Android APK Redirect Analysis -- Check Apk in Files Section

I need a solid teardown of a single Google Play APK that changes behaviour depending on who is running it. When USB-debugging is enabled or the package is being probed in a reverse-engineering environment, its WebView quietly loads an offline HTML file shipped in the assets folder. To a normal user, however, the same WebView bounces straight to an external website.

Your main task is to pinpoint exactly where, in the decompiled code or resources, that redirect decision is made. I’m interested in the class names, methods or smali blocks that switch between the local file and the live URL, plus any supporting logic—native checks, signature checks, anti-debug flags—that feeds into it. The end goal is a clear explanation I can follow and reproduce, not just a high-level guess.

Deliverables
• A short, well-structured report (PDF or Markdown) that:
– Identifies the file(s) or method(s) controlling the redirect
– Maps out any anti-debugging or tamper-detection routines tied to that logic
– Includes annotated code snippets or smali excerpts and screenshots/logs proving the flow
• Optional but appreciated: suggestions for bypassing or reproducing the behaviour in a test build

Relevant expertise
☑ Android app reverse engineering & APK analysis
☑ Android WebView / website-redirect troubleshooting
☑ Mobile app security testing & anti-debugging checks

When you submit, please give a brief, tool-based game plan (e.g., JADX, apktool, Frida, Burp, mitmproxy, etc.), estimated hours or milestones, and how you’ll document findings.