The entry file here is a loader. The real application code arrives RC4-encrypted, split across two vendor chunks, and is executed with new Function() - so it never exists as a file on disk.
Goal: recover the packed stage, then call the console route it registers. It needs a custom header, a token and a query parameter.
/JSRECON/js/l5.boot.js joins __vseg.a + __vseg.b + __vseg.c, base64 decodes them and RC4 decrypts with a key spelled out in hex escapes.
Easiest read: patch the last step. Copy the boot code into the console with new Function(_rc4(_p,_k))() replaced by console.log(_rc4(_p,_k)). The decrypted stage prints as readable JavaScript.
The stage registers window.__console(). Run it in the console on this page and read the response, or rebuild the request yourself: the header name is a char-code array and the token is joined from three fragments.