Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 693f3e275f773971…

MALICIOUS

Office (OLE)

112.0 KB Created: 2010-03-25 15:26:00 First seen: 2026-05-11
MD5: bd4d4d083dc7ade78dc3f181e5fe8116 SHA-1: 2b62e713159a563bb4381bf3143cfadcfa4001b0 SHA-256: 693f3e275f773971743238d1782d948c52686de7238fc7515d5d39a595530435
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File

The sample is a malicious Office document containing VBA macros. The macros utilize `CreateObject` to instantiate a COM object, `EtQOfficeInt.General`, which is likely used to download and execute a second-stage payload. The document body is a plausible lure for a shipping authorization, designed to encourage the recipient to open the malicious macro.

Heuristics 3

  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
           ThisDocument.VBProject.VBComponents("ThisDocument").CodeModule.InsertLines i, arrCtrls
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set OffInt = CreateObject("EtQOfficeInt.General")

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 18423 bytes
SHA-256: 6d98578d480d618dc6eff02e989d1fc8c802e24fbfa810d4c6a7dca96b2f5b16
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Attribute VB_Control = "EffectiveDate, 6, 1, MSForms, TextBox"
Attribute VB_Control = "ApproverList, 5, 2, MSForms, TextBox"
Attribute VB_Control = "DisDocType, 4, 3, MSForms, TextBox"
Attribute VB_Control = "EditRevision, 3, 4, MSForms, TextBox"
Attribute VB_Control = "EditDocNum, 2, 5, MSForms, TextBox"
Attribute VB_Control = "WorkflowStatus, 1, 6, MSForms, TextBox"
Attribute VB_Control = "DocName, 0, 7, MSForms, TextBox"
Public unid As String
Public database As String
Public engine As String
Public hostName As String
Public Port As String
Public fieldName As String
Public uid As String
Public unames As String
Public spwd As Boolean
Public WBProtocol As String
Public EventsCode As String
Public OffInt As Object

Public Sub Init()
    unid = "{BAD31A8352A413BA852571B700629A7C}"
    database = "/live/docwork.nsf"
    engine = "/live/engine.nsf"
    hostName = "lorntas03"
    Port = ""
    fieldName = "Attachments"
    uid = "CN=Lisa Mathews/O=ISSL"
    unames = "Lisa Mathews/ISSL,Lisa Mathews,lmathews"
    spwd = True
    WBProtocol = "http:"
End Sub

Public Function Save2EtQ(cDoc As Object) As Boolean

    On Error GoTo ErrHandler

    Save2EtQ = False
    Init
    Set OffInt = CreateObject("EtQOfficeInt.General")
    If OffInt.Initialize(unid, database, engine, hostName, Port, uid, unames, fieldName, 0, spwd, WBProtocol) Then
        Save2EtQ = OffInt.SaveFile(cDoc)
    End If
    Set OffInt = Nothing
    Exit Function

ErrHandler:
    Save2EtQ = False
    Set OffInt = Nothing
    MsgBox "Error Saving file to EtQ: " & Err.Number & " , " & Err.Description, vbCritical, "EtQ FW Office Integration"
End Function

Public Sub SaveToEtQ()
    If Save2EtQ(ThisDocument) Then
        If MsgBox("Would you like to quit the application?", vbYesNo, "EtQ FW Office Integration") = vbYes Then
            ThisDocument.Save
            Application.Quit 0
        End If
    End If
End Sub

Private Sub Document_Close()
    DeleteMenuItem
    ThisDocument.Save
    Application.NormalTemplate.Saved = True
End Sub


Public Sub EtQOpen()

    On Error GoTo ErrHandler

    Init
    Set OffInt = CreateObject("EtQOfficeInt.General")
    If OffInt.Initialize(unid, database, engine, hostName, Port, uid, unames, fieldName, 0, spwd, WBProtocol) Then
        If OffInt.OpenWordFile(ThisDocument) Then
            ImplementEvents EventsCode
            ImplementIcons
            ThisDocument.Save
        End If
    End If
    Set OffInt = Nothing
    Exit Sub

ErrHandler:
    Set OffInt = Nothing
    MsgBox "Error Opening file: " & Err.Number & " , " & Err.Description, vbCritical, "EtQ FW Office Integration"
End Sub

Public Sub ImplementEvents(arrCtrls As String)

