【JS逆向学习】猿人学第五题 js混淆乱码

逆向目标

网址：https://match.yuanrenxue.cn/match/5
接口：https://match.yuanrenxue.cn/api/match/5?page=2&m=1709806560791&f=1709806560000
参数：
- Cookie(m、RM4hZBv0dDon443M)
- payload(m、f)

逆向过程

老规矩，上来先分析网络请求
在这里插入图片描述
网页上分析请求有点不太清楚，我们直接转为 python 代码来分析，观察右侧python代码，加密的几个参数就清楚了 cookie(m、RM4hZBv0dDon443M) 和 params(m、f)

逆向分析

我们先进启动器跟栈观察发现加密参数都已经生成完成了，那我们先随便找个加密参数搜索一下看能不能找到window._$is的赋值语句，直接搜索_$is，返现只有一个匹配结果
在这里插入图片描述
这是一个window的属性，我们又没有搜索到赋值语句，所以可以断定是在某个js语句中执行了这个操作，那我们在当前文件继续查看分析这个文件，可以看到在实际的网络请求的逻辑上面就有一段自执行的函数代码

<script>
    function _$KS() {

        if (eval["toString"]() === "function eval() { [native code] }") {
            if ($_zw["length"] === 25) {
                $_ow = "";

                for (var h = 0; h < window["$$$"]["length"]; h++) {
                    $_ow += String["fromCharCode"](window["$$$"][h]["charCodeAt"]() - 76);
                }

                eval($_ow);
            } else {
                $_ow = "";

                for (var h = 0; h < window["$$$"]["length"]; h++) {
                    $_ow += String["fromCharCode"](window["$$$"][h]["charCodeAt"]() - 76);
                }

                eval($_ow);
            }
        } else {
            $_ow = "";

            for (var h = 0; h < window["$$$"]["length"]; h++) {
                $_ow += String["fromCharCode"](window["$$$"][h]["charCodeAt"]() - 2331 - parseInt(h["toString"]()["slice"](0, 1)) * 2);
            }

            eval($_ow);
        }
    }

    _$KS();
</script>

我们简单分析下这段代码，eval["toString"]() === "function eval() { [native code] }"的值为true，然后在控制台看下$_zw的length值为27，所以具体执行的是哪个分支就很清楚了，直接断点调试，发现断住了
在这里插入图片描述
接下来就是大家喜闻乐见的常规hook操作了，既然是 cookie加密 我们就先 hook cookie 的m参数

(function () {
    'use strict';
    var cookie_cache = document.cookie;
    Object.defineProperty(document, 'cookie', {
        get: function () {
            return cookie_cache;
        },
        set: function (val) {
            console.log('Setting cookie', val);
            //if (val.indexOf('RM4hZBv0dDon443M') !== -1) {
            if (val.indexOf('m') !== -1) {
                debugger;
            }
            var cookie = val.split(";")[0];
            var ncookie = cookie.split("=");
            var flag = false;
            var cache = cookie_cache.split("; ");
            cache = cache.map(function (a) {
                if (a.split("=")[0] === ncookie[0]) {
                    flag = true;
                    return cookie;
                }
                return a;
            })
            cookie_cache = cache.join("; ");
            if (!flag) {
                cookie_cache += cookie + "; ";
            }
            return cookie_cache;
        }
    });
})();

如下图，断点断在了如下位置
在这里插入图片描述
直接跟栈分析就行了

_$Wa = _0x12eaf3();
_0x3d0f3f[_$Fe] = 'm=' + _0x474032(_$Wa) + ';\x20path=/';

控制台打印_$Wa的值为1709864112000，是个 13 位的时间戳，再看_0x12eaf3 的函数定义

function _0x12eaf3() {
    return _0x35bb1d[_$UH[0xff]](new _0x35bb1d());
}
/* 
	控制台打印观察混淆后的变量值，如下
*/
_$UH[0xff]
>> 'parse'
_0x35bb1d
>> ƒ Date() { [native code] }

再来看_0x474032这个函数
在这里插入图片描述
一层层跟下去就可以发现具体的调用顺序了，如下图

调用顺序都有了，接下来我们要开始扣代码了，把上图所有涉及到的调用函数都扣下来，然后我们在本地nodejs中调试

function _0x1ee7ec(_0x206333) {
    return _0x12b47d(_0x11a7a2(_0x35f5f2(_0x206333), 0x8 * _0x206333[_$UH[0x6c]]));
}


function _0x499969(_0x82fe7e) {
    var _0x5bdda4, _0x322a73, _0xd0b5cd = '0123456789abcdef', _0x21f411 = '';
    for (_0x322a73 = 0x0; _0x322a73 < _0x82fe7e[_$UH[0x6c]]; _0x322a73 += 0x1)
        _0x5bdda4 = _0x82fe7e[_$UH[0xf]](_0x322a73),
            _0x21f411 += _0xd0b5cd['charAt'](_0x5bdda4 >>> 0x4 & 0xf) + _0xd0b5cd['charAt'](0xf & _0x5bdda4);
    return _0x21f411;
}

function _0x2b8a17(_0x36f847) {
    return unescape(encodeURIComponent(_0x36f847));
}

function _0x41873d(_0x5a6962) {
    return _0x1ee7ec(_0x2b8a17(_0x5a6962));
}

function _0x37614a(_0x32e7c1) {
    return _0x499969(_0x41873d(_0x32e7c1));
}

function _0x474032(_0x233f82, _0xe2ed33, _0x3229f9) {
    return _0xe2ed33 ? _0x3229f9 ? v(_0xe2ed33, _0x233f82) : y(_0xe2ed33, _0x233f82) : _0x3229f9 ? _0x41873d(_0x233f82) : _0x37614a(_0x233f82);
}

function _0x12b47d(_0x149183) {
    var _0xabbcb3, _0x1145c3 = '', _0x4fce58 = 0x20 * _0x149183[_$UH[0x6c]];
    for (_0xabbcb3 = 0x0; _0xabbcb3 < _0x4fce58; _0xabbcb3 += 0x8)
        _0x1145c3 += _0x30bc70[_$UH[0x114]](_0x149183[_0xabbcb3 >> 0x5] >>> _0xabbcb3 % 0x20 & 0xff);
    return _0x1145c3;
}

function _0x35f5f2(_0x243853) {
    var _0x139b8b, _0xa791a1 = [];
    for (_0xa791a1[(_0x243853[_$UH[0x6c]] >> 0x2) - 0x1] = void 0x0,
             _0x139b8b = 0x0; _0x139b8b < _0xa791a1[_$UH[0x6c]]; _0x139b8b += 0x1)
        _0xa791a1[_0x139b8b] = 0x0;
    var _0x41a533 = 0x8 * _0x243853[_$UH[0x6c]];
    for (_0x139b8b = 0x0; _0x139b8b < _0x41a533; _0x139b8b += 0x8)
        _0xa791a1[_0x139b8b >> 0x5] |= (0xff & _0x243853[_$UH[0xf]](_0x139b8b / 0x8)) << _0x139b8b % 0x20;
    return _0xa791a1;
}

