sekant-intercept-js 1.0.0

package/dist/sekant-intercept.browser.mjs

@@ -0,0 +1,15 @@
+/*
+ * Sekant Intercept.js
+ * Copyright 2026 Rishi Kant (Sekant Security Inc.)
+ * Licensed under Apache 2.0
+ * Includes third-party code from pe-library and spark-md5 (MIT)
+ */
+var vt=Object.create;var pe=Object.defineProperty;var bt=Object.getOwnPropertyDescriptor;var _t=Object.getOwnPropertyNames;var Ut=Object.getPrototypeOf,At=Object.prototype.hasOwnProperty;var xt=(r,e)=>()=>(e||r((e={exports:{}}).exports,e),e.exports),Ot=(r,e)=>{for(var t in e)pe(r,t,{get:e[t],enumerable:!0})},St=(r,e,t,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of _t(e))!At.call(r,i)&&i!==t&&pe(r,i,{get:()=>e[i],enumerable:!(n=bt(e,i))||n.enumerable});return r};var Et=(r,e,t)=>(t=r!=null?vt(Ut(r)):{},St(e||!r||!r.__esModule?pe(t,"default",{value:r,enumerable:!0}):t,r));var ct=xt((ft,lt)=>{(function(r){if(typeof ft=="object")lt.exports=r();else if(typeof define=="function"&&define.amd)define(r);else{var e;try{e=window}catch{e=self}e.SparkMD5=r()}})(function(r){"use strict";var e=function(y,c){return y+c&4294967295},t=["0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f"];function n(y,c,l,f,h,p){return c=e(e(c,y),e(f,p)),e(c<<h|c>>>32-h,l)}function i(y,c){var l=y[0],f=y[1],h=y[2],p=y[3];l+=(f&h|~f&p)+c[0]-680876936|0,l=(l<<7|l>>>25)+f|0,p+=(l&f|~l&h)+c[1]-389564586|0,p=(p<<12|p>>>20)+l|0,h+=(p&l|~p&f)+c[2]+606105819|0,h=(h<<17|h>>>15)+p|0,f+=(h&p|~h&l)+c[3]-1044525330|0,f=(f<<22|f>>>10)+h|0,l+=(f&h|~f&p)+c[4]-176418897|0,l=(l<<7|l>>>25)+f|0,p+=(l&f|~l&h)+c[5]+1200080426|0,p=(p<<12|p>>>20)+l|0,h+=(p&l|~p&f)+c[6]-1473231341|0,h=(h<<17|h>>>15)+p|0,f+=(h&p|~h&l)+c[7]-45705983|0,f=(f<<22|f>>>10)+h|0,l+=(f&h|~f&p)+c[8]+1770035416|0,l=(l<<7|l>>>25)+f|0,p+=(l&f|~l&h)+c[9]-1958414417|0,p=(p<<12|p>>>20)+l|0,h+=(p&l|~p&f)+c[10]-42063|0,h=(h<<17|h>>>15)+p|0,f+=(h&p|~h&l)+c[11]-1990404162|0,f=(f<<22|f>>>10)+h|0,l+=(f&h|~f&p)+c[12]+1804603682|0,l=(l<<7|l>>>25)+f|0,p+=(l&f|~l&h)+c[13]-40341101|0,p=(p<<12|p>>>20)+l|0,h+=(p&l|~p&f)+c[14]-1502002290|0,h=(h<<17|h>>>15)+p|0,f+=(h&p|~h&l)+c[15]+1236535329|0,f=(f<<22|f>>>10)+h|0,l+=(f&p|h&~p)+c[1]-165796510|0,l=(l<<5|l>>>27)+f|0,p+=(l&h|f&~h)+c[6]-1069501632|0,p=(p<<9|p>>>23)+l|0,h+=(p&f|l&~f)+c[11]+643717713|0,h=(h<<14|h>>>18)+p|0,f+=(h&l|p&~l)+c[0]-373897302|0,f=(f<<20|f>>>12)+h|0,l+=(f&p|h&~p)+c[5]-701558691|0,l=(l<<5|l>>>27)+f|0,p+=(l&h|f&~h)+c[10]+38016083|0,p=(p<<9|p>>>23)+l|0,h+=(p&f|l&~f)+c[15]-660478335|0,h=(h<<14|h>>>18)+p|0,f+=(h&l|p&~l)+c[4]-405537848|0,f=(f<<20|f>>>12)+h|0,l+=(f&p|h&~p)+c[9]+568446438|0,l=(l<<5|l>>>27)+f|0,p+=(l&h|f&~h)+c[14]-1019803690|0,p=(p<<9|p>>>23)+l|0,h+=(p&f|l&~f)+c[3]-187363961|0,h=(h<<14|h>>>18)+p|0,f+=(h&l|p&~l)+c[8]+1163531501|0,f=(f<<20|f>>>12)+h|0,l+=(f&p|h&~p)+c[13]-1444681467|0,l=(l<<5|l>>>27)+f|0,p+=(l&h|f&~h)+c[2]-51403784|0,p=(p<<9|p>>>23)+l|0,h+=(p&f|l&~f)+c[7]+1735328473|0,h=(h<<14|h>>>18)+p|0,f+=(h&l|p&~l)+c[12]-1926607734|0,f=(f<<20|f>>>12)+h|0,l+=(f^h^p)+c[5]-378558|0,l=(l<<4|l>>>28)+f|0,p+=(l^f^h)+c[8]-2022574463|0,p=(p<<11|p>>>21)+l|0,h+=(p^l^f)+c[11]+1839030562|0,h=(h<<16|h>>>16)+p|0,f+=(h^p^l)+c[14]-35309556|0,f=(f<<23|f>>>9)+h|0,l+=(f^h^p)+c[1]-1530992060|0,l=(l<<4|l>>>28)+f|0,p+=(l^f^h)+c[4]+1272893353|0,p=(p<<11|p>>>21)+l|0,h+=(p^l^f)+c[7]-155497632|0,h=(h<<16|h>>>16)+p|0,f+=(h^p^l)+c[10]-1094730640|0,f=(f<<23|f>>>9)+h|0,l+=(f^h^p)+c[13]+681279174|0,l=(l<<4|l>>>28)+f|0,p+=(l^f^h)+c[0]-358537222|0,p=(p<<11|p>>>21)+l|0,h+=(p^l^f)+c[3]-722521979|0,h=(h<<16|h>>>16)+p|0,f+=(h^p^l)+c[6]+76029189|0,f=(f<<23|f>>>9)+h|0,l+=(f^h^p)+c[9]-640364487|0,l=(l<<4|l>>>28)+f|0,p+=(l^f^h)+c[12]-421815835|0,p=(p<<11|p>>>21)+l|0,h+=(p^l^f)+c[15]+530742520|0,h=(h<<16|h>>>16)+p|0,f+=(h^p^l)+c[2]-995338651|0,f=(f<<23|f>>>9)+h|0,l+=(h^(f|~p))+c[0]-198630844|0,l=(l<<6|l>>>26)+f|0,p+=(f^(l|~h))+c[7]+1126891415|0,p=(p<<10|p>>>22)+l|0,h+=(l^(p|~f))+c[14]-1416354905|0,h=(h<<15|h>>>17)+p|0,f+=(p^(h|~l))+c[5]-57434055|0,f=(f<<21|f>>>11)+h|0,l+=(h^(f|~p))+c[12]+1700485571|0,l=(l<<6|l>>>26)+f|0,p+=(f^(l|~h))+c[3]-1894986606|0,p=(p<<10|p>>>22)+l|0,h+=(l^(p|~f))+c[10]-1051523|0,h=(h<<15|h>>>17)+p|0,f+=(p^(h|~l))+c[1]-2054922799|0,f=(f<<21|f>>>11)+h|0,l+=(h^(f|~p))+c[8]+1873313359|0,l=(l<<6|l>>>26)+f|0,p+=(f^(l|~h))+c[15]-30611744|0,p=(p<<10|p>>>22)+l|0,h+=(l^(p|~f))+c[6]-1560198380|0,h=(h<<15|h>>>17)+p|0,f+=(p^(h|~l))+c[13]+1309151649|0,f=(f<<21|f>>>11)+h|0,l+=(h^(f|~p))+c[4]-145523070|0,l=(l<<6|l>>>26)+f|0,p+=(f^(l|~h))+c[11]-1120210379|0,p=(p<<10|p>>>22)+l|0,h+=(l^(p|~f))+c[2]+718787259|0,h=(h<<15|h>>>17)+p|0,f+=(p^(h|~l))+c[9]-343485551|0,f=(f<<21|f>>>11)+h|0,y[0]=l+y[0]|0,y[1]=f+y[1]|0,y[2]=h+y[2]|0,y[3]=p+y[3]|0}function s(y){var c=[],l;for(l=0;l<64;l+=4)c[l>>2]=y.charCodeAt(l)+(y.charCodeAt(l+1)<<8)+(y.charCodeAt(l+2)<<16)+(y.charCodeAt(l+3)<<24);return c}function o(y){var c=[],l;for(l=0;l<64;l+=4)c[l>>2]=y[l]+(y[l+1]<<8)+(y[l+2]<<16)+(y[l+3]<<24);return c}function u(y){var c=y.length,l=[1732584193,-271733879,-1732584194,271733878],f,h,p,x,C,j;for(f=64;f<=c;f+=64)i(l,s(y.substring(f-64,f)));for(y=y.substring(f-64),h=y.length,p=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],f=0;f<h;f+=1)p[f>>2]|=y.charCodeAt(f)<<(f%4<<3);if(p[f>>2]|=128<<(f%4<<3),f>55)for(i(l,p),f=0;f<16;f+=1)p[f]=0;return x=c*8,x=x.toString(16).match(/(.*?)(.{0,8})$/),C=parseInt(x[2],16),j=parseInt(x[1],16)||0,p[14]=C,p[15]=j,i(l,p),l}function a(y){var c=y.length,l=[1732584193,-271733879,-1732584194,271733878],f,h,p,x,C,j;for(f=64;f<=c;f+=64)i(l,o(y.subarray(f-64,f)));for(y=f-64<c?y.subarray(f-64):new Uint8Array(0),h=y.length,p=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],f=0;f<h;f+=1)p[f>>2]|=y[f]<<(f%4<<3);if(p[f>>2]|=128<<(f%4<<3),f>55)for(i(l,p),f=0;f<16;f+=1)p[f]=0;return x=c*8,x=x.toString(16).match(/(.*?)(.{0,8})$/),C=parseInt(x[2],16),j=parseInt(x[1],16)||0,p[14]=C,p[15]=j,i(l,p),l}function g(y){var c="",l;for(l=0;l<4;l+=1)c+=t[y>>l*8+4&15]+t[y>>l*8&15];return c}function m(y){var c;for(c=0;c<y.length;c+=1)y[c]=g(y[c]);return y.join("")}m(u("hello"))!=="5d41402abc4b2a76b9719d911017c592"&&(e=function(y,c){var l=(y&65535)+(c&65535),f=(y>>16)+(c>>16)+(l>>16);return f<<16|l&65535}),typeof ArrayBuffer<"u"&&!ArrayBuffer.prototype.slice&&(function(){function y(c,l){return c=c|0||0,c<0?Math.max(c+l,0):Math.min(c,l)}ArrayBuffer.prototype.slice=function(c,l){var f=this.byteLength,h=y(c,f),p=f,x,C,j,Me;return l!==r&&(p=y(l,f)),h>p?new ArrayBuffer(0):(x=p-h,C=new ArrayBuffer(x),j=new Uint8Array(C),Me=new Uint8Array(this,h,x),j.set(Me),C)}})();function d(y){return/[\u0080-\uFFFF]/.test(y)&&(y=unescape(encodeURIComponent(y))),y}function w(y,c){var l=y.length,f=new ArrayBuffer(l),h=new Uint8Array(f),p;for(p=0;p<l;p+=1)h[p]=y.charCodeAt(p);return c?h:f}function _(y){return String.fromCharCode.apply(null,new Uint8Array(y))}function v(y,c,l){var f=new Uint8Array(y.byteLength+c.byteLength);return f.set(new Uint8Array(y)),f.set(new Uint8Array(c),y.byteLength),l?f:f.buffer}function U(y){var c=[],l=y.length,f;for(f=0;f<l-1;f+=2)c.push(parseInt(y.substr(f,2),16));return String.fromCharCode.apply(String,c)}function b(){this.reset()}return b.prototype.append=function(y){return this.appendBinary(d(y)),this},b.prototype.appendBinary=function(y){this._buff+=y,this._length+=y.length;var c=this._buff.length,l;for(l=64;l<=c;l+=64)i(this._hash,s(this._buff.substring(l-64,l)));return this._buff=this._buff.substring(l-64),this},b.prototype.end=function(y){var c=this._buff,l=c.length,f,h=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],p;for(f=0;f<l;f+=1)h[f>>2]|=c.charCodeAt(f)<<(f%4<<3);return this._finish(h,l),p=m(this._hash),y&&(p=U(p)),this.reset(),p},b.prototype.reset=function(){return this._buff="",this._length=0,this._hash=[1732584193,-271733879,-1732584194,271733878],this},b.prototype.getState=function(){return{buff:this._buff,length:this._length,hash:this._hash.slice()}},b.prototype.setState=function(y){return this._buff=y.buff,this._length=y.length,this._hash=y.hash,this},b.prototype.destroy=function(){delete this._hash,delete this._buff,delete this._length},b.prototype._finish=function(y,c){var l=c,f,h,p;if(y[l>>2]|=128<<(l%4<<3),l>55)for(i(this._hash,y),l=0;l<16;l+=1)y[l]=0;f=this._length*8,f=f.toString(16).match(/(.*?)(.{0,8})$/),h=parseInt(f[2],16),p=parseInt(f[1],16)||0,y[14]=h,y[15]=p,i(this._hash,y)},b.hash=function(y,c){return b.hashBinary(d(y),c)},b.hashBinary=function(y,c){var l=u(y),f=m(l);return c?U(f):f},b.ArrayBuffer=function(){this.reset()},b.ArrayBuffer.prototype.append=function(y){var c=v(this._buff.buffer,y,!0),l=c.length,f;for(this._length+=y.byteLength,f=64;f<=l;f+=64)i(this._hash,o(c.subarray(f-64,f)));return this._buff=f-64<l?new Uint8Array(c.buffer.slice(f-64)):new Uint8Array(0),this},b.ArrayBuffer.prototype.end=function(y){var c=this._buff,l=c.length,f=[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],h,p;for(h=0;h<l;h+=1)f[h>>2]|=c[h]<<(h%4<<3);return this._finish(f,l),p=m(this._hash),y&&(p=U(p)),this.reset(),p},b.ArrayBuffer.prototype.reset=function(){return this._buff=new Uint8Array(0),this._length=0,this._hash=[1732584193,-271733879,-1732584194,271733878],this},b.ArrayBuffer.prototype.getState=function(){var y=b.prototype.getState.call(this);return y.buff=_(y.buff),y},b.ArrayBuffer.prototype.setState=function(y){return y.buff=w(y.buff,!0),b.prototype.setState.call(this,y)},b.ArrayBuffer.prototype.destroy=b.prototype.destroy,b.ArrayBuffer.prototype._finish=b.prototype._finish,b.ArrayBuffer.hash=function(y,c){var l=a(new Uint8Array(y)),f=m(l);return c?U(f):f},b})});var ie=class{constructor(){this.children={},this.fail=null,this.outputs=[],this.nocase=!1}},Y=class{constructor(e){this.root=new ie,this.addRules(e)}addRules(e){let t=[],n=new TextDecoder;for(let i of e){let{id:s,strings:o}=i;for(let u of Object.keys(o)){let a=o[u];if(a.type==="text")for(let g of a.patterns){let m=g.bytes,d=n.decode(m);t.push({id:s,varName:u,pattern:d,matcher:a.matcher,xor:a.xor,nocase:a.nocase})}else a.type==="regex"&&a.literalPrefix&&a.literalPrefix.length>0&&t.push({id:s,varName:u,pattern:a.literalPrefix,matcher:a.matcher,nocase:a.nocase})}}this.generateAtoms(t),this.buildTrie(t),this.buildFailures()}generateAtoms(e,t=3){let n=[];for(let i of e){if(i.pattern.length<=t)i.atom=i.pattern,i.atomOffset=0;else{let s=Math.floor(Math.random()*(i.pattern.length-t));i.atom=i.pattern.slice(s,s+t),i.atomOffset=s}if(i.atomLength=i.atom.length,i.length=i.pattern.length,i.xor){let[s,o]=i.xor,u=Array.from(i.atom);for(let a=s;a<=o;a++){let g=u.map(m=>String.fromCharCode(m.charCodeAt(0)^a)).join("");a===s?(i.atom=g,i.xorKey=a):n.push({...i,atom:g,xorKey:a})}}}e.push(...n)}buildTrie(e){for(let t of e){let n=this.root;for(let i=0;i<t.atom.length;i++){let s=t.atom[i];n.children[s]||(n.children[s]=new ie),n=n.children[s],n.nocase=t.nocase??!1}n.outputs.push(t)}}printTrie(){let e=(t,n)=>{for(let[i,s]of Object.entries(t.children))console.log(`${n}${i} (nocase: ${s.nocase}) (children: [${Object.keys(s.children)}]) (outputs: ${s.outputs.length})`),e(s,n+"  ")};e(this.root,"")}buildFailures(){let e=[];for(let t in this.root.children){let n=this.root.children[t];n.fail=this.root,e.push(n)}for(;e.length>0;){let t=e.shift();for(let[n,i]of Object.entries(t.children)){e.push(i);let s=t.fail;for(;s&&!s.children[n];)s=s.fail;i.fail=s?s.children[n]:this.root,i.outputs=i.outputs.concat(i.fail.outputs)}}}search(e){let t=[],n=this.root;for(let i=0;i<e.length;i++){let s=e[i],o=typeof s=="number"?String.fromCharCode(s):s,u=o.toLowerCase();for(;n&&!(n.children[o]||n.children[u]&&n.children[u].nocase);)n=n.fail;if(n?n.children[o]?n=n.children[o]:n.children[u]?.nocase?n=n.children[u]:n=this.root:n=this.root,n!==this.root)for(let a of n.outputs){let g=i-(a.atomLength||0)+1;g-a.atomOffset<0||g-a.atomOffset+a.length>e.length||t.push({id:a.id,varName:a.varName,index:g,xorKey:a.xorKey,matcher:a.matcher})}}return t}};function He(r){r=r.trim();let e=r.startsWith("/"),t=r.startsWith("{"),n=r.match(/^"(.*)"(.*)$/);if(e)return Ct(r);if(t){let i=r.slice(r.lastIndexOf("}")+1);return jt(r.slice(1,r.lastIndexOf("}")).trim(),i)}else if(n){let[,i,s]=n,o=s.toLowerCase(),u={wide:/\bwide\b/.test(o),xor:Nt(o),allowKey0:!0,ascii:/\bascii\b/.test(o)||!/\bwide\b/.test(o),base64:/\bbase64\b/.test(o),base64wide:/\bbase64wide\b/.test(o),fullword:/\bfullword\b/.test(o),nocase:/\bnocase\b/.test(o),private:/\bprivate\b/.test(o)};return zt(i,u)}throw new Error("Unsupported definition: "+r)}function Le(r){return(e,t=-1,n=2048)=>{let i=t>=0;return t=Math.max(0,t-1),e=i?e.slice(t,t+n):e,r(e,i?t:-1)}}function Ct(r){let e=r.split("/").pop().toLowerCase()??"",t=e.split(" ")[0],n=/\bprivate\b/.test(e),i=r.slice(1,r.lastIndexOf("/")),s=t.includes("i"),o="g"+(t.includes("s")?"s":"")+(s?"i":""),u=It(i,s),a=new RegExp(i,o);return{matcher:Le((m,d=-1)=>{let w=new TextEncoder,_=new TextDecoder().decode(m),v=[],U=d>=0;d=d<0?0:d;let b;for(;(b=a.exec(_))!==null&&v.length<100;){let y=w.encode(_.slice(0,b.index)).length;if(v.push({offset:y+d,length:w.encode(b[0]).length}),a.lastIndex=b.index+1,U)break}return v}),literalPrefix:u,type:"regex",nocase:s,private:n}}function It(r,e=!1){r=r.replace(/^\^/,""),r=e?r.toLowerCase():r;let t=r.match(/^((?:\\[^bBdDwWsSAZzGnrtfv0u]|[^\\[\]()|*+?{}.])+)/);return!t||t.length<2?"":t[1].replace(/\\x([0-9A-Fa-f]{2})/g,(i,s)=>String.fromCharCode(parseInt(s,16))).replace(/\\(.)/g,"$1")}function zt(r,e){let t=new TextEncoder,n=[];e.wide||(e.ascii=!0),(e.base64||e.base64wide)&&(e.nocase=!1,e.fullword=!1,e.xor=null);let i=r.replace(/\\n/g,`