    Dim i As Integer

    On Error GoTo ErrHandler

    If arrCtrls <> "" Then
       i = ThisDocument.VBProject.VBComponents("ThisDocument").CodeModule.CountOfLines
       ThisDocument.VBProject.VBComponents("ThisDocument").CodeModule.InsertLines i, arrCtrls
    End If
    Exit Sub

ErrHandler:
    MsgBox "Error in Implementing Events: " & Err.Number & " , " & Err.Description, vbCritical, "EtQ FW Office Integration"
End Sub

Public Function ImplementIcons() As Boolean

Dim Ctrl As Object
On Error GoTo ErrHandler

For Each Ctrl In ThisDocument.InlineShapes
   If (Ctrl.Type = 5) And Not (Ctrl.OLEFormat Is Nothing) Then
      If (InStr(1, Ctrl.OLEFormat.ProgID, "Forms.", vbTextCompare) > 0) And Not (Ctrl.OLEFormat.Object Is Nothing) Then
           If Ctrl.OLEFormat.Object.MousePointer = 99 Then
               Ctrl.OLEFormat.Object.MouseIcon = LoadPicture("C:\WINDOWS\Temp\DBClick.ico")
           End If
      End If
    End If
Next
For Each Ctrl In ThisDocument.Shapes
   If (Ctrl.Type = 5) And Not (Ctrl.OLEFormat Is Nothing) Then
      If (InStr(1, Ctrl.OLEFormat.ProgID, "Forms.", vbTextCompare) > 0) And Not (Ctrl.OLEFormat.Object Is Nothing) Then
           If Ctrl.OLEFormat.Object.MousePointer = 99 Then
               Ctrl.OLEFormat.Object.MouseIcon = LoadPicture("C:\WINDOWS\Temp\DBClick.ico")
           End If
      End If
    End If
Next
Exit Function

ErrHandler:
MsgBox "Error in Implementing Icons: " & Err.Number & " , " & Err.Description, vbCritical, "EtQ FW Office Integration"
End Function

Private Function DeleteMenuItem() As Boolean
Dim Comm As Object
Dim ComFwe5 As Object
Dim CtrlFwe5 As Object
Dim CtrlFile As Object
Dim CtrlSave As Object

On Error GoTo ErrHandler

    DeleteMenuItem = True

    For Each Comm In Application.CommandBars
        If Comm.Name = "Menu Bar" Then
            Set ComFwe5 = Comm
            Exit For
        End If
    Next

    If Not (ComFwe5 Is Nothing) Then
        For Each CtrlFwe5 In ComFwe5.Controls
            If CtrlFwe5.Caption = "&File" Then
                Set CtrlFile = CtrlFwe5
                Exit For
            End If
        Next
    End If

    If Not (CtrlFile Is Nothing) Then
       For Each CtrlFwe5 In CtrlFile.Controls
           If CtrlFwe5.Caption = "Save to Et&Q" Then
               Set CtrlSave = CtrlFwe5
               Exit For
            End If
        Next
    End If

    If Not (CtrlSave Is Nothing) Then
        CtrlSave.Delete
    End If

    Exit Function

ErrHandler:
    DeleteMenuItem = False
    Err.Clear
    Resume Next

End Function

Public Function ShowDialog(CtrlName As String, Ctrl As Object) As Boolean

    On Error GoTo ErrHandler

    ShowDialog = False
    Init
    Set OffInt = CreateObject("EtQOfficeInt.General")
    If OffInt.Initialize(unid, database, engine, hostName, Port, uid, unames, fieldName, True, spwd, WBProtocol) Then
        ShowDialog = OffInt.GetDialog(CtrlName, Ctrl, 1)
    End If
    Set OffInt = Nothing
    Exit Function

ErrHandler:
    ShowDialog = False
    Set OffInt = Nothing
    MsgBox "Error Showing Dialog: " & Err.Number & " , " & Err.Description, vbCritical, "EtQ FW Office Integration"
End Function



