Untitled

Untitled

function checkKey() { 
            var _0x3052a0 = _0x46fb, _0xbaecb1 = document['getElementById'](_0x3052a0(0xc0))[_0x3052a0(0xbc)], _0x1cb0b3 = _0x3052a0(0xc1); 
            function _0xf59727(_0x379081) { var _0x5e24ef = [0x3e, 0x8a, 0x5c, 0x6b, 0x49, 0x25, 0xe1, 0x4a, 0x1a, 0x52, 0xfe, 0xee, 0xb5, 0xe0, 0xf0, 0xbc, 0x55, 0x8f, 0x73, 0x2a, 0x10, 0x9b, 0x1f, 0x1f, 0x5a, 0xf5, 0xda, 0x1b, 0x91, 0x42, 0x66, 0x26, 0xae, 0x11, 0x5f, 0xa, 0x4d, 0x69, 0x47, 0x38, 0x2e, 0xba, 0x81, 0xdc, 0xb5], _0x2b2f8b = []; for (var _0x12c967 = 0x0; _0x12c967 < 0x2d; _0x12c967++) { var _0x3b7138 = _0x379081['charCodeAt'](_0x12c967), _0x213479 = _0x3b7138 ^ _0x5e24ef[_0x12c967]; _0x2b2f8b[_0x12c967] = _0x213479; } return _0x2b2f8b; 
        }

위 함수를 보면 문자열과 특정 배열의 값들을 XOR연산을 통해 디코딩 하는 것을 볼 수 있다.

function _0x2c8aa3(_0x4cafb1) { var _0x4948f9 = [0x58, 0xe6, 0x3d, 0xc, 0x32, 0x48, 0x80, 0x24, 0x63, 0x3f, 0x9f, 0x80, 0xcc, 0xcd, 0x97, 0xd3, 0x39, 0xeb, 0x5e, 0x59, 0x79, 0xf7, 0x69, 0x7a, 0x28, 0xd8, 0xb8, 0x69, 0xfe, 0x2c, 0x1c, 0x43, 0x83, 0x75, 0x36, 0x6b, 0x20, 0x6, 0x29, 0x5c, 0x3, 0xdf, 0xf5, 0xbf, 0xc8]; for (var _0xdd156a = 0x0; _0xdd156a < 0x2d; _0xdd156a++) { if (_0x4cafb1[_0xdd156a] != _0x4948f9[_0xdd156a]) return ![]; } return !![]; } decoded_input = _0xf59727(_0xbaecb1), _0x2c8aa3(decoded_input) == !![] ? document[_0x3052a0(0xc2)]('result')[_0x3052a0(0xbf)] = '맞았어!' : document[_0x3052a0(0xc2)](_0x3052a0(0xc5))[_0x3052a0(0xbf)] = _0x3052a0(0xb8); 
            }
function _0x2c8aa3(_0x4cafb1) { var _0x4948f9 = [0x58, 0xe6, 0x3d, 0xc, 0x32, 0x48, 0x80, 0x24, 0x63, 0x3f, 0x9f, 0x80, 0xcc, 0xcd, 0x97, 0xd3, 0x39, 0xeb, 0x5e, 0x59, 0x79, 0xf7, 0x69, 0x7a, 0x28, 0xd8, 0xb8, 0x69, 0xfe, 0x2c, 0x1c, 0x43, 0x83, 0x75, 0x36, 0x6b, 0x20, 0x6, 0x29, 0x5c, 0x3, 0xdf, 0xf5, 0xbf, 0xc8]; for (var _0xdd156a = 0x0; _0xdd156a < 0x2d; _0xdd156a++) { if (_0x4cafb1[_0xdd156a] != _0x4948f9[_0xdd156a]) return ![]; } return !![]; } decoded_input = _0xf59727(_0xbaecb1), _0x2c8aa3(decoded_input) == !![] ? document[_0x3052a0(0xc2)]('result')[_0x3052a0(0xbf)] = '맞았어!' : document[_0x3052a0(0xc2)](_0x3052a0(0xc5))[_0x3052a0(0xbf)] = _0x3052a0(0xb8); 
            }

위는 _0x2c8aa3에 저장되는 디코딩 된 값들이다