+`).replace(/\\r/g,"\r").replace(/\\t/g,"	").replace(/\\x([0-9A-Fa-f]{2})/g,(u,a)=>String.fromCharCode(parseInt(a,16))).replace(/\\\\/g,"\\").replace(/\\"/g,'"').replace(/\\'/g,"'"),s=e.nocase?[i.toLowerCase()]:[i];for(let u of s)e.base64||e.base64wide?(e.base64&&(e.ascii&&n.push(...se(u,!1).map(a=>({bytes:a,isWide:!1}))),e.wide&&n.push(...se(oe(u),!1).map(a=>({bytes:a,isWide:!0})))),e.base64wide&&(e.ascii&&n.push(...se(u,!0).map(a=>({bytes:a,isWide:!0}))),e.wide&&n.push(...se(oe(u),!0).map(a=>({bytes:a,isWide:!0}))))):(e.ascii&&n.push({bytes:t.encode(u),isWide:!1}),e.wide&&n.push({bytes:oe(u),isWide:!0}));return{matcher:Le((u,a=-1)=>{let g=[],m=a>=0;a=a<0?0:a;for(let{bytes:d,isWide:w}of n)if(e.xor){let _=Tt(u,d,e.xor,e.allowKey0,m);g.push(..._.map(v=>({...v,length:d.length,isWide:w})))}else{let _=Rt(u,d,e.nocase,m);g.push(..._.map(v=>({...v,length:d.length,isWide:w})))}return e.fullword&&(g=g.filter(d=>Dt(u,d.offset,d.length))),g.forEach(d=>{d.offset+=a}),g}),patterns:n,type:"text",xor:e.xor,nocase:e.nocase,private:e.private}}function Tt(r,e,t,n=!0,i=!1){let[s,o]=t,u=[],a=e.length,g=r.length;if(a===0||a>g)return u;for(let m=s;m<=o;m++)for(let d=0;d<=g-a;d++){let w=!0;for(let _=0;_<a;_++)if((r[d+_]^m)!==e[_]){w=!1;break}if(w&&(u.push({offset:d,key:m}),i))break}return u}function Rt(r,e,t=!1,n=!1){let i=[],s=e.length,o=r.length;e:for(let u=0;u<=o-s;u++){for(let a=0;a<s;a++)if((t?$t(r[u+a]):r[u+a])!==e[a])continue e;if(i.push({offset:u}),n)break}return i}function $t(r){return r>=65&&r<=90?r+32:r}function Dt(r,e,t){let n=o=>o>=48&&o<=57||o>=65&&o<=90||o>=97&&o<=122,i=e===0||!n(r[e-1]),s=e+t>=r.length||!n(r[e+t]);return i&&s}function oe(r){let e=new Uint8Array(r.length*2);for(let t=0;t<r.length;t++){let n=r.charCodeAt(t);e[t*2]=n&255,e[t*2+1]=n>>8}return e}function Nt(r){let e=r.match(/xor(?:\((0x[0-9a-f]+|\d+)(?:-(0x[0-9a-f]+|\d+))?\))?/i);if(!e)return null;let[,t,n]=e;if(!t&&!n)return[0,255];let i=t?parseInt(t,t.startsWith("0x")?16:10):null,s=n?parseInt(n,n.startsWith("0x")?16:10):null;return i!==null&&s===null?[i,i]:s!==null&&i===null?[s,s]:[i,s]}var Pt=1e4;function jt(r,e){let t="";r=r?.toUpperCase().replace(/[^0-9A-F?~|()[\-\]]/g,"")||"";let n=r.match(/\[\d*(-\d*)?\]|\(.*\)|~?[0-9A-F?]{2}/g)||[],i=/\bprivate\b/.test(e);if(n.length===0)return{matcher:a=>[],type:"hex",private:i};for(let u of n)if(u.startsWith("["))if(u.indexOf("-")===-1){let g=parseInt(u.slice(1,-1));t+=`(?:[0-9A-F]{2}){${g}}`}else{let g=/\[(\d*)-(\d*)\]/.exec(u),m=parseInt(g[1])||0,d=parseInt(g[2])||Pt;t+=`(?:[0-9A-F]{2}){${m},${d}}`}else u.startsWith("(")?t+=Fe(u).replace(/\?/g,"[0-9A-F]"):u.startsWith("~")?t+=Fe(u):t+=u.replace(/\?/g,"[0-9A-F]");let s=new RegExp(t,"g");return{matcher:u=>{let a=typeof u=="string"?u:Array.from(u).map(d=>d.toString(16).toUpperCase().padStart(2,"0")).join(""),g=[],m;for(;(m=s.exec(a))!==null&&g.length<100;){if(m.index%2!==0){s.lastIndex=m.index+1;continue}g.push({offset:m.index/2}),s.lastIndex=m.index+2}return g},type:"hex",private:i}}function Fe(r){if(!r||!r.includes("~"))return r;let e=r.split("~"),t=e[0];for(let n=1;n<e.length;n++){let i=e[n].slice(0,2).split("");i[0]=i[0]==="?"?"[0-9A-F]":`${i[0]}`,i[1]=i[1]==="?"?"[0-9A-F]":`${i[1]}`,t+=`(?!${i[0]}${i[1]})[0-9A-F]{2}${e[n].slice(2)}`}return t}function se(r,e=!1){let t=new TextEncoder,n;typeof r=="string"?n=t.encode(r):n=r;let i=[],s=[0,2,3];for(let o=0;o<3;o++){let u=new Uint8Array(o+n.length);u.set(n,o);let a=btoa(String.fromCharCode(...u)),g=s[o],m=/=*$/.exec(a??[0])[0].length,d=a.slice(g,a.length-(m?m+1:0));i.push(e?oe(d):t.encode(d))}return i.filter(o=>o.length>=1)}var Be=["pe","elf","math","hash","time","string"];function Mt(r){let e=[],t=/^\s*import\s+"(\w+)"\s*$/gm,n;for(;(n=t.exec(r))!==null;){let i=n[1];if(!Be.includes(i))throw new Error(`Unsupported module import: "${i}". Supported modules are: ${Be.join(", ")}. Note: All supported modules are automatically available; the import statement is only for validation.`);e.push(i)}return e}function Ft(r){let e="",t=0,n=r.length;for(;t<n;)if(r[t]==='"'||r[t]==="'"){let i=r[t];for(e+=r[t++];t<n;)if(r[t]==="\\"&&t+1<n)e+=r[t++],e+=r[t++];else if(r[t]===i){e+=r[t++];break}else e+=r[t++]}else if(r[t]==="/"&&t+1<n&&r[t+1]==="/"){for(t+=2;t<n&&r[t]!==`
+`;)t++;t<n&&r[t]===`
+`&&(e+=r[t++])}else if(r[t]==="/"&&t+1<n&&r[t+1]==="*")for(t+=2;t<n-1;){if(r[t]==="*"&&r[t+1]==="/"){t+=2;break}r[t]===`
+`&&(e+=`
+`),t++}else e+=r[t++];return e}function We(r){let e=0,t=0,n=!1,i=null,s=0;for(;s<r.length;){let o=r[s];if(n&&o==="\\"&&s+1<r.length){s+=2;continue}(o==='"'||o==="'")&&!n?(n=!0,i=o):o===i&&n?(n=!1,i=null):n||(o==="{"?e++:o==="}"&&t++),s++}return{openCount:e,closeCount:t}}function qe(r,e=[]){Mt(r),r=r.replace(/^\s*import\s+"[^"]+"\s*$/gm,"");let t=e??[],n="",i=0,s=!1,o=r.split(`
+`);for(let u of o)if(!s&&u.match(/^\s*(?:\s*(?:private|global)\s+)*rule\b/i)){s=!0,n=u+`
+`;let a=We(u);i=a.openCount-a.closeCount;let g=a.openCount>0;i===0&&g&&(t.push(Ve(n)),s=!1,n="")}else if(s){n+=u+`
+`;let a=We(u);i+=a.openCount-a.closeCount,i===0&&(t.push(Ve(n)),s=!1,n="")}return t.forEach((u,a)=>{u.id=a+1}),t}function Ve(r){r=Ft(r).trim();let e=/^.*\bprivate\b.*rule\s+/i.test(r),t=/^.*\bglobal\b.*rule\s+/i.test(r),n=r.match(/^(?:.*)?rule\s+(\w+)(?:\s*:\s*([\w\s]+))?\s*\{/);if(!n)throw new Error("Invalid YARA rule: missing rule declaration");let i=n[1],s=n[2]?n[2].trim().split(/\s+/):[],o=r.match(/\{([\s\S]*)\}/);if(!o)throw new Error("Invalid YARA rule: missing rule body");let u=o[1],a=Ht(u),g=Lt(u),m=Bt(u);return{name:i,tags:s,metadata:a,strings:g,condition:m,private:e,global:t}}function Ht(r){let e=r.match(/meta:\s*([\s\S]*?)(?=strings:|condition:|$)/);if(!e)return{};let t=e[1],n={},i=t.match(/(\w+)\s*=\s*("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|(-)?\d+(\.\d+)?|true|false)/g);if(i)for(let s of i){let[,o,u]=s.match(/(\w+)\s*=\s*(.+)/);u.startsWith('"')||u.startsWith("'")?n[o]=u.slice(1,-1):u==="true"||u==="false"?n[o]=u==="true":isNaN(u)?n[o]=u:n[o]=Number(u)}return n}function Lt(r){let e=r.match(/strings:\s*([\s\S]*?)(?=condition:|$)/);if(!e)return{};let t=e[1],n={},i=t.match(/\$\w*\s*=\s*(.*)?/g);if(i){let s=0;for(let o of i){let u=o.match(/\$(\w*)\s*=\s*(.+)/);if(!u)continue;let[,a,g]=u;!a||a===""?a=`.anon_${s++}`:a.startsWith("$")||(a="$"+a);try{let m=He(g.trim());n[a]={definition:g.trim(),...m}}catch(m){console.warn(`Warning: Failed to compile string $${a}: ${m.message}`),console.warn(`Definition: ${g.trim()}`),console.warn(o),console.warn(e),console.warn(r),n[a]={definition:g.trim(),type:null,matcher:null,error:m.message}}}}return n}function Bt(r){let e=r.match(/condition:\s*([\s\S]*?)$/);if(!e)throw new Error("Invalid YARA rule: missing condition");return e[1].trim().replace(/\}\s*$/,"").trim()}function ke(r,e={},t={},n={}){let i={};for(let[s,o]of Object.entries(e))Array.isArray(o)?i[s]={identifier:s,matched:o.length>0,count:o.length,matches:o,offsets:o.map(u=>u.offset)}:typeof o=="object"&&o!==null&&(i[s]={identifier:s,matched:o.matched??o.count>0,count:o.count??0,matches:o.matches??[],offsets:o.offsets??(o.matches||[]).map(u=>u.offset),...o});return{data:r,filesize:r.length,entrypoint:n.entrypoint??0,isFileSizeCapped:n.isFileSizeCapped??!1,maxFileSize:n.maxFileSize??1024*1024,strings:i,modules:t||{},matchedRules:n.matchedRules||{},metadata:n.metadata||{}}}var ge=class{constructor(e){this.facts=e,this.data=e.data,this.filesize=e.filesize,this.entrypoint=e.entrypoint,this.isFileSizeCapped=e.isFileSizeCapped??!1,this.maxFileSize=e.maxFileSize??1024*1024,this.strings=e.strings,this.modules=e.modules,this.matchedRules=e.matchedRules||{}}isAnyUndefined(...e){return e.some(t=>t===void 0)}async evaluate(e){return typeof e=="string"&&(e=this.parseCondition(e)),await this.evaluateNode(e)}parseCondition(e){throw new Error("String parsing not implemented - pass AST directly")}async evaluateNode(e){if(e==null)return!1;let t=e.type;switch(t){case"boolean":return e.value;case"number":return e.value;case"string":return e.value;case"identifier":return this.resolveIdentifier(e.name);case"ruleIdentifier":return this.evaluateRuleIdentifier(e);case"stringIdentifier":return this.evaluateStringIdentifier(e);case"stringCount":return this.getStringCount(e.identifier);case"stringOffset":{let n=e.index;return typeof n=="object"&&(n=await this.evaluateNode(n)),this.getStringOffset(e.identifier,n)}case"stringLength":{let n=e.index;return typeof n=="object"&&(n=await this.evaluateNode(n)),this.getStringLength(e.identifier,n)}case"and":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return!(n===void 0||n===!1||i===void 0||i===!1)}case"or":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return(n===void 0?!1:n)||(i===void 0?!1:i)}case"not":{let n=await this.evaluateNode(e.operand);return this.isAnyUndefined(n)?void 0:!n}case"defined":return await this.evaluateDefined(e.operand);case"equal":return await this.evaluateEqual(e);case"notEqual":return await this.evaluateNotEqual(e);case"lessThan":return await this.evaluateLessThan(e);case"greaterThan":return await this.evaluateGreaterThan(e);case"lessThanOrEqual":return await this.evaluateLessThanOrEqual(e);case"greaterThanOrEqual":return await this.evaluateGreaterThanOrEqual(e);case"add":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n+i}case"subtract":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n-i}case"multiply":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n*i}case"divide":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:Math.floor(n/i)}case"modulo":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n%i}case"bitwiseAnd":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n&i}case"bitwiseOr":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n|i}case"bitwiseXor":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n^i}case"bitwiseNot":{let n=await this.evaluateNode(e.operand);return this.isAnyUndefined(n)?void 0:~n}case"shiftLeft":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n<<i}case"shiftRight":{let n=await this.evaluateNode(e.left),i=await this.evaluateNode(e.right);return this.isAnyUndefined(n,i)?void 0:n>>i}case"contains":return await this.stringContains(e.left,e.right,!1);case"icontains":return await this.stringContains(e.left,e.right,!0);case"startswith":return await this.stringStartsWith(e.left,e.right,!1);case"istartswith":return await this.stringStartsWith(e.left,e.right,!0);case"endswith":return await this.stringEndsWith(e.left,e.right,!1);case"iendswith":return await this.stringEndsWith(e.left,e.right,!0);case"iequals":return await this.stringEquals(e.left,e.right,!0);case"matches":return await this.stringMatches(e.left,e.right);case"in":return await this.evaluateInOperator(e);case"range":return{start:await this.evaluateNode(e.start),end:await this.evaluateNode(e.end)};case"all":return await this.evaluateAll(e.items);case"any":return await this.evaluateAny(e.items);case"none":return await this.evaluateNone(e.items);case"quantified":return await this.evaluateQuantified(e);case"for":return await this.evaluateFor(e);case"memberAccess":return await this.evaluateMemberAccess(e);case"arrayAccess":return await this.evaluateArrayAccess(e);case"functionCall":return await this.evaluateFunctionCall(e);case"dataAccess":return this.evaluateDataAccess(e);case"at":return await this.evaluateAt(e);case"inRange":return await this.evaluateInRange(e);case"within":return await this.evaluateWithin(e);case"moduleFunction":return await this.evaluateModuleFunction(e);default:throw new Error(`Unknown node type: ${t}`)}}resolveIdentifier(e){if(this.forContext&&e in this.forContext)return this.forContext[e];switch(e){case"filesize":return this.filesize;case"entrypoint":if(typeof this.entrypoint!="number")throw new Error("Entrypoint is not defined");return this.entrypoint;default:if(this.modules&&e in this.modules)return this.modules[e];if(["pe","elf","hash","math","string","time"].includes(e))return;throw new Error(`Unknown identifier: ${e}`)}}isFilesizeNode(e){return e&&e.type==="identifier"&&e.name==="filesize"}async evaluateEqual(e){let t=await this.evaluateNode(e.left),n=await this.evaluateNode(e.right);if(!this.isAnyUndefined(t,n))return this.isFilesizeNode(e.left)&&this.isFileSizeCapped&&n>=this.maxFileSize||this.isFilesizeNode(e.right)&&this.isFileSizeCapped&&t>=this.maxFileSize?!0:t===n}async evaluateNotEqual(e){let t=await this.evaluateEqual(e);if(!this.isAnyUndefined(t))return!t}async evaluateLessThan(e){let t=await this.evaluateNode(e.left),n=await this.evaluateNode(e.right);if(!this.isAnyUndefined(t,n))return t<n}async evaluateGreaterThan(e){let t=await this.evaluateNode(e.left),n=await this.evaluateNode(e.right);if(!this.isAnyUndefined(t,n))return this.isFilesizeNode(e.left)&&this.isFileSizeCapped&&n>=this.maxFileSize?!0:t>n}async evaluateLessThanOrEqual(e){let t=await this.evaluateNode(e.left),n=await this.evaluateNode(e.right);if(!this.isAnyUndefined(t,n))return t<=n}async evaluateGreaterThanOrEqual(e){let t=await this.evaluateNode(e.left),n=await this.evaluateNode(e.right);if(!this.isAnyUndefined(t,n))return this.isFilesizeNode(e.left)&&this.isFileSizeCapped&&n>=this.maxFileSize?!0:t>=n}evaluateStringIdentifier(e){let t=e.identifier;t==="$"&&this.forContext&&this.forContext.$&&(t=this.forContext.$);let n=this.strings[t];return n?n.matched&&n.count>0:!1}evaluateRuleIdentifier(e){let t=e.name;return t in this.matchedRules?this.matchedRules[t]===!0:!1}getStringCount(e){e==="$"&&this.forContext&&this.forContext.$&&(e=this.forContext.$);let t=this.strings[e];return t?t.count:0}getStringOffset(e,t=0){e==="$"&&this.forContext&&this.forContext.$&&(e=this.forContext.$),typeof t=="string"&&this.forContext&&t in this.forContext&&(t=this.forContext[t]);let n=this.strings[e];if(!n||!n.offsets||n.offsets.length===0)return;let i=t===0?0:t-1;return n.offsets[i]}getStringLength(e,t=0){e==="$"&&this.forContext&&this.forContext.$&&(e=this.forContext.$),typeof t=="string"&&this.forContext&&t in this.forContext&&(t=this.forContext[t]);let n=this.strings[e];if(!n||!n.matches||n.matches.length===0)return;let i=t===0?0:t-1,s=n.matches[i];return s?s.length:void 0}evaluateAll(e){let t=this.resolveStringSet(e);return t.length===0?!1:t.every(n=>{let i=this.strings[n];return i&&i.matched&&i.count>0})}evaluateAny(e){let t=this.resolveStringSet(e);return t.length===0?!1:t.some(n=>{let i=this.strings[n];return i&&i.matched&&i.count>0})}evaluateNone(e){let t=this.resolveStringSet(e);return t.length===0?!0:t.every(n=>{let i=this.strings[n];return!i||!i.matched||i.count===0})}evaluateQuantified(e){let t=this.resolveStringSet(e.items);if(t.length===0)return!1;let n=t.filter(s=>{let o=this.strings[s];return o&&o.matched&&o.count>0}).length,i=e.quantifier;if(i.type==="number")return n>=i.value;if(i.type==="percentage"){let s=Math.ceil(t.length*i.value/100);return n>=s}else if(i.type==="range"){let s=i.min,o=i.max;return n>=s&&n<=o}return!1}resolveStringSet(e){if(e==="them")return Object.keys(this.strings);if(Array.isArray(e)){let t=[];for(let n of e)if(n.includes("*")){let i=n.replace(/\*/g,".