Office (OLE) malware analysis — malicious · 03872785a900a343

MALICIOUS

Office (OLE)

392.0 KB Created: 1999-12-24 16:36:33 Authoring application: Microsoft Excel First seen: 2015-10-01

MD5: addcfc34f2b878f93646955598b46940 SHA-1: 704fc250c4d2d3d7622911bd579c114715f12efa SHA-256: 03872785a900a343f641dddad09bc97b1c098c80432e6810c88a17d7b98b9663

388 Risk Score

Malware Insights

MITRE ATT&CK

T1203 Exploitation for Client Execution T1059.005 Visual Basic

The file is an Excel document containing both VBA and Excel 4.0 macros, and critically, an embedded PE executable. Heuristics indicate exploitation of CVE-2011-0105, a known Excel vulnerability, and references to LoadLibrary and GetProcAddress APIs suggest dynamic loading of malicious code. The embedded executable is the primary payload, likely dropped and executed by the macros.

Heuristics 10

CVE-2011-0105 — Excel EXTSST record overflow critical CVE exact CVE_2011_0105

Workbook BIFF stream contains an EXTSST (Extended Shared String Table) record declaring 128 ISSTINF entries — far more than the shared string table's cstUnique/Dsst warrants (expected 1) — together with shellcode / a heap-spray in the same stream. This SST/EXTSST inconsistency is the documented CVE-2011-0105 (MS11-021) data-initialization primitive: Excel copies the over-declared entry array — attacker-controlled bytes that double as the heap-spray / pointer table — past the destination buffer, leading to memory corruption and code execution from a crafted .xls.
ClamAV: Win.Trojan.ShellcodeFindKernel32-1 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.ShellcodeFindKernel32-1
Embedded PE executable critical OLE_EMBEDDED_EXE

MZ/PE header found inside document — possible embedded executable

NOP sled detected high SC_NOP_SLED

Found 20+ consecutive 0x90 bytes

Disassembly

Attempted x86 opcode disassembly

00000C66  90                nop
00000C67  90                nop
00000C68  90                nop
00000C69  90                nop
00000C6A  90                nop
00000C6B  90                nop
00000C6C  90                nop
00000C6D  90                nop
00000C6E  90                nop
00000C6F  90                nop
00000C70  90                nop
00000C71  90                nop
00000C72  90                nop
00000C73  90                nop
00000C74  90                nop
00000C75  90                nop
00000C76  90                nop
00000C77  90                nop
00000C78  90                nop
00000C79  90                nop
00000C7A  90                nop
00000C7B  90                nop
00000C7C  90                nop
00000C7D  90                nop
00000C7E  90                nop
00000C7F  90                nop
00000C80  90                nop
00000C81  90                nop
00000C82  90                nop
00000C83  90                nop
00000C84  90                nop
00000C85  90                nop
00000C86  90                nop
00000C87  90                nop
00000C88  90                nop
00000C89  90                nop
00000C8A  90                nop
00000C8B  90                nop
00000C8C  90                nop
00000C8D  90                nop
00000C8E  90                nop
00000C8F  90                nop
00000C90  90                nop
00000C91  90                nop
00000C92  90                nop
00000C93  90                nop
00000C94  90                nop
00000C95  90                nop
00000C96  90                nop
00000C97  90                nop
00000C98  90                nop
00000C99  90                nop
00000C9A  90                nop
00000C9B  90                nop
00000C9C  90                nop
00000C9D  90                nop
00000C9E  90                nop
00000C9F  90                nop
00000CA0  90                nop
00000CA1  90                nop
00000CA2  90                nop
00000CA3  90                nop
00000CA4  90                nop
00000CA5  90                nop
00000CA6  90                nop
00000CA7  90                nop
00000CA8  90                nop
00000CA9  90                nop
00000CAA  90                nop
00000CAB  90                nop
00000CAC  90                nop
00000CAD  90                nop
00000CAE  90                nop
00000CAF  90                nop
00000CB0  90                nop
00000CB1  90                nop
00000CB2  90                nop
00000CB3  90                nop
00000CB4  90                nop
00000CB5  90                nop
00000CB6  90                nop
00000CB7  90                nop
00000CB8  90                nop
00000CB9  90                nop
00000CBA  90                nop
00000CBB  90                nop
00000CBC  90                nop
00000CBD  90                nop
00000CBE  90                nop
00000CBF  90                nop
00000CC0  90                nop
00000CC1  90                nop
00000CC2  90                nop
00000CC3  90                nop
00000CC4  90                nop
00000CC5  90                nop