' Processing file: /tmp/qstore_f3ukspmw
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 11440 bytes
' Line #0:
' 	Dim (Public) 
' 	VarDefn unid (As String)
' Line #1:
' 	Dim (Public) 
' 	VarDefn Database (As String)
' Line #2:
' 	Dim (Public) 
' 	VarDefn engine (As String)
' Line #3:
' 	Dim (Public) 
' 	VarDefn hostName (As String)
' Line #4:
' 	Dim (Public) 
' 	VarDefn Port (As String)
' Line #5:
' 	Dim (Public) 
' 	VarDefn fieldName (As String)
' Line #6:
' 	Dim (Public) 
' 	VarDefn uid (As String)
' Line #7:
' 	Dim (Public) 
' 	VarDefn unames (As String)
' Line #8:
' 	Dim (Public) 
' 	VarDefn spwd (As Boolean)
' Line #9:
' 	Dim (Public) 
' 	VarDefn WBProtocol (As String)
' Line #10:
' 	Dim (Public) 
' 	VarDefn EventsCode (As String)
' Line #11:
' 	Dim (Public) 
' 	VarDefn OffInt (As Object)
' Line #12:
' Line #13:
' 	FuncDefn (Public Sub Init())
' Line #14:
' 	LitStr 0x0022 "{BAD31A8352A413BA852571B700629A7C}"
' 	St unid 
' Line #15:
' 	LitStr 0x0011 "/live/docwork.nsf"
' 	St Database 
' Line #16:
' 	LitStr 0x0010 "/live/engine.nsf"
' 	St engine 
' Line #17:
' 	LitStr 0x0009 "lorntas03"
' 	St hostName 
' Line #18:
' 	LitStr 0x0000 ""
' 	St Port 
' Line #19:
' 	LitStr 0x000B "Attachments"
' 	St fieldName 
' Line #20:
' 	LitStr 0x0016 "CN=Lisa Mathews/O=ISSL"
' 	St uid 
' Line #21:
' 	LitStr 0x0027 "Lisa Mathews/ISSL,Lisa Mathews,lmathews"
' 	St unames 
' Line #22:
' 	LitVarSpecial (True)
' 	St spwd 
' Line #23:
' 	LitStr 0x0005 "http:"
' 	St WBProtocol 
' Line #24:
' 	EndSub 
' Line #25:
' Line #26:
' 	FuncDefn (Public Function Save2EtQ(cDoc As Object, id_FFFE As Boolean) As Boolean)
' Line #27:
' Line #28:
' 	OnError ErrHandler 
' Line #29:
' Line #30:
' 	LitVarSpecial (False)
' 	St Save2EtQ 
' Line #31:
' 	ArgsCall Init 0x0000 
' Line #32:
' 	SetStmt 
' 	LitStr 0x0014 "EtQOfficeInt.General"
' 	ArgsLd CreateObject 0x0001 
' 	Set OffInt 
' Line #33:
' 	Ld unid 
' 	Ld Database 
' 	Ld engine 
' 	Ld hostName 
' 	Ld Port 
' 	Ld uid 
' 	Ld unames 
' 	Ld fieldName 
' 	LitDI2 0x0000 
' 	Ld spwd 
' 	Ld WBProtocol 
' 	Ld OffInt 
' 	ArgsMemLd Initialize 0x000B 
' 	IfBlock 
' Line #34:
' 	Ld cDoc 
' 	Ld OffInt 
' 	ArgsMemLd SaveFile 0x0001 
' 	St Save2EtQ 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #37:
' 	ExitFunc 
' Line #38:
' Line #39:
' 	Label ErrHandler 
' Line #40:
' 	LitVarSpecial (False)
' 	St Save2EtQ 
' Line #41:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #42:
' 	LitStr 0x001A "Error Saving file to EtQ: "
' 	Ld Err 
' 	MemLd Number 
' 	Concat 
' 	LitStr 0x0003 " , "
' 	Concat 
' 	Ld Err 
' 	MemLd Description 
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsCall MsgBox 0x0003 
' Line #43:
' 	EndFunc 
' Line #44:
' Line #45:
' 	FuncDefn (Public Sub SaveToEtQ())
' Line #46:
' 	Ld ThisDocument 
' 	ArgsLd Save2EtQ 0x0001 
' 	IfBlock 
' Line #47:
' 	LitStr 0x0027 "Would you like to quit the application?"
' 	Ld vbYesNo 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsLd MsgBox 0x0003 
