REACT/node/codemirror assistance

My Crypto wallet was hacked by files I downloaded to look for arbitrage opportunities - what I need is a coder to analyse the code and show me how they did it. I would like to deconstruct it and get as much info as possible including the .env variables etc. that ran when I viewed the index.html. They have obviously obviscated the files and added many un necessary files to try and confuse the user and have also used codemirror - can you help? I dont only want you to tell me how it was done - I want you to show me