Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 929d736d4f055d90…

MALICIOUS

Office (OLE)

606.5 KB Created: 2015-05-22 19:38:00 Authoring application: Microsoft Office Word First seen: 2015-08-19
MD5: 2546e9943ace38d85d70e6fd2a220dcd SHA-1: d5a1b114c25a5ae602e26732d1616da538b50962 SHA-256: 929d736d4f055d90c9331b52bee68a921e400a1d9da6bc9e679e802bd2407ce3
386 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1204.002 Malicious File T1087.001 Local Accounts T1059.001 PowerShell

The sample contains VBA macros, indicated by the OLE_VBA_MACROS and OLE_VBA_WSCRIPT heuristics, which utilize WScript.Shell and CreateObject. The presence of an Auto_Open macro suggests an attempt to automatically execute code upon opening the document. The script also references Windows Script Host and uses Environ("CodebaseDir"), indicating it likely attempts to download and execute a second-stage payload. The self-replication heuristic suggests the macro may also attempt to tamper with AV or replicate itself.

Heuristics 13

  • VBA macros detected medium 6 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • WScript.Shell usage critical OLE_VBA_WSCRIPT
    WScript.Shell usage
    Matched line in script
        Set wsh = VBA.CreateObject("WScript.Shell")
  • VBA macro-virus self-replication / AV tampering critical OLE_VBA_MACRO_VIRUS_REPLICATION
    VBA macro programmatically rewrites VBA project code through the VBE object model (CodeModule/VBComponents InsertLines/DeleteLines/AddFromString or OrganizerCopy) to copy itself into the global template and other open documents, and/or disables Office macro-virus protection (Options.VirusProtection = False). This is the defining behavior of the W97M document macro-virus family — self-replicating code with no benign document use, independent of any AV signature.
    Matched line in script
            .InsertLines lineNum, " "
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
            Set FSO = CreateObject("Scripting.FileSystemObject")
  • Auto_Open macro low OLE_VBA_AUTO
    Auto_Open macro
    Matched line in script
        ' where this XLA is deployed, the dll is immediately unloaded after this auto_open method is
  • Auto_Close macro low OLE_VBA_AUTOCLOSE
    Auto_Close macro
    Matched line in script
        ' executed (as if Excel does not know that the dll is needed later in auto_close). With this
  • Environ() call (env variable access) low OLE_VBA_ENVIRON
    Environ() call (env variable access)
    Matched line in script
        codeBase = Environ("CodebaseDir")
  • Reference to Windows Script Host high SC_STR_WSCRIPT
    Reference to Windows Script Host
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Suspicious extracted artifact high EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sf.symcd.com0& In document text (OLE body)
    • http://ocsp.verisign.com0In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://logo.verisign.com/vslogo.gif0In document text (OLE body)
    • https://www.verisign.com/rpaIn document text (OLE body)
    • https://d.symcb.com/cps0%In document text (OLE body)
    • https://d.symcb.com/rpa0In document text (OLE body)
    • http://sf.symcb.com/sf.crl0WIn document text (OLE body)
    • http://sf.symcb.com/sf.crt0In document text (OLE body)
    • https://www.verisign.com/cps0*In document text (OLE body)
    • https://www.verisign.com/rpa0In document text (OLE body)
    • http://logo.verisign.com/vslogo.gif04In document text (OLE body)
    • http://crl.verisign.com/pca3-g5.crl04In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 523081 bytes
SHA-256: 48c9f54a595dac9e72fe4571b4bfdc96d197a3488ad3e4f6b7737aed5be624cb
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 8 eval/decoder/string-building token(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "ModuleImporter"
Option Explicit
Option Private Module
''
Const vbext_ct_ClassModule = 2
Const vbext_ct_Document = 100
Const vbext_ct_MSForm = 3
Const vbext_ct_StdModule = 1
Const DiffProgramLocation = "\Src\Utilities\VBAUtils\diff.exe"
Const GitProgramLocation = "\Src\Utilities\VBAUtils\git.exe"
Dim bleSkipModuleTracking As Boolean
Dim FSO As Object

Dim tmpExportFolders() As String


Sub testImportModulesFromFolder()
    Dim codeBase As String
    codeBase = Environ("CodebaseDir")
    
