforescriptexecute",
      "Onafterscriptexecute",
      "onbeforescriptexecute",
      "ondragleave",
      "release",
      "HyhDBkZZfw",
      "Write",
      "getDefaultComputedStyle",
      "buildID (important return the buildID on firefox in addition to productSub)",
      "onended",
      "onclick",
      "mediaDevices",
      "visibilityState",
      "Opera",
      "onrendersubtreeactivation",
      "requestMediaKeySystemAccess",
      "HyhDBUdbdA",
      "Onauxclick",
      "createElementFromPoint",
      "call",
      "oncuechange",
      "ondragend",
      "CreateAttributeNS",
      "webkitSpeechRecognitionEvent",
      "VRFrameData",
      "mozFullScreenElement",
      "ondeviceorientationabsolute",
      "HyhDBkZZcQ",
      "onpointerdown",
      "VRPose",
      "HyhDBkFffg",
      "VRDisplayCapabilities",
      "W29iamVjdCBTYWZhcmlSZW1vdGVOb3RpZmljYXRpb25d",
      "elementFromPoint",
      "filter",
      "sort",
      "c2FmYXJp",
      "onpointerleave",
      "closed",
      "Bluetooth",
      "toolbar",
      "queryCommandState",
      "Onreadystatechange",
      "onseeked",
      "writeIn",
      "180XGEVgo",
      "compatMode",
      "dmFsdWU=",
      "locationbar",
      "HyhDBkFZfg",
      "onchange",
      "onbeforeprint",
      "onselectstart",
      "caretPositionFromPoint",
      "onsuspend",
      "substring",
      "mozCancelFullScreen",
      "mozSetImageElement",
      "onclose",
      "onpause",
      "754867zOwMCl",
      "Y2FsbA==",
      "test",
      "HyhDBkZZcg",
      "HyhDBkZccw",
      "crypto",
      "querySelector",
      "mozRTCIceCandidate",
      "querySelectorAll",
      "onfocus",
      "onwebkittransitionend",
      "CaptureEvents",
      "getAnimatinos",
      "onkeypress",
      "lastStyleSheetSet",
      "loadOverlay",
      "onstorage",
      "webkitSpeechGrammarList",
      "HyhDBkBQdw",
      "queryCommandSupported",
      "onpointermove",
      "yandexAPI",
      "Onfullscreenchange",
      "ontransitionend",
      "oncanplaythrough",
      "appCodeName",
      "getOwnPropertyNames",
      "createEvent",
      "onpointercancel",
      "ondrag",
      "getOverrideStyle",
      "Onanimationiteration",
      "onbeforeinstallprompt",
      "onvrdisplayactivate",
      "onvrdisplayconnect",
      "Onvisibilitychange",
      "javaEnabled",
      "ontimeupdate",
      "onpointerrawupdate",
      "undefined",
      "1466zUggwt",
      "ondragenter",
      "HyhDBkZRcw",
      "rootScroller",
      "mediaCapabilities",
      "devicePixelRatio",
      "onprogress",
      "onemptied",
      "createElementsFromPoint",
      "onresize",
      "HyhDBURQdg",
      "919336noLzKJ",
      "personalbar",
      "getCSSCanvasContext",
      "documentElement",
      "createAttribute",
      "VREyeParameters",
      "Clear",
      "eval",
      "onabsolutedeviceorientation",
      "onbeforexrselect",
      "Replacechildren",
      "getBoxObjectFor",
      "ancestorOrigins",
      "mozInnerScreenY",
      "onloadend",
      "createTreeWalker",
      "cHJvdG90eXBl",
      "createTouchList",
      "d2ViZHJpdmVy",
      "queryCommandText",
      "onmessage",
      "Securitypolicy",
      "CREATEcOMMENT",
      "ontransitioncancel",
      "onkeydown",
      "onpopstate",
      "name",
      "mozRTCPeerConnection",
      "HyhDBUBccQ",
      "Presentation",
      "getElementsById"
  ];
    return n[(t -= 293)];
  }

