It probably comes from config/database, not hard-coded, so might not get it after all.
With the code it should be easier to fake a client, download and decode that configuration. Hopefully some further experiments can be done with access to the real source.
The configuration will be server-side only. It would be madness to generate the lootbox result client-side.
I think it's Korea or China that requires the rates to be published, so they might be available somewhere already.
I guess we can’t be sure whether the rates are the same across regions.
Or you could confirm that the published rates match what is in the source, assuming that it is not loaded in from the server at runtime. Loading them from the server, in my opinion, is very likely.
One imagines that the source code just makes those variables, and they're configured server side as required.