fix

Author: kmvi

index.js.map

@@ -15,4 +15,5 @@ try {
     console.log(result);
 } catch (e) {
     console.error(e);
+    console.error(e.stack);
 }

index.ts

@@ -214,10 +214,13 @@ export class FunctionControlFlow extends ProtectionBase {
                     || Utils.isFunctionDeclaration(node))
                     && Utils.isBlockStatement(node.body) && node.body.body.length > 0)
                 {
-                    const firstStmt = node.body.body[0];
-                    if (Utils.isVariableDeclaration(firstStmt)) {
-                        const id = firstStmt.declarations[0].id;
-                        const obj = firstStmt.declarations[0].init;
+                    for (let i = 0; i < node.body.body.length; ++i) {
+                        const stmt = node.body.body[i];
+                        if (!Utils.isVariableDeclaration(stmt)) {
+                            break;
+                        }
+                        const id = stmt.declarations[0].id;
+                        const obj = stmt.declarations[0].init;
                         if (Utils.isIdentifier(id) && obj
                             && Utils.isObjectExpression(obj)
                             && obj.properties.length > 0
@@ -227,7 +230,7 @@ export class FunctionControlFlow extends ProtectionBase {
                             const result = this.processProperties(obj.properties);
                             if (Object.keys(result).length > 0) {
                                 this.data[id.name] = result;
-                                this.decl[id.name] = firstStmt;
+                                this.decl[id.name] = stmt;
                             }
                         }
                     }

src/control-flow.ts

@@ -55,6 +55,7 @@ export class Deobfuscator {
             if (p.detect()) {
                 ast = p.remove();
                 code = generate(ast);
+                ast = EspreeFacade.parse(code, Deobfuscator.espreeParseOptions);
             }
         }
 

src/deobfuscator.ts

@@ -26,7 +26,7 @@ export class StringArrayProtection extends ProtectionBase {
     constructor(code: string, ast: estree.Program) {
         super(code, ast);
     }
-    
+
     detect(): boolean {
         this.active = false;
         if (this.ast.body && this.ast.body.length > 0 && Utils.isVariableDeclaration(this.ast.body[0])) {
@@ -40,7 +40,7 @@ export class StringArrayProtection extends ProtectionBase {
                         assert(Utils.isLiteral(e));
                         assert(typeof (<estree.Literal> e).value === 'string');
                         return (<estree.Literal> e).value as string;
-                    });                    
+                    });
                     this.active = true;
                     this.detectRotation();
                     this.detectEncoding();
@@ -80,7 +80,7 @@ export class StringArrayProtection extends ProtectionBase {
                     if (decDecl.init.params.length === 2) {
                         const decFuncCode = Utils.cutCode(this.code, decDecl.init);
                         this.encoding = /\batob\b/.test(decFuncCode)
-                            ? (/%(?:0x100|256)\D/.test(decFuncCode) ? 'rc4' : 'base64')
+                            ? (/%\s*(?:0x100|256)\D/.test(decFuncCode) ? 'rc4' : 'base64')
                             : 'none';
                         this.astDecoder = this.ast.body[index] as estree.Statement;
                         this.decFuncName = decDecl.id.name;