#If EXCEL Then
    ReDim tmpExportFolders(4)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\ExcelAddins\XLAS\VBAModules\Excel\"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
    tmpExportFolders(4) = codeBase & "\Src\OfficeAddins\Common\VBA\LM\"
#ElseIf Powerpoint And LOADER Then
    ReDim tmpExportFolders(3)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\PowerPoint\PowerPoint\Loader"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
#ElseIf Powerpoint And LEGACY Then
    ReDim tmpExportFolders(5)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\PowerPoint\PowerPoint\"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\PowerPoint\PowerPoint\Legacy"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(4) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
    tmpExportFolders(5) = codeBase & "\Src\OfficeAddins\Common\VBA\LM\"
#ElseIf Powerpoint Then
    ReDim tmpExportFolders(4)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\PowerPoint\PowerPoint\"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
    tmpExportFolders(4) = codeBase & "\Src\OfficeAddins\Common\VBA\LM\"
#ElseIf WORD And LEGACY Then
    ReDim tmpExportFolders(5)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\Word\Word\"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\Word\WordLegacy\"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(4) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
    tmpExportFolders(5) = codeBase & "\Src\OfficeAddins\Common\VBA\LM\"
#ElseIf WORD Then
    ReDim tmpExportFolders(4)
    tmpExportFolders(0) = codeBase & "\Src\OfficeAddins\Word\Word\"
    tmpExportFolders(1) = codeBase & "\Src\OfficeAddins\Common\VBA\"
    tmpExportFolders(2) = codeBase & "\Src\OfficeAddins\Common\VBA\APIRegistry\"
    tmpExportFolders(3) = codeBase & "\Src\OfficeAddins\Common\VBA\OFCUI\"
    tmpExportFolders(4) = codeBase & "\Src\OfficeAddins\Common\VBA\LM\"
#End If
    
    Dim idx As Integer
    For idx = LBound(tmpExportFolders) To UBound(tmpExportFolders)
        importModulesFromFolder tmpExportFolders(idx)
    Next idx
    checkModuleChanges "", True, True
    appendExportFoldersFunction tmpExportFolders
End Sub

Sub appendExportFoldersFunction(tmpExportFolders() As String)
    Dim v
    Dim VBProj As Variant
    Dim VBComp As Variant
    Dim CodeMod As Variant
    Dim lineNum As Long
    Const DQUOTE = """"
    Dim idx As Integer
    
    
    For Each VBComp In Application.VBE.ActiveVBProject.VBComponents
        If VBComp.name = "ModuleImporterHash" Then
            Set CodeMod = VBComp.CodeModule
            Exit For
        End If
    Next VBComp
    
    With CodeMod
        lineNum = .CountOfLines + 1
        .InsertLines lineNum, " "
        lineNum = lineNum + 1
        .InsertLines lineNum, "Public Function getExportFolders() As String()"
        lineNum = lineNum + 1
        .InsertLines lineNum, "    Static exportFolders(0 To " & UBound(tmpExportFolders) & ") As String"
        lineNum = lineNum + 1
        .InsertLines lineNum, "    Static assigned As Boolean"
        lineNum = lineNum + 1
        .InsertLines lineNum, "    If Not assigned Then"
        lineNum = lineNum + 1
        .InsertLines lineNum, "        assigned = True"
        lineNum = lineNum + 1
        
        For idx = LBound(tmpExportFolders) To UBound(tmpExportFolders)
            .InsertLines lineNum, "        exportFolders(" & CStr(idx) & ") = " & DQUOTE & tmpExportFolders(idx) & DQUOTE
            lineNum = lineNum + 1
        Next idx
        
        .InsertLines lineNum, "    End If"
        lineNum = lineNum + 1
        .InsertLines lineNum, "    getExportFolders = exportFolders"
        lineNum = lineNum + 1
        .InsertLines lineNum, "End Function"
    End With
End Sub


Public Function getFSO() As Object
    If FSO Is Nothing Then
        Set FSO = CreateObject("Scripting.FileSystemObject")
    End If
    Set getFSO = FSO
End Function

Public Sub importModuleFromFile(modulePath As String)
    If (dir(modulePath, vbNormal) <> "") Then
        Application.VBE.ActiveVBProject.VBComponents.Import modulePath
    End If
End Sub

Public Sub importModulesFromFolder(SourceFolder As String)
    Dim moduleFile As String
    Dim mask As String
    If (dir(SourceFolder, vbDirectory) <> "") Then
        mask = SourceFolder & "\" & "*.cls"
        moduleFile = dir(mask)
        Do While moduleFile <> ""
            If moduleFile = "ThisWorkbook.cls" Then
                ReadModuleCodeFromFile Application.VBE.ActiveVBProject.VBComponents.Item("ThisWorkbook"), SourceFolder & "\" & moduleFile
            ElseIf Mid(moduleFile, 1, 5) = "Sheet" Then
                ''NOTHING FOR NOW!
            Else
                Application.VBE.ActiveVBProject.VBComponents.Import SourceFolder & "\" & moduleFile
            End If
            moduleFile = dir
        Loop
        
        mask = SourceFolder & "\" & "*.bas"
        moduleFile = dir(mask)
        Do While moduleFile <> ""
            If moduleFile = "ModuleImporter.bas" Then
                ''NOTHING FOR NOW!
            Else
                Application.VBE.ActiveVBProject.VBComponents.Import SourceFolder & "\" & moduleFile
            End If
            moduleFile = dir
        Loop
        
        mask = SourceFolder & "\" & "*.frm"
        moduleFile = dir(mask)
        Do While moduleFile <> ""
            Application.VBE.ActiveVBProject.VBComponents.Import SourceFolder & "\" & moduleFile
            moduleFile = dir
        Loop
    End If
End Sub

Sub ForceExportModules()
    Dim codeBase As String
    On Error GoTo handleError
    bleSkipModuleTracking = True
    ExportModules
handleError:
    bleSkipModuleTracking = False
End Sub