' 	Ld vbYes 
' 	Eq 
' 	IfBlock 
' Line #48:
' 	Ld ThisDocument 
' 	ArgsMemCall Save 0x0000 
' Line #49:
' 	LitDI2 0x0000 
' 	Ld Application 
' 	ArgsMemCall Quit 0x0001 
' Line #50:
' 	EndIfBlock 
' Line #51:
' 	EndIfBlock 
' Line #52:
' 	EndSub 
' Line #53:
' Line #54:
' 	FuncDefn (Private Sub Document_Close())
' Line #55:
' 	ArgsCall DeleteMenuItem 0x0000 
' Line #56:
' 	Ld ThisDocument 
' 	ArgsMemCall Save 0x0000 
' Line #57:
' 	LitVarSpecial (True)
' 	Ld Application 
' 	MemLd NormalTemplate 
' 	MemSt Saved 
' Line #58:
' 	EndSub 
' Line #59:
' Line #60:
' Line #61:
' 	FuncDefn (Public Sub EtQOpen())
' Line #62:
' Line #63:
' 	OnError ErrHandler 
' Line #64:
' Line #65:
' 	ArgsCall Init 0x0000 
' Line #66:
' 	SetStmt 
' 	LitStr 0x0014 "EtQOfficeInt.General"
' 	ArgsLd CreateObject 0x0001 
' 	Set OffInt 
' Line #67:
' 	Ld unid 
' 	Ld Database 
' 	Ld engine 
' 	Ld hostName 
' 	Ld Port 
' 	Ld uid 
' 	Ld unames 
' 	Ld fieldName 
' 	LitDI2 0x0000 
' 	Ld spwd 
' 	Ld WBProtocol 
' 	Ld OffInt 
' 	ArgsMemLd Initialize 0x000B 
' 	IfBlock 
' Line #68:
' 	Ld ThisDocument 
' 	Ld OffInt 
' 	ArgsMemLd OpenWordFile 0x0001 
' 	IfBlock 
' Line #69:
' 	Ld EventsCode 
' 	ArgsCall ImplementEvents 0x0001 
' Line #70:
' 	ArgsCall ImplementIcons 0x0000 
' Line #71:
' 	Ld ThisDocument 
' 	ArgsMemCall Save 0x0000 
' Line #72:
' 	EndIfBlock 
' Line #73:
' 	EndIfBlock 
' Line #74:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #75:
' 	ExitSub 
' Line #76:
' Line #77:
' 	Label ErrHandler 
' Line #78:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #79:
' 	LitStr 0x0014 "Error Opening file: "
' 	Ld Err 
' 	MemLd Number 
' 	Concat 
' 	LitStr 0x0003 " , "
' 	Concat 
' 	Ld Err 
' 	MemLd Description 
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsCall MsgBox 0x0003 
' Line #80:
' 	EndSub 
' Line #81:
' Line #82:
' 	FuncDefn (Public Sub ImplementEvents(arrCtrls As String))
' Line #83:
' Line #84:
' 	Dim 
' 	VarDefn i (As Integer)
' Line #85:
' Line #86:
' 	OnError ErrHandler 
' Line #87:
' Line #88:
' 	Ld arrCtrls 
' 	LitStr 0x0000 ""
' 	Ne 
' 	IfBlock 
' Line #89:
' 	LitStr 0x000C "ThisDocument"
' 	Ld ThisDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	MemLd CountOfLines 
' 	St i 
' Line #90:
' 	Ld i 
' 	Ld arrCtrls 
' 	LitStr 0x000C "ThisDocument"
' 	Ld ThisDocument 
' 	MemLd VBProject 
' 	ArgsMemLd VBComponents 0x0001 
' 	MemLd CodeModule 
' 	ArgsMemCall InsertLines 0x0002 
' Line #91:
' 	EndIfBlock 
' Line #92:
' 	ExitSub 
' Line #93:
' Line #94:
' 	Label ErrHandler 
' Line #95:
' 	LitStr 0x001E "Error in Implementing Events: "
' 	Ld Err 
' 	MemLd Number 
' 	Concat 
' 	LitStr 0x0003 " , "
' 	Concat 
' 	Ld Err 
' 	MemLd Description 
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsCall MsgBox 0x0003 
' Line #96:
' 	EndSub 
' Line #97:
' Line #98:
' 	FuncDefn (Public Function ImplementIcons(id_FFFE As Boolean) As Boolean)
' Line #99:
' Line #100:
' 	Dim 
' 	VarDefn Ctrl (As Object)
' Line #101:
' 	OnError ErrHandler 
