Many scripts use "unpackers" to hide the actual payload inside a string that is only executed at runtime via eval() or Function() .
: Resolves complex function chains used to hide original API calls. Usage Tips Security Note javascript+deobfuscator+and+unpacker+portable