Sub WriteModuleCodeToFile(VBComp As Variant, strPath As String)
    Dim oFile As Object
    Dim strLines As String
    
    If VBComp.CodeModule.CountOfLines > 0 Then
        Set oFile = FSO.CreateTextFile(strPath)
            
        strLines = VBComp.CodeModule.Lines(1, VBComp.CodeModule.CountOfLines)
        oFile.WriteLine strLines
        oFile.Close
        Set FSO = Nothing
    End If
End Sub

Sub ReadModuleCodeFromFile(VBComp As Variant, strPath As String)
    Dim oFile As Object
    Dim strLines As String
    Dim deleteLineCount As Integer
    Dim i As Integer
    
    deleteLineCount = 0
    
    VBComp.CodeModule.AddFromFile strPath
    strLines = VBComp.CodeModule.Lines(1, 1)
    If (InStr(strLines, "VERSION 1.0 CLASS") > 0) Then
        For i = 2 To VBComp.CodeModule.CountOfLines + 1
            strLines = VBComp.CodeModule.Lines(i, 1)
            If (InStr(LCase(strLines), LCase("Option Explicit")) > 0) Then
                deleteLineCount = i - 1
                Exit For
            End If
        Next i
    End If
    If deleteLineCount > 0 Then
        VBComp.CodeModule.DeleteLines 1, deleteLineCount
    End If
End Sub

Function overwriteIfChanged(newFile As String, AppSpecificTargetFile As String) As Boolean
    Dim result As Integer
    Dim tempOut As String
    Dim f
    Dim doCopy As Boolean
    doCopy = False
    Dim actionReport As String
    Dim targetFile As String
    
    Dim wsh As Object
    Set wsh = VBA.CreateObject("WScript.Shell")
    Dim waitOnReturn As Boolean: waitOnReturn = True
    Dim windowStyle As Integer: windowStyle = 0
    Dim errorCode As Integer
    
    Dim codeBase As String
    codeBase = Environ("CodebaseDir")
    Dim exportFolders() As String
    
    overwriteIfChanged = False
    
    exportFolders = Application.Run("getExportFolders")
    
    '''''Check in which folder the file is residing currently'''
    Dim idx As Integer
    For idx = LBound(exportFolders) To UBound(exportFolders)
        If getFSO().FileExists(codeBase & "\" & exportFolders()(idx) & AppSpecificTargetFile) Then
            targetFile = codeBase & "\" & exportFolders()(idx) & "\" & AppSpecificTargetFile
            Exit For
        End If
    Next idx
    
    If targetFile = "" Then
        targetFile = codeBase & "\" & exportFolders()(0) & "\" & AppSpecificTargetFile
    End If
    
    errorCode = wsh.Run(Chr(34) & Environ("CodebaseDir") & DiffProgramLocation & Chr(34) & " -i " & newFile & " " & targetFile, windowStyle, waitOnReturn)
    If errorCode = 0 Then
        doCopy = False
    Else
        doCopy = True
    End If
    
    If doCopy And getFSO().FileExists(newFile) Then
        If getFSO().FileExists(targetFile) Then
            getFSO().DeleteFile (targetFile)
        End If
        getFSO().CopyFile newFile, targetFile
        actionReport = "CHANGED "
    Else
        actionReport = "KEPT    "
    End If
        
    If InStr(targetFile, ".bak") > 0 Then
        targetFile = newFile
    End If
    
    Debug.Print actionReport & " [" & targetFile & "]"
    
    Set wsh = Nothing
    overwriteIfChanged = doCopy
End Function


Sub ExportModules()
    Dim VBComp As Variant
    Dim tempFile As String
    Dim lineCharCount As Integer
    Dim tmpSavePath As String
    
    tmpSavePath = Environ$("TEMP")
    
    lineCharCount = 0
    If dir(tmpSavePath, vbDirectory) <> "" Then
        tempFile = tmpSavePath & "\" & "TempFile"
        For Each VBComp In Application.VBE.ActiveVBProject.VBComponents
            If checkModuleChanges(VBComp.name, True) Or (VBComp.Type = vbext_ct_MSForm And VBComp.HasOpenDesigner) Then
                If lineCharCount > 0 Then
                    lineCharCount = 0
                    Debug.Print
                End If
                Select Case VBComp.Type
                    Case vbext_ct_StdModule
                        VBComp.Export tempFile
                        overwriteIfChanged tempFile, VBComp.name & ".bas"
                    Case vbext_ct_Document
                        #If EXCEL Then
                        WriteModuleCodeToFile VBComp, tempFile
                        overwriteIfChanged tempFile, VBComp.name & ".cls"
                        #End If
                    Case vbext_ct_ClassModule
                        ' ThisDocument and class modules
                        VBComp.Export tempFile
                        overwriteIfChanged tempFile, VBComp.name & ".cls"
                    Case vbext_ct_MSForm
                        '''' For Forms we have to export to the correct file, otherwise the wrong info about temp
                        '''' file will be stuck in the file causing problems!
                        VBComp.Export tmpSavePath & "\" & VBComp.name & ".frm"
                        overwriteIfChanged tmpSavePath & "\" & VBComp.name & ".frm", VBComp.name & ".frm"
                        overwriteIfChanged tmpSavePath & "\" & VBComp.name & ".frx", VBComp.name & ".frx"
                        Kill tmpSavePath & "\" & VBComp.name & ".frm"
                        Kill tmpSavePath & "\" & VBComp.name & ".frx"
                    Case Else
                        VBComp.Export tempFile
                        overwriteIfChanged tempFile, tmpSavePath & "\" & VBComp.name
                End Select
            Else
                Debug.Print ".";
                lineCharCount = lineCharCount + 1
                If (lineCharCount >= 100) Then
                    Debug.Print
                    lineCharCount = 0
                End If
            End If
        Next
        If dir(tempFile) <> "" Then
            Kill tempFile
        End If
    End If
    If (lineCharCount > 0) Then Debug.Print
    Debug.Print "Export done."
End Sub

