This was a pain and manually deobfuscated. Here are my notes:
```Must start with VULNCON{ and end with }
Must contain a body of five groups separated by _
Constraints 1
    data[2].length == 2 // data[2] must be length of 2    ||    data[1].length == 2    ||    data[1][1] == data[2][1]    ||    data[2][1] - data[2][0]) == 4 // data[2][1] and data[2][0] must be numerical    ||    data[1][0].charCodeAt(0) - data[1][1]) == 101    ||    data[1][0] == 'j')
Constraints 2
    compare(runfun(xor, data[3]), 'f`C`?e') // data[3] == "71r1n6"    ||    compare(runfun2(a, data[3], data[0]), [150, 234, 151, 101, 189, 29, 57, 44, 194, 164])    // data[0] is length 10    // a(expkey, expected)    // '0bfu5c473d'
Putting it together
0bfu5c473d_j5_15_71r1n6_ABCDEF
Constraints 3
    for (let i = 0; i < data[4].length; i++) {        text += String.fromCharCode(xor(data[0][i].charCodeAt(0), data[4][i].charCodeAt(0)));    }
	// In [142]: xor(b'0bfu5c473d', [85, 1, 84, 76, 3, 87, 2, 84, 11, 6])	// Out[142]: b'ec29646c8b'
Final:
VULNCON{0bfu5c473d_j5_15_71r1n6_ec29646c8b}```
**Flag:** `VULNCON{0bfu5c473d_j5_15_71r1n6_ec29646c8b}`