*").replace(/\$/g,"\\$"),s=new RegExp("^"+i+"$"),o=Object.keys(this.strings).filter(u=>s.test(u));t.push(...o)}else t.push(n);return t}if(typeof e=="string"){if(e.includes("*")){let t=e.replace(/\*/g,".*").replace(/\$/g,"\\$"),n=new RegExp("^"+t+"$");return Object.keys(this.strings).filter(i=>n.test(i))}return[e]}return[]}async evaluateFor(e){let t=e.quantifier,n=e.variable,i=e.set,s=e.condition,o=[];if(i.type==="stringSet"){if(o=this.resolveStringSet(i.items),o.length===0)return t==="all"}else if(i.type==="range"){let m=await this.evaluateNode(i.start),d=await this.evaluateNode(i.end);if(typeof m!="number"||typeof d!="number")throw new Error(`Invalid range values: ${m} to ${d}`);for(let w=m;w<=d;w++)o.push(w);if(o.length===0)return t==="all"}else{let m=await this.evaluateNode(i);Array.isArray(m)?o=m:o=[m]}if(o.length===0)return t==="all";let u=this.forContext||{},a=[];for(let m of o){this.forContext={...u,[n]:m};try{let d=await this.evaluateNode(s);a.push(!!d)}catch(d){console.warn(`For loop condition evaluation failed for item ${m}:`,d.message),a.push(!1)}}this.forContext=u;let g=a.filter(m=>m).length;if(t==="any")return g>0;if(t==="all")return g===o.length;if(t==="none")return g===0;if(typeof t=="number")return g>=t;if(t&&t.type==="percentage"){let m=Math.ceil(o.length*t.value/100);return g>=m}else if(t&&t.type==="number")return g>=t.value;return!1}async evaluateMemberAccess(e){let t=await this.evaluateNode(e.object),n=e.property;if(t!=null){if(typeof n=="string")return t[n];{let i=await this.evaluateNode(n);return t[i]}}}async evaluateArrayAccess(e){let t=await this.evaluateNode(e.object),n=await this.evaluateNode(e.index);if(t==null||!Array.isArray(t))return;let i=n<0?t.length+n:n;if(!(i<0||i>=t.length))return t[i]}async evaluateFunctionCall(e){let t=await this.evaluateNode(e.function),n=await Promise.all(e.arguments.map(s=>this.evaluateNode(s)));if(typeof t!="function")throw new Error(`Not a function: ${e.function}`);let i=t(...n);return i instanceof Promise?await i:i}async evaluateDataAccess(e){let t=await this.evaluateNode(e.offset),n=e.dataType,i=e.endian||"little";if(t<0||t>=this.data.length)return;let s=new DataView(this.data.buffer,this.data.byteOffset,this.data.byteLength),o=i==="little";try{switch(n){case"uint8":return s.getUint8(t);case"uint16":return s.getUint16(t,o);case"uint32":return s.getUint32(t,o);case"int8":return s.getInt8(t);case"int16":return s.getInt16(t,o);case"int32":return s.getInt32(t,o);default:throw new Error(`Unknown data type: ${n}`)}}catch{return}}async evaluateDefined(e){try{let t=await this.evaluateNode(e);return t!=null}catch{return!1}}async evaluateAt(e){let t=e.identifier;if(typeof t=="object"&&t.type==="string"){let s=await this.evaluateNode(e.offset),o=t.value,u=new TextEncoder().encode(o);if(s<0||s+u.length>this.data.length)return!1;for(let a=0;a<u.length;a++)if(this.data[s+a]!==u[a])return!1;return!0}t==="$"&&this.forContext&&this.forContext.$&&(t=this.forContext.$);let n=await this.evaluateNode(e.offset),i=this.strings[t];return!i||!i.offsets?!1:i.offsets.includes(n)}async evaluateInRange(e){let t=e.identifier;t==="$"&&this.forContext&&this.forContext.$&&(t=this.forContext.$);let n=await this.evaluateNode(e.range),i=this.strings[t];return!i||!i.offsets?!1:i.offsets.some(s=>s>=n.start&&s<=n.end)}async evaluateWithin(e){let t=e.identifier,n=e.reference;t==="$"&&this.forContext&&this.forContext.$&&(t=this.forContext.$),n==="$"&&this.forContext&&this.forContext.$&&(n=this.forContext.$);let i=await this.evaluateNode(e.distance),s=this.strings[t],o=this.strings[n];if(!s||!s.offsets||s.offsets.length===0||!o||!o.offsets||o.offsets.length===0)return!1;for(let u of s.offsets)for(let a of o.offsets)if(Math.abs(u-a)<=i)return!0;return!1}async evaluateModuleFunction(e){let{module:t,function:n,args:i}=e,s=this.modules[t];if(!s)return;let o=s[n];if(typeof o!="function")return;let u=await Promise.all(i.map(async a=>{let g=await this.evaluateNode(a);if(a.type==="stringIdentifier"){let m=this.strings[a.identifier];if(m&&m.matches&&m.matches.length>0){let d=m.matches[0];if(d.value)return d.value;if(this.data&&d.offset!==void 0&&d.length!==void 0){let w=this.data.slice(d.offset,d.offset+d.length);return new TextDecoder().decode(w)}}return""}return g}));try{let a=o.apply(s,u);return a instanceof Promise?await a:a}catch(a){throw new Error(`Error calling ${t}.${n}: ${a.message}`)}}async evaluateInOperator(e){let t=await this.evaluateNode(e.value),n=await this.evaluateNode(e.set);if(!this.isAnyUndefined(t,n))return Array.isArray(n)?n.includes(t):n&&typeof n=="object"&&n.start!==void 0&&n.end!==void 0?t>=n.start&&t<=n.end:!1}async stringContains(e,t,n=!1){let i=await this.evaluateNode(e),s=await this.evaluateNode(t);if(!this.isAnyUndefined(i,s))return typeof i!="string"||typeof s!="string"?!1:(n&&(i=i.toLowerCase(),s=s.toLowerCase()),i.includes(s))}async stringStartsWith(e,t,n=!1){let i=await this.evaluateNode(e),s=await this.evaluateNode(t);if(!this.isAnyUndefined(i,s))return typeof i!="string"||typeof s!="string"?!1:(n&&(i=i.toLowerCase(),s=s.toLowerCase()),i.startsWith(s))}async stringEndsWith(e,t,n=!1){let i=await this.evaluateNode(e),s=await this.evaluateNode(t);if(!this.isAnyUndefined(i,s))return typeof i!="string"||typeof s!="string"?!1:(n&&(i=i.toLowerCase(),s=s.toLowerCase()),i.endsWith(s))}async stringEquals(e,t,n=!1){let i=await this.evaluateNode(e),s=await this.evaluateNode(t);if(!this.isAnyUndefined(i,s))return typeof i!="string"||typeof s!="string"?!1:(n&&(i=i.toLowerCase(),s=s.toLowerCase()),i===s)}async stringMatches(e,t){let n=await this.evaluateNode(e),i=await this.evaluateNode(t);if(this.isAnyUndefined(n,i))return;if(typeof n!="string")return!1;let s;if(i instanceof RegExp)s=i;else if(typeof i=="string")s=new RegExp(i);else return!1;return s.test(n)}};async function Ge(r,e){return new ge(e).evaluate(r)}var ae="__LITERAL_";var Wt=[{name:"uint8",bits:8,signed:!1,endian:"little"},{name:"uint16",bits:16,signed:!1,endian:"little"},{name:"uint32",bits:32,signed:!1,endian:"little"},{name:"int8",bits:8,signed:!0,endian:"little"},{name:"int16",bits:16,signed:!0,endian:"little"},{name:"int32",bits:32,signed:!0,endian:"little"},{name:"uint16be",bits:16,signed:!1,endian:"big"},{name:"uint32be",bits:32,signed:!1,endian:"big"},{name:"int16be",bits:16,signed:!0,endian:"big"},{name:"int32be",bits:32,signed:!0,endian:"big"}];function Ye(r,e){let t=e;for(;t<r.length&&/\s/.test(r[t]);)t++;return t}function Vt(r){if(!r.startsWith("(")||!r.endsWith(")"))return!1;let e=0;for(let t=0;t<r.length;t++)if(r[t]==="("&&e++,r[t]===")"&&e--,e===0&&t<r.length-1)return!1;return!0}function qt(r,e){let t=!1;for(let n=1;n<r.length-1;n++){if(t){t=!1;continue}if(r[n]==="\\"){t=!0;continue}if(r[n]===e)return!0}return!1}function kt(r,e){return r.length===2?!0:!qt(r,e)}function Gt(r){let e=[],t=r,n=0,i=(s,o)=>{let u=new RegExp(`${o}(?:[^${o}\\\\]|\\\\.)*${o}`,"g");return s.replace(u,a=>{if(kt(a,o)){let g=`${ae}${n}__`;return e.push({id:g,type:"string",value:a.slice(1,-1)}),n++,g}return a})};return t=i(t,'"'),t=i(t,"'"),{processed:t,literals:e}}function de(r,e){if(!r||typeof r!="object")return r;if(r.type==="identifier"&&r.name&&r.name.startsWith(ae)){let n=e.find(i=>i.id===r.name);if(n)return{type:"string",value:n.value}}let t={...r};for(let n in t)Object.prototype.hasOwnProperty.call(t,n)&&(Array.isArray(t[n])?t[n]=t[n].map(i=>{if(typeof i=="string"&&i.startsWith(ae)){let s=e.find(o=>o.id===i);return s?s.value:i}return typeof i=="object"?de(i,e):i}):typeof t[n]=="object"&&(t[n]=de(t[n],e)));return t}function Ke(r,e={}){r=r.trim();let{processed:t,literals:n}=Gt(r),i=V(t,e);return de(i,n)}function Yt(r){let e=/^(any|all|none|\d+|\d+%|\d+\.\.\d+)\s+of\s+(them|\([^)]+\))$/,t=r.match(e);if(!t)return null;let[,n,i]=t,s,o;if(n==="any")o="any";else if(n==="all")o="all";else if(n==="none")o="none";else if(n.includes("..")){let[a,g]=n.split("..").map(m=>parseInt(m));o="quantified",s={type:"range",min:a,max:g}}else n.endsWith("%")?(o="quantified",s={type:"percentage",value:parseInt(n)}):(o="quantified",s={type:"number",value:parseInt(n)});let u;return i==="them"?u="them":u=i.slice(1,-1).split(",").map(g=>g.trim()),{type:o,...s&&{quantifier:s},items:u}}function V(r,e={}){for(r=r.trim();Vt(r);)r=r.slice(1,-1).trim();let t=Yt(r);if(t)return t;let n=(d,w)=>{let _=L(r,` ${d} `);if(_===-1)return null;let v=Ye(r,_);return v+=w,v=Ye(r,v),{type:d,left:V(r.substring(0,_),e),right:V(r.substring(v),e)}},i=n("or",2);if(i)return i;let s=n("and",3);if(s)return s;if(r.trim().startsWith("for ")){let d=r.indexOf(":");if(d!==-1){let w=d+1;for(;w<r.length&&r[w]!=="(";)w++;if(w<r.length){let _=1,v=w+1;for(;v<r.length&&_>0;)r[v]==="("&&_++,r[v]===")"&&_--,v++;if(_===0){let U=r.substring(0,d).trim(),b=r.substring(w+1,v-1).trim(),y=f=>["all","any","none"].includes(f)?f:f.endsWith("%")?{type:"percentage",value:parseInt(f)}:{type:"number",value:parseInt(f)},c=f=>{let h=f.match(/^(\w+)\s+in\s+\((.+?)\.\.(.+?)\)$/);if(h)return{variable:h[1],set:{type:"range",start:A(h[2].trim()),end:A(h[3].trim())}};let p=f.match(/^of\s+(.+)$/);if(p){let x=p[1].trim(),C;return x==="them"?C="them":x.startsWith("(")&&x.endsWith(")")?C=x.slice(1,-1).split(",").map(j=>j.trim()):C=x,{variable:"$",set:{type:"stringSet",items:C}}}return{variable:null,set:null}},l=U.match(/^for\s+(all|any|none|\d+|(\d+)%)\s+(.+)$/);if(l){let f=y(l[1]),{variable:h,set:p}=c(l[3]);return{type:"for",quantifier:f,variable:h,set:p,condition:V(b,e)}}}}}}if(r.startsWith("not "))return{type:"not",operand:V(r.substring(4),e)};if(r.startsWith("defined "))return{type:"defined",operand:V(r.substring(8),e)};let o=r.match(/^(\$\w*|\w+)\s+at\s+(.+)$/);if(o){let d=o[1];if(d.startsWith("$"))return{type:"at",identifier:d,offset:A(o[2])};if(d.startsWith(ae))return{type:"at",identifier:A(d),offset:A(o[2])}}let u=r.match(/^(\$\w*)\s+in\s+\((.+)\.\.(.+)\)$/);if(u)return{type:"inRange",identifier:u[1],range:{type:"range",start:A(u[2]),end:A(u[3])}};let a=r.match(/^(\$\w*)\s+within\s+(.+?)(?:\s+bytes)?\s+of\s+(\$\w*)$/);if(a)return{type:"within",identifier:a[1],distance:A(a[2]),reference:a[3]};let g=[{pattern:"icontains",type:"icontains"},{pattern:"contains",type:"contains"},{pattern:"istartswith",type:"istartswith"},{pattern:"startswith",type:"startswith"},{pattern:"iendswith",type:"iendswith"},{pattern:"endswith",type:"endswith"}];for(let d of g){let w=L(r,` ${d.pattern} `);if(w!==-1){let _=w;for(;_<r.length&&/\s/.test(r[_]);)_++;for(_+=d.pattern.length;_<r.length&&/\s/.test(r[_]);)_++;return{type:d.type,left:A(r.substring(0,w)),right:A(r.substring(_))}}}let m=[{pattern:"==",type:"equal"},{pattern:"!=",type:"notEqual"},{pattern:"<=",type:"lessThanOrEqual"},{pattern:">=",type:"greaterThanOrEqual"},{pattern:"<",type:"lessThan"},{pattern:">",type:"greaterThan"}];for(let d of m){let w=L(r,d.pattern);if(w!==-1)return{type:d.type,left:A(r.substring(0,w)),right:A(r.substring(w+d.pattern.length))}}return A(r)}function A(r){if(r=r.trim(),r==="true")return{type:"boolean",value:!0};if(r==="false")return{type:"boolean",value:!1};let e=r.match(/^(\d+)(KB|MB|GB)$/i);if(e){let v=parseInt(e[1]),U=e[2].toUpperCase(),b={KB:1024,MB:1024*1024,GB:1024*1024*1024};return{type:"number",value:v*b[U]}}if(/^-?\d+\.\d+$/.test(r))return{type:"number",value:parseFloat(r)};if(/^-?\d+$/.test(r))return{type:"number",value:parseInt(r)};if(/^0x[0-9a-fA-F]+$/.test(r))return{type:"number",value:parseInt(r,16)};if(/^\$\w*$/.test(r))return{type:"stringIdentifier",identifier:r};if(/^#\w*$/.test(r))return{type:"stringCount",identifier:r.replace("#","$")};if(/^@\w*$/.test(r))return{type:"stringOffset",identifier:r.replace("@","$"),index:0};let t=(v,U,b)=>{let y=new RegExp(`^\\${U}([\\w$]+)\\[([^\\]]+)\\]$`),c=v.match(y);if(!c)return null;let l=c[1],f=c[2].trim(),h=l.startsWith("$")?l:`$${l}`,p=/^\d+$/.test(f)?parseInt(f):A(f);return{type:b,identifier:h,index:p}},n=t(r,"@","stringOffset");if(n)return n;if(/^![\w$]+$/.test(r)){let v=r.slice(1);return{type:"stringLength",identifier:v.startsWith("$")?v:`$${v}`,index:0}}let i=t(r,"!","stringLength");if(i)return i;if(r==="filesize")return{type:"identifier",name:"filesize"};if(r==="entrypoint")return{type:"identifier",name:"entrypoint"};for(let v of Wt){let U=new RegExp(`^${v.name}\\((.+)\\)$`),b=r.match(U);if(b)return{type:"dataAccess",dataType:v.name.replace("be",""),offset:A(b[1]),endian:v.endian}}let s=r.match(/^(\w+)\.(\w+)\((.*)\)$/);if(s){let[,v,U,b]=s,y=[];if(b.trim()){let c=0,l="";for(let f=0;f<b.length;f++){let h=b[f];h==="("&&c++,h===")"&&c--,h===","&&c===0?(y.push(A(l.trim())),l=""):l+=h}l.trim()&&y.push(A(l.trim()))}return{type:"moduleFunction",module:v,function:U,args:y}}let o=r.match(/^(\w+)\.(\w+)\[([^\]]+)\]\.?(\w*)$/);if(o){let[,v,U,b,y]=o,c={type:"arrayAccess",object:{type:"memberAccess",object:{type:"identifier",name:v},property:U},index:A(b.trim())};if(y){let l=y.split(".");for(let f of l)f&&(c={type:"memberAccess",object:c,property:f})}return c}let u=r.match(/^(\w+)\.(\w+)$/);if(u){let[,v,U]=u;return{type:"memberAccess",object:{type:"identifier",name:v},property:U}}if(r.startsWith("~")){let v=r.substring(1).trim(),U=0;if(v.startsWith("(")){let c=1;for(U=1;U<v.length&&c>0;)v[U]==="("&&c++,v[U]===")"&&c--,U++}else if(v.startsWith("~")){let c=0;for(;c<v.length&&v[c]==="~";)c++;let l=v.substring(c).trim(),f=0;if(l.startsWith("(")){let h=1;for(f=1;f<l.length&&h>0;)l[f]==="("&&h++,l[f]===")"&&h--,f++}else{let h=l.match(/^([a-zA-Z_$]\w*)\s*\(/);if(h){let p=1;for(f=h[0].length;f<l.length&&p>0;)l[f]==="("&&p++,l[f]===")"&&p--,f++}else{let p=l.match(/^(0x[0-9a-fA-F]+|\d+|[a-zA-Z_$]\w*)/);p&&(f=p[0].length)}}U=c+f}else{let c=v.match(/^([a-zA-Z_$]\w*)\s*\(/);if(c){let l=1;for(U=c[0].length;U<v.length&&l>0;)v[U]==="("&&l++,v[U]===")"&&l--,U++}else{let l=v.match(/^(0x[0-9a-fA-F]+|\d+|[a-zA-Z_$]\w*)/);if(l)U=l[0].length;else return{type:"bitwiseNot",operand:A(v)}}}let b=A(v.substring(0,U)),y=v.substring(U).trim();if(y){let c="("+r.substring(0,U+1)+")"+y;return A(c)}return{type:"bitwiseNot",operand:b}}let a=L(r,"|");if(a!