function _0x11a7a2(_0x193f00, _0x1cfe89) {
    _0x193f00[_0x1cfe89 >> 0x5] |= 0x80 << _0x1cfe89 % 0x20,
        _0x193f00[0xe + (_0x1cfe89 + 0x40 >>> 0x9 << 0x4)] = _0x1cfe89;
    try {
        var _0x42fb36 = _0x4e96b4[_$UH[0x260]][_$UH[0x8]]['DONE'] * 0x4;
    } catch (_0x1b1b35) {
        var _0x42fb36 = 0x1;
    }
    try {
        _0x4e96b4['$_z2'][0x0] = 'Q';
    } catch (_0x4c574d) {
        try {
            op = _0x4e96b4['$_zw'][_$UH[0x6c]];
        } catch (_0x58af26) {
            var _0x3b7935 = 0x0;
            for (var _0x1badc3 = 0x0; _0x1badc3 < 0xf4240; _0x1badc3++) {
                _0x3b7935 = _0x3b7935 + _0x1badc3[_$UH[0x1f]]();
                history['pushState'](0x0, 0x0, _0x3b7935);
            }
        }
        if (op > 0x14) {
            eval('b64pad = _0x4e96b4[\'$_zw\'][9][\'length\'];');
        } else if (op < 0xa) {
            _0x4e96b4['$_zw'] = [0x1, 0x8, 0x2, 0x4, 0x17, 0x2d, 0x8, 0xf, 0x51, 0x44, 0xd, 0x48, 0x46];
        }
    }
    var _0x1badc3, _0x38ca59, _0x431764, _0x43f1b4, _0x5722c0, _0x3e0c38 = _0x1171c8, _0xdb4d2c = _0x4dae05,
        _0x1724c5 = _0x183a1d, _0x257ec6 = _0xcfa373;
    try {
        if (_0x4e96b4['_$6_']) {
        } else {
            _0x4e96b4['_$6_'] = 0x20dc5d57f;
        }
    } catch (_0x15bf3f) {
        _0x4e96b4['_$6_'] = 0x2421603;
    }
    for (_0x1badc3 = 0x0; _0x1badc3 < _0x193f00[_$UH[0x6c]]; _0x1badc3 += _0x42fb36)
        _0x38ca59 = _0x3e0c38,
            _0x431764 = _0xdb4d2c,
            _0x43f1b4 = _0x1724c5,
            _0x5722c0 = _0x257ec6,
            _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3], 0x7, 0x7d60c),
            _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x1], 0xc, _0x4e96b4['_$6_']),
            _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x2], 0x11, 0x242070db),
            _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x3], 0x16, -0x3e423112),
            _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x4], 0x7, -0xa83f051),
            _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x5], 0xc, 0x4787c62a),
            _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x6], 0x11, -0x57cfb9ed),
            _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x7], 0x16, -0x2b96aff),
            _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x8], 0x7, 0x698098d8),
            _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x9], 0xc, -0x74bb0851),
            _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xa], 0x11, -0xa44f),
            _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xb], 0x16, -0x76a32842),
            _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0xc], 0x7, 0x6b901122),
            _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xd], 0xc, -0x2678e6d),
            _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xe], 0x11, -0x5986bc72),
            _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xf], 0x16, 0x49b40821),
            _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x1], 0x5, -0x9e1da9e),
            _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x6], 0x9, -0x3fbf4cc0),
            _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xb], 0xe, 0x265e5a51),
            _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3], 0x14, -0x16493856),
            _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x5], 0x5, -0x29d0efa3),
            _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xa], 0x9, 0x2441453),
            _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xf], 0xe, _0x4e96b4['_$tT']),
            _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x4], 0x14, _0x4e96b4['_$Jy']),
            _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x9], 0x5, 0x21e1cde6),
            _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xe], 0x9, -0x3cc8aa0a),
            _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x3], 0xe, -0xb2af279),
            _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x8], 0x14, 0x455a14ed),
            _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0xd], 0x5, -0x5caa8e7b),
            _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x2], 0x9, -0x3105c08),
            _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x7], 0xe, 0x676f02d9),
            _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xc], 0x14, -0x72d5b376),
            _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x5], 0x4, -0x241282e),
            _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x8], 0xb, -0x788e097f),
            _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xb], 0x10, 0x6d9d6122),
            _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xe], 0x17, -0x21ac7f4),
            _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x1], 0x4, -0x5b4115bc * b64pad),
            _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x4], 0xb, 0x4bdecfa9),
            _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x7], 0x10, -0x944b4a0),
            _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xa], 0x17, -0x41404390),
            _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0xd], 0x4, 0x289b7ec6),
            _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3], 0xb, -0x155ed806),
            _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x3], 0x10, -0x2b10cf7b),
            _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x6], 0x17, 0x2d511fd9),
            _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x9], 0x4, -0x3d12017),
            _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xc], 0xb, -0x1924661b),
            _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xf], 0x10, 0x1fa27cf8),
            _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x2], 0x17, -0x3b53a99b),
            _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3], 0x6, -0xbd6ddbc),
            _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x7], 0xa, 0x432aff97),
            _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xe], 0xf, -0x546bdc59),
            _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x5], 0x15, -0x36c5fc7),
            _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0xc], 0x6, 0x655b59c3),
            _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0x3], 0xa, -0x70ef89ee),
            _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xa], 0xf, -0x644f153),
            _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x1], 0x15, -0x7a7ba22f),
            _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x8], 0x6, 0x6fa87e4f),
            _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xf], 0xa, -0x1d31920),
            _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x6], 0xf, -0x5cfebcec),
            _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0xd], 0x15, 0x4e0811a1),
            _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 0x4], 0x6, -0x8ac817e),
            _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 0xb], 0xa, -1120211379),
            _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0x2], 0xf, 0x2ad7d2bb),
            _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x9], 0x15, -0x14792c01),
            _0x3e0c38 = _0x12e4a8(_0x3e0c38, _0x38ca59),
            _0xdb4d2c = _0x12e4a8(_0xdb4d2c, _0x431764),
            _0x1724c5 = _0x12e4a8(_0x1724c5, _0x43f1b4),
            _0x257ec6 = _0x12e4a8(_0x257ec6, _0x5722c0);
    return [_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6];
}

console.log(_0x474032(1709864813000));

发现报错了 for (_0xa791a1[(_0x243853[_$UH[0x6c]] >> 0x2) - 0x1] = void 0x0, ReferenceError: _$UH is not defined，在浏览器中搜索这个变量的赋值语句 _$UH = _0xceb4b2;，然后继续抠下去就行了