' Line #102:
' Line #103:
' 	StartForVariable 
' 	Ld Ctrl 
' 	EndForVariable 
' 	Ld ThisDocument 
' 	MemLd InlineShapes 
' 	ForEach 
' Line #104:
' 	Ld Ctrl 
' 	MemLd Type 
' 	LitDI2 0x0005 
' 	Eq 
' 	Paren 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	And 
' 	IfBlock 
' Line #105:
' 	LitDI2 0x0001 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd ProgID 
' 	LitStr 0x0006 "Forms."
' 	Ld vbTextCompare 
' 	FnInStr4 
' 	LitDI2 0x0000 
' 	Gt 
' 	Paren 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	And 
' 	IfBlock 
' Line #106:
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	MemLd MousePointer 
' 	LitDI2 0x0063 
' 	Eq 
' 	IfBlock 
' Line #107:
' 	LitStr 0x001B "C:\WINDOWS\Temp\DBClick.ico"
' 	ArgsLd LoadPicture 0x0001 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	MemSt MouseIcon 
' Line #108:
' 	EndIfBlock 
' Line #109:
' 	EndIfBlock 
' Line #110:
' 	EndIfBlock 
' Line #111:
' 	StartForVariable 
' 	Next 
' Line #112:
' 	StartForVariable 
' 	Ld Ctrl 
' 	EndForVariable 
' 	Ld ThisDocument 
' 	MemLd Shapes 
' 	ForEach 
' Line #113:
' 	Ld Ctrl 
' 	MemLd Type 
' 	LitDI2 0x0005 
' 	Eq 
' 	Paren 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	And 
' 	IfBlock 
' Line #114:
' 	LitDI2 0x0001 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd ProgID 
' 	LitStr 0x0006 "Forms."
' 	Ld vbTextCompare 
' 	FnInStr4 
' 	LitDI2 0x0000 
' 	Gt 
' 	Paren 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	And 
' 	IfBlock 
' Line #115:
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	MemLd MousePointer 
' 	LitDI2 0x0063 
' 	Eq 
' 	IfBlock 
' Line #116:
' 	LitStr 0x001B "C:\WINDOWS\Temp\DBClick.ico"
' 	ArgsLd LoadPicture 0x0001 
' 	Ld Ctrl 
' 	MemLd OLEFormat 
' 	MemLd Object 
' 	MemSt MouseIcon 
' Line #117:
' 	EndIfBlock 
' Line #118:
' 	EndIfBlock 
' Line #119:
' 	EndIfBlock 
' Line #120:
' 	StartForVariable 
' 	Next 
' Line #121:
' 	ExitFunc 
' Line #122:
' Line #123:
' 	Label ErrHandler 
' Line #124:
' 	LitStr 0x001D "Error in Implementing Icons: "
' 	Ld Err 
' 	MemLd Number 
' 	Concat 
' 	LitStr 0x0003 " , "
' 	Concat 
' 	Ld Err 
' 	MemLd Description 
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsCall MsgBox 0x0003 
' Line #125:
' 	EndFunc 
' Line #126:
' Line #127:
' 	FuncDefn (Private Function DeleteMenuItem(id_FFFE As Boolean) As Boolean)
' Line #128:
' 	Dim 
' 	VarDefn Comm (As Object)
' Line #129:
' 	Dim 
' 	VarDefn ComFwe5 (As Object)
' Line #130:
' 	Dim 
' 	VarDefn CtrlFwe5 (As Object)
' Line #131:
' 	Dim 
' 	VarDefn CtrlFile (As Object)
' Line #132:
' 	Dim 
' 	VarDefn CtrlSave (As Object)
' Line #133:
' Line #134:
' 	OnError ErrHandler 
' Line #135:
' Line #136:
' 	LitVarSpecial (True)
' 	St DeleteMenuItem 
' Line #137:
' Line #138:
' 	StartForVariable 
' 	Ld Comm 
' 	EndForVariable 
' 	Ld Application 
' 	MemLd CommandBars 
' 	ForEach 
' Line #139:
' 	Ld Comm 
' 	MemLd Name 
' 	LitStr 0x0008 "Menu Bar"
' 	Eq 
' 	IfBlock 
' Line #140:
' 	SetStmt 
' 	Ld Comm 
' 	Set ComFwe5 