==-1)return{type:"bitwiseOr",left:A(r.substring(0,a)),right:A(r.substring(a+1))};let g=L(r,"^");if(g!==-1)return{type:"bitwiseXor",left:A(r.substring(0,g)),right:A(r.substring(g+1))};let m=L(r,"&");if(m!==-1)return{type:"bitwiseAnd",left:A(r.substring(0,m)),right:A(r.substring(m+1))};let d=L(r,"<<");if(d!==-1)return{type:"shiftLeft",left:A(r.substring(0,d)),right:A(r.substring(d+2))};let w=L(r,">>");if(w!==-1)return{type:"shiftRight",left:A(r.substring(0,w)),right:A(r.substring(w+2))};let _=[{pattern:"+",type:"add"},{pattern:"-",type:"subtract"},{pattern:"*",type:"multiply"},{pattern:"\\",type:"divide"},{pattern:"%",type:"modulo"}];for(let v of _){let U=L(r,v.pattern);if(U!==-1)return{type:v.type,left:A(r.substring(0,U)),right:A(r.substring(U+v.pattern.length))}}if(r.startsWith("(")&&r.endsWith(")")){let v=0,U=!0;for(let b=0;b<r.length;b++)if(r[b]==="("&&v++,r[b]===")"&&v--,v===0&&b<r.length-1){U=!1;break}if(U)return A(r.slice(1,-1))}return/^[A-Z][a-zA-Z0-9_]*$/.test(r)?{type:"ruleIdentifier",name:r}:{type:"identifier",name:r}}function L(r,e){let t=e.trim(),n=/^(and|or|not)$/.test(t),i=0,s=0;for(let o=0;o<r.length;o++)if(r[o]==="("&&i++,r[o]===")"&&i--,r[o]==="["&&s++,r[o]==="]"&&s--,i===0&&s===0){if(n){if(!(o===0||/\s/.test(r[o-1])))continue;let a=o;for(;a<r.length&&/\s/.test(r[a]);)a++;if(r.substring(a,a+t.length)===t){let g=a+t.length;if(g>=r.length||/\s/.test(r[g]))return o}}else if(r.substring(o,o+e.length)===e)return o}return-1}var fe={};Ot(fe,{ArrayFormatBase:()=>q,FormatBase:()=>I,ImageDataDirectoryArray:()=>T,ImageDirectoryEntry:()=>M,ImageDosHeader:()=>E,ImageFileHeader:()=>R,ImageNtHeaders:()=>W,ImageOptionalHeader:()=>P,ImageOptionalHeader64:()=>z,ImageSectionHeaderArray:()=>F,findImageSectionBlockByDirectoryEntry:()=>mn,getImageDosHeader:()=>pn,getImageNtHeadersByDosHeader:()=>gn,getImageSectionHeadersByNtHeaders:()=>dn});var Kt=(function(){function r(e){this.view=e}return r.prototype.copyTo=function(e,t){new Uint8Array(e,t,this.view.byteLength).set(new Uint8Array(this.view.buffer,this.view.byteOffset,this.view.byteLength))},Object.defineProperty(r.prototype,"byteLength",{get:function(){return this.view.byteLength},enumerable:!1,configurable:!0}),r})(),I=Kt;var Xt=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),me=(function(r){Xt(e,r);function e(t){return r.call(this,t)||this}return e.prototype.forEach=function(t){var n=this.length,i=[];i.length=n;for(var s=0;s<n;++s)i[s]=this.get(s);for(var s=0;s<n;++s)t(i[s],s,this)},e.prototype._iterator=function(){return new((function(){function t(n){this.base=n,this.i=0}return t.prototype.next=function(){return this.i===this.base.length?{value:void 0,done:!0}:{value:this.base.get(this.i++),done:!1}},t})())(this)},e})(I);typeof Symbol<"u"&&(me.prototype[Symbol.iterator]=me.prototype._iterator);var q=me;var Zt=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),Qt=(function(r){Zt(e,r);function e(t){var n=r.call(this,t)||this;return n.length=16,n}return e.from=function(t,n){return n===void 0&&(n=0),new e(new DataView(t,n,128))},e.prototype.get=function(t){return{virtualAddress:this.view.getUint32(t*8,!0),size:this.view.getUint32(4+t*8,!0)}},e.prototype.set=function(t,n){this.view.setUint32(t*8,n.virtualAddress,!0),this.view.setUint32(4+t*8,n.size,!0)},e.prototype.findIndexByVirtualAddress=function(t){for(var n=0;n<16;++n){var i=this.view.getUint32(n*8,!0),s=this.view.getUint32(4+n*8,!0);if(t>=i&&t<i+s)return n}return null},e.size=128,e.itemSize=8,e})(q),T=Qt;var Jt={Export:0,Import:1,Resource:2,Exception:3,Certificate:4,Security:4,BaseRelocation:5,Debug:6,Architecture:7,GlobalPointer:8,Tls:9,TLS:9,LoadConfig:10,BoundImport:11,Iat:12,IAT:12,DelayImport:13,ComDescriptor:14,COMDescriptor:14},M=Jt;function K(r){var e={};return Object.keys(r).forEach(function(t){e[t]=r[t]}),e}function X(r,e,t){if("buffer"in r){var n=r.byteOffset,i=r.byteLength;return typeof e<"u"&&(n+=e,i-=e),typeof t<"u"&&(i=t),new DataView(r.buffer,n,i)}else return new DataView(r,e,t)}function ye(r,e){for(var t=E.from(r),n=new DataView(r),i=t.newHeaderAddress+88,s=0,o=4294967296,u=function(_){s+=_,s>=o&&(s=s%o+(s/o|0))},a=n.byteLength,g=a%4,m=a-g,d=0;d<m;d+=4)d!==i&&u(n.getUint32(d,!0));if(g!==0){for(var w=0,d=0;d<g;d++)w|=n.getUint8(m+d)<<(3-d)*8;u(w)}return s=(s&65535)+(s>>>16),s+=s>>>16,s=(s&65535)+a,e&&n.setUint32(i,s,!0),s}function O(r,e){return Math.floor((r+e-1)/e)*e}function Z(r,e,t,n,i){var s="buffer"in r?new Uint8Array(r.buffer,r.byteOffset+(e||0),i):new Uint8Array(r,e,i),o="buffer"in t?new Uint8Array(t.buffer,t.byteOffset+(n||0),i):new Uint8Array(t,n,i);s.set(o)}function Q(r,e,t){var n=new ArrayBuffer(t);return Z(n,0,r,e,t),n}function ue(r){if("buffer"in r){var e=new ArrayBuffer(r.byteLength);return new Uint8Array(e).set(new Uint8Array(r.buffer,r.byteOffset,r.byteLength)),e}else{var e=new ArrayBuffer(r.byteLength);return new Uint8Array(e).set(new Uint8Array(r)),e}}function Xe(r,e,t){for(var n=0,i=0;i<t&&r.getUint8(e+i)!==0;++i)++n;if(typeof Buffer<"u")return Buffer.from(r.buffer,r.byteOffset+e,n).toString("utf8");if(typeof decodeURIComponent<"u"){for(var s="",i=0;i<n;++i){var o=r.getUint8(e+i);o<16?s+="%0"+o.toString(16):s+="%"+o.toString(16)}return decodeURIComponent(s)}else{for(var s="",i=0;i<n;++i){var o=r.getUint8(e+i);s+=String.fromCharCode(o)}return s}}function Ze(r,e,t,n){if(typeof Buffer<"u"){var i=new Uint8Array(r.buffer,r.byteOffset+e,t);i.set(new Uint8Array(t)),i.set(Buffer.from(n,"utf8").subarray(0,t))}else if(typeof encodeURIComponent<"u")for(var s=encodeURIComponent(n),o=0,u=0;o<t;++o)if(u>=s.length)r.setUint8(o+e,0);else{var a=s.charCodeAt(u);if(a===37){var g=parseInt(s.substr(u+1,2),16);typeof g=="number"&&!isNaN(g)?r.setUint8(o+e,g):r.setUint8(o+e,0),u+=3}else r.setUint8(o+e,a)}else for(var o=0,u=0;o<t;++o)if(u>=n.length)r.setUint8(o+e,0);else{var a=n.charCodeAt(u);r.setUint8(o+e,a&255)}}function Qe(r){if(typeof TextDecoder<"u"){var e=new TextDecoder;return e.decode(r)}else if(typeof Buffer<"u"){var t=void 0;return"buffer"in r?t=Buffer.from(r.buffer,r.byteOffset,r.byteLength):t=Buffer.from(r),t.toString("utf8")}else{var n=void 0;if("buffer"in r?n=new Uint8Array(r.buffer,r.byteOffset,r.byteLength):n=new Uint8Array(r),typeof decodeURIComponent<"u"){for(var i="",s=0;s<n.length;++s){var o=n[s];o<16?i+="%0"+o.toString(16):i+="%"+o.toString(16)}return decodeURIComponent(i)}else{for(var i="",s=0;s<n.length;++s){var o=n[s];i+=String.fromCharCode(o)}return i}}}function Je(r){if(typeof TextEncoder<"u"){var e=new TextEncoder;return ue(e.encode(r))}else{if(typeof Buffer<"u")return ue(Buffer.from(r,"utf8"));if(typeof encodeURIComponent<"u"){for(var t=encodeURIComponent(r),n=0,i=0;i<t.length;++n){var s=t.charCodeAt(i);s===37?i+=3:++i}for(var o=new ArrayBuffer(n),u=new Uint8Array(o),i=0,a=0;i<t.length;++a){var s=t.charCodeAt(i);if(s===37){var g=parseInt(t.substring(i+1,i+3),16);u[a]=g,i+=3}else u[a]=s,++i}return o}else{var o=new ArrayBuffer(r.length);return new Uint8Array(o).set([].map.call(r,function(d){return d.charCodeAt(0)})),o}}}var en=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),tn=(function(r){en(e,r);function e(t){return r.call(this,t)||this}return e.from=function(t,n){return n===void 0&&(n=0),new e(X(t,n,64))},e.prototype.isValid=function(){return this.magic===e.DEFAULT_MAGIC},Object.defineProperty(e.prototype,"magic",{get:function(){return this.view.getUint16(0,!0)},set:function(t){this.view.setUint16(0,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"lastPageSize",{get:function(){return this.view.getUint16(2,!0)},set:function(t){this.view.setUint16(2,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"pages",{get:function(){return this.view.getUint16(4,!0)},set:function(t){this.view.setUint16(4,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"relocations",{get:function(){return this.view.getUint16(6,!0)},set:function(t){this.view.setUint16(6,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"headerSizeInParagraph",{get:function(){return this.view.getUint16(8,!0)},set:function(t){this.view.setUint16(8,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minAllocParagraphs",{get:function(){return this.view.getUint16(10,!0)},set:function(t){this.view.setUint16(10,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"maxAllocParagraphs",{get:function(){return this.view.getUint16(12,!0)},set:function(t){this.view.setUint16(12,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"initialSS",{get:function(){return this.view.getUint16(14,!0)},set:function(t){this.view.setUint16(14,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"initialSP",{get:function(){return this.view.getUint16(16,!0)},set:function(t){this.view.setUint16(16,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"checkSum",{get:function(){return this.view.getUint16(18,!0)},set:function(t){this.view.setUint16(18,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"initialIP",{get:function(){return this.view.getUint16(20,!0)},set:function(t){this.view.setUint16(20,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"initialCS",{get:function(){return this.view.getUint16(22,!0)},set:function(t){this.view.setUint16(22,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"relocationTableAddress",{get:function(){return this.view.getUint16(24,!0)},set:function(t){this.view.setUint16(24,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"overlayNum",{get:function(){return this.view.getUint16(26,!0)},set:function(t){this.view.setUint16(26,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"oemId",{get:function(){return this.view.getUint16(36,!0)},set:function(t){this.view.setUint16(36,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"oemInfo",{get:function(){return this.view.getUint16(38,!0)},set:function(t){this.view.setUint16(38,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"newHeaderAddress",{get:function(){return this.view.getUint32(60,!0)},set:function(t){this.view.setUint32(60,t,!0)},enumerable:!1,configurable:!0}),e.size=64,e.DEFAULT_MAGIC=23117,e})(I),E=tn;var nn=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),rn=(function(r){nn(e,r);function e(t){return r.call(this,t)||this}return e.from=function(t,n){return n===void 0&&(n=0),new e(new DataView(t,n,20))},Object.defineProperty(e.prototype,"machine",{get:function(){return this.view.getUint16(0,!0)},set:function(t){this.view.setUint16(0,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"numberOfSections",{get:function(){return this.view.getUint16(2,!0)},set:function(t){this.view.setUint16(2,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"timeDateStamp",{get:function(){return this.view.getUint32(4,!0)},set:function(t){this.view.setUint32(4,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"pointerToSymbolTable",{get:function(){return this.view.getUint32(8,!0)},set:function(t){this.view.setUint32(8,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"numberOfSymbols",{get:function(){return this.view.getUint32(12,!0)},set:function(t){this.view.setUint32(12,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfOptionalHeader",{get:function(){return this.view.getUint16(16,!0)},set:function(t){this.view.setUint16(16,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"characteristics",{get:function(){return this.view.getUint16(18,!0)},set:function(t){this.view.setUint16(18,t,!0)},enumerable:!1,configurable:!0}),e.size=20,e})(I),R=rn;var sn=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),on=(function(r){sn(e,r);function e(t){return r.call(this,t)||this}return e.from=function(t,n){return n===void 0&&(n=0),new e(new DataView(t,n,96))},Object.defineProperty(e.prototype,"magic",{get:function(){return this.view.getUint16(0,!0)},set:function(t){this.view.setUint16(0,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorLinkerVersion",{get:function(){return this.view.getUint8(2)},set:function(t){this.view.setUint8(2,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorLinkerVersion",{get:function(){return this.view.getUint8(3)},set:function(t){this.view.setUint8(3,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfCode",{get:function(){return this.view.getUint32(4,!0)},set:function(t){this.view.setUint32(4,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfInitializedData",{get:function(){return this.view.getUint32(8,!0)},set:function(t){this.view.setUint32(8,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfUninitializedData",{get:function(){return this.view.getUint32(12,!0)},set:function(t){this.view.setUint32(12,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"addressOfEntryPoint",{get:function(){return this.view.getUint32(16,!0)},set:function(t){this.view.setUint32(16,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"baseOfCode",{get:function(){return this.view.getUint32(20,!0)},set:function(t){this.view.setUint32(20,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"baseOfData",{get:function(){return this.view.getUint32(24,!0)},set:function(t){this.view.setUint32(24,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"imageBase",{get:function(){return this.view.getUint32(28,!0)},set:function(t){this.view.setUint32(28,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sectionAlignment",{get:function(){return this.view.getUint32(32,!0)},set:function(t){this.view.setUint32(32,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"fileAlignment",{get:function(){return this.view.getUint32(36,!0)},set:function(t){this.view.setUint32(36,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorOperatingSystemVersion",{get:function(){return this.view.getUint16(40,!0)},set:function(t){this.view.setUint16(40,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorOperatingSystemVersion",{get:function(){return this.view.getUint16(42,!0)},set:function(t){this.view.setUint16(42,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorImageVersion",{get:function(){return this.view.getUint16(44,!0)},set:function(t){this.view.setUint16(44,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorImageVersion",{get:function(){return this.view.getUint16(46,!0)},set:function(t){this.view.setUint16(46,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorSubsystemVersion",{get:function(){return