Sub deleteAllModules()
    Dim VBComp As Variant
    Dim cnt As Integer
    For Each VBComp In Application.VBE.ActiveVBProject.VBComponents
        If VBComp.name <> "ModuleImporter" And VBComp.name <> "ThisWorkbook" And VBComp.Type <> vbext_ct_Document Then
            Application.VBE.ActiveVBProject.VBComponents.Remove VBComp
        ElseIf VBComp.Type = vbext_ct_Document Then
            cnt = VBComp.CodeModule.CountOfLines
            If cnt > 0 Then
                VBComp.CodeModule.DeleteLines 1, VBComp.CodeModule.CountOfLines
            End If
        End If
    Next
End Sub


Function computeCRC16(txt As String) As String
Dim x As Long
Dim mask, i, j, nC, Crc As Integer
Dim c As String

Crc = &HFFFF

For nC = 1 To Len(txt) Step 2
    j = val("&H" + LCase$(Mid(txt, nC, 2)))
    Crc = Crc Xor j
    For j = 1 To 8
        mask = 0
        If Crc / 2 <> Int(Crc / 2) Then mask = &HA001
        Crc = Int(Crc / 2) And &H7FFF: Crc = Crc Xor mask
    Next j
Next nC

computeCRC16 = Hex$(Crc) ''

End Function


Public Function checkModuleChanges(Optional moduleName As String = "", Optional Reset As Boolean = False, Optional Serialize As Boolean = False, Optional PassedEnvCodeBaseDir As String = "") As Boolean
    Dim VBComp As Variant
    Dim strContent As String
    Dim strHash As String
    Dim strHashNew As String
    Dim allComponents As Variant
    Static moduleChanges As Object
    Dim lineCharCount As Integer
    lineCharCount = 0
    
    checkModuleChanges = False
    
    ''''Never save for ModuleImporterHash:   False means no changes'''
    If moduleName = "ModuleImporterHash" Then
        Exit Function
    End If
    
    ''''Always save when the SkipModuleTracking is set: True means Yes, there were changes! '''
    If bleSkipModuleTracking Then
        checkModuleChanges = True
        Exit Function
    End If
    
    
    If moduleChanges Is Nothing Then
        Set moduleChanges = CreateObject("Scripting.Dictionary")
        On Error Resume Next
        Application.Run "PopulateHashDictionary", moduleChanges
        On Error GoTo 0
    End If
    
    If moduleName = "" Then
        Set allComponents = Application.VBE.ActiveVBProject.VBComponents
    Else
        Set allComponents = New Collection
        allComponents.Add Application.VBE.ActiveVBProject.VBComponents.Item(moduleName)
    End If
    
    For Each VBComp In allComponents
        Dim numLines As Integer
        numLines = VBComp.CodeModule.CountOfLines
        If numLines = 0 Then
            numLines = 1
        End If
        strContent = VBComp.name & vbNewLine & "--" & vbNewLine & VBComp.CodeModule.Lines(1, numLines)
        strHashNew = computeCRC16(strContent) '''Application.Run("hashStr", strContent)
        If (moduleChanges.Exists(VBComp.name)) Then
            strHash = moduleChanges.Item(VBComp.name)
        Else
            strHash = vbNullString
        End If
        If moduleName = "" Then
            If strHashNew <> strHash Then
                Debug.Print "+";
            Else
                Debug.Print ".";
            End If
            lineCharCount = lineCharCount + 1
            If (lineCharCount >= 100) Then
                Debug.Print
                lineCharCount = 0
            End If
        End If
        If strHashNew <> strHash Then
            checkModuleChanges = True
            If (moduleChanges.Exists(VBComp.name)) Then
                If Reset Then
                    moduleChanges.Item(VBComp.name) = strHashNew
                End If
            Else
                moduleChanges.Add VBComp.name, strHashNew
            End If
        End If
    Next VBComp
    
    
    If Serialize Then
        Dim v
        Dim VBProj As Variant
        Dim CodeMod As Variant
        Dim lineNum As Long
        Const DQUOTE = """"
        
        For Each VBComp In Application.VBE.ActiveVBProject.VBComponents
            If VBComp.name = "ModuleImporterHash" Then
                Application.VBE.ActiveVBProject.VBComponents.Remove VBComp
                Exit For
            End If
        Next VBComp
        