var _0xceb4b2 = []
      , _0x2b11f1 = String['fromCharCode'];
    function _0xac9d20(_0x16f6c8) {
        var _0x7d707d = _0x2b11f1(0x60);
        _0xceb4b2 = _0x48d4b5(_0x16f6c8)['split'](_0x7d707d);
    }
    function _0x48d4b5(_0xabcf4d) {
        var _0x10430a = _0xabcf4d['length'];
        var _0x4c73dc, _0x324511 = new Array(_0x10430a - 0x1), _0x4a9df7 = _0xabcf4d['charCodeAt'](0x0) - 0x61;
        for (var _0x399f28 = 0x0, _0x3a7b53 = 0x1; _0x3a7b53 < _0x10430a; ++_0x3a7b53) {
            _0x4c73dc = _0xabcf4d['charCodeAt'](_0x3a7b53);
            if (_0x4c73dc >= 0x28 && _0x4c73dc < 0x5c) {
                _0x4c73dc += _0x4a9df7;
                if (_0x4c73dc >= 0x5c)
                    _0x4c73dc = _0x4c73dc - 0x34;
            } else if (_0x4c73dc >= 0x61 && _0x4c73dc < 0x7f) {
                _0x4c73dc += _0x4a9df7;
                if (_0x4c73dc >= 0x7f)
                    _0x4c73dc = _0x4c73dc - 0x1e;
            }
            _0x324511[_0x399f28++] = _0x4c73dc;
        }
        return _0x2b11f1['apply'](null, _0x324511);
    }
    function _0xaaef84(_0xaf3112, _0x2a165a, _0x532fb4, _0x10aa40, _0x41c4e7, _0x1cb4da) {
        return _0x12e4a8(_0x3634fc(_0x12e4a8(_0x12e4a8(_0x2a165a, _0xaf3112), _0x12e4a8(_0x10aa40, _0x1cb4da)), _0x41c4e7), _0x532fb4);
    }
    _0xac9d20('o~q}u`euf3ffdyrgfu`fkbu`xduv`wuf3ffdyrgfu`qsfya~`sq||`efdy~w`bdafafkbu`e|ysu`$_vb~W`eb|ysu`qbb|k`3sfyhuJArzusf`dueg|f`sxqd5atu3f`rgffa~`eu~t`vad}`ratk`}ageu}ahu`xqeAi~Bdabudfk`xaef~q}u`|asqfya~`abu~`eb|yf`euf;~fudhq|`xffbe,`s|ys{`sa~sqf`}ufxat`faEfdy~w`~atuFkbu`adywy~`v|aad`badf`$_~t`:F?>9u~udys7|u}u~f`fqw@q}u`saa{yu`$_<C~x`exai?atq|6yq|aw`du}ahu5xy|t`{uk5atu`bqdu~f@atu`wufFy}u`duqtkEfqfu`ujus`bqfx~q}u`euqdsx`fuef`yvdq}u`eufFy}uagf`:F?>8ad}7|u}u~f`hyeyry|yfk`qbbu~t5xy|t`qtt7hu~f>yefu~ud`y~tujut64`esdybf`a~duqtkefqfusxq~wu`uhq|`y~~ud:F?>`hq|gu`7{sB`|asq|Efadqwu`a~egr}yf`arzusf`bdafasa|`sa~fu~f`s|a~u@atu`y~tujAv`qeeyw~`idyfu`tasg}u~f`du}ahu7hu~f>yefu~ud`dag~t`efk|u`$_hh5;`dub|qsu`vg~sfya~`?ysda?ueeu~wud`geud3wu~f`ixy|u`a~s|ys{`y~bgf`suy|`?qfx`xyttu~`fqdwuf`|aqt`}rezmkexsv`~g}rud`sduqfu7|u}u~f`wuf7|u}u~fe4kFqw@q}u`wuf7|u}u~f4k;t`qffqsx7hu~f`$_vxV`s|yu~f6qfq`egr}yf`fy}uEfq}b`va~fe`A~|k\x20a~u\x20hqdyqr|u\x20tus|qdqfya~\x20q||aiut\x20y~\x20vadTTy~\x20|aab`fdq~eyu~f`qdyfk`tyeqr|ut`fkbuav`sxqdeuf`egbud`|u~wfx`#v*X`?ej}|XTJ?>:FFBTYTV`fa6qfqGD>`asd_dtkfigDsddqqmujgnh`qbb|ysqfya~5qsxu`}g|fybqdfUvad}Stqfq`hqd\x20wuf3ffdyrgfu/vg~sfya~N~q}uOmdufgd~\x20sgd_u|uTwuf3ffdyrgfuN~q}uO-o-`qffdyrgfue`Marzusf\x203ddqk]`bgex@afyvysqfya~`hayt`F=_EFD;@9`VVVV`qffdHudfuj`bgr|ys`efabBdabqwqfya~`l_,zcze~ld_VQR_+zxfiyzi9_jzcze~ld9xvcc,zcze~ld`$_vV`xqex`su||g|qd`8EE44`qssu|udqfya~`fdq~evud5xq~~u|`~7hdo5od|hu`fdgu`sduqfuArzusfEfadu`?ej}|XTJ?>:FFBT[TV`du}ahu3ffdyrgfu`b|gwy~e`o__vf{jwf_wjs~ishw6__kwtvf{jwf_wjs~ishw6__gw~wb{ia_wjs~ishw6__xlvf{jwf_wjs~ishw6__vf{jwf_ibkfsddwv6__kwtvf{jwf_ibkfsddwv6__gw~wb{ia_ibkfsddwv6__xlvf{jwf_ibkfsddwv6__kwtvf{jwf_guf{dh_xibu6__kwtvf{jwf_guf{dh_xb`fdkmdufgd~\x20Niy~tai\x20y~efq~suav\x20Iy~taiO-osqfsxNuOmo`?ej}|XTEudhudJ?>:FFB`sa|ad6ubfx`fWY/ebisbqf~|N3f}bq|k\x20,|~efkb\x204kfNVllig|wwN5boa|k|N[bisbqf~|\x20-brb\x20+3\x20/ol\x20FH\x203efkNq|elj|N+Z\x202j|oq_[\x20qbpq\x201bdri|oNW(-/ol@ifdeqN[bisbqf~|\x20+3\x20GF\x20+fdeq\x20XuqbkabaN[bisb,_(kaf|N2XV1l}lql+fdeq\x20UliaN.1\x20,le|kqv\x204kf~lab\x201bdri|oNWolfa\x202|kp\x203e|fN*|kk|a|\x202|kd|j\x20,-NWWV\x204~ebkN~il~hECDI_sDADN2|jprkd*|kk|a|1bdri|oN,(\x20+T-3(-Z\x20UliaN2|jprkd2|kp-rjF+\x20+fdeqNsboa|k|N[bisbqf~|-brb3efkN2XVY|ii}|~hN2|jprkdXjlgfN3birdr\x202|kd|j\x20,-NV|oolfp\x20Zlqef~\x202VNYivjb\x20+fdeq\x201l}lql\x20+fdeqN2l,T@Wfdfq\x20+fdeqN2l,V\x202|kp\x201bdri|oN[87f8r|k)NppqNp|jprkd@p|kp@krjG3Ndj_jbkdjbkdN+lefq\x20*|kk|a|Nqfjbp\x20kbt\x20olj|kNp|jprkd@p|kp@krjG+Npbofc@jlklpm|~bN2|jprkd2|kp-rj@F3\x203efkNVlilo.24(@73efkNWolfa\x20-|phe\x202efcq\x20TiqN2|jprkd3birdr1bdri|oNUbkd|if\x20.32N,(\x20+|k3fkd_ZU\x20.rqpfab\x2082NY9,f|l6r_ZUDKCFCNebisb@kbrb@obdri|oN223\x20,bafrjNVlrofbo\x20-btN*ejbo\x20,lkarihfof\x20UliaN[bisbqf~|\x20+3\x20EF\x204iqo|\x20+fdeq\x20XuqbkabaN[bisbqf~|\x20+3\x20EH\x204iqo|\x20+fdeqN1l}lql\x20,bafrjNWolfa\x202|kp\x20UliaNdlravNp|kp@pbofc@~lkabkpba@ifdeqN2YfkaboNklql@p|kp@~gh@jbafrjNjfrfN,1l~hv\x20/1V\x20UliaNTkaolfaVil~h\x201bdri|oN2|jprkd2|kp-rj@G+\x20+fdeqNp|kp@pbofc@qefkNT|/|kd8|boN~|pr|iNU-\x20,le|kqv.3\x20UliaNu@ppqN-lql2|kp,v|kj|o9|tdvfN[bisbqf~|\x20+3\x20FF\x203efk\x20XuqbkabaNTpeibv2~ofmq,3\x20TiqN-lql\x202|kp\x20Wbs|k|d|of\x204(N1l}lql\x20Vlkabkpba\x20UliaN1l}lql\x20,bafrj\x20(q|if~NjfrfbuN-lql\x202|kp\x20Zrojrhef\x204(N223\x205fbqk|jbpb\x20+fdeqN+Z_.ofv|Nev~lccbbNu@ppq@riqo|ifdeqNWY[bfT6J@TNY9967U3.3_4kf~labNWbs|k|d|of\x202|kd|j\x20,-\x20UliaNp|kp@pbofc@jlklpm|~bN/|a|rh\x20Ullh\x20UliaN+Z@Y98fkdUf*|f2er@2DH@5EAEN+Z@Y98fkdUf*|f2er@2DH@5EAFN[bisbqf~|-brb+3\x20/ol\x20FH\x203eN,f~olplcq\x20[fj|i|v|N2|jprkd2|kpY|ii}|~hN223\x20,bafrj\x20(q|if~NTkaolfaXjlgfN2|jprkd2|kp-rj@F1N(3V\x202qlkb\x202bofcNp|kp@pbofc@pj|ii~|mpNu@ppq@jbafrjN+Z_2fke|ibpbN1l}lql\x203efk\x20(q|if~N~bkqrov@dlqef~NVil~hlmf|N+rjfklrp_2|kpNYilofaf|k\x202~ofmq\x20TiqN-lql\x202|kp\x20Zrojrhef\x20UliaN+3[829*\x20UliaNZ2_3e|fN2|jprkd-bl-rj_F3_ENTo|}f~Ne|kp@p|kp@kloj|iN+lefq\x203birdrN[80f[bf@HC2\x20+fdeqN+fkapbv\x20clo\x202|jprkdNT1\x20Vovpq|iebf\x20WUN2|jprkd\x202|kp\x20,bafrjNp|jprkd@p|kp@krjGHNe|kp@p|kp@}liaN+rjfklrp_2~ofmqN223\x20VlkabkpbaN2|jprkdWbs|k|d|of1bdri|oNTkg|i\x20,|i|v|i|j\x20,-N2|jprkd3e|f;qbpq<NY9+|k3fkd[bf@,@ZUDKCFCN[b}obt\x20.32NZ2GH_To|};Tkaolfa.2<N2|jprkd\x202|kp\x20+fdeqNVel~l\x20~llhvNebisb@kbrb@qefkN/-\x20,le|kqv.3\x20,bafrjN+Z@Y9*|3lkd@,DL@5EAGNWolfa\x202bofcN2|jprkd2fke|i|1bdri|oNebisbqf~|N+Z@Y9*|3lkd@,DL@5EAEN-lql\x202|kp\x20Wbs|k|d|of\x204(\x20UliaN223\x20+fdeqNWY/XjlgfNtb|qeboclkqkbt\x201bdri|oN1l}lql-rjF1NW(-/ol@jbafrjN2|jprkd\x202|kp\x20-rjHHN223\x20[b|sv\x20(q|if~N+Zil~hG\x201bdri|o_CKCHNZblodf|Nklql@p|kp@~ghN3birdr\x202|kd|j\x20,-\x20UliaN,(4(\x20X7\x20-loj|iN[80f[bf@JH2\x20UliaN-lql2|kp,v|kj|o9|tdvf\x20UliaNvrklpmol@}i|~hNebisb@kbrb@kloj|iN+rjfklrp_2bofcN3,\x20,le|kqv.3\x20-loj|iN2|jprkd2|kp-rj@F+s\x20+fdeqN2|jprkd\x202|kp\x20-rjGHN2j|oqZlqef~\x20,bafrjNdblodf|N~|pr|i@clkq@qvmbN2|jprkd\x202|kp\x20UliaNpj|ii@~|mfq|ipN,Yfk|k~b\x20/1V\x20UliaNY9+|k3fkd[bf_ZUDKCFCN2|jprkdTojbkf|kN1l}lql\x20UliaN~bkqrov@dlqef~@}liaNu@ppq@eb|svN223\x20+fdeq\x20(q|if~N3e|o+lkNu@ppq@ifdeqNWfk}li\x201bdri|oN2|jprkdUbkd|if1bdri|oN*-\x20,le|kqv.32j|ii\x20,bafrjNevmrobN2|jprkd3|jfi1bdri|oN,|i|v|i|j\x202|kd|j\x20,-N-lql\x202|kp\x20*|kk|a|\x204(Nebisb@kbrbN[bisbqf~|\x20+3\x20HH\x201lj|kN-lql\x202|kp\x20*|kk|a|\x20UliaN2|kmv|N2|jprkd/rkg|}f1bdri|oNp|jprkd@p|kp@krjG+sN+Z_*|kk|a|N2|jprkd\x202|kp\x201bdri|oN9|tdvf@.kbNWolfa\x202bofc\x20Ulia\x20(q|if~NY9*T3)6N~lrofbo\x20kbtN2|jprkdXjlgf1bdri|oN,(4(\x20X7\x20UliaNTkaolfa\x20XjlgfN-lql\x20-|phe\x20To|}f~\x204(N+VW\x20VljNYrqro|\x20,bafrj\x20U3N5