Reference to LoadLibrary API high SC_STR_LOADLIBRARY

Reference to LoadLibrary API
Reference to GetProcAddress API high SC_STR_GETPROCADDRESS

Reference to GetProcAddress API
OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY

OLE file is 401,408 bytes but its declared streams total only 184,311 bytes — 217,097 bytes (54%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).
Excel 4.0 (XLM) macro sheet present medium OLE_XLM_AUTOOPEN

Workbook contains an Excel 4.0 macro sheet sub-stream — XLM is rarely seen in modern legitimate workbooks and was a major Office malware vector during 2020-2022.
VBA macros detected medium 1 related finding OLE_VBA_MACROS

Document contains VBA macro code
Workbook_Open macro low OLE_VBA_WBOPEN

Workbook_Open macro
Matched line in script
```
Private Sub Workbook_Open()
```

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_macros.txt`	xlm-macro	oletools.olevba.extract_all_macros (XLM macro listing)	17509 bytes
SHA-256: `c2d076a6e609a8b33579240c4c97ddb741702fb224c691665176231441d0ac2f`
Preview script First 1,000 lines of the extracted script ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - worksheet or dialog sheet, visible - LV ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 0085 11 BOUNDSHEET : Sheet Information - Excel 4.0 macro sheet, hidden - ms ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 00fd 10 LABELSST : Cell Value, String Constant/ SST ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' 002a 2 PRINTHEADERS : Print Row/Column Labels ' Sheet,Reference,Formula,Value ' LV,O1,"",0.00000000000000000000 ' LV,O2,"",1.00000000000000000000 ' LV,M3,"",1.00000000000000000000 ' LV,O3,"",2.00000000000000000000 ' LV,O4,"",3.00000000000000000000 ' LV,O5,"",4.00000000000000000000 ' LV,A6,"",2.00000000000000000000 ' LV,O6,"",5.00000000000000000000 ' LV,B7,"",4.00000000000000000000 ' LV,H2,"",4.00000000000000000000 ' LV,A4,"",1.00000000000000000000 ' LV,H7,"",3.00000000000000000000 ' LV,H3,"",3.00000000000000000000 ' LV,H6,"",3.00000000000000000000 ' LV,H7,"",3.00000000000000000000 ' LV,A2,"",1.00000000000000000000 ' LV,G2,"",7.00000000000000000000 ' LV,A8,"",1.00000000000000000000 ' LV,H1,"",4.00000000000000000000 ' LV,H3,"",4.00000000000000000000 ' LV,H4,"",3.00000000000000000000 ' LV,H1,"",4.00000000000000000000 ' LV,A2,"",1.00000000000000000000 ' LV,H2,"",5.00000000000000000000 ' LV,A4,"",1.00000000000000000000 ' LV,E5,"",6.00000000000000000000 ' LV,F4,"",5.00000000000000000000 ' LV,H4,"",3.00000000000000000000 ' LV,H7,"",1.00000000000000000000 ' LV,B4,"",3.00000000000000000000 ' LV,A5,"",2.00000000000000000000 ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],"" ' ms,A1,[],"" ' ms,B1,[],"" ' ms,C1,[],"" ' ms,D1,[],"" ' ms,E1,[],"" ' ms,F1,[],"" ' ms,G1,[],"" ' ms,H1,[],"" ' ms,A2,[],"" ' ms,B2,[],"" ' ms,C2,[],"" ' ms,D2,[],"" ' ms,E2,[],"" ' ms,F2,[],"" ' ms,G2,[],"" ' ms,H2,[],"" ' ms,A3,[],"" ' ms,B3,[],"" ' ms,C3,[],"" ' ms,D3,[],"" ' ms,E3,[],"" ' ms,F3,[],"" ' ms,G3,[],"" ' ms,H3,[],"" ' ms,A4,[],"" ' ms,B4,[],"" ' ms,C4,[],"" ' ms,D4,[],"" ' ms,E4,[],"" ' ms,F4,[],"" ' ms,G4,[],"" ' ms,H4,[],"" ' ms,A5,[],"" ' ms,B5,[],"" ' ms,C5,[],"" ' ms,D5,[],"" ' ms,E5,[],"" ' ms,F5,[],"" ' ms,G5,[],"" ' ms,H5,[],"" ' ms,A6,[],"" ' ms,B6,[],"" ' ms,C6,[],"" ' ms,D6,[],"" ' ms,E6,[],"" ' ms,F6,[],"" ' ms,G6,[],"" ' ms,H6,[],"" ' ms,A7,[],"" ' ms,B7,[],"" ' ms,C7,[],"" ' ms,D7,[],"" ' ms,E7,[],"" ' ms,F7,[],"" ' ms,G7,[],"" ' ms,H7,[],"" ' ms,A8,[],"" ' ms,B8,[],"" ' ms,C8,[],"" ' ms,D8,[],"" ' ms,E8,[],"" ' ms,F8,[],"" ' ms,G8,[],"" ' ms,H8,[],""
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	27370 bytes
SHA-256: `1993a1b6bbc40f8189298cad226848361cd8af404b47e5aeade11ddd4fa803da`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisWorkbook" Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Dim bCount As Integer Private Sub Workbook_Open() ShotCount End Sub Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As Excel.Range) On Error GoTo TheReset If ShotCount Then TheLevel = Worksheets("lv1").Range("m3").Value + 1 TheScore = 1000 - (TheLevel * 3 * bCount) MsgBox "The game is over! Your score is " & TheScore & " out of 1000.", , "Congratulations!" Exit Sub End If With Target If .Address = Range("m1").Address Then Application.ScreenUpdating = False Application.EnableEvents = False If .Value = "Mark Bomb Position" Then For y = 1 To 8 Set lvSheet = Worksheets("lv" & y) With lvSheet .Unprotect .Range("m1").Value = "Bomb Marking OFF" .Protect End With Next Else For z = 1 To 8 Set lvSheet = Worksheets("lv" & z) With lvSheet .Unprotect .Range("m1").Value = "Mark Bomb Position" .Protect End With Next End If Application.EnableEvents = True Application.ScreenUpdating = True Exit Sub End If If ShotCount Then Exit Sub If ActiveCell.Address <> .Address Then Exit Sub 'if it is not a single cell selection If Intersect(Range(strRange), Target) Is Nothing Then Exit Sub 'if the selection is not on the board If .Interior.PatternColorIndex = xlNone Then Exit Sub 'if the cell is already unhidden ActiveSheet.Unprotect If Range("m1").Value = "Mark Bomb Position" Then If .NumberFormat = """?"" ;""?"";""?"" ;""?""" Then .NumberFormat = """"" ;"""";"""" ;""""" .Font.ColorIndex = 15 .Font.FontStyle = "Normal" If .Value = "M" Then .Font.Name = "Wingdings" End If ActiveSheet.Protect Exit Sub Else .NumberFormat = "General" .Interior.PatternColorIndex = xlNone .Font.ColorIndex = xlAutomatic End If If .Value = "M" Then ShotCount If bCount > 1 Then bString = " bombs" Else bString = " bomb" End If MsgBox "KABOOM!", , "You have hit " & bCount & bString & " so far!" End If Else If .NumberFormat = """?"" ;""?"";""?"" ;""?""" Then Exit Sub If .Interior.PatternColorIndex = xlNone Then Exit Sub .NumberFormat = """?"" ;""?"";""?"" ;""?""" With .Font .Name = "Arial" .FontStyle = "Bold" .ColorIndex = 3 End With End If End With ActiveSheet.Protect TheReset: ActiveSheet.Protect Application.EnableEvents = True End Sub Function ShotCount() As Boolean ShotCount = False sCount = 0 bCount = 0 For s = 1 To 8 For Each sCell In Worksheets("lv" & s).Range(strRange) If sCell.Font.ColorIndex = xlAutomatic Then sCount = sCount + 1 End If If sCell.Font.Name = "Wingdings" And sCell.Font.ColorIndex = xlAutomatic Then bCount = bCount + 1 End If Next Next fCount = sCount - bCount If fCount = 448 Then ShotCount = True End If End Function Attribute VB_Name = "Sheet1" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Control = "cbut1, 7, 0, MSForms, CommandButton" Attribute VB_Control = "cbut2, 76, 1, MSForms, CommandButton" Attribute VB_Control = "cbut3, 78, 2, MSForms, CommandButton" Private Sub cbut1_Click() ResetGameBoard End Sub Private Sub cbut2_Click() TheInstructions End Sub Private Sub cbut3_Click() AboutThisGame End Sub Attribute VB_Name = "Sheet2" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet211" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet11" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet21" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet12" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet22" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "Sheet111" Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = False Attribute VB_Customizable = True Attribute VB_Name = "modMain" Public Const strRange = "a1:h8" Sub ResetGameBoard() Application.ScreenUpdating = False With Application calcVar = .Calculation bIter = .Iteration vMaxIter = .MaxIterations .Calculation = xlManual .Iteration = True .MaxIterations = 1000 End With For c = 1 To 8 Set mSht = Sheets("ms" & c) Set bSht = Sheets("lv" & c) With bSht .Unprotect .Range("m1").Value = "Mark Bomb Position" mSht.Range(strRange).Copy Destination:=.Range(strRange) Randomize n = 0 Do Until n > 7 x = Int((8 * Rnd)) y = Int((8 * Rnd)) With .Range(strRange).Offset(x, y).Resize(1, 1) If .Formula <> "M" Then .Formula = "M" .Font.Name = "Wingdings" n = n + 1 End If End With Loop End With Next Calculate For f = 1 To 8 Set fSht = Sheets("lv" & f) With fSht .Activate .Range(strRange).Copy .Range(strRange).PasteSpecial xlValues .Range("j2").Select For Each uCell In .Range(strRange) With uCell If .Value < Worksheets("lv1").Range("m3").Value Then .Interior.PatternColorIndex = xlNone .NumberFormat = "General" .Font.ColorIndex = xlAutomatic End If End With Next .Protect End With Next Application.CutCopyMode = False Worksheets("lv1").Activate With Application .Calculation = calcVar .Iteration = bIter .MaxIterations = vMaxIter End With Application.ScreenUpdating = True End Sub Sub TheInstructions() msgStr = "Click New Game to start. Setup is determined by the selected game option." & Chr(10) msgStr = msgStr & "The Unhide Cells <1 option produces a board with cells displayed that have " & Chr(10) msgStr = msgStr & "no adjacent bombs. As an example, if cell E2 on sheet lv2 contains a zero," & Chr(10) msgStr = msgStr & "then the range D1:F3 on sheets lv1, lv2 and lv3 contains no bombs. The" & Chr(10) msgStr = msgStr & "Unhide Cells <4 option displays cells with 0-3 adjacent bombs and this is the" & Chr(10) msgStr = msgStr & "easiest game option. Click on a cell to unhide it." & Chr(10) & Chr(13) & Chr(13) msgStrA = "To mark a cell as a suspected bomb, select the cell