this.view.getUint16(48,!0)},set:function(t){this.view.setUint16(48,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorSubsystemVersion",{get:function(){return this.view.getUint16(50,!0)},set:function(t){this.view.setUint16(50,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"win32VersionValue",{get:function(){return this.view.getUint32(52,!0)},set:function(t){this.view.setUint32(52,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfImage",{get:function(){return this.view.getUint32(56,!0)},set:function(t){this.view.setUint32(56,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeaders",{get:function(){return this.view.getUint32(60,!0)},set:function(t){this.view.setUint32(60,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"checkSum",{get:function(){return this.view.getUint32(64,!0)},set:function(t){this.view.setUint32(64,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"subsystem",{get:function(){return this.view.getUint16(68,!0)},set:function(t){this.view.setUint16(68,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"dllCharacteristics",{get:function(){return this.view.getUint16(70,!0)},set:function(t){this.view.setUint16(70,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackReserve",{get:function(){return this.view.getUint32(72,!0)},set:function(t){this.view.setUint32(72,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackCommit",{get:function(){return this.view.getUint32(76,!0)},set:function(t){this.view.setUint32(76,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapReserve",{get:function(){return this.view.getUint32(80,!0)},set:function(t){this.view.setUint32(80,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapCommit",{get:function(){return this.view.getUint32(84,!0)},set:function(t){this.view.setUint32(84,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"loaderFlags",{get:function(){return this.view.getUint32(88,!0)},set:function(t){this.view.setUint32(88,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"numberOfRvaAndSizes",{get:function(){return this.view.getUint32(92,!0)},set:function(t){this.view.setUint32(92,t,!0)},enumerable:!1,configurable:!0}),e.size=96,e.DEFAULT_MAGIC=267,e})(I),P=on;var an=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})();function J(r,e){return r.getUint32(e+4,!0)*4294967296+r.getUint32(e,!0)}function ee(r,e,t){r.setUint32(e,t&4294967295,!0),r.setUint32(e+4,Math.floor(t/4294967296),!0)}function te(r,e){if(typeof BigInt>"u")throw new Error("BigInt not supported");return BigInt(4294967296)*BigInt(r.getUint32(e+4,!0))+BigInt(r.getUint32(e,!0))}function ne(r,e,t){if(typeof BigInt>"u")throw new Error("BigInt not supported");r.setUint32(e,Number(t&BigInt(4294967295)),!0),r.setUint32(e+4,Math.floor(Number(t/BigInt(4294967296)&BigInt(4294967295))),!0)}var un=(function(r){an(e,r);function e(t){return r.call(this,t)||this}return e.from=function(t,n){return n===void 0&&(n=0),new e(new DataView(t,n,112))},Object.defineProperty(e.prototype,"magic",{get:function(){return this.view.getUint16(0,!0)},set:function(t){this.view.setUint16(0,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorLinkerVersion",{get:function(){return this.view.getUint8(2)},set:function(t){this.view.setUint8(2,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorLinkerVersion",{get:function(){return this.view.getUint8(3)},set:function(t){this.view.setUint8(3,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfCode",{get:function(){return this.view.getUint32(4,!0)},set:function(t){this.view.setUint32(4,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfInitializedData",{get:function(){return this.view.getUint32(8,!0)},set:function(t){this.view.setUint32(8,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfUninitializedData",{get:function(){return this.view.getUint32(12,!0)},set:function(t){this.view.setUint32(12,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"addressOfEntryPoint",{get:function(){return this.view.getUint32(16,!0)},set:function(t){this.view.setUint32(16,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"baseOfCode",{get:function(){return this.view.getUint32(20,!0)},set:function(t){this.view.setUint32(20,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"imageBase",{get:function(){return J(this.view,24)},set:function(t){ee(this.view,24,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"imageBaseBigInt",{get:function(){return te(this.view,24)},set:function(t){ne(this.view,24,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sectionAlignment",{get:function(){return this.view.getUint32(32,!0)},set:function(t){this.view.setUint32(32,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"fileAlignment",{get:function(){return this.view.getUint32(36,!0)},set:function(t){this.view.setUint32(36,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorOperatingSystemVersion",{get:function(){return this.view.getUint16(40,!0)},set:function(t){this.view.setUint16(40,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorOperatingSystemVersion",{get:function(){return this.view.getUint16(42,!0)},set:function(t){this.view.setUint16(42,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorImageVersion",{get:function(){return this.view.getUint16(44,!0)},set:function(t){this.view.setUint16(44,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorImageVersion",{get:function(){return this.view.getUint16(46,!0)},set:function(t){this.view.setUint16(46,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"majorSubsystemVersion",{get:function(){return this.view.getUint16(48,!0)},set:function(t){this.view.setUint16(48,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"minorSubsystemVersion",{get:function(){return this.view.getUint16(50,!0)},set:function(t){this.view.setUint16(50,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"win32VersionValue",{get:function(){return this.view.getUint32(52,!0)},set:function(t){this.view.setUint32(52,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfImage",{get:function(){return this.view.getUint32(56,!0)},set:function(t){this.view.setUint32(56,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeaders",{get:function(){return this.view.getUint32(60,!0)},set:function(t){this.view.setUint32(60,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"checkSum",{get:function(){return this.view.getUint32(64,!0)},set:function(t){this.view.setUint32(64,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"subsystem",{get:function(){return this.view.getUint16(68,!0)},set:function(t){this.view.setUint16(68,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"dllCharacteristics",{get:function(){return this.view.getUint16(70,!0)},set:function(t){this.view.setUint16(70,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackReserve",{get:function(){return J(this.view,72)},set:function(t){ee(this.view,72,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackReserveBigInt",{get:function(){return te(this.view,72)},set:function(t){ne(this.view,72,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackCommit",{get:function(){return J(this.view,80)},set:function(t){ee(this.view,80,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfStackCommitBigInt",{get:function(){return te(this.view,80)},set:function(t){ne(this.view,80,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapReserve",{get:function(){return J(this.view,88)},set:function(t){ee(this.view,88,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapReserveBigInt",{get:function(){return te(this.view,88)},set:function(t){ne(this.view,88,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapCommit",{get:function(){return J(this.view,96)},set:function(t){ee(this.view,96,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"sizeOfHeapCommitBigInt",{get:function(){return te(this.view,96)},set:function(t){ne(this.view,96,t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"loaderFlags",{get:function(){return this.view.getUint32(104,!0)},set:function(t){this.view.setUint32(104,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"numberOfRvaAndSizes",{get:function(){return this.view.getUint32(108,!0)},set:function(t){this.view.setUint32(108,t,!0)},enumerable:!1,configurable:!0}),e.size=112,e.DEFAULT_MAGIC=523,e})(I),z=un;var fn=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),ln=(function(r){fn(e,r);function e(t){return r.call(this,t)||this}return e.from=function(t,n){n===void 0&&(n=0);var i=X(t,n+R.size,6).getUint16(4,!0),s=4+R.size+T.size;return i===z.DEFAULT_MAGIC?s+=z.size:s+=P.size,new e(X(t,n,s))},e.prototype.isValid=function(){return this.signature===e.DEFAULT_SIGNATURE},e.prototype.is32bit=function(){return this.view.getUint16(R.size+4,!0)===P.DEFAULT_MAGIC},Object.defineProperty(e.prototype,"signature",{get:function(){return this.view.getUint32(0,!0)},set:function(t){this.view.setUint32(0,t,!0)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"fileHeader",{get:function(){return R.from(this.view.buffer,this.view.byteOffset+4)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"optionalHeader",{get:function(){var t=R.size+4,n=this.view.getUint16(t,!0);return n===z.DEFAULT_MAGIC?z.from(this.view.buffer,this.view.byteOffset+t):P.from(this.view.buffer,this.view.byteOffset+t)},enumerable:!1,configurable:!0}),Object.defineProperty(e.prototype,"optionalHeaderDataDirectory",{get:function(){return T.from(this.view.buffer,this.view.byteOffset+this.getDataDirectoryOffset())},enumerable:!1,configurable:!0}),e.prototype.getDataDirectoryOffset=function(){var t=R.size+4,n=this.view.getUint16(t,!0);return n===z.DEFAULT_MAGIC?t+=z.size:t+=P.size,t},e.prototype.getSectionHeaderOffset=function(){return this.getDataDirectoryOffset()+T.size},e.DEFAULT_SIGNATURE=17744,e})(I),W=ln;var cn=(function(){var r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,i){n.__proto__=i}||function(n,i){for(var s in i)Object.prototype.hasOwnProperty.call(i,s)&&(n[s]=i[s])},r(e,t)};return function(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");r(e,t);function n(){this.constructor=e}e.prototype=t===null?Object.create(t):(n.prototype=t.prototype,new n)}})(),hn=(function(r){cn(e,r);function e(t,n){var i=r.call(this,t)||this;return i.length=n,i}return e.from=function(t,n,i){i===void 0&&(i=0);var s=n*40;return new e(new DataView(t,i,s),n)},e.prototype.get=function(t){return{name:Xe(this.view,t*40,8),virtualSize:this.view.getUint32(8+t*40,!0),virtualAddress:this.view.getUint32(12+t*40,!0),sizeOfRawData:this.view.getUint32(16+t*40,!0),pointerToRawData:this.view.getUint32(20+t*40,!0),pointerToRelocations:this.view.getUint32(24+t*40,!0),pointerToLineNumbers:this.view.getUint32(28+t*40,!0),numberOfRelocations:this.view.getUint16(32+t*40,!0),numberOfLineNumbers:this.view.getUint16(34+t*40,!0),characteristics:this.view.getUint32(36+t*40,!0)}},e.prototype.set=function(t,n){Ze(this.view,t*40,8,n.name),this.view.setUint32(8+t*40,n.virtualSize,!0),this.view.setUint32(12+t*40,n.virtualAddress,!0),this.view.setUint32(16+t*40,n.sizeOfRawData,!0),this.view.setUint32(20+t*40,n.pointerToRawData,!0),this.view.setUint32(24+t*40,n.pointerToRelocations,!0),this.view.setUint32(28+t*40,n.pointerToLineNumbers,!0),this.view.setUint16(32+t*40,n.numberOfRelocations,!0),this.view.setUint16(34+t*40,n.numberOfLineNumbers,!0),this.view.setUint32(36+t*40,n.characteristics,!0)},e.itemSize=40,e})(q),F=hn;function pn(r){return E.from(r)}function gn(r,e){return W.from(r,e.newHeaderAddress)}function dn(r,e,t){return F.from(r,t.fileHeader.numberOfSections,e.newHeaderAddress+t.byteLength)}function mn(r,e,t,n){for(var i=F.from(r,t.fileHeader.numberOfSections,e.newHeaderAddress+t.byteLength),s=i.length,o=t.optionalHeaderDataDirectory.get(n).virtualAddress,u=0;u<s;++u){var a=i.get(u),g=a.virtualAddress+a.virtualSize;if(o>=a.virtualAddress&&o<g){var m=a.pointerToRawData;return m?r.slice(m,m+a.sizeOfRawData):null}if(o<a.virtualAddress)return null}return null}var we=new Uint8Array([14,31,186,14,0,180,9,205,33,184,1,76,205,33,68,79,83,32,109,111,100,101,32,110,111,116,32,115,117,112,112,111,114,116,101,100,46,13,13,10,36,0,0,0,0,0,0,0]),re=O(E.size+we.length,128),et=512;function yn(r){var e=E.from(r);e.magic=E.DEFAULT_MAGIC,e.lastPageSize=re%512,e.pages=Math.ceil(re/512),e.relocations=0,e.headerSizeInParagraph=Math.ceil(E.size/16),e.minAllocParagraphs=0,e.maxAllocParagraphs=65535,e.initialSS=0,e.initialSP=128,e.relocationTableAddress=E.size,e.newHeaderAddress=re,Z(r,E.size,we,0,we.length)}function wn(r){return 4+R.size+(r?P.size:z.size)+T.size}function vn(r,e,t,n,i){var s,o;"buffer"in r?(s=r.buffer,o=r.byteOffset+e):(s=r,o=e),new DataView(s,o).setUint32(0,W.DEFAULT_SIGNATURE,!0);var u=R.from(s,o+4);u.machine=n?332:34404,u.numberOfSections=0,u.timeDateStamp=0,u.pointerToSymbolTable=0,u.numberOfSymbols=0,u.sizeOfOptionalHeader=(n?P.size:z.size)+T.size,u.characteristics=i?8450:258;var a=(n?P:z).from(s,o+4+R.size);a.magic=n?P.DEFAULT_MAGIC:z.DEFAULT_MAGIC,a.sizeOfCode=0,a.sizeOfInitializedData=0,a.sizeOfUninitializedData=0,a.addressOfEntryPoint=0,a.baseOfCode=4096,a.imageBase=n?16777216:6442450944,a.sectionAlignment=4096,a.fileAlignment=et,a.majorOperatingSystemVersion=6,a.minorOperatingSystemVersion=0,a.majorSubsystemVersion=6,a.minorSubsystemVersion=0,a.sizeOfHeaders=O(t,a.fileAlignment),a.subsystem=2,a.dllCharacteristics=(n?0:32)+64+256,a.sizeOfStackReserve=1048576,a.sizeOfStackCommit=4096,a.sizeOfHeapReserve=1048576,a.sizeOfHeapCommit=4096,a.numberOfRvaAndSizes=T.size/T.itemSize}function tt(r,e){var t=O(re+wn(r),et),n=new ArrayBuffer(t);return yn(n),vn(n,re,t,r,e),n}var bn=(function(){function r(e,t,n){this._headers=e,this._sections=t,this._ex=n;var i=E.from(e),s=W.from(e,i.newHeaderAddress);this._dh=i,this._nh=s,this._dda=s.optionalHeaderDataDirectory,t.sort(function(o,u){var a=o.info.pointerToRawData,g=o.info.pointerToRawData;if(a!