fsl@buqo|~qNU|kdi|\x202|kd|j\x20,-\x20UliaNe|kp@p|kp@obdri|oN2-rj@F1N2-rj@F3Ne|kp@p|kpN223\x204iqo|\x20+fdeqN1l}lql\x201bdri|oN1l}lql\x20+fdeqN[|krj|kNkbtiddlqef~NWY[bfT6H@TNe|kp@p|kp@ifdeqN/i|qb\x20Zlqef~N2-rj@F+N[bisbqf~|\x20+3\x20GH\x20+fdeqN,v|kj|o\x202|kd|j\x209|tdvf\x20UliaNid@p|kp@pbofc@ifdeqN,(4(\x20X7\x20+fdeqN1l}lql\x203efkN2l,T\x20UliaN/|a|rhN2|jprkd\x202|kpN2m|~flrp_2j|iiV|mNp|kp@pbofcNW5\x20,le|kqv.3\x20,bafrjN2q|}ib_2i|mNjlk|~lNYivjb@+fdeqNcwwvp@alpmvN2~obbk2|kpN~il~hECDIN1l}lql\x20Vlkabkpba\x20Ulia\x20(q|if~NTof|iN*-\x20,le|kqv\x20,bafrjN,lqlv|+,|or\x206F\x20jlklN[|kapbq\x20VlkabkpbaN1l}lql\x20(q|if~N[3V\x20[|kaN223\x204iqo|\x20+fdeq\x20(q|if~N223\x205fbqk|jbpb\x201lj|kN-lql\x20-|phe\x20To|}f~\x204(\x20UliaN~ekcwue@jbafrjN2-rjVlka@F3N~bkqrov@dlqef~@obdri|oNabc|riq_ol}lql@ifdeqN-lql\x202|kp\x20,v|kj|oN,v|kj|o\x202|kd|j\x20,-NTmmib\x20Vlilo\x20XjlgfNtb|qeboclkq1bdN2|jprkd,|i|v|i|j1bdri|oN|of|iNWolfa\x202bofc\x20UliaNV/lF\x20/1V\x20UliaN,(\x20+T-3(-ZN2|jprkd*lob|k@1bdri|oNqbpqGH\x201bdri|oNpmfofq_qfjbNWbs|k|d|of\x202|kd|j\x20,-N2~obbk2bofcN1l}lqlN~ropfsb@clkq@qvmbN23[bfqf_sfslN~ekcwueN2|jprkd\x20Vil~hYlkq\x20FTN1l}lql\x20Vlkabkpba\x201bdri|oNp|jprkd@kbl@krjF1NZ)\x20,le|kqv.3\x20,bafrjNVeriel\x20-brb\x20+l~hNol}lql@krjF+Nebisb@kbrb@riqo|+fdeqbuqbkabaN2|jprkd.ofv|1bdri|oN2|jprkd2|kp-rj@G+s\x20+fdeqN,8fkd[bf_DKCFC_VE@UliaNWY/2e|l-s6H@ZUN1l}lql\x20Ui|~hNebisb@kbrb@riqo|ifdeqNdj_ufebfN+Zil~hG\x20+fdeq_CKCHNZrg|o|qf\x202|kd|j\x20,-N,|i|v|i|j\x202|kd|j\x20,-\x20UliaNol}lql@krjF1N237febf_sfslNY99erk8r|k_ZUDKCFCNklql@p|kp@~gh@ifdeqN~lilolpN-lql\x202|kp\x20ZrojrhefN-lql\x202|kp\x202vj}lipN1l}lql\x20+fdeq\x20(q|if~N+lefq\x203|jfiN~ropfsbNabc|riq_ol}lqlNUe|pefq|Vljmibu2|kp\x20UliaN+Z_-rj}bo_1l}lql\x203efkNjlklpm|~ba@tfqelrq@pbofcpN[bisbqf~|\x20+3\x20FH\x203efkNp|jprkd@p|kp@krjF+5NW(-/olN)ljlie|ofNp|kp@pbofc@ifdeqNebisb@kbrb@}i|~hN+lefq\x20Ubkd|ifN,v|kj|o\x202|kd|j\x209|tdvfNWolfa\x202bofc\x20(q|if~N1l}lql\x20Ulia\x20(q|if~N-|krjZlqef~N2lkv\x20,l}fib\x204W\x20Zlqef~\x201bdri|oNZblodf|\x20Ulia\x20(q|if~Np|jprkd@p|kp@krjF+sNvrklp@qefkNp|jprkd@kbl@krjF3@~lkaN-lql\x202|kp\x20,v|kj|o\x204(\x20UliaNidpbofcNY98lr[bf@1@ZUDKCFCN+lefq\x20/rkg|}fN}|phbosfiibNp|jprkd@p|kp@krjG3sNp|jprkd@p|kp@qefkN+Z\x20XjlgfNTkg|if-bt+fmfN2|jprkd2|kp-rj@G3\x203efkN2|jprkd*lob|k@UliaNjfrfbu@ifdeqN-lql\x202|kp\x20*|kk|a|N1l}lql\x20-loj|i\x20(q|if~NZblodf|\x20(q|if~Np|kp@pbofc@jbafrjN2j|oq\x209|tdvfN1l}lql\x20Vlkabkpba\x20(q|if~N-lql\x202|kp\x20*|kk|a|\x204(\x20UliaNWY/\x202~\x202|kp\x20[brbFC_DCFN+Z_-rj}bo_1l}lql\x20UliaN/|a|rh\x20UllhNu@ppq@~lkabkpbaN2rkpefkb@4~ebkN1l}lql\x20Ui|~h\x20(q|if~N1fkdl\x20Vlilo\x20XjlgfNWbs|k|d|of\x20.32N2j|oq\x209|tdvf\x20/olNY9+|k3fkd[bf@,@ZU*NTkaolfaVil~h@+|odb\x201bdri|oNmolmloqflk|iiv@pm|~ba@tfqelrq@pbofcpNVrqfsb\x20,lklNqfjbpN+Z\x202j|oq_[\x20qbpq\x20UliaNW(-/ol@+fdeqNp|kp@pbofc@}i|~hN+lefq\x20Wbs|k|d|ofNmolmloqflk|iiv@pm|~ba@tfqe@pbofcpNp|jprkd@p|kp@krjF+N,8lrkd\x20/1V\x20,bafrjNWYZlqef~/6H@U(ZH[*@2.-8Ne|kp@p|kp@jbafrjN223\x20[b|svN+Z@Y99erk8r|k@,CE@5EAEN,v|kj|o4-bt\x201bdri|oN-lql\x20-|phe\x20To|}f~\x20UliaN2|jprkdZrg|o|qef1bdri|oNc|kq|pvNebisb@kbrb@ifdeqN[bisbqf~|\x20-brb\x20.32\x20UliaNklql@p|kp@~gh@}liaNp|jprkd@p|kp@krjF1N+fkapbv\x202|jprkdNp|jprkd@p|kp@krjF3N2~obbk2bofc,lklNX3orjm\x20,v|kj|o_96Nebisb@kbrb@qefkbuqbkabaN-lql\x20-|phe\x20To|}f~N+Z_Zrg|o|qfN2j|oq_,lklpm|~baN3|jfi\x202|kd|j\x20,-N+Z\x20Xjlgf\x20-lkT,XN1l}lql\x20Vlkabkpba\x20+fdeq\x20(q|if~Ndj_gfkdh|fNY9+|k3fkd*|k[bf_ZUDKCFCNidqo|sbiNm|i|qfklNZblodf|\x20UliaNWolfa\x202|kpN+Z_/rkg|}fN2j|oqZlqef~\x20UliaN2|jprkd\x202|kp\x203efkN223\x20Vlkabkpba\x20UliaNVljf~p_-|ooltN~lrofboN.ofv|\x202|kd|j\x20,-Nebisb@kbrb@ifdeqbuqbkabaNY9+|k3fkd[bf@1@ZUDKCFCNT1\x20Vovpq|iebf[*2V2\x20WUNpbofcN13628rb1lraZlZCsD@1bdri|oN,f|l6r_mobsNY98D*N+Z_-rj}bo_1l}lql\x201bdri|oNTkaolfaVil~hN2l,T\x201bdri|oN[80f[bf@GC2\x20+fdequNid@p|kp@pbofcNW|k~fkd\x202~ofmq\x20UliaNabc|riqNpb~@ol}lql@ifdeqNVlilo.24(@1bdri|oNqbpq\x201bdri|oN3|jfi\x202|kd|j\x20,-\x20UliaNY98fkdUf7fkd2er@2DIN1l}lql-rjF+\x20+fdeqNjlklpm|~ba@tfqe@pbofcpNp|jprkd@p|kp@krjFHNVlli\x20g|wwN2|jprkd-bl-rj@F+N237fkdh|fN2~obbk2|kp,lklNWY/6|6|6H@ZUN2|jprkd2|kp-rj@F+\x20+fdeqNU|kdi|\x202|kd|j\x20,-NZrojrhef\x202|kd|j\x20,-N2XV1l}lql+fdeqNevclkuo|fkN,8fkd[bfZUDKCFCV@UliaNp|jprkd@p|kp@ifdeqN[bisbqf~|\x20+3\x20IH\x20,bafrjNWolfa\x202|kp\x20Y|ii}|~hN1l}lql\x203bpqD\x20UliaN-lql\x202|kp\x20,v|kj|o\x20UliaNp|kp@pbofc@~lkabkpba@~rpqljN2|jprkd-bl-rj@F3N2|jprkd\x202|kp\x20-rjFHNjlklpm|~bN3+\x20,le|kqv\x20,bafrjNebisb@kbrb@jbafrjN+3[829*N1l}lql\x20Vlkabkpba\x20~rpqljb\x20UliaN,v|kj|oFNWolfa\x202|kp\x20Wbs|k|d|ofN2e|l-s_mobsNp|jprkd@kbl@krjF+NY9+|k3fkd[bf@X+@ZU*NvrklpNp|jprkd@kbl@krjF3N3fjbp\x20-bt\x201lj|kNebisb@kbrb@}liaNklql@p|kp@~gh@obdri|oN-lql\x202|kp\x20Zrojrhef\x204(\x20UliaNW(-/ol@}i|~hNY9+|k3fkd[bf@X+@ZUDKCFCN223\x205fbqk|jbpb\x20,bafrjN1l}lql\x20Vlkabkpba\x20+fdeqN223\x205fbqk|jbpb\x20UliaNT1\x20W)@**NWolfa\x202|kp\x202X,VN-lql\x202|kp\x20,v|kj|o\x204(NVljfkd\x202llkN,8rmmv\x20/1V\x20,bafrjN1lpbj|ovN+lefq\x20Zrg|o|qfN1l}lql\x20Vlkabkpba\x20~rpqlj\x20UliaNY9+|k3fkd[bf2@1@ZUN[bisbqf~|\x20-brb\x20.32N*|fqf_mobsN1l}lql@UfdVil~hNY98U*2)6N[|kapbq\x20Vlkabkpba\x20UliaN2|jprkdZblodf|kNW|k~fkd\x202~ofmqNp|kp@pbofc@~lkabkpbaNe|kp@p|kp@qefkN2|jprkd2|kp-rj@G3s\x203efkN+lefq\x20.af|NUe|pefq|Vljmibu2|kp`y~efq~suav`qtt4uxqhyad`9ufAdywy~q|Gd|`sa~~usfya~`y~s|gtu`vdq}u`dufgd~\x20qMr]N`sxy|tdu~`2turgwwud`\x27~g||\x27\x20ye\x20~af\x20q~\x20arzusf`vg~s`$_h<Fb`dvdajhs)hccdm`esduu~K`@g}rud`vq|eu`eds7|u}u~f`d$1qd6XWqnvrdqXk~rrhbA6XWqnvrdq.drr~fdXdmsdq`gd|N#tuvqg|f#geudtqfqO`eufDucguef:uqtud`y}badf`}ageuAhud`}ufq`?ej}|TJ?>:FFB`v@p:zm3tww3z}xAzzwM@zrzb:~p`~qfyhu`wq}}q`wufFy}ula~uAvveuf`tqfqeSfe`__a~|aqt__`g5+.h{uan@-U6`zresxu}u,UUcgugu_xqe_}ueeqwu`eufFy}u`yfu}`?76;G?_8>A3F`_r|q~{`v|aqf`#W)u`ujfu~te`v__dpmo}tcp}_~n}t{a_qy`Ducguef`?ej}|XTEudhudJ?>:FFBTYTV`s|yu~f;~vad}qfya~`fxu~`?EBay~fud7hu~f`B|uqeu\x20u~qr|u\x20saa{yu\x20y~\x20kagd\x20rdaieud\x20ruvadu\x20kag\x20sa~fy~guT`sqbfgduEfqs{Fdqsu`pOrivRtbaSrirRagvewrtv5{vfzba`:F?>Arzusf7|u}u~f`EF3F;5_6D3I`qsae`ujfud~q|`yixxtqki|qwvMbK{pwksai~mKnti{p`dufgd~\x20~ui\x20qN`3~q|keud@atu`}al5a~~usfya~`dqtya`EufDucguef:uqtud`DF5Buud5a~~usfya~`a~gbwdqtu~uutut`bqdeu;~f`sq~hqe`15E/`g~uesqbu`-\x20Eusgdu`w|arq|Efadqwu`?ej}|XTJ?>:FFB`p[vr}+zuvb7[vr}+zuvb1g~2\x20Jtgziv-\x20Lbageb}\x201<;6szg2`?ysdaeavfTJ?>:FFBTWTV`sqfsx`Budvad}q~suAreudhud`wuf5a~fujf`tuvqg|fBduhu~fut`avveufFab`sa~fqy~e`tqfq,`$r_b|qfvad}`xffbe,UU`:;9:_;@F`arzusfEfadu@q}ue`fxye`skw<Q`CC4daieud`Ahuddytu?y}uFkbu`ljzcze~ld`iytfx`}ageu?ahu`sxqd`|>jg?43tl4xl_<508<,_`rweag~t`y7wd+xxmizivkm`baeyfya~`sqeu`b6lzqfE[fufdujpo`fagsxu~t`duvduex`$r}8VqJL|D}|HkG:<`bdab`|qef;~tujAv`sq||rqs{`~g||`G~u~s|aeut\x20efdy~wT`t@dvpxCvzrQ@dvpxCvzr`rD~v~f`wuf3ffdyr>asqfya~`<EA@`~atuHq|gu`9q}ubqt`rufq`__q~sxad__`avveuf>uvf`{c\x5cyF\x5cCtgzo|k\x20iujk\x5c]\x5cyFe`bqdeu`tqfq`$_vd`bqs{qwu`daie`ArzusfT;~zusfutEsdybfTuhq|gqfu`abu~ud`}ageugb`exu~zyq~`turgwwud`ufxud~uf`$_s6da`F7?BAD3DK`mmyvxh}lyh`dub|qsu5xy|t`BAEF`~g};fu}e`sqbfgdu`tasg}u~fSvdqw}u~f`va~f`vydef5xy|t`vda}5xqd5atu`iur{yf;~tujut64`Bay~fud7hu~f`iur{yfDucguef8y|uEkefu}`sxqd3f`tuesdybfya~`pfcz_ybb|vu5~bmJaz~rgzba(greg)z~v5~bmRauvkvuMK5~bm[vdhvfgJaz~rgzbaOer~v`wuf4qffudk`{;?