        Set VBProj = Application.VBE.ActiveVBProject
        Set VBComp = VBProj.VBComponents.Add(vbext_ct_StdModule)
        VBComp.name = "ModuleImporterHash"
        Set CodeMod = VBComp.CodeModule
        
        '''''''''''''''''''''''' GET THE GIT HASH '''''''''''''''''''''''''
        On Error Resume Next
        Dim GitHash As String
        Dim HASHfile As String
        
        Dim f, contents, var1
        Set f = getFSO().OpenTextFile(PassedEnvCodeBaseDir & "\.git\HEAD", 1)
        contents = f.ReadAll
        f.Close
        f = Null
        
        HASHfile = Replace$(Mid$(contents, 6), "/", "\")
        HASHfile = Left$(HASHfile, Len(HASHfile) - 1)
        HASHfile = PassedEnvCodeBaseDir & "\.git\" & HASHfile & ""
        Set f = getFSO().OpenTextFile(HASHfile)
        GitHash = Left$(f.ReadAll, 10)
        f.Close
        On Error GoTo 0
        '''''''''''''''''''''''' GOT THE GIT HASH ''''''''''''''''''''''''''
        
        With CodeMod
            lineNum = .CountOfLines + 1
            
            .InsertLines lineNum, "Public Const LatestGitHash = " & DQUOTE & GitHash & DQUOTE
            lineNum = lineNum + 1
            .InsertLines lineNum, "Public Const BuildDateTime = " & DQUOTE & Now & DQUOTE
            lineNum = lineNum + 1
            .InsertLines lineNum, ""
            lineNum = lineNum + 1
                                    
            .InsertLines lineNum, "Public Sub PopulateHashDictionary(byref d as Object)"
            For Each v In moduleChanges.Keys
                lineNum = lineNum + 1
                .InsertLines lineNum, "    d.add " & DQUOTE & v & DQUOTE & "," & DQUOTE & moduleChanges.Item(v) & DQUOTE
            Next v
            lineNum = lineNum + 1
            .InsertLines lineNum, "End Sub"
        End With
    End If
    
    
    If moduleName = "" Then
        If lineCharCount > 0 Then Debug.Print
        Debug.Print "Done (Re)hashing."
    End If
End Function




Attribute VB_Name = "Loader_Globals"
Option Explicit

'version:
'   2011-09-09.1

'declarations required for api
Public Type ToolParamsVt
    Parameters() As Variant
End Type