==g)return a-g;var m=o.info.virtualAddress,d=u.info.virtualAddress;return m===d?o.info.virtualSize-u.info.virtualSize:m-d})}return r.createEmpty=function(e,t){return e===void 0&&(e=!1),t===void 0&&(t=!0),this.from(tt(e,t))},r.from=function(e,t){var n=E.from(e),i=W.from(e,n.newHeaderAddress);if(!n.isValid()||!i.isValid())throw new TypeError("Invalid binary format");if(i.fileHeader.numberOfSymbols>0)throw new Error("Binary with symbols is not supported now");var s=i.optionalHeader.fileAlignment,o=i.optionalHeaderDataDirectory.get(M.Certificate);if(o.size>0&&!t?.ignoreCert)throw new Error("Parsing signed executable binary is not allowed by default.");var u=n.newHeaderAddress+i.getSectionHeaderOffset(),a=i.fileHeader.numberOfSections,g=[],m=Q(e,u,a*F.itemSize),d=F.from(m,a,0),w=O(u+a*F.itemSize,s);d.forEach(function(b){if(!b.pointerToRawData||!b.sizeOfRawData)b.pointerToRawData=0,b.sizeOfRawData=0,g.push({info:b,data:null});else{var y=Q(e,b.pointerToRawData,b.sizeOfRawData);g.push({info:b,data:y});var c=O(b.pointerToRawData+b.sizeOfRawData,s);c>w&&(w=c)}});var _=Q(e,0,u),v=null,U=e.byteLength;return o.size>0&&(U=o.virtualAddress),w<U&&(v=Q(e,w,U-w)),new r(_,g,v)},r.prototype.is32bit=function(){return this._nh.is32bit()},r.prototype.getTotalHeaderSize=function(){return this._headers.byteLength},Object.defineProperty(r.prototype,"dosHeader",{get:function(){return this._dh},enumerable:!1,configurable:!0}),Object.defineProperty(r.prototype,"newHeader",{get:function(){return this._nh},enumerable:!1,configurable:!0}),r.prototype.getRawHeader=function(){return this._headers},r.prototype.getImageBase=function(){return this._nh.optionalHeader.imageBase},r.prototype.getFileAlignment=function(){return this._nh.optionalHeader.fileAlignment},r.prototype.getSectionAlignment=function(){return this._nh.optionalHeader.sectionAlignment},r.prototype.getAllSections=function(){return this._sections},r.prototype.getSectionByEntry=function(e){var t=this._dda.get(e),n=this._sections.filter(function(i){var s=i.info.virtualAddress+i.info.virtualSize;return t.virtualAddress>=i.info.virtualAddress&&t.virtualAddress<s}).shift();return n!==void 0?n:null},r.prototype.setSectionByEntry=function(e,t){var n=t?{data:t.data,info:t.info}:null,i=this._dda.get(e),s=i.size>0;if(n){var d=n.data?n.data.byteLength:0,w=this._nh.optionalHeader.fileAlignment,_=this._nh.optionalHeader.sectionAlignment,v=n.data?O(d,w):0,U=n.data?O(n.info.virtualSize,_):0;if(n.info.sizeOfRawData<v?n.info.sizeOfRawData=v:v=n.info.sizeOfRawData,s)this.replaceSectionImpl(i.virtualAddress,n.info,n.data);else{var b=0,y=O(this._headers.byteLength,w);this._sections.forEach(function(c){c.info.pointerToRawData&&y<=c.info.pointerToRawData&&(y=c.info.pointerToRawData+c.info.sizeOfRawData),b<=c.info.virtualAddress&&(b=c.info.virtualAddress+c.info.virtualSize)}),v||(y=0),b||(b=this.newHeader.optionalHeader.baseOfCode),b=O(b,_),n.info.pointerToRawData=y,n.info.virtualAddress=b,this._dda.set(e,{size:d,virtualAddress:b}),this._sections.push(n),this._nh.fileHeader.numberOfSections=this._sections.length,this._nh.optionalHeader.sizeOfImage=O(b+U,this._nh.optionalHeader.sectionAlignment)}}else if(s){this._dda.set(e,{size:0,virtualAddress:0});for(var o=this._sections.length,u=0;u<o;++u){var a=this._sections[u],g=a.info.virtualAddress,m=g+a.info.virtualSize;if(i.virtualAddress>=g&&i.virtualAddress<m){this._sections.splice(u,1),this._nh.fileHeader.numberOfSections=this._sections.length;break}}}},r.prototype.getExtraData=function(){return this._ex},r.prototype.setExtraData=function(e){e===null?this._ex=null:this._ex=ue(e)},r.prototype.generate=function(e){var t=this._dh,n=this._nh,i=t.newHeaderAddress+n.getSectionHeaderOffset(),s=i;s+=this._sections.length*F.itemSize;var o=n.optionalHeader.fileAlignment;s=O(s,o),this._sections.forEach(function(d){if(d.info.pointerToRawData){var w=d.info.pointerToRawData+d.info.sizeOfRawData;s<w&&(s=w,s=O(s,o))}});var u=s;this._ex!==null&&(s+=this._ex.byteLength),typeof e=="number"&&(s+=e);var a=new ArrayBuffer(s),g=new Uint8Array(a);g.set(new Uint8Array(this._headers,0,i)),T.from(a,t.newHeaderAddress+n.getDataDirectoryOffset()).set(M.Certificate,{size:0,virtualAddress:0});var m=F.from(a,this._sections.length,i);return this._sections.forEach(function(d,w){d.data||(d.info.pointerToRawData=0,d.info.sizeOfRawData=0),m.set(w,d.info),!(!d.data||!d.info.pointerToRawData)&&g.set(new Uint8Array(d.data),d.info.pointerToRawData)}),this._ex!==null&&g.set(new Uint8Array(this._ex),u),n.optionalHeader.checkSum!==0&&ye(a,!0),a},r.prototype.rearrangeSections=function(e,t,n,i){if(!(!t&&!i)){for(var s=this._nh,o=s.optionalHeader.sectionAlignment,u=this._dda,a=this._sections.length,g=0,m=0;m<a;++m){var d=this._sections[m],w=d.info.virtualAddress;if(i&&w>=n){var _=u.findIndexByVirtualAddress(w);w+=i,_!==null&&u.set(_,{virtualAddress:w,size:d.info.virtualSize}),d.info.virtualAddress=w}var v=d.info.pointerToRawData;t&&v>=e&&(d.info.pointerToRawData=v+t),g=O(d.info.virtualAddress+d.info.virtualSize,o)}s.optionalHeader.sizeOfImage=g}},r.prototype.replaceSectionImpl=function(e,t,n){for(var i=this._sections.length,s=0;s<i;++s){var o=this._sections[s];if(o.info.virtualAddress===e){var u=this._nh.optionalHeader.sectionAlignment,a=o.info.pointerToRawData,g=a+o.info.sizeOfRawData,m=e+O(o.info.virtualSize,u);o.info=K(t),o.info.virtualAddress=e,o.info.pointerToRawData=a,o.data=n;var d=a+t.sizeOfRawData,w=e+O(t.virtualSize,u);this.rearrangeSections(g,d-g,m,w-m);{var _=this._dda,v=_.findIndexByVirtualAddress(e);v!==null&&_.set(v,{virtualAddress:e,size:t.virtualSize})}break}}},r})(),ve=bn;function _n(r){return r.reduce(function(e,t){return e.indexOf(t)>=0?e:e.concat(t)},[])}function be(r,e){var t=r.getUint16(e,!0),n="";e+=2;for(var i=0;i<t;++i)n+=String.fromCharCode(r.getUint16(e,!0)),e+=2;return n}function nt(r,e,t,n,i){var s=n,o={name:t,languageTable:n,characteristics:r.getUint32(s,!0),dateTime:r.getUint32(s+4,!0),majorVersion:r.getUint16(s+8,!0),minorVersion:r.getUint16(s+10,!0)},u=r.getUint16(s+12,!0),a=r.getUint16(s+14,!0);s+=16;for(var g=0;g<u;++g){var m=r.getUint32(s,!0)&2147483647,d=r.getUint32(s+4,!0);if((d&2147483648)!==0){s+=8;continue}var w=be(r,m);i(e,o,{lang:w,dataOffset:d}),s+=8}for(var g=0;g<a;++g){var _=r.getUint32(s,!0)&2147483647,d=r.getUint32(s+4,!0);if((d&2147483648)!==0){s+=8;continue}i(e,o,{lang:_,dataOffset:d}),s+=8}}function rt(r,e,t,n){var i=t,s={type:e,nameTable:t,characteristics:r.getUint32(i,!0),dateTime:r.getUint32(i+4,!0),majorVersion:r.getUint16(i+8,!0),minorVersion:r.getUint16(i+10,!0)},o=r.getUint16(i+12,!0),u=r.getUint16(i+14,!0);i+=16;for(var a=0;a<o;++a){var g=r.getUint32(i,!0)&2147483647,m=r.getUint32(i+4,!0);if(!(m&2147483648)){i+=8;continue}m&=2147483647;var d=be(r,g);nt(r,s,d,m,n),i+=8}for(var a=0;a<u;++a){var w=r.getUint32(i,!0)&2147483647,m=r.getUint32(i+4,!0);if(!(m&2147483648)){i+=8;continue}m&=2147483647,nt(r,s,w,m,n),i+=8}}function it(r,e,t){var n={},i={};t.forEach(function(u){typeof u.lang=="string"?(n[u.lang]=u,e.push(u.lang)):i[u.lang]=u});var s=Object.keys(n);s.sort().forEach(function(u){r.s.push(n[u])});var o=Object.keys(i);return o.map(function(u){return Number(u)}).sort(function(u,a){return u-a}).forEach(function(u){r.n.push(i[u])}),16+8*(s.length+o.length)}function st(r,e,t){var n={},i={};t.forEach(function(u){var a,g;if(typeof u.id=="string"){var m=(a=n[u.id])!==null&&a!==void 0?a:n[u.id]=[];e.push(u.id),m.push(u)}else{var m=(g=i[u.id])!==null&&g!==void 0?g:i[u.id]=[];m.push(u)}});var s=Object.keys(n).sort().map(function(u){var a={id:u,s:[],n:[]};return r.s.push(a),it(a,e,n[u])}).reduce(function(u,a){return u+8+a},0),o=Object.keys(i).map(function(u){return Number(u)}).sort(function(u,a){return u-a}).map(function(u){var a={id:u,s:[],n:[]};return r.n.push(a),it(a,e,i[u])}).reduce(function(u,a){return u+8+a},0);return 16+s+o}function Un(r,e,t){var n={},i={};t.forEach(function(u){var a,g;if(typeof u.type=="string"){var m=(a=n[u.type])!==null&&a!==void 0?a:n[u.type]=[];e.push(u.type),m.push(u)}else{var m=(g=i[u.type])!==null&&g!==void 0?g:i[u.type]=[];m.push(u)}});var s=Object.keys(n).sort().map(function(u){var a={type:u,s:[],n:[]};return r.s.push(a),st(a,e,n[u])}).reduce(function(u,a){return u+8+a},0),o=Object.keys(i).map(function(u){return Number(u)}).sort(function(u,a){return u-a}).map(function(u){var a={type:u,s:[],n:[]};return r.n.push(a),st(a,e,i[u])}).reduce(function(u,a){return u+8+a},0);return 16+s+o}function ut(r){var e=r.length;return e>65535?65535:e}function _e(r,e){for(var t=e.length,n=0;n<t;++n){var i=e[n];if(i.text===r)return i.offset}throw new Error("Unexpected")}function An(r,e,t){var n=ut(t);r.setUint16(e,n,!0),e+=2;for(var i=0;i<n;++i)r.setUint16(e,t.charCodeAt(i),!0),e+=2;return e}function ot(r,e,t,n){return r.setUint32(e,0,!0),r.setUint32(e+4,0,!0),r.setUint32(e+8,0,!0),r.setUint16(e+12,n.s.length,!0),r.setUint16(e+14,n.n.length,!0),e+=16,n.s.forEach(function(i){var s=_e(i.lang,t);r.setUint32(e,s,!0),r.setUint32(e+4,i.offset,!0),e+=8}),n.n.forEach(function(i){r.setUint32(e,i.lang,!0),r.setUint32(e+4,i.offset,!0),e+=8}),e}function at(r,e,t,n,i){return r.setUint32(e,0,!0),r.setUint32(e+4,0,!0),r.setUint32(e+8,0,!0),r.setUint16(e+12,i.s.length,!0),r.setUint16(e+14,i.n.length,!0),e+=16,i.s.forEach(function(s){s.offset=t,t=ot(r,t,n,s)}),i.n.forEach(function(s){s.offset=t,t=ot(r,t,n,s)}),i.s.forEach(function(s){var o=_e(s.id,n);r.setUint32(e,o+2147483648,!0),r.setUint32(e+4,s.offset+2147483648,!0),e+=8}),i.n.forEach(function(s){r.setUint32(e,s.id,!0),r.setUint32(e+4,s.offset+2147483648,!0),e+=8}),t}function xn(r,e,t,n){r.setUint32(e,0,!0),r.setUint32(e+4,0,!0),r.setUint32(e+8,0,!0),r.setUint16(e+12,n.s.length,!0),r.setUint16(e+14,n.n.length,!0),e+=16;var i=e+8*(n.s.length+n.n.length);return n.s.forEach(function(s){s.offset=i,i+=16+8*(s.s.length+s.n.length)}),n.n.forEach(function(s){s.offset=i,i+=16+8*(s.s.length+s.n.length)}),n.s.forEach(function(s){var o=_e(s.type,t);r.setUint32(e,o+2147483648,!0),r.setUint32(e+4,s.offset+2147483648,!0),e+=8,i=at(r,s.offset,i,t,s)}),n.n.forEach(function(s){r.setUint32(e,s.type,!0),r.setUint32(e+4,s.offset+2147483648,!0),e+=8,i=at(r,s.offset,i,t,s)}),i}var hi=(function(){function r(){this.dateTime=0,this.majorVersion=0,this.minorVersion=0,this.entries=[],this.sectionDataHeader=null,this.originalSize=0}return r.prototype.parse=function(e,t){if(e.data){var n=new DataView(e.data);this.dateTime=n.getUint32(4,!0),this.majorVersion=n.getUint16(8,!0),this.minorVersion=n.getUint16(10,!0);for(var i=n.getUint16(12,!0),s=n.getUint16(14,!0),o=16,u=[],a=function(v,U,b){var y=n.getUint32(b.dataOffset,!0)-e.info.virtualAddress,c=n.getUint32(b.dataOffset+4,!0),l=n.getUint32(b.dataOffset+8,!0);if(y>=0){var f=new Uint8Array(c);f.set(new Uint8Array(e.data,y,c)),u.push({type:v.type,id:U.name,lang:b.lang,codepage:l,bin:f.buffer})}else{if(!t)throw new Error("Cannot parse resource directory entry; RVA seems to be invalid.");u.push({type:v.type,id:U.name,lang:b.lang,codepage:l,bin:new ArrayBuffer(0),rva:b.dataOffset})}},g=0;g<i;++g){var m=n.getUint32(o,!0)&2147483647,d=n.getUint32(o+4,!0);if(!(d&2147483648)){o+=8;continue}d&=2147483647;var w=be(n,m);rt(n,w,d,a),o+=8}for(var g=0;g<s;++g){var _=n.getUint32(o,!0)&2147483647,d=n.getUint32(o+4,!0);if(!(d&2147483648)){o+=8;continue}d&=2147483647,rt(n,_,d,a),o+=8}this.entries=u,this.originalSize=e.data.byteLength}},r.from=function(e,t){t===void 0&&(t=!1);var n=[].concat(e.getAllSections()).sort(function(m,d){return m.info.virtualAddress-d.info.virtualAddress}),i=e.getSectionByEntry(M.Resource);if(i)for(var s=e.getSectionByEntry(M.BaseRelocation),o=0;o<n.length;++o){var u=n[o];if(u===i){for(var a=o+1;a<n.length;++a)if(!s||n[a]!==s)throw new Error("After Resource section, sections except for relocation are not supported");break}}var g=new r;return g.sectionDataHeader=i?K(i.info):null,i&&g.parse(i,t),g},r.prototype.replaceResourceEntry=function(e){for(var t=this.entries.length,n=0;n<t;++n){var i=this.entries[n];if(i.type===e.type&&i.id===e.id&&i.lang===e.lang){this.entries[n]=e;return}}this.entries.push(e)},r.prototype.getResourceEntriesAsString=function(e,t){return this.entries.filter(function(n){return n.type===e&&n.id===t}).map(function(n){return[n.lang,Qe(n.bin)]})},r.prototype.replaceResourceEntryFromString=function(e,t,n,i){var s={type:e,id:t,lang:n,codepage:1200,bin:Je(i)};this.replaceResourceEntry(s)},r.prototype.removeResourceEntry=function(e,t,n){this.entries=this.entries.filter(function(i){return!(i.type===e&&i.id===t&&(typeof n>"u"||i.lang===n))})},r.prototype.generateResourceData=function(e,t,n,i){n===void 0&&(n=!1),i===void 0&&(i=!1);var s={s:[],n:[]},o=[],u=Un(s,o,this.entries);o=_n(o);var a=u;u+=o.reduce(function(h,p){return h+2+ut(p)*2},0),u=O(u,8);var g=u;u=this.entries.reduce(function(h,p){return p.offset=h,h+16},g);var m=u;u=this.entries.reduce(function(h,p){return O(h,8)+p.bin.byteLength},m);var d=O(u,t),w=O(this.originalSize,t);if(n&&d>w)throw new Error("New resource data is larger than original");i||d<w&&(d=w);var _=new ArrayBuffer(d),v=new DataView(_),U=g,b=e+m;this.entries.forEach(function(h){var p=h.bin.byteLength;typeof h.rva<"u"?v.setUint32(U,h.rva,!0):(b=O(b,8),v.setUint32(U,b,!0),b+=p),v.setUint32(U+4,p,!0),v.setUint32(U+8,h.codepage,!0),v.setUint32(U+12,0,!0),U+=16}),U=m,this.entries.forEach(function(h){var p=h.bin.byteLength;Z(_,U,h.bin,0,p),U+=O(p,8)});var y=[];if(U=a,o.forEach(function(h){y.push({offset:U,text:h}),U=An(v,U,h)}),xn(v,0,y,s),d>u)for(var c="PADDINGX",l=u,f=0;l<d;++l,++f)f===8&&(f=0),v.setUint8(l,c.charCodeAt(f));return{bin:_,rawSize:u,dataOffset:m,descEntryOffset:g,descEntryCount:this.entries.length}},r.prototype.outputResource=function(e,t,n){t===void 0&&(t=!1),n===void 0&&(n=!1);var i=e.getFileAlignment(),s;this.sectionDataHeader?s={data:null,info:K(this.sectionDataHeader)}:s={data:null,info:{name:".rsrc",virtualSize:0,virtualAddress:0,sizeOfRawData:0,pointerToRawData:0,pointerToRelocations:0,pointerToLineNumbers:0,numberOfRelocations:0,numberOfLineNumbers:0,characteristics:1073741888}};var o=this.generateResourceData(0,i,t,n);s.data=o.bin,s.info.sizeOfRawData=o.bin.byteLength,s.info.virtualSize=o.rawSize,e.setSectionByEntry(M.Resource,s);for(var u=e.getSectionByEntry(M.Resource),a=new DataView(u.data),g=o.descEntryOffset,m=u.info.virtualAddress+o.dataOffset,d=0;d<o.descEntryCount;++d){var w=a.getUint32(g+4,!0);m=O(m,8),a.setUint32(g,m,!0),m+=w,g+=16}},r})();var ht=Et(ct(),1),Sn=typeof crypto<"u",En=typeof globalThis.process<"u"&&globalThis.process.versions&&globalThis.process.versions.node;function Cn(){if(Sn)return crypto;if(En)return globalThis.crypto;throw new Error("Crypto API not available in this environment")}function le(r){let e=new Uint32Array(256);for(let i=0;i<r.length;i++)e[r[i]]++;let t=0,n=r.length;if(n===0)return 0;for(let i=0;i<256;i++){if(e[i]===0)continue;let s=e[i]/n;t-=s*Math.log2(s)}return t}function In(r){return Array.from(r).map(e=>e.toString(16).padStart(2,"0")).join("")}async function $(r,e){let n=await Cn().subtle.digest(r,e);return In(new Uint8Array(n))}function B(r){let e=new ht.default.ArrayBuffer;return e.append(r.buffer.slice(r.byteOffset,r.byteOffset+r.byteLength)),e.end()}function D(r,e,t){return r.getUint16(e,t)}function S(r,e,t){return r.getUint32(e,t)}function N(r,e,t){let n=r.getUint32(e+(t?0:4),t);return r.getUint32(e+(t?4:0),t)*2**32+n}function k(r,e,t=1024){let n=Math.min(r.length,e+t),i="";for(let s=e;s<n&&r[s]!