  function Ri(t, e) {
    var n = [
      "defineProperty",
      "HyhHAkI",
      "handler",
      "HyhDBUtbcQ",
      "HyhDBURZfw",
      "captcha_max_stale",
      "HyhFAkA",
      "ODlkNWZhOGQtMTgwZi00NGExLTg0OTctMDZiNWRlMjMwMmQ0",
      "HyhDBUBc",
      "HyhDBUVbdA",
      "HyhDBUBb",
      "HyhDBUVdcQ",
      "28ToIWEp",
      "languages",
      "HyhDBkNY",
      "HyhDBUpbdQ",
      "75303hnVlhI",
      "fontFromResourceApi",
      "HyhDBUBa",
      "HyhDBkNRcw",
      "HyhDBUpQcg",
      "length",
      "cssFromResourceApi",
      "HyhDBkZYdw",
      "HyhDBERe",
      "HyhDBkNRfw",
      "replace",
      "HyhDBUpYfw",
      "random",
      "HyhDBERY",
      "HyhDBkVbcw",
      "HyhDBUddcg",
      "HyhFAkc",
      "HyhDBUdd",
      "hasOwnProperty",
      "HyhDBURccw",
      "HyhDBkFecg",
      "HyhDBUVdfw",
      "HyhDBUpffg",
      "18890660hyqGzd",
      "HyhFAUY",
      "HyhDBURQdA",
      "HyhDBUpRdw",
      "HyhDBkVZcA",
      "HyhDBkJacA",
      "HyhDBkFbdg",
      "querySelectorAll",
      "HyhDBERQ",
      "4221qqSExc",
      "HyhDBkZadg",
      "imgFromResourceApi",
      "nodeName",
      "2089630RggBhk",
      "HyhFAkE",
      "HyhDBUVRfw",
      "705974fBHepm",
      "636420XeImkt",
      "HyhDBkVZcQ",
      "HyhEAEY",
      "getElementById",
      "HyhDBUBd",
      "21PtfmVb",
      "round",
      "1205596AIaNEn",
      "toLowerCase",
      "HyhDBUdYfw",
      "cssFromStyleSheets",
      "1616YoNOWq"
  ];
    return n[(t -= 329)];
  }

  function Ey(t, e) {
    var n = [
      "35260980wplrPy",
      "1490478gJjMTr",
      "splice",
      "HyhDBkZecw",
      "filter",
      "202638ERBpVm",
      "sendActivitiesCount",
      "params",
      "join",
      "HyhDBkFQdg",
      "HyhDBUdRcA",
      "activities",
      "trigger",
      "Events",
      "bind",
      "HyhDBUZRdg",
      "HyhDBUBbdA",
      "48324JYphKF",
      "clientFailures",
      "HyhDBUtRdw",
      "Blob",
      "xhrSuccess",
      "postData",
      "px_c_p_",
      "clientRoutesLength",
      "push",
      "setItem",
      "HyhHAkI",
      "hasOwnProperty",
      "_px",
      "_px2",
      "333ArFCca",
      "clientHttpErrorStatuses",
      "extend",
      "386792TlTCGu",
      "HyhDBkNRcw",
      "getTime",
      "sendBeacon",
      "HyhDBUBQcw",
      "HyhDBkFcfg",
      "Hyg6dzEHKTsDBkYSGBI9GRdH",
      "4296436cwFxQY",
      "xhrFailure",
      "_px3",
      "length",
      "148spysiH",
      "xhrResponse",
      "clientXhrErrors",
      "203ikeYdh",
      "fallbackStartIndex",
      "testDefaultPath",
      "2236215JIIfKa",
      "HyhDBkZecg",
      "captchaFailures",
      "Hyg6dzUJLSomF0YaDi8sEQZdHAYUKgMCWx0bIw",
      "getItem"
  ];
    return n[(t -= 487)];
  }

  function cp(t, e) {
    var n = [
      "20ztQlha",
      "xhrSuccess",
      "reload",
      "vid",
      "xhrFailure",
      "HyhDBURQdA",
      "HyhDBUZRdg",
      "xhrResponse",
      "_pxVid",
      "pxvid",
      "HyhDBUVccw",
      "HyhDBkFYcQ",
      "22tnEQUr",
      "496095iBoyFw",
      "length",
      "platform",
      "HyhDBUBadg",
      "180528NieMUV",
      "removeItem",
      "HyhDBkNRcw",
      "bind",
      "Hyg",
      "getItem",
      "pxInit",
      "4278765cWcfmx",
      "_asyncInit",
      "val",
      "189cIkkUk",
      "getTime",
      "uid",
      "8282583edIsWM",
      "_pxRootUrl",
      "HyhDBkFecg",
      "ttl",
      "3966896hYFkSr",
      "random",
      "trigger",
      "HyhDBkddfg",
      "14783HyWrao",
      "subscribe",
      "13347100TVBdtk",
      "one",
      "_pxmvid",
      "HyhDBUtRfg",
      "HyhDBUdecw"
  ];
    return n[(t -= 141)];
  }