'api
#If VBA7 Then
'WinAPI, alphabetical
Public Declare PtrSafe Function AccessibleObjectFromWindow Lib "oleacc" (ByVal Hwnd As LongPtr, ByVal dwId As Long, ByRef riid As GUID, ByRef ppvObject As Object) As Long
Public Declare PtrSafe Function BringWindowToTop Lib "user32" (ByVal Hwnd As LongPtr) As Long
Public Declare PtrSafe Function CLSIDFromString Lib "OLE32.DLL" (pstCLS As LongPtr, clsID As GUID) As Long
Public Declare PtrSafe Function DrawMenuBar Lib "user32" (ByVal Hwnd As LongPtr) As Long
Public Declare PtrSafe Function EnableMenuItem Lib "user32" (ByVal hMenu As LongPtr, ByVal wIDEnableItem As Long, ByVal wEnable As Long) As Long
Public Declare PtrSafe Function EnumChildWindows Lib "user32" (ByVal hWndParent As LongPtr, ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Long
Public Declare PtrSafe Function EnumWindows Lib "user32" (ByVal lpEnumFunc As LongPtr, ByVal lParam As LongPtr) As Long
Public Declare PtrSafe Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As LongPtr
Public Declare PtrSafe Function FindNextFile Lib "kernel32" Alias "FindNextFileA" (ByVal hFindFile As LongPtr, lpFindFileData As WIN32_FIND_DATA) As Long
Public Declare PtrSafe Function FileTimeToLocalFileTime Lib "kernel32" (lpFileTime As FILETIME, lpLocalFileTime As FILETIME) As Long
Public Declare PtrSafe Function FileTimeToSystemTime Lib "kernel32" (lpFileTime As FILETIME, lpSystemTime As SYSTEMTIME) As Long
Public Declare PtrSafe Function FindClose Lib "kernel32" (ByVal hFindFile As LongPtr) As Long
Public Declare PtrSafe Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As LongPtr
Public Declare PtrSafe Function FreeLibrary Lib "kernel32" (ByVal hLibModule As LongPtr) As Long
Public Declare PtrSafe Function GetActiveObject Lib "Oleaut32.dll" (lpRclsid As LongPtr, pvReserved As LongPtr, lpUnk As LongPtr) As Long
Public Declare PtrSafe Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal Hwnd As LongPtr, ByVal lpClassName As String, ByVal nMaxCount As Long) As Long
Public Declare PtrSafe Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare PtrSafe Function GetForegroundWindow Lib "user32" () As LongPtr
Public Declare PtrSafe Function GetLastError Lib "kernel32" () As Long
Public Declare PtrSafe Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA" (ByVal Locale As Long, ByVal LCType As Long, ByVal lpLCData As String, ByVal cchData As Long) As Long
Public Declare PtrSafe Function GetLongPathName Lib "kernel32" Alias "GetLongPathNameA" (ByVal lpShortPath As String, ByVal lpLongPath As String, ByVal hBuffer As Long) As Long
Public Declare PtrSafe Function GetSystemMenu Lib "user32" (ByVal Hwnd As LongPtr, ByVal bRevert As Long) As LongPtr
Public Declare PtrSafe Function GetMenuItemCount Lib "user32" (ByVal hMenu As LongPtr) As Long
Public Declare PtrSafe Function GetWindowPlacement Lib "user32" (ByVal Hwnd As LongPtr, lpwndpl As WINDOWPLACEMENT) As Long
Public Declare PtrSafe Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal Hwnd As LongPtr) As Long
Public Declare PtrSafe Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal Hwnd As LongPtr, ByVal lpString As String, ByVal cch As Long) As Long
Public Declare PtrSafe Function IIDFromString Lib "ole32" (ByVal lpsz As LongPtr, ByRef lpiid As GUID) As LongPtr
Public Declare PtrSafe Function IsWindowVisible Lib "user32" (ByVal Hwnd As LongPtr) As Long
Public Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
Public Declare PtrSafe Function LoadLibraryEx Lib "kernel32" Alias "LoadLibraryExA" (ByVal lpLibFileName As String, ByVal hFile As LongPtr, ByVal dwFlags As Long) As LongPtr
Public Declare PtrSafe Function PathCombine Lib "shlwapi" Alias "PathCombineA" (ByVal szDest As String, ByVal lpszDir As String, ByVal lpszFile As String) As Long
Public Declare PtrSafe Function PathFileExists Lib "shlwapi" Alias "PathFileExistsA" (ByVal pszPath As String) As Long
Public Declare PtrSafe Function PathIsDirectory Lib "shlwapi" Alias "PathIsDirectoryA" (ByVal pszPath As String) As Long
Public Declare PtrSafe Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal Hwnd As LongPtr, ByVal wMsg As Long, ByVal wParam As LongPtr, lParam As Any) As LongPtr
Public Declare PtrSafe Function SetCurrentDirectory Lib "kernel32" Alias "SetCurrentDirectoryA" (ByVal lpPathName As String) As Long
Public Declare PtrSafe Function SetFocus Lib "user32" (ByVal Hwnd As LongPtr) As LongPtr
Public Declare PtrSafe Function ShowWindow Lib "user32" (ByVal Hwnd As LongPtr, ByVal nCmdShow As Long) As Long
Public Declare PtrSafe Function SystemTimeToVariantTime Lib "oleaut32" (psystime As SYSTEMTIME, pvtime As Double) As Long

'Bloomberg API
Public Declare PtrSafe Function AddRunningObject Lib "Bloomberg.Rtd.Ipc.Interop.dll" Alias "_AddRunningObject@8" (ByVal szMoniker As String, ByVal pVal As Application) As Integer
Public Declare PtrSafe Function APICoCreateInstance Lib "bbloader.dll" (ByVal lpszFilePathName As String, ByRef rclsid As GUID, riid As GUID, ByRef ppv As Object) As Long
Public Declare PtrSafe Sub HelpHelp Lib "bbtblwiz.dll" ()
Public Declare PtrSafe Function RemoveRunningObjects Lib "Bloomberg.Rtd.Ipc.Interop.dll" Alias "_RemoveRunningObjects@0" () As Integer
Public Declare PtrSafe Sub TogglePane Lib "Bloomberg.Taskpane.Host.dll" (ByVal toolID As Integer)
'Bloomberg API - ToolsProxy
#If Win64 Then
Public Declare PtrSafe Function Initialize Lib "ToolsProxy.dll" (ByVal App As Application, ByVal hwndOwner As Long) As Boolean
Public Declare PtrSafe Function ActivateTool Lib "ToolsProxy.dll" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function DeactivateTool Lib "ToolsProxy.dll" ()
Public Declare PtrSafe Function RetrieveToolParams Lib "ToolsProxy.dll" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function AsyncInvokeTool Lib "ToolsProxy.dll" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function ExcelAsyncInvokeDone Lib "ToolsProxy.dll" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Sub Cleanup Lib "ToolsProxy.dll" ()
#Else
Public Declare PtrSafe Function Initialize Lib "ToolsProxy.dll" Alias "_Initialize@8" (ByVal App As Application, ByVal hwndOwner As Long) As Boolean
Public Declare PtrSafe Function ActivateTool Lib "ToolsProxy.dll" Alias "_ActivateTool@4" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function DeactivateTool Lib "ToolsProxy.dll" Alias "_DeactivateTool@0" ()
Public Declare PtrSafe Function RetrieveToolParams Lib "ToolsProxy.dll" Alias "_RetrieveToolParams@4" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function AsyncInvokeTool Lib "ToolsProxy.dll" Alias "_AsyncInvokeTool@4" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Function ExcelAsyncInvokeDone Lib "ToolsProxy.dll" Alias "_ExcelAsyncInvokeDone@4" (Params As ToolParamsVt) As Boolean
Public Declare PtrSafe Sub Cleanup Lib "ToolsProxy.dll" Alias "_Cleanup@0" ()
#End If