+zrJ;?+zr`qrea|gfu`dueba~euFujf`saa{yu7~qr|ut`mdyjifuhayh8__di8__diMffydx,ynj8ye/yvNhemiyh`vy~q|`bdu|aqt`=ukraqdt`r|gufaafx`sq~su|4grr|u`ujusEsdybf`fdkmdufgd~\x20__vy|u~q}u-osqfsxNuOmo`hqd\x20sgd_u|u\x20/\x20fxye-`iyfx`x__bnkm{ran{_naju~j}n`efqfge`fa8yjut`tyeb|qk`egrefd`M~g||]\x20ye\x20~af\x20q~\x20arzusf`jPzkh+SU=+SU`L*J:<<KTr}8VqJL|D}|HkG:<NO`euf;fu}`.U$W`|aqtut`Du}ahu7hu~f>yefu~ud`a~qgfasa}b|ufu`$r_sq||:q~t|ud`\x20edv|j\x20`bdafusfut`}qfsx`wafa`tdqi3ddqke`}utyq6uhysue`s|aeu`iurefadu`iur{yfDF5Buud5a~~usfya~`5ag~f`fujfUzqhqesdybf`qrefdqsf`budvad}q~su`Efadqwu`w$ryyu$L$$vyqqo|L$$v}zL$$v}|lL$rnd$L$|okne/yno-v|okne1doma~on5x@rs}2|kwoL$}nd$L$aso$`|q~wgqwue`$_vr`euf>asq|6uesdybfya~`eagdsu`U,geud_va~fe`F=_@G?47D`esda||`$r_vufsxCgugu`.!SSMyv\x20wf\x20;7\x20`zkl}pjlvyplu{h{pvu`bdusyeya~\x20}utyg}b\x20v|aqf-hqdky~w\x20husX\x20hqdky~Fuj5aadty~qfu-hayt\x20}qy~NO\x20mw|_8dqw5a|ad/husZNhqdky~Fuj5aadty~qfuRVRWO-o`sduqfuBdawdq}`p^\x5c$0r6m]ut_`baef`:F?>7|u}u~f`fujfUxf}|`.!SS`arzusfEfadu`v}xzneO?plw=wlfp}\x204S\x200zya}zwOR`|y~{Bdawdq}`bdusyeya~`yu{~q{qjqtq|ckpivom`7~fyfk`p~fLevuvagzr}f`cds{|}6a7jfxI<y:3bWeHK=GYD8?Ci*;9vBA+Xrh>@zT)lJ4qE~gVF5(wk_ZLu[tmonp\x20!#$%NOPQRS-/12M]^`g~yvad}Xv`zqhqesdybf,`p*L,vsNkg5htjvs`dub|qsuEfqfu`ha|qfy|u`sduqfu6qfq5xq~~u|`geu\x20efdysf`adywy~q|Fqdwuf`u__ru~qr{f__N_ru~qr{f_@qmpq~;{pq`zqhqesdybf,\x20haytNVO-`G~ujbusfut\x20sxqdqsfud,\x20`m\x22abfya~q|\x22\x20,\x20M\x20m\x22Dfb6qfq5xq~~u|e\x22\x20,\x20fdguo\x20]o`G~fud}y~qfut\x20}g|fy|y~u\x20sa}}u~f`UF)3kFdjaIj9t`Egr}yf`fy}u`dueba~eu`dq~wu?y~`fdy}`sxus{raj`L*J:z`sa~ef`E7>75F\x20hq|gu\x208DA?\x207{sB_f\x20I:7D7\x20~q}u/1`8|aqfYX3ddqk`9ufDueba~eu:uqtud`avveufJ`s#dP^b#:#d{|d{}d{6d{ad{7d{jd{fd{xd{Id{<d{yd{:d{gd|fdE6`duvuddud`k*RT<*z|Qljd`~atu@q}u`wufDueba~eu:uqtud`.}ufq\x5ceQxffbSucgyh/M\x22\x27]1duvduexM\x22\x27]1\x5ce`ek~sxda~ylut`ujbadf`vy|u~q}u`abu~6qfqrqeu`b__ds:fcC__hZs:fc`u~qr|uHudfuj3ffdyr3ddqk`xffb,UU`xuywxf`eqvqdy`E7@6`zresxu}u,UU`bnp{wjtjcjmjuzdibohf`G~u~s|aeut\x20duwg|qd\x20ujbdueeya~T`iur{yfBudeyefu~fEfadqwu`ww}4snnox`___fe___`s|qee`dg~fy}u`}al;~tujut64`bqdu~f7|u}u~f`?yeey~w\x20sqfsxUvy~q||k\x20r|as{e`sK#d6343E3~3V3F3(WJe.e0HiD-8~8$8%8\x20?c?*?;?9CcCxCIC:C3CbC?CrChC^C&CPihi)ili~igiL*s*{*a*e*H*K*T;c;d;s;|;};6;?;C;_;Z;L9C9*9;999h9>9S9)9l959(929$vjv^v&vPvNvOvoB}AzASA(AwAnA\x20+w+_+Z+2+$+%+&+P+N+O+,+-X}X6XXXrrGrvr)rlr.r0hZhP>f>x>OzGzvzBSXSrS2S%S&S/S.)g)_)ZlvJlJJJgJ_JZJLJuJ[JtJpJ\x204c4d4s4S4)4l4J44454w4&(p$a$7$h$>%W%B%A%+%k&mN;N9N>N@NzQyQ:/|/}/2/$/%/0/T/1/U/,.e0tT=TGTiT*T+TXTr1j1f1x1z141q1E1~1g,x,I,<,ym6mWmG#!#d{3d{bd{$d{%d{\x20d}gd~&d~P}v!}vT}v1}A3}Ab}rG}r?}r9}rw}rk}r_}rZ}rL}hL}hu}>h}z{}z|}zV}Sx}SI}S<}SW}Se}SH})J})4})q})E})~})g})V})F})2})/}).}lv}l]}J|}J}}Jx}JI}Jy}EX}Er}Eh}E>}E@}Ez}ES}E)}EJ}E47fC7e37eb7=b`qffdyrgfu\x20husX\x20qffdHudfuj-hqdky~w\x20husX\x20hqdky~Fuj5aadty~qfu-g~yvad}\x20husX\x20g~yvad}Avveuf-hayt\x20}qy~NOmhqdky~Fuj5aadty~qfu/qffdHudfujQg~yvad}Avveuf-w|_Baeyfya~/husZNqffdHudfujRVRWO-o`raa|uq~`bgexEfqfu`du}ahu;fu}`\x00`sxqdqsfudEuf`kk{d{fame;{nwdmwl{`kyu|t`dufgd~`rqffudk`vad7qsx`y}b|u}u~fe`uhq|gqfu`|y~u~a`?ej}|XTJ?>:FFBT(TV`F=_D79_7J`wufEgbbadfut7jfu~eya~e`mxebf|}d8xebf|}d}dze8xebf|}dcyju`dwrqNXZVRWWVR[YRVTZO`?ej}|XTJ?>:FFBTZTV`}al;fu}e`s|uqd;~fudhq|`fxdai`q/sq~tytqfu,`$_s{`3radf`sxus{ut`avveuf:uywxf`9ufHqdyqr|u`avveufIytfx`eu|usfut`|qkudJ`tu|ufu`Nuhq|gqfy~w\x20\x27~g||MV]\x27O`efq~tq|a~u`esduu~`Duw7jb`s|yu~fK`sxqdwy~w`}ueeqwu`Eu~t`}y}uFkbue`wuf;fu}`Yzu3>uEeq(`sxda}u`va~f8q}y|k`tuvqg|f`uhu~f`wufG~yvad}>asqfya~`NfxyeO-`G~ujbusfut\x20fa{u~\x20`fdq~eqsfya~`adyu~fqfya~`wufEagdsue`g~tuvy~ut`M~qfyhu\x20satu]`CFB_7B7_:AA=`vufsx`hytua`:F?>3~sxad7|u}u~f`bdbqudib5fgsftiCdbqudib_sfgsftiCdifdl/phjoCefdszquZbmmcbdl`iur{yf5a~~usfya~`iyvy`.7?476\x20yt/`6A?Bqdeud`;||uwq|\x20~ui|y~u\x20qvfud\x202fxdai`avveufG~yvad}`{uk6ai~`dufgd~Hq|gu`|a~w`sxqdwy~wFy}u`AB7@`etgqg~gjgrwaf}lec`\x5crM^0]P0NM\x5ce\x5cE]P1O.\x5cU`}ageuAgf`_fe_`sa~fy~gu`iurw|`}ageuGb`u~g}udqfu6uhysue`egrefdy~w`esduu~J`g0a{h.h{uan@0a{h.h{uan:pi;\x20S}pera6\x20Ukjpnkh\x20:ED?|ep;`|uhu|`.tyh0;7*.Utyh0`$r_eufgb`vy||Efk|u`sq~tytqfu`-\x20bqfx/U`xffb`eiyfsx`s|yu~fJ`puezive`rkfu`u~qr|utB|gwy~`dq~wu?qj`a~ruvadug~|aqt`u~saty~w`bqdu~f`}ageutai~`\x5c\x5c`efqfys`}ageuagf`wufExqtudBdusyeya~8ad}qf`hudfuj3ffdyrBay~fud`z~likyp}lyJl}hs|h{l`3ttEuqdsxBdahytud`efqfgeFujf`dD#d,s{s77+7rjMj]fIfW:BW)Wle_eQe/emeoHxHC=x=T=1=o8g8&?y?:?)?l?1CdCWC9CvCVCFCmCoiii*i9iviAi+iO*%*^*1;j;D;8;N;O9W9e9i9L9u9,vfv9vvvAvXvrvzvSvnAWAlAJAFA5+kXdX{X|rarzrShJ>Q>/@p@!@$@&@P@O@.zxz<z3zbzYzDzAz)z2z$S<J!4f4y4:4(q.V%Fm%g%w&o1(1w#X#dd:ddbddeds?d|Cd|zd}od6cd6yd6id6;d6vd6PdaAda+d@udS/dExdEIdE!dE2dLgslJsJ9}yq}9M}9]}+-}+m}E26]G7f?7fL7f[7ft7f!7f2`pJxLbageb}7JxLbageb}`?76;G?_;@F`uddad`|rta/niijs`q|bxq`{ukGb`nwxk|vxbdi|dc`exqtudEagdsu`cds{|}6a7jfxI<y:3bWeHK=GYD8?Ci*;9vBA+Xrh>@zS)lJ4qE~gVF5(wk_ZLu[tp!2$%^&PNOQ/.0T1U,-moM]n\x20`bqeeiadt`~ujfEyr|y~w`$_fe`dq~ta}`sduqfuAvvud`3DEueeya~R3gtyaFdqs{>yefR4uvadu;~efq||Bda}bf7hu~fTbdafafkbuT=7KGBR4|ar6ai~|aqt5q||rqs{R563F3Eusfya~TbdafafkbuTdu}ahuR5EE5xqdeufDg|uR5EEBdy}yfyhuHq|guT5EE_H:R5q~hqeDu~tudy~w5a~fujfX6TbdafafkbuTiur{yf9uf;}qwu6qfq:6R5|ys{6qfqR5|aeu7hu~fTbdafafkbuTy~yf5|aeu7hu~fR5a}ba~u~feTy~fudvqsueT;5a}uf?qd{e7jfu~eya~R6uhysuAdyu~fqfya~7hu~fR8g~sfya~TbdafafkbuTry~tR9ufBudvFuefeR:F?>6asg}u~fTbdafafkbuTsduqfuFagsx>yefR:F?>8ad}7|u}u~fTbdafafkbuTducguef3gfasa}b|ufuR:F?>8dq}uEuf7|u}u~fTbdafafkbuTxqeBay~fud5qbfgduR:F?>8dq}uEuf7|u}u~fTbdafafkbuTiur{yfDucguef8g||Esduu~R;~f|R?FF_I=EufFujfEylu;~tujR?utyq5a~fda||udR?utyq7~sdkbfut7hu~fR@afyvysqfya~RArzusfTbdafafkbuT__tuvy~uEuffud__RArzusfTeuq|RArzusfTeufBdafafkbuAvRAvvesduu~5q~hqeDu~tudy~w5a~fujfX6RBqfxX6TbdafafkbuTqttBqfxRBqk}u~fDueba~euRBudvad}q~suBqy~fFy}y~wRBdueu~fqfya~5a~~usfya~5|aeu7hu~fRDuqtud?atu3dfys|uBqwuREH99dqbxyse7|u}u~fTbdafafkbuT}alDucguefBay~fud>as{REH9Bqffud~7|u}u~fTEH9_G@;F_FKB7_A4<75F4AG@6;@94AJREsduu~Adyu~fqfya~REawag>awy~Gfy|eREagdsu4gvvudREagdsu4gvvudTbdafafkbuTsxq~wuFkbuREbuusxEk~fxueyeGffudq~suRFujfFdqs{>yefTbdafafkbuTwufFdqs{4k;tRG5Iur7jfRIur=yf8|qweR_IJ<ER__$_cyxaaY(V_$__R__vyduvaj__R__{eqr5ee5ag~fR__abudqR__eawag_eusgdu_y~bgfR_tagr|uWW_Rsxda}uRsxda}uTqbbT;~efq||EfqfuRsxda}uTseyRsa~ea|uRtuvqg|fEfqfgeRtasg}u~fTratkTa~}ageuu~fudRtasg}u~fTratkTa~bqwuRtasg}u~fTratkTefk|uTrqs{wdag~t4|u~t?atuRtasg}u~fTratkTefk|uT|y~u4duq{Rtasg}u~fTratkTefk|uT}y~IytfxRtasg}u~fTratkTefk|uT}eFujfEylu3tzgefRtasg}u~fTratkTefk|uTfujf3|yw~>qefRtasg}u~fTratkTjS}eSqssu|udqfad{ukRtasg}u~fTtuvqg|f5xqdeufRtasg}u~fTtasg}u~f7|u}u~fTa~dueyluRtasg}u~fTvy|u5duqfut6qfuRtasg}u~fT}e5qbe>as{Iqd~y~wAvvRtasg}u~fTa~}ageu}ahuRtasg}u~fTa~eu|usfya~sxq~wuRtasg}u~fTesda||y~w7|u}u~fTefk|uTva~fHqdyq~f@g}udysRtasg}u~fTeu|usfya~Rtasg}u~fTeu|usfya~Tfkbu6ufqy|Rujfud~q|Rujfud~q|T3tt8qhadyfuRujfud~q|T;eEuqdsxBdahytud;~efq||utRv|kv|ai_iq||bqbud_zeRwuf?qfsxut5EEDg|ueRwduu~fuqRye@atuIxyfuebqsuRzueya~Ra~uddadRa~}ueeqwuRa~abudqtufqsxuthyuisxq~wuRabu~6qfqrqeuRbqeeiadt_}q~qwud_u~qr|utRbudvad}q~suRexai?atq|6yq|awRfqardaieud_7hu~fRiuqfxud4dytwuRiur{yf3gtya5a~fujfTbdafafkbuTs|aeuRiur{yfDucguef8y|uEkefu}`avveufK`vy~q||k`p__~ggLevrgvOer~v5~ggLh~fgb~S(`rqeu`Budvad}q~suAreudhud7~fdk>yef`qffqsxExqtud`u~qr|u/fdgu`a~ysusq~tytqfu`fdkmdufgd~\x20__tyd~q}u-osqfsxNuOmo`;@E7DF\x20AD\x20D7B>357\x20;@FA\x207{sB_f\x20N~q}uR\x20hq|guO\x20H3>G7EN1R\x201O`ye@q@`?ageu`q~tdayt`{ukgb`6uhysuAdyu~fqfya~7hu~f`m\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22ysuEudhude\x22\x20,\x20M\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~VWTeybbxa~uTsa}\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~Tu{ywqT~uf\x22oR\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~Tvit~ufT~uf\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~TytuqeybTsa}\x22oR\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~Tybfu|Tadw\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~Tdyjfu|usa}Teu\x22oR\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~Tesx|g~tTtu\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~T|Twaaw|uTsa},W+YVX\x22oR\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~WT|Twaaw|uTsa},W+YVX\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~XT|Twaaw|uTsa},W+YVX\x22oR\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~YT|Twaaw|uTsa},W+YVX\x22oR\x20m\x22gd|\x22\x20,\x20\x22efg~,efg~ZT|Twaaw|uTsa},W+YVX\x22o\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20]\x20\x20\x20\x20\x20\x20\x20\x20\x20o`fxdaie`@q}u\x20ujbusfut`q|udf`6uhysu?afya~7hu~f`sdutu~fyq|e`q~sxad`hudfujBae3ffdyr`>AI_8>A3F`prcc(traL}zt|5rcc(traObthfXhg5rcc(traTvlMbja5rcc(traTvl*c`qgtya`hqd\x20egr}yf/vg~sfya~NOmvadNhqd\x20f/sgd_u|u-f!//tasg}u~f&&N!fTfqw@q}unn\x22vad}\x22!//fTfqw@q}uTfa>aiud5qeuNOO-Of/fTbqdu~f7|u}u~f-f!//tasg}u~f&&fTegr}yfNOo-`qduq`W*bj\x20\x273dyq|\x27`ai~ud6asg}u~f`?ej}|XTEudhudJ?>:FFBT(TV`?ej}|XTEudhudJ?>:FFBT[TV`fuefe`?ej}|XTEudhudJ?>:FFBTZTV`9uf@ujfDuc;6`fujfqduq`tasg}u~f7|u}u~f`tuhysu;t`abfya~e`g~ysatu`ruxqhyad`tufqsx7hu~f`y~fudvqsu`vdq}ue`ujusgfuEc|`vy||Fujf`g~yvad}Avveuf`F=_@3?7`dM#7wjTIn<s3d3lbhbEWjWCeZe!e%eOe1e-HLH]=c=f=^=0GGG8GCG+GrG>GzGJD1D,8V858(8[8t828P8/CsC|C}C7i@iSi5iw*U*-*m*n9v9+v0v1v,vmB4BEAeAKA=ADA?AiA;AB+L+pr7rfrxryr3rWrHr=hph2h$h^hOhU>.>-@6@<z8z;zJzg)X)~)V)w)%)/)0lGJ4J~JVJk4a4j4x4<434=484i4q4F4$4^292B2p22%e%D%8%v%X%4^y^3NYN8N?N*NvNANSNqNENgO1Q6/6/7/^///-.c.d.6.a.30Z0[TYTCT;TAT0TM1S1JUo,s,{,f-T-U--m}mam<Mg]c]G]D#B#d}Bd}Jd}(d}2d>=d>YdzMdS?dEqdEF}>G}>r}>$}>o}@q}@(}@,}zs}zE}zg}Sy}Sb}SK}SY})>})l}l\x20}Jd7W57W^7W]7e{7ez7e)`eu|v`ujbudy}u~fq|Siurw|`000/`9uf3||Dueba~eu:uqtude`u__?B>__6==9_<=B7473@`5D73F7\x20F34>7\x20;8\x20@AF\x207J;EFE\x207{sB_f\x20Nyt\x20;@F797D\x20@AF\x20@G>>\x20BD;?3DK\x20=7K\x203GFA;@5D7?7@FR\x20~q}u\x20F7JF\x20@AF\x20@G>>R\x20hq|gu\x20F7JF\x20@AF\x20@G>>R\x20G@;CG7\x20N~q}uOO`-\x20ujbydue/`ht8}`tyebqfsx7hu~f`6yebqfsx7hu~f`3DD3K_4G887D`rr*X{z`tagr|u`tg}b3||`\ufeff`va~f>yef`vy||Dusf`8g~sfya~`efdy~wyvk`fa>aiud5qeu`eqhu`>AI_;@F`bqdeu8da}Efdy~w`fa9?FEfdy~w`}ageuahud`u|u}u~fe`a~uddad`k6|mfylagf67\x20snwj\x20w\x20K\x20f{o\x20Rwl{67I\x20z{xm}}{jI\x20j{lmjf\x20f{o\x20Rwl{67\x20;\x20w\x20L\x20?>>Iu677`g~exyvf`J?>:ffbDucguef`qbbHudeya~`}e5dkbfa`NMVS+]mWRYoN\x5cTMVS+]mWRYoOmYon\x20NNMVS+qSv]mWRZo,Om)R)oMVS+qSv]mWRZonNMVS+qSv]mWRZo,OmWR)o,nNMVS+qSv]mWRZo,OmWR(o,MVS+qSv]mWRZonNMVS+qSv]mWRZo,OmWR[oN,MVS+qSv]mWRZoOmWRXonNMVS+qSv]mWRZo,OmWRZoN,MVS+qSv]mWRZoOmWRYonNMVS+qSv]mWRZo,OmWRYoN,MVS+qSv]mWRZoOmWRZonNMVS+qSv]mWRZo,OmWRXoN,MVS+qSv]mWRZoOmWR[onMVS+qSv]mWRZo,NN,MVS+qSv]mWRZoOmWR(oOn,NN,MVS+qSv]mWRZoOmWR)on,On,,NvvvvN,VmWRZoOmVRWo,OmVRWoNNX[MVS[]nNXMVSZ]nWmVRWoMVS+]OmVRWoMVS+]O\x5cTOmYRYoNX[MVS[]nNXMVSZ]nWmVRWoMVS+]OmVRWoMVS+]OnNMVS+qSv]mWRZo,OmWRZo,NNX[MVS[]nNXMVSZ]nWmVRWoMVS+]OmVRWoMVS+]O\x5cTOmYRYoNX[MVS[]nNXMVSZ]nWmVRWoMVS+]OmVRWoMVS+]OO\x20O`FD;3@9>7_EFD;B`lxvcc)}vekfd9_g}vekfd`eufEudhud6qfq`a~egssuee`biq_jefoujgjfs`xffbSucgyh`g~ujbusfut\x20~g}rud\x20u~ty~wT`\x0d\x0a`iy}qj`\x20xaef\x20`fujf4qeu|y~u`bduhu~f6uvqg|f`cexit(ullscreen`:;9:_8>A3F`gfvS*`g~|aqt`sa}by|uExqtud`G~ujbusfut\x20fa{u~,\x20`]0.y0.Uy0.!Mu~tyv]SS0`}ageu6ai~`ahuddytu?y}uFkbu`agfud:F?>`8EE43`xaef`yfu}Eylu`geuBdawdq}`wn|sbo|Mobkvak~o`uesqbu`gsa|gepreoe|ehepu}d{jca`H7DF7J_E:367D`?utyqEfduq}Fdqs{`Abu~`fagsxue`d#!#s\x20#ddd7dvsys+srs%s&a-an7j7Y7Cj1jmfcf{fyf3fHfhf@xBx+IM<}y^ym:;:z:U3pbdbabjbwW7W4ewH6H7H*HZKcK\x20=+=%Dm848T8n?Y?C?B?@?q?^?P?0?m?]CACXCOCTCnieiKi?i%iP*|*6*G*;*v*A*X*_*L*2*P*/;[;^;.979f939K9D9t9!vIvbvKvGvDvCv4vEvFvpBgB_BLB[BpB]B\x20A7AfAy+d+7+f+I+y+++r+4+E+FX>X4XEXgXFX/X0r{r%rOr1hahxhBh+h)hEh(>D>N>\x20@}@m@]@\x20z}zazjzez=zrzzS0SoS])9)L)tJsJ)J-Jn4{464G4D4*4z4OqKq9qQqUEUE]~p~&g[g^VVV5VkVLV2V&VOV.F?FiF9FAF$F^FNF/F,FMF\x205s535W5Q5.515-(Zw7wGw>kAkqp)p4p5p!!d!a!,2y282C2;2J2t2T$6$K$v$A$X$F%:^A&v&z&-P,NHNNOIO:OeO;ONQaQ<Q&/{0pTKThTl1I1@UqUm,+,r,E,omXM~]8#d]#dc+dchdc)dc4dcodcndd{dd6dd<ddKddgdd5dsbdsedsDds;dsvdsAds@dsldsqdsgdswdsudsOds1ds,dsmd{cd|Zd|td6{d6Id6Wd6=d6Ad6rd6>d6~d6Fd6wd6[d62dX~dradrjdr(drkdrNdrQdr]dhcd>xd>hd>.d>nd@gd@TdzxdzKdz?dzidzAdzXdzSdzldzgdzFdzZdzudz$dz^dz/dz0dzmdE(dEZdEPd~$d~Qd~.d~TdgTdgUdgmdVcdV>dV)dFqdF2d5cd5kd5N}:H}C?}i5}9(}9Z}9Q}vW}vE}vV}vp}v,}B3}A(}At}A2}+1}r3}r=}rY}r8}rC}r;}rv}r(}rM}h4}h[}>=}@H}@4}@_}@U}S\x20})h})t})!})$})Q7|H7a57ak7787797jq7jn7f|7fb7fK7fi7fr7f>7fV7f57f_7f%7x]7I;73X73w7b*7bv7b]7Wr7WE7e07e,7em7Kh7K.7=I7=e7=)7=w7G(7GZ7Gp7G$7GN7G/7GU7Gm7GM`y}qwu`N~uqd\x20\x27TTT\x20~g||MV]TTT\x27O`|qkudK`dueba~euJ?>`y~eudf4uvadu`eudhud6qfq`?ej}|YTJ?>:FFB`epkmavB2c}j0j}wcp\x20[F\x20Wmlrpmj`y\x209:<M`?ysdaeavfTJ?>:FFB`rduq{`dueuf`ye8y~yfu`o)zcu}ksjwP~sgz8)zcu}ksjwP~sgz`ai~ud7|u}u~f`}e;~tujut64`wuf3||Dueba~eu:uqtude`qradf`3tt7hu~f>yefu~ud`{uktai~`fagsx}ahu`sa}b|ufu`wufBqdq}ufud`eu|usfS`s|uqd`qssu|udqfya~;~s|gty~w9dqhyfk`sduqfu4gvvud`;~vy~yfk`|y~{`A4<75F`}alDF5Buud5a~~usfya~`$_vW`$r_a~4dytwuDuqtk`a~|aqt`r-~qytre\x20xs.\x22qq)Wzy\x22\x20r{pddxs.\x22r{dxs+XUZUu)V*R*)qZRVVruRqq)WRUUppUUqsrtUq\x22\x20hxsew.\x22Uai\x22\x20wtxvwe.\x22Uai\x22/-T~qytre/`xyefadk`u~sfkbu`bdyhqfu`8>A3F`R\x20ujbusfut\x20`sduqfuExqtud`tr|s|ys{`efqs{`fagsxefqdf`wuf5|yu~f6qfq;~5aa{yu`eueeya~Efadqwu`zjhjol_`rgvvud6qfq`duqtidyfu`tusatuGD;5a}ba~u~f`$r_a~@qfyhuDueba~eu`xffb,`ry~t4gvvud`faGbbud5qeu`hudfujBae3ddqk`dueba~eu4atk`xuqt`sa~efdgsfad`\x20xuywxf/(\x20iytfx/W\x20fkbu/qbb|ysqfya~UjSexas{iqhuSv|qex\x20eds/`sa~fujf}u~g`wufEudhud6qfq;~5aa{yu`u~g}`u|eu`iy~taieSWX[X`__#s|qeeFkbu`|asq|6uesdybfya~`exadf`~a~u`byju|6ubfx`h|qgu`8D39?7@F_E:367D`8y|uDuqtud`_6;H`.ebq~\x20efk|u/\x22va~fSvq}y|k,}}||yy-va~fSeylu,WWZbj\x220}}}}}}}}}}}||yyy.Uebq~0`ujsubf`:F?>7}rut7|u}u~f`$_KIFG`euf5|yu~f6qfq`wuf7jfu~eya~');