with the label Mark Bomb" & Chr(10) msgStrA = msgStrA & "Position on any sheet. The text in this cell will change to Bomb Marking OFF." & Chr(10) msgStrA = msgStrA & "A question mark will be added to any hidden cell when clicked. Select the " & Chr(10) msgStrA = msgStrA & "cell with the label Bomb Marking OFF to turn off this feature." & Chr(10) & Chr(13) & Chr(13) msgStrB = "The game is complete when all of the cells not containing bombs have been " & Chr(10) msgStrB = msgStrB & "uncovered. Your score is determined by the # of bombs you hit and the option" & Chr(10) msgStrB = msgStrB & "that you selected. The highest possible score is 1000. Since this is a long " & Chr(10) msgStrB = msgStrB & "game (minimum of 448 moves), it was made to be saved at any stage." & Chr(10) MsgBox msgStr & msgStrA & msgStrB, , "Mine3D Game Instructions" End Sub Sub AboutThisGame() msgStr = "The inspiration for this game came from someone who thought that a " & Chr(10) msgStr = msgStr & "previous game that I had made was similar to a minesweeper-style" & Chr(10) msgStr = msgStr & "game. I overcame several technical challenges in the making of this" & Chr(10) msgStr = msgStr & "game, not the least of which was dealing with how Excel handles " & Chr(10) msgStr = msgStr & "circular references. Feel free to dig into the guts of the game to find" & Chr(10) msgStr = msgStr & "out how I did this. All of the code is unprotected. You can use any parts" & Chr(10) msgStr = msgStr & "of it in your own projects, but do not modify the code in this workbook" & Chr(10) msgStr = msgStr & "in any way. I hope that you enjoy this game!" & Chr(10) & Chr(13) & Chr(13) msgStrA = "Contact David Hager at dchager@compuserve.com for Excel " & Chr(10) msgStrA = msgStrA & "consulting work." & Chr(10) MsgBox msgStr & msgStrA, , "About Mine3D..." End Sub ' Processing file: /opt/analyzer/scan_staging/323145ca9624446eb9185c8c7200831d.bin ' =============================================================================== ' Module streams: ' _VBA_PROJECT_CUR/VBA/ThisWorkbook - 24437 bytes ' Line #0: ' Line #1: ' Line #2: ' Dim ' VarDefn bCount (As Integer) ' Line #3: ' Line #4: ' FuncDefn (Private Sub Workbook_Open()) ' Line #5: ' ArgsCall ShotCount 0x0000 ' Line #6: ' EndSub ' Line #7: ' Line #8: ' FuncDefn (Private Sub Workbook_SheetSelectionChange(ByVal Sh As Object, ByVal Target As )) ' Line #9: ' Line #10: ' OnError TheReset ' Line #11: ' Line #12: ' Ld ShotCount ' IfBlock ' Line #13: ' LitStr 0x0002 "m3" ' LitStr 0x0003 "lv1" ' ArgsLd Worksheets 0x0001 ' ArgsMemLd Range 0x0001 ' MemLd Value ' LitDI2 0x0001 ' Add ' St TheLevel ' Line #14: ' LitDI2 0x03E8 ' Ld TheLevel ' LitDI2 0x0003 ' Mul ' Ld bCount ' Mul ' Paren ' Sub ' St TheScore ' Line #15: ' LitStr 0x0020 "The game is over! Your score is " ' Ld TheScore ' Concat ' LitStr 0x000D " out of 1000." ' Concat ' ParamOmitted ' LitStr 0x0010 "Congratulations!" ' ArgsCall MsgBox 0x0003 ' Line #16: ' ExitSub ' Line #17: ' EndIfBlock ' Line #18: ' Line #19: ' StartWithExpr ' Ld Target ' With ' Line #20: ' Line #21: ' MemLdWith