#Else
'WinAPI, alphabetical
Public Declare Function AccessibleObjectFromWindow Lib "oleacc" (ByVal Hwnd As Long, _
                                                                 ByVal dwId As Long, _
                                                                 ByRef riid As GUID, _
                                                                 ByRef ppvObject As Object) _
                                                                 As Long
Public Declare Function BringWindowToTop Lib "user32" (ByVal Hwnd As Long) As Long
Public Declare Function CLSIDFromString Lib "OLE32.DLL" (pstCLS As Long, ByRef clsID As GUID) As Long
Public Declare Function DrawMenuBar Lib "user32" (ByVal Hwnd As Long) As Long
Public Declare Function EnumChildWindows Lib "user32" (ByVal hWndParent As Long, _
                                                       ByVal lpEnumFunc As Long, _
                                                       ByVal lParam As Long) As Long
Public Declare Function EnumWindows Lib "user32" (ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function EnableMenuItem Lib "user32" (ByVal hMenu As Long, _
                                                     ByVal wIDEnableItem As Long, _
                                                     ByVal wEnable As Long) As Long
Public Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal lpFileName As String, _
                                                                             lpFindFileData As WIN32_FIND_DATA) As Long
Public Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileA" (ByVal hFindFile As Long, _
                                                                           lpFindFileData As WIN32_FIND_DATA) As Long
Public Declare Function FileTimeToLocalFileTime Lib "kernel32" (lpFileTime As FILETIME, lpLocalFileTime As FILETIME) As Long
Public Declare Function FileTimeToSystemTime Lib "kernel32" (lpFileTime As FILETIME, lpSystemTime As SYSTEMTIME) As Long
Public Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Public Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) As Long
Public Declare Function GetActiveObject Lib "Oleaut32.dll" (lpRclsid As Long, pvReserved As Long, lpUnk As Long) As Long
Public Declare Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal Hwnd As Long, _
                                                                         ByVal lpClassName As String, _
                                                                         ByVal nMaxCount As Long) As Long
Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare Function GetForegroundWindow Lib "user32" () As Long
Public Declare Function GetLastError Lib "kernel32.dll" () As Long
Public Declare Function GetLocaleInfo Lib "kernel32" Alias "GetLocaleInfoA" (ByVal Locale As Long, ByVal LCType As Long, ByVal lpLCData As String, ByVal cchData As Integer) As Integer
Public Declare Function GetLongPathName Lib "kernel32" Alias "GetLongPathNameA" (ByVal lpShortPath As String, ByVal lpLongPath As String, ByVal hBuffer As Long) As Long
Public Declare Function GetSystemMenu Lib "user32" (ByVal Hwnd As Long, ByVal bRevert As Long) As Long
Public Declare Function GetMenuItemCount Lib "user32" (ByVal hMenu As Long) As Long
Public Declare Function GetWindowPlacement Lib "user32" (ByVal Hwnd As Long, lpwndpl As WINDOWPLACEMENT) As Long
Public Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthA" (ByVal Hwnd As Long) As Long
Public Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal Hwnd As Long, _
                                                                           ByVal lpString As String, _
                                                                           ByVal cch As Long) As Long
Public Declare Function IIDFromString Lib "ole32" (ByVal lpsz As Long, ByRef lpiid As GUID) As Long
Public Declare Function IsWindowVisible Lib "user32" (ByVal Hwnd As Long) As Long
Public Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal module As String) As Long
Public Declare Function LoadLibraryEx Lib "kernel32" Alias "LoadLibraryExA" (ByVal lpLibFileName As String, ByVal hFile As Long, ByVal dwFlags As Long) As Long
Public Declare Function PathCombine Lib "shlwapi" Alias "PathCombineA" (ByVal szDest As String, ByVal lpszDir As String, ByVal lpszFile As String) As Long
Public Declare Function PathFileExists Lib "shlwapi" Alias "PathFileExistsA" (ByVal pszPath As String) As Long
Public Declare Function PathIsDirectory Lib "shlwapi" Alias "PathIsDirectoryA" (ByVal pszPath As String) As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal Hwnd As Long, _
                                                                       ByVal msg As Long, _
                                                                       ByVal wParam As Long, _
                                                                       ByVal lParam As Any) As Long
Public Declare Function SetCurrentDirectory Lib "kernel32" Alias "SetCurrentDirectoryA" (ByVal lpPathName As String) As Long
Public Declare Function SetFocus Lib "user32" (ByVal Hwnd As Long) As Long
Public Declare Function ShowWindow Lib "user32" (ByVal lHwnd As Long, ByVal lCmdShow As Long) As Boolean
Public Declare Function SystemTimeToVariantTime Lib "oleaut32" (psystime As SYSTEMTIME, pvtime As Double) As Long