==0;s++)i+=String.fromCharCode(r[s]);return i}function pt(r,e){let t=r.length,n=e.length;for(let i=0;i<=t-n;i++){let s=!0;for(let o=0;o<n;o++)if(r[i+o]!==e[o]){s=!1;break}if(s)return i}return-1}async function zn(r,e){let t=[],n=r.getAllSections?.()||r.sections||[];for(let i of n){let s=i.info||i,o=i.data?new Uint8Array(i.data):i.data??new Uint8Array,u=B(o),a=await $("SHA-1",o),g=await $("SHA-256",o),m={md5:u,sha1:a,sha256:g};t.push({name:(s.name||i.name||"")?.replace(/\0.*$/,""),raw_data:o,entropy:le(o),virtual_address:s.virtualAddress??s.VirtualAddress??i.VirtualAddress??0,virtual_size:s.virtualSize??s.VirtualSize??i.VirtualSize??0,raw_data_offset:s.pointerToRawData??s.PointerToRawData??i.PointerToRawData??0,raw_data_size:s.sizeOfRawData??s.SizeOfRawData??i.SizeOfRawData??0,characteristics:(s.characteristics??s.Characteristics??i.Characteristics??0)>>>0,...m})}return t}function Tn(r){return(r.imports||[]).map(e=>({dll:e.name||"",functions:(e.functions||[]).map(t=>({name:t.name||null,ordinal:t.ordinal||null}))}))}function Rn(r){return(r.exports||[]).map(e=>e.name||e).filter(Boolean)}function $n(r){let e=[];for(let n of r){let i=(n.dll||"").toLowerCase();if(Array.isArray(n.functions))for(let s of n.functions){let o=(s.name||`ordinal${s.ordinal||""}`).toLowerCase();e.push(`${i}.${o}`)}}let t=new TextEncoder;return B(t.encode(e.join(",")))}function Dn(r){let e=r.optionalHeader?.dataDirectory?.[fe.ImageDirectoryEntry.Security];return!e||!e.virtualAddress||!e.size?{has_signature:!1}:{has_signature:!0,certificate_table:{offset:e.virtualAddress,size:e.size}}}function Nn(r){let e=new Uint8Array([82,105,99,104]),t=pt(r,e);return t!==-1?{offset:t}:null}function Pn(r){let e=r.newHeader?.optionalHeader||r.optionalHeader;return e?{size_of_code:e.sizeOfCode??0,size_of_initialized_data:e.sizeOfInitializedData??0,size_of_uninitialized_data:e.sizeOfUninitializedData??0,address_of_entry_point:e.addressOfEntryPoint??0,base_of_code:e.baseOfCode??0,base_of_data:e.baseOfData??0,image_base:e.imageBase??0,section_alignment:e.sectionAlignment??0,file_alignment:e.fileAlignment??0,subsystem:e.subsystem??0,dll_characteristics:e.dllCharacteristics??0,size_of_stack_reserve:e.sizeOfStackReserve??0,size_of_stack_commit:e.sizeOfStackCommit??0,size_of_heap_reserve:e.sizeOfHeapReserve??0,size_of_heap_commit:e.sizeOfHeapCommit??0}:{}}async function Ue(r){r instanceof ArrayBuffer&&(r=new Uint8Array(r));let e;try{e=ve.from(r)}catch(v){return{error:"Failed to parse PE",message:v.message}}let t=await zn(e,r),n=Tn(e),i=Rn(e),s=$n(n),o=Dn(e),u=Nn(r),a=Pn(e),g=e.newHeader?.optionalHeader||e.optionalHeader,m=e.newHeader?.fileHeader||e.coffHeader,d=g?.addressOfEntryPoint??0,w=d;if(d>0&&t.length>0)for(let v of t){let U=v.virtual_address,b=U+v.virtual_size;if(d>=U&&d<b){w=d-v.virtual_address+v.raw_data_offset;break}}let _={machine:m?.machine??0,entry_point:w,image_base:g?.imageBase??0,number_of_sections:t.length,sections:t,imports:n,exports:i,imphash:s,digital_signature:o,rich_signature:u,...a,file_size:r.length};return _.is_dll=()=>((m?.characteristics??0)&8192)!==0,_.is_32bit=()=>(g?.magic??0)===267,_.is_64bit=()=>(g?.magic??0)===523,_}function Ae(r){return!r||r.error?null:{machine:r.machine,entry_point:r.entry_point,image_base:r.image_base,number_of_sections:r.number_of_sections,sections:r.sections,imports:r.imports,exports:r.exports,imphash:r.imphash,rich_signature:r.rich_signature,digital_signature:r.digital_signature,size_of_code:r.size_of_code,size_of_initialized_data:r.size_of_initialized_data,size_of_uninitialized_data:r.size_of_uninitialized_data,address_of_entry_point:r.address_of_entry_point,base_of_code:r.base_of_code,base_of_data:r.base_of_data,section_alignment:r.section_alignment,file_alignment:r.file_alignment,subsystem:r.subsystem,dll_characteristics:r.dll_characteristics,is_dll:r.is_dll,is_32bit:r.is_32bit,is_64bit:r.is_64bit,imports_dll:e=>{let t=e.toLowerCase();return r.imports.some(n=>n.dll.toLowerCase()===t)},importsFunction:(e,t)=>{let n=e.toLowerCase(),i=r.imports.find(o=>o.dll.toLowerCase()===n);if(!i)return!1;if(!t)return!0;let s=t.toLowerCase();return i.functions.some(o=>o.name&&o.name.toLowerCase()===s)},exports_function:e=>{let t=e.toLowerCase();return r.exports.some(n=>n.toLowerCase()===t)},MACHINE_I386:332,MACHINE_AMD64:34404,MACHINE_ARM:448,MACHINE_ARM64:43620,SUBSYSTEM_NATIVE:1,SUBSYSTEM_WINDOWS_GUI:2,SUBSYSTEM_WINDOWS_CUI:3,SECTION_CNT_CODE:32,SECTION_CNT_INITIALIZED_DATA:64,SECTION_CNT_UNINITIALIZED_DATA:128,SECTION_MEM_EXECUTE:536870912,SECTION_MEM_READ:1073741824,SECTION_MEM_WRITE:2147483648}}var jn=[127,69,76,70],Mn=1,Fn=14,Hn=15,Ln=29;function Bn(r){let e=new DataView(r.buffer,r.byteOffset,r.byteLength);for(let s=0;s<4;s++)if(r[s]!==jn[s])throw new Error("Not ELF");let t=r[4],n=r[5]===1,i={is64bit:t===2,littleEndian:n};return i.type=D(e,16,n),i.machine=D(e,18,n),i.entry_point=i.is64bit?N(e,24,n):S(e,24,n),i.phoff=i.is64bit?N(e,32,n):S(e,28,n),i.shoff=i.is64bit?N(e,40,n):S(e,32,n),i.phentsize=i.is64bit?D(e,54,n):D(e,42,n),i.phnum=i.is64bit?D(e,56,n):D(e,44,n),i.shentsize=i.is64bit?D(e,58,n):D(e,46,n),i.shnum=i.is64bit?D(e,60,n):D(e,48,n),i.shstrndx=i.is64bit?D(e,62,n):D(e,50,n),i}function Wn(r,e){let t=[],n=new DataView(r.buffer,r.byteOffset,r.byteLength),i=e.phoff;for(let s=0;s<e.phnum;s++){let o,u,a,g,m,d,w;e.is64bit?(o=S(n,i,e.littleEndian),d=S(n,i+4,e.littleEndian),u=N(n,i+8,e.littleEndian),a=N(n,i+16,e.littleEndian),g=N(n,i+32,e.littleEndian),m=N(n,i+40,e.littleEndian),w=N(n,i+48,e.littleEndian),i+=56):(o=S(n,i,e.littleEndian),u=S(n,i+4,e.littleEndian),a=S(n,i+8,e.littleEndian),g=S(n,i+16,e.littleEndian),m=S(n,i+20,e.littleEndian),d=S(n,i+24,e.littleEndian),w=S(n,i+28,e.littleEndian),i+=32),t.push({type:o,offset:u,vaddr:a,filesz:g,memsz:m,flags:d,align:w})}return t}async function Vn(r,e){let t=[],n=new DataView(r.buffer,r.byteOffset,r.byteLength),i=e.shoff;for(let s=0;s<e.shnum;s++){let o=e.is64bit?N(n,i+24,e.littleEndian):S(n,i+16,e.littleEndian),u=e.is64bit?N(n,i+32,e.littleEndian):S(n,i+20,e.littleEndian),a=o+u<=r.length?r.slice(o,o+u):new Uint8Array,g=B(a),m=await $("SHA-1",a),d=await $("SHA-256",a);t.push({offset:o,size:u,entropy:le(a),raw_data:a,md5:g,sha1:m,sha256:d}),i+=e.is64bit?64:40}return t}function qn(r,e,t){let n=e.find(_=>_.raw_data&&_.raw_data.length>0&&_.name===".dynamic"),i=e.find(_=>_.raw_data&&_.raw_data.length>0&&_.name===".dynstr");if(!n||!i)return{needed_libraries:[],soname:null,rpath:null,runpath:null};let s=n.raw_data,o=i.raw_data,u=new DataView(s.buffer,s.byteOffset,s.byteLength),a=t.is64bit?16:8,g=[],m=null,d=null,w=null;for(let _=0;_+a<=s.length;_+=a){let v=t.is64bit?N(u,_,t.littleEndian):S(u,_,t.littleEndian),U=t.is64bit?N(u,_+8,t.littleEndian):S(u,_+4,t.littleEndian);v===Mn?g.push(k(o,U)):v===Fn?m=k(o,U):v===Hn?d=k(o,U):v===Ln&&(w=k(o,U))}return{needed_libraries:g,soname:m,rpath:d,runpath:w}}function kn(r,e,t){let n=[],i=e.find(m=>m.name===".dynsym"),s=e.find(m=>m.name===".dynstr");if(!i||!s)return n;let o=i.raw_data,u=s.raw_data,a=new DataView(o.buffer,o.byteOffset,o.byteLength),g=t.is64bit?24:16;for(let m=0;m+g<=o.length;m+=g){let d=S(a,m,t.littleEndian);if(d>=u.length)continue;let w=k(u,d);w&&n.push(w)}return n}async function xe(r){r instanceof ArrayBuffer&&(r=new Uint8Array(r));let e=r.length,t;try{t=Bn(r)}catch(w){return{error:"Invalid ELF file",message:w.message}}let n=Wn(r,t),i=await Vn(r,t),{needed_libraries:s,soname:o,rpath:u,runpath:a}=qn(r,i,t),g=kn(r,i,t),m=(n?.map(w=>w.vaddr)||[0])[0],d=(n?.map(w=>w.offset)||[0])[0];return{type:t.type,machine:t.machine,entry_point:t.entry_point-m+d,is_64bit:t.is64bit,endianness:t.littleEndian?"little":"big",file_size:e,program_headers:n,sections:i,imports:s.map(w=>({dll:w,functions:[]})),exports:g,needed_libraries:s,soname:o,rpath:u,runpath:a,hashes:{}}}function Oe(r){return!r||r.error?null:{type:r.type||0,machine:r.machine||0,entry_point:r.entry_point||0,file_size:r.file_size||0,is_64bit:r.is_64bit||!1,endianness:r.endianness||"little",sections:r.sections||[],number_of_sections:(r.sections||[]).length,program_headers:r.program_headers||[],segments:r.program_headers||[],number_of_segments:(r.program_headers||[]).length,imports:r.needed_libraries||[],exports:r.exports||[],needed_libraries:r.needed_libraries||[],soname:r.soname||null,rpath:r.rpath||null,runpath:r.runpath||null,is_32bit(){return!this.is_64bit},is_little_endian(){return this.endianness==="little"},is_big_endian(){return this.endianness==="big"},imports_library(t){return this.needed_libraries.some(n=>n.toLowerCase().includes(t.toLowerCase()))},exports_function(t){return this.exports.some(n=>n===t)},get_section_by_name(t){return this.sections.find(n=>n.name===t)},ET_NONE:0,ET_REL:1,ET_EXEC:2,ET_DYN:3,ET_CORE:4,EM_NONE:0,EM_386:3,EM_X86_64:62,EM_ARM:40,EM_AARCH64:183,ARCH_X86:3,ARCH_X86_64:62,ARCH_ARM:40,ARCH_AARCH64:183,TYPE_EXEC:2,TYPE_DYN:3,TYPE_CORE:4}}function G(r){return new TextEncoder().encode(r)}function Se(r){if(r.length===0)return 0;let e=new Uint32Array(256);for(let i=0;i<r.length;i++)e[r[i]]++;let t=0,n=r.length;for(let i=0;i<256;i++)if(e[i]>0){let s=e[i]/n;t-=s*Math.log2(s)}return t}function Ee(r){if(r.length===0)return 0;let e=0;for(let t=0;t<r.length;t++)e+=r[t];return e/r.length}function gt(r,e){if(r.length===0)return 0;let t=0;for(let n=0;n<r.length;n++){let i=r[n]-e;t+=i*i}return Math.sqrt(t/r.length)}function dt(r){if(r.length<2)return 0;let e=0,t=0;for(let n=0;n<r.length-1;n+=2){let i=r[n]/255*2-1,s=r[n+1]/255*2-1;i*i+s*s<=1&&e++,t++}return t===0?0:4*e/t}function mt(r){if(r.length<2)return 0;let e=Ee(r),t=0,n=0;for(let i=0;i<r.length-1;i++)t+=(r[i]-e)*(r[i+1]-e);for(let i=0;i<r.length;i++){let s=r[i]-e;n+=s*s}return n===0?0:t/n}function Gn(...r){if(r.length===0)throw new Error("No data provided");return Math.min(...r)}function Yn(...r){if(r.length===0)throw new Error("No data provided");return Math.max(...r)}function Kn(r,e){let t=0;for(let n=0;n<e.length;n++)e[n]===r&&t++;return t}function Xn(r){if(r.length===0)return 0;let e=new Uint32Array(256);for(let i=0;i<r.length;i++)e[r[i]]++;let t=0,n=0;for(let i=0;i<256;i++)e[i]>t&&(t=e[i],n=i);return n}function Ce(r){if(!r||!(r instanceof Uint8Array))throw new Error("Math module requires a Uint8Array data buffer");return{entropy:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=G(e[0]);return Se(t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);if(t>=r.length||t+n>r.length)return 0;let i=r.slice(t,t+n);return i.length===0?0:Se(i)}else throw new Error("entropy() requires either (offset, size) or (string)")},monte_carlo_pi:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=G(e[0]);return dt(t)}else if(e.length===2){let[t,n]=e;if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);if(t>=r.length||t+n>r.length)return 0;let i=r.slice(t,t+n);return i.length===0?0:dt(i)}else throw new Error("monte_carlo_pi() requires (offset, size)")},serial_correlation:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=G(e[0]);return mt(t)}else if(e.length===2){let[t,n]=e;if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);if(t>=r.length||t+n>r.length)return 0;let i=r.slice(t,t+n);return i.length===0?0:mt(i)}else throw new Error("serial_correlation() requires (offset, size)")},mean:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=G(e[0]);return Ee(t)}else if(e.length===2){let[t,n]=e;if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);if(t>=r.length||t+n>r.length)return 0;let i=r.slice(t,t+n);return i.length===0?0:Ee(i)}else throw new Error("mean() requires (offset, size)")},deviation:function(...e){if(e.length===2&&typeof e[0]=="string"){let[t,n]=e,i=G(t);return gt(i,n)}else if(e.length===3){let[t,n,i]=e;if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);if(t>=r.length||t+n>r.length)return 0;let s=r.slice(t,t+n);return s.length===0?0:gt(s,i)}else throw new Error("deviation() requires (offset, size, mean)")},min:function(e,t){return Gn(e,t)},max:function(e,t){return Yn(e,t)},count:function(e,t,n){if(e<0||e>255)throw new Error(`Invalid byte value: ${e} (must be 0-255)`);if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return i.length===0?0:Kn(e,i)},percentage:function(e,t,n){return this.count(e,t,n)/n},mode:function(e,t){if(e<0||t<0)throw new Error(`Invalid range: offset=${e}, size=${t}, data.length=${r.length}`);let n=r.slice(e,e+t);return n.length===0?0:Xn(n)},abs:function(e){return Math.abs(e)},to_number:function(e){return e?1:0},in_range:function(e,t,n){return e>=t&&e<=n}}}var Zn={entropy:function(r){let e=G(r);return Se(e)},abs:function(r){return Math.abs(r)},to_number:function(r){return r?1:0},in_range:function(r,e,t){return r>=e&&r<=t}};function H(r){return new TextEncoder().encode(r)}function Ie(r){let e=0;for(let t=0;t<r.length;t++)e=e+r[t]>>>0;return e&4294967295}var Qn=(()=>{let r=new Uint32Array(256);for(let e=0;e<256;e++){let t=e;for(let n=0;n<8;n++)t=t&1?3988292384^t>>>1:t>>>1;r[e]=t}return r})();function ze(r){let e=4294967295;for(let t=0;t<r.length;t++)e=e>>>8^Qn[(e^r[t])&255];return e=(e^4294967295)>>>0,e}function Te(r){if(!r||!