' Line #141:
' 	ExitFor 
' Line #142:
' 	EndIfBlock 
' Line #143:
' 	StartForVariable 
' 	Next 
' Line #144:
' Line #145:
' 	Ld ComFwe5 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	IfBlock 
' Line #146:
' 	StartForVariable 
' 	Ld CtrlFwe5 
' 	EndForVariable 
' 	Ld ComFwe5 
' 	MemLd Controls 
' 	ForEach 
' Line #147:
' 	Ld CtrlFwe5 
' 	MemLd Caption 
' 	LitStr 0x0005 "&File"
' 	Eq 
' 	IfBlock 
' Line #148:
' 	SetStmt 
' 	Ld CtrlFwe5 
' 	Set CtrlFile 
' Line #149:
' 	ExitFor 
' Line #150:
' 	EndIfBlock 
' Line #151:
' 	StartForVariable 
' 	Next 
' Line #152:
' 	EndIfBlock 
' Line #153:
' Line #154:
' 	Ld CtrlFile 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	IfBlock 
' Line #155:
' 	StartForVariable 
' 	Ld CtrlFwe5 
' 	EndForVariable 
' 	Ld CtrlFile 
' 	MemLd Controls 
' 	ForEach 
' Line #156:
' 	Ld CtrlFwe5 
' 	MemLd Caption 
' 	LitStr 0x000C "Save to Et&Q"
' 	Eq 
' 	IfBlock 
' Line #157:
' 	SetStmt 
' 	Ld CtrlFwe5 
' 	Set CtrlSave 
' Line #158:
' 	ExitFor 
' Line #159:
' 	EndIfBlock 
' Line #160:
' 	StartForVariable 
' 	Next 
' Line #161:
' 	EndIfBlock 
' Line #162:
' Line #163:
' 	Ld CtrlSave 
' 	LitNothing 
' 	Is 
' 	Paren 
' 	Not 
' 	IfBlock 
' Line #164:
' 	Ld CtrlSave 
' 	ArgsMemCall Delete 0x0000 
' Line #165:
' 	EndIfBlock 
' Line #166:
' Line #167:
' 	ExitFunc 
' Line #168:
' Line #169:
' 	Label ErrHandler 
' Line #170:
' 	LitVarSpecial (False)
' 	St DeleteMenuItem 
' Line #171:
' 	Ld Err 
' 	ArgsMemCall Clear 0x0000 
' Line #172:
' 	Resume (Next) 
' Line #173:
' Line #174:
' 	EndFunc 
' Line #175:
' Line #176:
' 	FuncDefn (Public Function ShowDialog(CtrlName As String, Ctrl As Object, id_FFFE As Boolean) As Boolean)
' Line #177:
' Line #178:
' 	OnError ErrHandler 
' Line #179:
' Line #180:
' 	LitVarSpecial (False)
' 	St ShowDialog 
' Line #181:
' 	ArgsCall Init 0x0000 
' Line #182:
' 	SetStmt 
' 	LitStr 0x0014 "EtQOfficeInt.General"
' 	ArgsLd CreateObject 0x0001 
' 	Set OffInt 
' Line #183:
' 	Ld unid 
' 	Ld Database 
' 	Ld engine 
' 	Ld hostName 
' 	Ld Port 
' 	Ld uid 
' 	Ld unames 
' 	Ld fieldName 
' 	LitVarSpecial (True)
' 	Ld spwd 
' 	Ld WBProtocol 
' 	Ld OffInt 
' 	ArgsMemLd Initialize 0x000B 
' 	IfBlock 
' Line #184:
' 	Ld CtrlName 
' 	Ld Ctrl 
' 	LitDI2 0x0001 
' 	Ld OffInt 
' 	ArgsMemLd GetDialog 0x0003 
' 	St ShowDialog 
' Line #185:
' 	EndIfBlock 
' Line #186:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #187:
' 	ExitFunc 
' Line #188:
' Line #189:
' 	Label ErrHandler 
' Line #190:
' 	LitVarSpecial (False)
' 	St ShowDialog 
' Line #191:
' 	SetStmt 
' 	LitNothing 
' 	Set OffInt 
' Line #192:
' 	LitStr 0x0016 "Error Showing Dialog: "
' 	Ld Err 
' 	MemLd Number 
' 	Concat 
' 	LitStr 0x0003 " , "
' 	Concat 
' 	Ld Err 
' 	MemLd Description 
' 	Concat 
' 	Ld vbCritical 
' 	LitStr 0x0019 "EtQ FW Office Integration"
' 	ArgsCall MsgBox 0x0003 
' Line #193:
' 	EndFunc 
' Line #194:
' Line #195:

Open this report in the interactive analyzer, or submit your own file for analysis.