补上上述代码后执行结果如下图，这就是一段无限循环的反调试代码，这种我们不用硬扣，直接浏览器调试，看下浏览器的执行逻辑
在这里插入图片描述
浏览器调试后我们发现和本地走的分支不一致，可以判定代码是做了检测的，我们直接按照浏览器的代码逻辑来改写我们的本地逻辑

/*
	改写前
*/
try {
	var _0x42fb36 = _0x4e96b4[_$UH[0x260]][_$UH[0x8]]['DONE'] * 0x4;
	} catch (_0x1b1b35) {
	    var _0x42fb36 = 0x1;
	}
	try {
	    _0x4e96b4['$_z2'][0x0] = 'Q';
	} catch (_0x4c574d) {
	    try {
	        op = _0x4e96b4['$_zw'][_$UH[0x6c]];
	    } catch (_0x58af26) {
	        var _0x3b7935 = 0x0;
	        for (var _0x1badc3 = 0x0; _0x1badc3 < 0xf4240; _0x1badc3++) {
	            _0x3b7935 = _0x3b7935 + _0x1badc3[_$UH[0x1f]]();
	            history['pushState'](0x0, 0x0, _0x3b7935);
	        }
	    }
	    if (op > 0x14) {
	        eval('b64pad = _0x4e96b4[\'$_zw\'][9][\'length\'];');
	    } else if (op < 0xa) {
	        _0x4e96b4['$_zw'] = [0x1, 0x8, 0x2, 0x4, 0x17, 0x2d, 0x8, 0xf, 0x51, 0x44, 0xd, 0x48, 0x46];
	    }
	}
	var _0x1badc3, _0x38ca59, _0x431764, _0x43f1b4, _0x5722c0, _0x3e0c38 = _0x1171c8, _0xdb4d2c = _0x4dae05, _0x1724c5 = _0x183a1d, _0x257ec6 = _0xcfa373;
	try {
	    if (_0x4e96b4['_$6_']) {} else {
	        _0x4e96b4['_$6_'] = 0x20dc5d57f;
	    }
	} catch (_0x15bf3f) {
	    _0x4e96b4['_$6_'] = 0x2421603;
	}
/*
	改写后
*/
var _0x42fb36 = 16;
var b64pad = 1;
var _0x1badc3, _0x38ca59, _0x431764, _0x43f1b4, _0x5722c0, _0x3e0c38 = _0x1171c8, _0xdb4d2c = _0x4dae05,
    _0x1724c5 = _0x183a1d, _0x257ec6 = _0xcfa373;
_0x4e96b4['_$6_'] = 0x20dc5d57f;