(r instanceof Uint8Array))throw new Error("Hash module requires a Uint8Array data buffer");return{md5:async function(...e){if(e.length===1&&typeof e[0]=="string"){let t=H(e[0]);return B(t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return B(i)}else throw new Error("md5() requires either (offset, size) or (string)")},sha1:async function(...e){if(e.length===1&&typeof e[0]=="string"){let t=H(e[0]);return await $("SHA-1",t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0||t+n>r.length)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return await $("SHA-1",i)}else throw new Error("sha1() requires either (offset, size) or (string)")},sha256:async function(...e){if(e.length===1&&typeof e[0]=="string"){let t=H(e[0]);return await $("SHA-256",t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0||t+n>r.length)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return await $("SHA-256",i)}else throw new Error("sha256() requires either (offset, size) or (string)")},checksum32:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=H(e[0]);return Ie(t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return i.length===0?0:Ie(i)}else throw new Error("checksum32() requires either (offset, size) or (string)")},crc32:function(...e){if(e.length===1&&typeof e[0]=="string"){let t=H(e[0]);return ze(t)}else if(e.length===2){let t=e[0],n=e[1];if(t<0||n<0)throw new Error(`Invalid range: offset=${t}, size=${n}, data.length=${r.length}`);let i=r.slice(t,t+n);return i.length===0?0:ze(i)}else throw new Error("crc32() requires either (offset, size) or (string)")}}}var Jn={md5:async function(r){let e=H(r);return B(e)},sha1:async function(r){let e=H(r);return await $("SHA-1",e)},sha256:async function(r){let e=H(r);return await $("SHA-256",e)},checksum32:function(r){let e=H(r);return Ie(e)},crc32:function(r){let e=H(r);return ze(e)}};var Re={now:()=>Date.now()};var $e={to_int:(r,e=10)=>{if(typeof r!="string"&&!(r instanceof String))throw new Error("to_int() first argument must be a string");r.startsWith("0x")||r.startsWith("0X")?(e=16,r=r.slice(2)):(r.startsWith("O")||r.startsWith("o"))&&(e=8,r=r.slice(1));let t=parseInt(r,e);if(isNaN(t))throw new Error(`to_int() could not convert string '${r}' to integer`);return t},length:r=>typeof r=="string"||r instanceof String?r.length:0};var yt=typeof console<"u"&&typeof console.log=="function"?(...r)=>console.log(...r):()=>{},er=typeof globalThis<"u"&&globalThis.performance&&typeof globalThis.performance.now=="function";function tr(){return er?globalThis.performance.now():Date.now()}function nr(r){return r==null?r:JSON.parse(JSON.stringify(r))}var De=class{constructor(e={}){let t=e.enabled??e.enableTiming??!1,n=e.logger??yt,i=e.autoPrint??!1;this.options={enabled:!!t,logger:n,autoPrint:!!i},this.lastTiming={compile:null,scan:null}}isEnabled(){return!!this.options.enabled}now(){return tr()}updateOptions(e={}){(Object.prototype.hasOwnProperty.call(e,"enabled")||Object.prototype.hasOwnProperty.call(e,"enableTiming"))&&(this.options.enabled=!!(e.enabled??e.enableTiming)),Object.prototype.hasOwnProperty.call(e,"logger")&&(this.options.logger=e.logger??yt),Object.prototype.hasOwnProperty.call(e,"autoPrint")&&(this.options.autoPrint=!!e.autoPrint)}enable(e=!0,t){this.updateOptions({enabled:e,logger:t})}clearCompile(){this.lastTiming.compile=null}clearScan(){this.lastTiming.scan=null}recordCompile(e){let t={total:e};this.lastTiming.compile=t,this.printTiming("compile",t)}createScanTiming(){return{total:0,steps:{buildAutomaton:0,acSearch:0,deduplicate:0,verifyCandidates:0,buildMatches:0,evaluateConditions:0,filterStrings:0},modules:{total:0,pe:0,elf:0,math:0,hash:0},conditionParsing:{total:0,byRule:{}},matchCount:0}}finalizeScan(e){this.lastTiming.scan=e,this.printTiming("scan",e)}accumulateStep(e,t,n){!e||!Number.isFinite(n)||(e[t]=(e[t]||0)+n)}accumulateModule(e,t,n){!e||!Number.isFinite(n)||(e.total=(e.total||0)+n,e[t]=(e[t]||0)+n)}accumulateCondition(e,t,n){!e||!Number.isFinite(n)||(e.total=(e.total||0)+n,e.byRule||(e.byRule={}),e.byRule[t]=(e.byRule[t]||0)+n)}getSnapshot(){return nr(this.lastTiming)}printTiming(e,t){if(!this.options.enabled||!this.options.autoPrint||!this.options.logger||!t)return;let n=this.options.logger;if(e==="compile"){n(`[InterceptScanner] Compile completed in ${t.total.toFixed(3)}ms`);return}if(e==="scan"){let i=t.matchCount??"n/a";n(`[InterceptScanner] Scan completed in ${t.total.toFixed(3)}ms (matches: ${i})`),t.steps&&Object.entries(t.steps).forEach(([s,o])=>{o!=null&&n(`  \u2022 ${s}: ${o.toFixed(3)}ms`)}),t.modules&&t.modules.total&&n(`  \u2022 moduleCreation.total: ${t.modules.total.toFixed(3)}ms`),t.conditionParsing&&t.conditionParsing.total&&n(`  \u2022 conditionParsing.total: ${t.conditionParsing.total.toFixed(3)}ms`)}}};function wt(r={}){return new De(r)}var Ne=class{constructor(e){if(this._isLoaded=!1,this._name=e,!Pe(e))throw new Error(`Invalid module name: "${e}". It is either reserved or malformed.`)}getName(){return this._name}isLoaded(){return this._isLoaded}async load(){return this._isLoaded=!0,this._isLoaded}async initialize(e,t){throw new Error("CustomModule.initialize() must be implemented")}createModule(e){throw new Error("CustomModule.createModule() must be implemented")}},rr=["pe","elf","math","hash","string","time","filesize","entrypoint"];function Pe(r){if(!r||typeof r!="string")return!1;let e=r.toLowerCase();return!rr.includes(e)}var he=class{constructor(e={}){this.compiledRules=[],this.ac=null,this.autoParsePE=!0,this.autoParseELF=!0,this.maxFileSize=1024*1024,this.setModules(e.modules),this.customModules=e.modules||{};let t={enabled:e.timing?.enabled??e.timing?.enableTiming??e.enableTiming??!1,autoPrint:e.timing?.autoPrint??e.autoPrint??!1,logger:e.timing?.logger??e.timingLogger??e.logger};this.timingTracker=wt(t)}compile(e){let t=this.timingTracker,n=t?.isEnabled(),i=n?t.now():0;this.compiledRules=qe(e,this.compiledRules||[]),this.ac=null,n?t.recordCompile(t.now()-i):t&&t.clearCompile()}addRules(e){this.compile(e)}clearRules(){this.compiledRules=[],this.ac=null}setModules(e){this.modules={string:$e,time:Re,...e||{}}}setTiming(e={}){this.timingTracker.updateOptions(e)}enableTiming(e=!0,t){this.timingTracker.enable(e,t)}getTiming(){return this.timingTracker.getSnapshot()}deduplicateCandidates(e){let t=new Map;for(let n of e){let i=`${n.id}:${n.varName}:${n.offset}`;t.has(i)||t.set(i,n)}return Array.from(t.values())}verifyCandidates(e,t,n){let i=[];for(let s of e){let o=n.find(a=>a.id===s.id);if(!o)continue;let u=o.strings[s.varName];if(!(!u||!u.matcher))if(u.type==="text"||u.type==="regex"&&u.literalPrefix){let a=u.matcher(t,s.offset);a&&a.length>0&&i.push({...s,matches:a})}else i.push(s)}return i}buildStringMatches(e,t,n){let i={};for(let o of t){i[o.id]={};for(let u of Object.keys(o.strings)){let a=u.startsWith("$")||u.startsWith(".")?u:`$${u}`,g=a.startsWith(".")?`$${a}`:a,m=u.startsWith(".")?`$${u}`:a;i[o.id][m]={identifier:m,matched:!1,count:0,matches:[],offsets:[],private:o.strings[u].private}}}for(let o of e){let u=o.varName.startsWith(".")?`$${o.varName}`:o.varName,a=i[o.id][u]||u.startsWith("$")?u:`$${u}`,g=i[o.id][a];if(o.matches&&o.matches.length>0){let m=o.matches.length>100?o.matches.slice(0,100):o.matches;g.matched=!0,g.count+=m.length,g.matches.push(...m),g.offsets.push(...o.matches.map(d=>d.offset))}else g.matched=!0,g.count+=1,g.matches.push({offset:o.offset,length:o.length||0}),g.offsets.push(o.offset)}let s=null;for(let o of t)for(let[u,a]of Object.entries(o.strings)){if(a.type==="text"||a.type==="regex"&&a.literalPrefix?.length>0)continue;let g=u.startsWith(".")?`$${u}`:u,m=i[o.id][g]||g.startsWith("$")?g:`$${g}`,d=i[o.id][m];a.type==="hex"&&s===null&&(s=Array.from(n).map(_=>_.toString(16).toUpperCase().padStart(2,"0")).join(""));let w=a.type==="hex"&&s!==null?a.matcher(s,-1):a.matcher(n,-1);if(w&&w.length>0){let _=w.length>100?w.slice(0,100):w;d.matched=!0,d.count+=_.length,d.matches.length===0?d.matches=_:d.matches.push(..._),d.offsets.push(...w.map(v=>v.offset))}}return i}async evaluateConditions(e,t,n,i={},s=null){let o=[],u={},a=s?.tracker,g=s?.modules,m=this.modules.pe;if(this.autoParsePE&&!m){let y=a?a.now():0;try{if(n.length>2&&n[0]===77&&n[1]===90){let c=await Ue(n);c&&!c.error&&(m=Ae(c))}}catch{}finally{a&&g&&a.accumulateModule(g,"pe",a.now()-y)}}let d=this.modules.elf;if(this.autoParseELF&&!d){let y=a?a.now():0;try{if(n.length>4&&n[0]===127&&n[1]===69&&n[2]===76&&n[3]===70){let c=await xe(n);c&&!c.error&&(d=Oe(c))}}catch{}finally{a&&g&&a.accumulateModule(g,"elf",a.now()-y)}}let w={...this.modules,...m&&{pe:m},...d&&{elf:d}},_=a?a.now():0;w.math=Ce(n),a&&g&&a.accumulateModule(g,"math",a.now()-_);let v=a?a.now():0;w.hash=Te(n),a&&g&&a.accumulateModule(g,"hash",a.now()-v);for(let[y,c]of Object.entries(this.modules))try{if(typeof c?.getName=="function"){let l=c.getName();if(!Pe(l)){console.warn(`InterceptScanner: Custom module "${l}" has reserved name - skipping initialization`);continue}if(typeof c.isLoaded=="function"&&!c.isLoaded()){let x=a?a.now():0;typeof c.load=="function"&&await c.load(),a&&g&&a.accumulateModule(g,`${l}_load`,a.now()-x)}let f=a?a.now():0,h={...i,filesize:n.length,hasPE:!!m,hasELF:!!d,timestamp:Date.now()},p=c;if(typeof c.initialize=="function"&&typeof c.createModule=="function"){let x=await c.initialize(n,h);p=c.createModule(x)}a&&g&&a.accumulateModule(g,l,a.now()-f),w[l]=p}}catch(l){console.warn(`InterceptScanner: Error initializing custom module "${y}": ${l.message}`)}let U=t.filter(y=>y.global);for(let y of U){let c=await this.evaluateRuleCondition(e,y,n,u,{peModule:m,elfModule:d,modulesWithBinary:w},s);if(c)y.private||o.push(c);else return o}let b=t.filter(y=>!y.global);for(let y of b){let c=await this.evaluateRuleCondition(e,y,n,u,{peModule:m,elfModule:d,modulesWithBinary:w},s);c&&!y.private&&o.push(c)}for(let[y,c]of Object.entries(w))if(!["string","time","hash","math"].includes(y)){o[y]={};for(let[l,f]of Object.entries(c))!l.startsWith("_")&&typeof f!="function"&&!/[A-Z0-9]+/.test(l)&&(o[y][l]=typeof f=="object"?je({...f},["raw_data","data"]):f)}return o}async evaluateRuleCondition(e,t,n,i,s={},o=null){let{peModule:u,elfModule:a,modulesWithBinary:g}=s,m=o?.tracker,d=o?.condition;try{let w=u?u.entry_point:a?a.entry_point:-1e6,_=n.length,v=_>=this.maxFileSize,U=ke(n,e[t.id],g,{entrypoint:w,filesize:_,isFileSizeCapped:v,maxFileSize:this.maxFileSize,matchedRules:i,metadata:{ruleName:t.name}}),b,y=m?m.now():0;try{b=Ke(t.condition,U.strings)}catch{b=this.parseSimpleCondition(t.condition,U.strings)}finally{m&&d&&m.accumulateCondition(d,t.name,m.now()-y)}let c=await Ge(b,U);if(i[t.name]=c,c){let l={};for(let[f,h]of Object.entries(e[t.id]))!f.startsWith("$.")&&!h.private&&(l[f]=h);return{rule:t.name,namespace:t.namespace||"default",tags:t.tags||[],metadata:t.metadata||{},strings:l}}}catch(w){console.log("Failing rule: ",t),console.trace(w)}return!1}parseSimpleCondition(e,t){if(e=e.trim(),e==="any of them")return{type:"any",items:"them"};if(e==="all of them")return{type:"all",items:"them"};if(e==="none of them")return{type:"none",items:"them"};let n=e.match(/^(\d+)\s+of\s+them$/);if(n)return{type:"quantified",quantifier:{type:"number",value:parseInt(n[1])},items:"them"};let i=e.match(/^\$(\w+)$/);if(i)return{type:"stringIdentifier",identifier:`$${i[1]}`};let s=e.match(/^\(?(\$\w+)\s+and\s+(\$\w+)\)?$/);if(s)return{type:"and",left:{type:"stringIdentifier",identifier:s[1]},right:{type:"stringIdentifier",identifier:s[2]}};let o=e.match(/^\(?(\$\w+)\s+or\s+(\$\w+)\)?$/);if(o)return{type:"or",left:{type:"stringIdentifier",identifier:o[1]},right:{type:"stringIdentifier",identifier:o[2]}};let u=Object.keys(t);for(let a of u)if(e.includes(a)&&t[a].matched)return{type:"boolean",value:!0};return{type:"boolean",value:!1}}filterStringResults(e){Array.isArray(e)&&e.forEach(t=>{if(Object.keys(t.strings).length>0)for(let[n,i]of Object.entries(t.strings))i.matched||delete t.strings[n]})}async scan(e,t={}){let n=this.timingTracker,i=n?.isEnabled(),s=i?n.now():0,o=i?n.createScanTiming():null;if(typeof e=="string"&&(e=new TextEncoder().encode(e)),!this.compiledRules||this.compiledRules.length===0)return i&&o?(o.total=n.now()-s,o.matchCount=0,n.finalizeScan(o)):n&&n.clearScan(),[];if(!this.ac)if(i&&o){let l=n.now();this.ac=new Y(this.compiledRules),n.accumulateStep(o.steps,"buildAutomaton",n.now()-l)}else this.ac=new Y(this.compiledRules);let u=i?n.now():0,a=this.ac.search(e);i&&o&&n.accumulateStep(o.steps,"acSearch",n.now()-u);let g=i?n.now():0,m=this.deduplicateCandidates(a);i&&o&&n.accumulateStep(o.steps,"deduplicate",n.now()-g);let d=i?n.now():0,w=this.verifyCandidates(m,e,this.compiledRules);i&&o&&n.accumulateStep(o.steps,"verifyCandidates",n.now()-d);let _=i?n.now():0,v=this.buildStringMatches(w,this.compiledRules,e);i&&o&&n.accumulateStep(o.steps,"buildMatches",n.now()-_);let U=null,b=0;i&&o&&(U={tracker:n,modules:o.modules,condition:o.conditionParsing},b=n.now());let y=await this.evaluateConditions(v,this.compiledRules,e,t,U);i&&o&&n.accumulateStep(o.steps,"evaluateConditions",n.now()-b);let c=i?n.now():0;return this.filterStringResults(y),i&&o?(n.accumulateStep(o.steps,"filterStrings",n.now()-c),o.total=n.now()-s,o.matchCount=y.length,n.finalizeScan(o)):n&&n.clearScan(),y}setMaxFileSize(e){this.maxFileSize=e}getStats(){return{totalRules:this.compiledRules.length,ruleNames:this.compiledRules.map(e=>e.name),rulesWithStrings:this.compiledRules.filter(e=>Object.keys(e.strings).length>0).length,totalStrings:this.compiledRules.reduce((e,t)=>e+Object.keys(t.strings).length,0),totalPatterns:this.compiledRules.reduce((e,t)=>e+Object.values(t.strings).reduce((n,i)=>n+(i.patterns?i.patterns.length:0),0),0),acBuilt:this.ac!==null,maxFileSize:this.maxFileSize}}clear(){this.compiledRules=[],this.ac=null,this.setModules(this.customModules)}};function je(r,e){return typeof r=="string"||typeof r=="number"||typeof r=="boolean"||r===null?r:Array.isArray(r)?r.map(t=>je(t,e)):r!==null&&typeof r=="object"?Object.fromEntries(Object.entries(r).filter(([t])=>!e.includes(t)).map(([t,n])=>[t,je(n,e)])):r}export{Ne as BaseCustomModule,he as InterceptScanner,he as YaraScanner,Oe as createELFModule,Te as createHashModule,Ce as createMathModule,Ae as createPEModule,Jn as hash,Zn as math,xe as parseELFYaraFull,Ue as parsePEYara,$e as string,Re as time};