  function $h(t, e) {
    var n = [
      "HNKDfr0Iz4",
      "caR",
      "10aINaRW",
      "4vtwATU",
      "pIY6sc",
      "7cXqKg",
      "floor",
      "UmFj",
      "112120PbTFQA",
      "7ncQN",
      "1574356UncXCG",
      "5425629BFYylJ",
      "QiugjY",
      "reverse",
      "475744gSKbwD",
      "join",
      "split",
      "375603AQaSvr",
      "18OyvpTc",
      "87568iRkbUm",
      "cztI3",
      "8qzt0QH",
      "90XmhrEQ",
      "458852jQkxdn",
      "HyhDBkZfdQ",
      "apply"
  ];
    return n[(t -= 288)];
  }

  function mh(t, e) {
    var n = [
      "webdriver",
      "toJSON",
      "fetch",
      "http",
      "runtime",
      "929847YGAzAw",
      "YXBw",
      "indexOf",
      "2994idCmBe",
      "238ZwXSwl",
      "1565500vcVECh",
      "loadTimes",
      "csi",
      "timing",
      "dispatchToListener",
      "1731QlDfni",
      "15320LdbFHk",
      "performance",
      "sendMessage",
      "length",
      "15ZDGXhH",
      "install",
      "constructor",
      "cnVudGltZQ==",
      "webstore",
      "342lvdEMg",
      "createElement",
      "onInstallStageChanged",
      "Y2hyb21l",
      "5400252qyQKjU",
      "195160yfnXSb",
      "6376579MZFQxH",
      "protocol"
  ];
    return n[(t -= 257)];
  }

  var a = (function () {
    try {
      if (atob && "test" === atob("dGVzdA==")) {
        return atob;
      }
    } catch (t) {}

    function t(t) {
      this.message = t;
    }

    t.prototype = new Error();
    t.prototype.name = "InvalidCharacterError";
    return function (e) {
      var n = String(e).replace(/[=]+$/, "");

      if (n.length % 4 == 1) {
        throw new t(
          "'atob' failed: The string to be decoded is not correctly encoded."
        );
      }

      var r;
      var a;
      var o = 0;
      var c = 0;

      for (
        var i = "";
        (a = n.charAt(c++));
        ~a && ((r = o % 4 ? 64 * r + a : a), o++ % 4)
          ? (i += String.fromCharCode(255 & (r >> ((-2 * o) & 6))))
          : 0
      ) {
        a =
          "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(
            a
          );
      }

      return i;
    };
  })();

  function c(n) {
    var i = a(n);
    var u = "";

    for (var f = 0; f < i.length; ++f) {
      var s = "Opr4shF".charCodeAt(f % 7);
      u += String.fromCharCode(s ^ i.charCodeAt(f));
    }

    return u;
  }

  const calls = { gl, Ef, Fs, Qf, Xh, Ri, Ey, cp, $h, mh };

  function apply_R_Transform(path) {
    if (
      t.isIdentifier(path.node.callee, { name: "R" }) &&
      path.node.arguments.length === 1 &&
      t.isStringLiteral(path.node.arguments[0])
    ) {
      const rValue = R(path.node.arguments[0].value);
      path.replaceWith(t.stringLiteral(rValue));
    }
  }

  function apply_c_Transform(path) {
    if (
      t.isIdentifier(path.node.callee, { name: "c" }) &&
      path.node.arguments.length === 1 &&
      t.isStringLiteral(path.node.arguments[0])
    ) {
      try {
        const rValue = c(path.node.arguments[0].value);
        path.replaceWith(t.stringLiteral(rValue));
      } catch (err) {}
    }
  }

  return {
    name: "ast-transform", // not required
    visitor: {
      Program(path) {
        path.traverse({
          CallExpression(path) {
            apply_R_Transform(path);
            apply_c_Transform(path);

            if (
              t.isIdentifier(path.node.callee) &&
              path.node.callee.name in calls &&
              path.node.arguments.length === 1 &&
              t.isNumericLiteral(path.node.arguments[0])
            ) {
              const rValue = calls[path.node.callee.name](
                path.node.arguments[0].value
              );
              try {
                path.replaceWith(t.stringLiteral(rValue));
              } catch (err) {}
            }
          },
        });

        // Replace the remaining calls to the functions of R and c with the following
        path.traverse({
          CallExpression(path) {
            apply_R_Transform(path);
            apply_c_Transform(path);
          },
        });

        // Remove these codes, which can send execution into a dead loop
        path.traverse({
          ExpressionStatement(path) {
            const code = path.getSource();
            if (code.split("\n").length > 13) return;
            const regex = /!?\s*function\s*\(\s*\w+\s*,\s*\w+\s*\)\s*{\s*for\s*\(.*\)\s*{\s*try\s*{\s*.*parseInt.*\s*\.push\(.*\.shift\(\)\);\s*} catch/s;
            if (regex.test(code)) path.remove();
          },
        })
      },
    },
  };
}