调整后继续执行还是报错

var _0x1badc3, _0x38ca59, _0x431764, _0x43f1b4, _0x5722c0, _0x3e0c38 = _0x1171c8, _0xdb4d2c = _0x4dae05,
 
ReferenceError: _0x1171c8 is not defined

继续补

var _0x1171c8 = 0x67452301;
var _0x4dae05 = -0x10325477;
var _0x183a1d = -0x67452302;
var _0xcfa373 = 0x10325476;

调制后执行

_0x4e96b4['_$6_'] = 0x20dc5d57f;

ReferenceError: _0x4e96b4 is not defined

浏览器搜索这个变量的赋值如下

var _0x4e96b4 = window
  , _0x30bc70 = String;
var _0x3912f2 = Error
  , _0x4d2d2c = Array
  , _0x109910 = Math
  , _0xff7e93 = parseInt
  , _0x35bb1d = Date
  , _0x3d0f3f = document
  , _0x5cd506 = Object
  , _0x3bdc68 = unescape
  , _0x1ec3c0 = encodeURIComponent
  , _0x3b2c8e = Function;

后面还有有一些函数和变量需要补，这里就不一一补了，全部补完整之后执行有结果了，但是和同样的时间戳参数和浏览器生成的结果不一致，我们只能继续分析扣下来的代码哪里和浏览器不一致，最有可能的就是刚才我们改写的那段有反调试的函数，我们继续分析那个函数的下半部分，发现有两个地方很有可能会有问题，_$tT、_$Jy

 _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 0xf], 0xe, _0x4e96b4['_$tT']),
 _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 0x4], 0x14, _0x4e96b4['_$Jy']),

我们先本地调试和浏览器比较一下这两个变量的值是否一致，本地调试值未定义
在这里插入图片描述
浏览器中是有值

_0x4e96b4['_$tT']
>> -172015004
_0x4e96b4['_$Jy']
>> 461512024

那我们直接搜索浏览器中有没有对应的赋值语句，发现是常量赋值

_0x4e96b4['_$tT'] = -0xa40bd9c;
_0x4e96b4['_$Jy'] = 0x1b821d58;

我们把下属两个变量值补上后执行看下结果和浏览器是否一致

# 本地执行结果
时间戳： 1709866067000
m值： bc4e1ca035c948d788e00af44c37f54e

# 浏览器执行结果
_$Wa
>> 1709866067000
_0x474032(_$Wa)
>> 'bc4e1ca035c948d788e00af44c37f54e'

发现得到的结果是一致的，到这里m值我们已经拿到了，接下来分析RM4hZBv0dDon443M，我们直接hook 这个cookie值
在这里插入图片描述
跟栈分析，然后搜索_0x4e96b4['_$ss'] 的赋值语句，因为代码做了变量混淆，搜索不到结果的

_0x4e96b4['_$' + _$UH[0x348][0x1] + _$UH[0x353][0x1]] = _0x29dd83[_$UH[0x1f]]();

_$UH[0x348][0x1]
>> 's'

如果ast 功底够硬，代码还原后就很好分析了，可惜我功力不够，只能跟栈分析喽，向上一层就看到了具体的加密逻辑了

_$Ww = _$Tk[_$UH[0x2db]][_$UH[0x2dc]][_$UH[0xff]](_0x4e96b4['_$pr'][_$UH[0x1f]]()),
_0x29dd83 = _$Tk['A' + _$UH[0x32d]][_$UH[0x337] + _$UH[0x336]](_$Ww, _0x4e96b4[_0xc77418('0x6', 'OCbs')], {
    'mode': _$Tk[_$UH[0x339] + _$UH[0x33a]][_$UH[0x2e5]],
    'padding': _$Tk[_$UH[0x33b]][_$UH[0x33c] + _$UH[0x33d]]
}),
_0x4e96b4['_$' + _$UH[0x348][0x1] + _$UH[0x353][0x1]] = _0x29dd83[_$UH[0x1f]]();

我们浏览器控制台打印一下变量观察

_$UH[0x2db]
>> 'enc'
_$UH[0x2dc]
>> 'Utf8'
_$UH[0xff]
>> 'parse'
_$UH[0x32d]
>> 'ES'
_$UH[0x337]
>> 'enc'
_$UH[0x339]
>> 'mo'

把实际变量值替换至本地就更清晰了，AES、ECB、Pkcs7，加密的逻辑找到了，现在来看核心的参数_0x4e96b4['_$pr']

[
    "f0f2801e9807835435f30d3234741e94",
    "b899269b9901b9014e9064a05e099296",
    "5f7b5db810cce3484f986a813ffe9dfe",
    "4840e6854244789a1fc62ca3dc1238b8",
    "63626caaac9a792759e2717bea55aec7"
]

是一个数组，总共做了五次push 操作

_$Wa = _0x12eaf3();
/*
	前四次操作
*/
_0x4e96b4['_$pr']['push'](_0x474032(_$Wa));

/*
	第五次
*/
_$yw = _0x2d5f5b()[_$UH[0x1f]]();
_0x4e96b4['_$is'] = _$yw;
_0x4e96b4['_$pr']['push'](_0x474032(_$yw));

核心参数拿到了，剩下按照代码逻辑还原下加密算法就行了，对了，还有一个加密的key 值没拿到
在这里插入图片描述
直接搜索赋值语句

在第五次push操作的时候，不知道大家对_$is这个变量还有印象没？我们回顾一下

payload 的加密参数m是不是有了，然后再来看下f（window.$_zw[23]），控制台打印出来，是一个13位的时间戳

window.$_zw[23]
>> 1709876783000

# 赋值语句
let $_t1 = Date.parse(new Date());
...
$_aiding = window;
...
$_aiding.$_zw.push($_t1);

至此所有的加密我们都分析完毕了

逆向结果

猿人学第五题源码，需要的自取
在这里插入图片描述