Address ' LitStr 0x0002 "m1" ' ArgsLd Range 0x0001 ' MemLd Address ' Eq ' IfBlock ' Line #22: ' Line #23: ' LitVarSpecial (False) ' Ld Application ' MemSt ScreenUpdating ' Line #24: ' Line #25: ' LitVarSpecial (False) ' Ld Application ' MemSt EnableEvents ' Line #26: ' Line #27: ' MemLdWith Value ' LitStr 0x0012 "Mark Bomb Position" ' Eq ' IfBlock ' Line #28: ' Line #29: ' StartForVariable ' Ld y ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0008 ' For ' Line #30: ' SetStmt ' LitStr 0x0002 "lv" ' Ld y ' Concat ' ArgsLd Worksheets 0x0001 ' Set lvSheet ' Line #31: ' StartWithExpr ' Ld lvSheet ' With ' Line #32: ' ArgsMemCallWith Unprotect 0x0000 ' Line #33: ' LitStr 0x0010 "Bomb Marking OFF" ' LitStr 0x0002 "m1" ' ArgsMemLdWith Range 0x0001 ' MemSt Value ' Line #34: ' ArgsMemCallWith Protect 0x0000 ' Line #35: ' EndWith ' Line #36: ' StartForVariable ' Next ' Line #37: ' Line #38: ' ElseBlock ' Line #39: ' Line #40: ' StartForVariable ' Ld z ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0008 ' For ' Line #41: ' SetStmt ' LitStr 0x0002 "lv" ' Ld z ' Concat ' ArgsLd Worksheets 0x0001 ' Set lvSheet ' Line #42: ' StartWithExpr ' Ld lvSheet ' With ' Line #43: ' ArgsMemCallWith Unprotect 0x0000 ' Line #44: ' LitStr 0x0012 "Mark Bomb Position" ' LitStr 0x0002 "m1" ' ArgsMemLdWith Range 0x0001 ' MemSt Value ' Line #45: ' ArgsMemCallWith Protect 0x0000 ' Line #46: ' EndWith ' Line #47: ' StartForVariable ' Next ' Line #48: ' Line #49: ' EndIfBlock ' Line #50: ' Line #51: ' LitVarSpecial (True) ' Ld Application ' MemSt EnableEvents ' Line #52: ' Line #53: ' LitVarSpecial (True) ' Ld Application ' MemSt ScreenUpdating ' Line #54: ' Line #55: ' ExitSub ' Line #56: ' Line #57: ' EndIfBlock ' Line #58: ' Line #59: ' Ld ShotCount ' If ' BoSImplicit ' ExitSub ' EndIf ' Line #60: ' Line #61: ' Ld ActiveCell ' MemLd Address ' MemLdWith Address ' Ne ' If ' BoSImplicit ' ExitSub ' EndIf ' QuoteRem 0x0036 0x0024 "if it is not a single cell selection" ' Line #62: ' Line #63: ' Line #64: ' Ld strRange ' ArgsLd Range 0x0001 ' Ld Target ' ArgsLd Intersect 0x0002 ' LitNothing ' Is ' If ' BoSImplicit ' ExitSub ' EndIf ' QuoteRem 0x0045 0x0024 "if the selection is not on the board" ' Line #65: ' Line #66: ' MemLdWith Interior ' MemLd PatternColorIndex ' Ld xlNone ' Eq ' If ' BoSImplicit ' ExitSub ' EndIf ' QuoteRem 0x003D 0x001F "if the cell is already unhidden" ' Line #67: ' Line #68: ' Ld ActiveSheet ' ArgsMemCall Unprotect 0x0000 ' Line #69: ' Line #70: ' LitStr 0x0002 "m1" ' ArgsLd Range 0x0001 ' MemLd Value ' LitStr 0x0012 "Mark Bomb Position" ' Eq ' IfBlock ' Line #71: ' Line #72: ' Line #73: ' MemLdWith NumberFormat ' LitStr 0x0011 ""?" ;"?";"?" ;"?"" ' Eq ' IfBlock ' Line #74: ' Line #75: ' LitStr 0x000D """ ;"";"" ;""" ' MemStWith NumberFormat ' Line #76: ' LitDI2 0x000F ' MemLdWith Font ' MemSt ColorIndex ' Line #77: ' LitStr 0x0006 "Normal" ' MemLdWith Font ' MemSt FontStyle ' Line #78: ' MemLdWith Value ' LitStr 0x0001 "M" ' Eq ' IfBlock ' Line #79: ' LitStr 0x0009 "Wingdings" ' MemLdWith Font ' MemSt New ' Line #80: ' EndIfBlock ' Line #81: ' Ld ActiveSheet ' ArgsMemCall Protect 0x0000 ' Line #82: ' ExitSub ' Line #83: ' Line #84: ' ElseBlock ' Line #85: ' Line #86: ' LitStr 0x0007 "General" ' MemStWith NumberFormat ' Line #87: ' Ld xlNone ' MemLdWith Interior ' MemSt PatternColorIndex ' Line #88: ' Ld xlAutomatic ' MemLdWith Font ' MemSt ColorIndex ' Line #89: ' Line #90: ' EndIfBlock ' Line #91: ' Line #92: ' MemLdWith Value ' LitStr 0x0001 "M" ' Eq ' IfBlock ' Line #93: ' ArgsCall ShotCount 0x0000 ' Line #94: ' Ld bCount ' LitDI2 0x0001 ' Gt ' IfBlock ' Line #95: ' LitStr 0x0006 " bombs" ' St bString ' Line #96: ' ElseBlock ' Line #97: ' LitStr 0x0005 " bomb" ' St bString ' Line #98: ' EndIfBlock ' Line #99: ' LitStr 0x0007 "KABOOM!" ' ParamOmitted ' LitStr 0x000D "You have hit " ' Ld bCount ' Concat ' Ld bString ' Concat ' LitStr 0x0008 " so far!" ' Concat ' ArgsCall MsgBox 0x0003 ' Line #100: ' EndIfBlock ' Line #101: ' Line #102: ' ElseBlock ' Line #103: ' Line #104: ' Line #105: ' MemLdWith NumberFormat ' LitStr 0x0011 ""?" ;"?";"?" ;"?"" ' Eq ' If ' BoSImplicit ' ExitSub ' EndIf ' Line #106: ' MemLdWith Interior ' MemLd PatternColorIndex ' Ld xlNone ' Eq ' If ' BoSImplicit ' ExitSub ' EndIf ' Line #107: ' LitStr 0x0011 ""?" ;"?";"?" ;"?"" ' MemStWith NumberFormat ' Line #108: ' StartWithExpr ' MemLdWith Font ' With ' Line #109: ' LitStr 0x0005 "Arial" ' MemStWith New ' Line #110: ' LitStr 0x0004 "Bold" ' MemStWith FontStyle ' Line #111: ' LitDI2 0x0003 ' MemStWith ColorIndex ' Line #112: ' EndWith ' Line #113: ' Line #114: ' EndIfBlock ' Line #115: ' Line #116: ' EndWith ' Line #117: ' Line #118: ' Ld ActiveSheet ' ArgsMemCall Protect 0x0000 ' Line #119: ' Line #120: ' Label TheReset ' Line #121: ' Ld ActiveSheet ' ArgsMemCall Protect 0x0000 ' Line #122: ' LitVarSpecial (True) ' Ld Application ' MemSt EnableEvents ' Line #123: ' EndSub ' Line #124: ' Line #125: ' FuncDefn (Function ShotCount(id_FFFE As Boolean) As Boolean) ' Line #126: ' LitVarSpecial (False) ' St ShotCount ' Line #127: ' LitDI2 0x0000 ' St sCount ' Line #128: ' LitDI2 0x0000 ' St bCount ' Line #129: ' StartForVariable ' Ld s ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0008 ' For ' Line #130: ' StartForVariable ' Ld sCell ' EndForVariable ' Ld strRange ' LitStr 0x0002 "lv" ' Ld s ' Concat ' ArgsLd Worksheets 0x0001 ' ArgsMemLd Range 0x0001 ' ForEach ' Line #131: ' Ld sCell ' MemLd Font ' MemLd ColorIndex ' Ld xlAutomatic ' Eq ' IfBlock ' Line #132: ' Ld sCount ' LitDI2 0x0001 ' Add ' St sCount ' Line #133: ' EndIfBlock ' Line #134: ' Ld sCell ' MemLd Font ' MemLd New ' LitStr 0x0009 "Wingdings" ' Eq ' Ld sCell ' MemLd Font ' MemLd ColorIndex ' Ld xlAutomatic ' Eq ' And ' IfBlock ' Line #135: ' Ld bCount ' LitDI2 0x0001 ' Add ' St bCount ' Line #136: ' EndIfBlock ' Line #137: ' StartForVariable ' Next ' Line #138: ' StartForVariable ' Next ' Line #139: ' Ld sCount ' Ld bCount ' Sub ' St fCount ' Line #140: ' Ld fCount ' LitDI2 0x01C0 ' Eq ' IfBlock ' Line #141: ' LitVarSpecial (True) ' St ShotCount ' Line #142: ' EndIfBlock ' Line #143: ' EndFunc ' _VBA_PROJECT_CUR/VBA/Sheet1 - 4848 bytes ' Error: unpack_from requires a buffer of at least 2387629 bytes for unpacking 2 bytes at offset 2387627 (actual buffer size is 4848). ' _VBA_PROJECT_CUR/VBA/Sheet2 - 1934 bytes ' Line #0: ' _VBA_PROJECT_CUR/VBA/Sheet211 - 1682 bytes ' _VBA_PROJECT_CUR/VBA/Sheet11 - 1681 bytes ' _VBA_PROJECT_CUR/VBA/Sheet21 - 2199 bytes ' Line #0: ' _VBA_PROJECT_CUR/VBA/Sheet12 - 1681 bytes ' _VBA_PROJECT_CUR/VBA/Sheet22 - 1681 bytes ' _VBA_PROJECT_CUR/VBA/Sheet111 - 1682 bytes ' _VBA_PROJECT_CUR/VBA/modMain - 24306 bytes ' Line #0: ' Dim (Public Const) ' LitStr 0x0005 "a1:h8" ' VarDefn strRange ' Line #1: ' Line #2: ' Line #3: ' FuncDefn (Sub ResetGameBoard()) ' Line #4: ' Line #5: ' LitVarSpecial (False) ' Ld Application ' MemSt ScreenUpdating ' Line #6: ' Line #7: ' StartWithExpr ' Ld Application ' With ' Line #8: ' MemLdWith Calculation ' St calcVar ' Line #9: ' MemLdWith Iteration ' St bIter ' Line #10: ' MemLdWith MaxIterations ' St vMaxIter ' Line #11: ' Ld xlManual ' MemStWith Calculation ' Line #12: ' LitVarSpecial (True) ' MemStWith Iteration ' Line #13: ' LitDI2 0x03E8 ' MemStWith MaxIterations ' Line #14: ' EndWith ' Line #15: ' Line #16: ' StartForVariable ' Ld c ' EndForVariable ' LitDI2 0x0001 ' LitDI2 0x0008 ' For ' Line #17: ' Line #18: ' SetStmt ' LitStr 0x0002 "ms" ' Ld c ' Concat ' ArgsLd Sheets 0x0001 ' Set mSht ' Line #19: ' SetStmt ' LitStr 0x0002 "lv" ' Ld c ' Concat ' ArgsLd Sheets 0x0001 ' Set bSht ' Line #20: ' Line #21: ' StartWithExpr ' Ld bSht ' With ' Line #22: ' ArgsMemCallWith Unprotect 0x0000 ' Line #23: ' LitStr 0x0012 "Mark Bomb Position" ' LitStr 0x0002 "m1" ' ArgsMemLdWith Range 0x0001 ' MemSt Value ' Line #24: ' Ld strRange ' ArgsMemLdWith Range 0x0001 ' ParamNamed Destination ' Ld strRange ' Ld mSht ' ArgsMemLd Range 0x0001 ' ArgsMemCall Copy 0x0001 ' Line #25: ' Line #26: ' ArgsCall Read 0x0000 ' Line #27: ' Line #28: ' LitDI2 0x0000 ' St n ' Line #29: ' Line #30: ' Ld n ' LitDI2 0x0007 ' Gt ' DoUnitil ' Line #31: ' LitDI2 0x0008 ' Ld Rnd ' Mul ' Paren ' FnInt ' St x ' Line #32: ' LitDI2 0x0008 ' Ld Rnd ' Mul ' Paren ' FnInt ' St y ' Line #33: ' StartWithExpr ' LitDI2 0x0001 ' LitDI2 0x0001 ' Ld x ' Ld y ' Ld strRange ' ArgsMemLdWith Range 0x0001 ' ArgsMemLd Offset 0x0002 ' ArgsMemLd Resize 0x0002 ' With ' Line #34: ' MemLdWith Formula ' LitStr 0x0001 "M" ' Ne ' IfBlock ' Line #35: ' LitStr 0x0001 "M" ' MemStWith Formula ' Line #36: ' LitStr 0x0009 "Wingdings" ' MemLdWith Font ' MemSt New ' Line #37: ' Ld n ' LitDI2 0x0001 ' Add ' St n ' Line #38: ' EndIfBlock ' Line #39: ' EndWith ' Line #40: ' Loop ' Line #41: ' Line #42: ' EndWith ' Line #43: ' Line #44: ' StartForVariable ' Next ' Line #45: ' Line #46: ' ArgsCall Calculate 0x0000 ' Line #47: ' Line #48: ' StartForVariable ' Ld False ' EndForVariable …
`embedded_office_0002fff0.exe`	embedded-pe	Office MZ+PE at offset 0x2FFF0	204816 bytes
SHA-256: `3a7c9a99a033ba891cff085754552250ac10fca29cb4ee20b3b0f6dd3d27f724`

Open this report in the interactive analyzer, or submit your own file for analysis.