'Bloomberg API
Public Declare Function AddRunningObject Lib "Bloomberg.Rtd.Ipc.Interop.dll" Alias "_AddRunningObject@8" (ByVal szMoniker As String, ByVal pVal As Application) As Integer
Public Declare Function APICoCreateInstance Lib "bbloader.dll" (ByVal lpszFilePathName As String, ByRef rclsid As GUID, riid As GUID, ByRef ppv As Object) As Long
Public Declare Sub HelpHelp Lib "bbtblwiz.dll" ()
Public Declare Function RemoveRunningObjects Lib "Bloomberg.Rtd.Ipc.Interop.dll" Alias "_RemoveRunningObjects@0" () As Integer
Public Declare Sub TogglePane Lib "Bloomberg.Taskpane.Host.dll" (ByVal toolID As Integer)
'Bloomberg API - ToolsProxy
Public Declare Function Initialize Lib "ToolsProxy.dll" Alias "_Initialize@8" (ByVal App As Application, ByVal hwndOwner As Long) As Boolean
Public Declare Function ActivateTool Lib "ToolsProxy.dll" Alias "_ActivateTool@4" (Params As ToolParamsVt) As Boolean
Public Declare Function DeactivateTool Lib "ToolsProxy.dll" Alias "_DeactivateTool@0" ()
Public Declare Function RetrieveToolParams Lib "ToolsProxy.dll" Alias "_RetrieveToolParams@4" (Params As ToolParamsVt) As Boolean
Public Declare Function AsyncInvokeTool Lib "ToolsProxy.dll" Alias "_AsyncInvokeTool@4" (Params As ToolParamsVt) As Boolean
Public Declare Function ExcelAsyncInvokeDone Lib "ToolsProxy.dll" Alias "_ExcelAsyncInvokeDone@4" (Params As ToolParamsVt) As Boolean
Public Declare Sub Cleanup Lib "ToolsProxy.dll" Alias "_Cleanup@0" ()
#End If

'global constants
Public Const MAINMENUBAR                    As String = "Menu Bar"
Public Const SettingFileName                As String = "BBPTConfig.xml"
Public Const Setting_VersionSuffix_Pre12    As String = "2003"
Public Const Setting_VersionSuffix_12Plus   As String = "2007"
Public Const CopyToPowerPoint_NamePrefix    As String = "bb_"
Public Const LinkedExcelFile_ExtensionFilter As String = ".xl*"
Public Const DefaultNewPasteShapeLeft       As Long = 50
Public Const DefaultNewPasteShapeTop        As Long = 100

Public Const MAX_PATH                       As Long = 260
Public Const OverviewPage                   As String = "Overview_PPT.htm"
Public Const WhatsNewPage                   As String = "What_s_New_PPT.htm"

'types
Public Type ACL
        AclRevision As Byte
        Sbz1 As Byte
        AclSize As Integer
        AceCount As Integer
        Sbz2 As Integer
End Type

Public Type GUID
    Data1 As Long
    Data2 As Integer
    Data3 As Integer
    Data4(7) As Byte
End Type

Public Type FILETIME
    dwLowDateTime As Long
    dwHighDateTime As Long
End Type

Public Type POINTAPI
    x As Long
    y As Long
End Type

Public Type RECT
    Left As Long
    Top As Long
    Right As Long
    Bottom As Long
End Type

Public Type SYSTEMTIME
    wYear As Integer
    wMonth As Integer
    wDayOfWeek As Integer
    wDay As Integer
    wHour As Integer
    wMinute As Integer
    wSecond As Integer
    wMilliseconds As Integer
End Type

Public Type UFILEDATA
    filename        As Variant
    PathIsRelative  As Boolean
    ModifiedDate    As Date
    CreatedDate     As Date
    Size            As Double
    Owner           As String
    NewFileFlag     As Boolean
End Type

Public Type WIN32_FIND_DATA
    dwFileAttributes    As Long
    ftCreationTime      As FILETIME
    ftLastAccessTime    As FILETIME
    ftLastWriteTime     As FILETIME
    nFileSizeHigh       As Long
    nFileSizeLow        As Long
    dwReserved0         As Long
    dwReserved1         As Long
    cFileName           As String * MAX_PATH
    cAlternate          As String * 14
End Type

Public Type WINDOWPLACEMENT
    Length As Long
    flags As Long
    showCmd As Long
    ptMinPosition As POINTAPI
    ptMaxPosition As POINTAPI
    rcNormalPosition As RECT
End Type

'enums
Public Enum lpaLinkPasteAspectRatio
    lpaSizeToDestinationBoth = 0
    lpaSizeToDestinationWidth = 1
    lpaSizeToDestinationHeight = 2
    lpaKeepOriginalSize = 3
    lpaIntelligentSizing = 4
End Enum

Public Enum lumLinkUpdateMode
    lumNoneUnknown = 0
    lumUpdateLinks
    lumManageLinks
    lumBrokenLinks
    lumShowSource
End Enum

Public Enum lusLinksUpdateScope
    lusNoneUnknown = 0
    lusSelectedShape = 1
    lusActiveSlide = 2
    lusPresentation = 3
End Enum

Public Enum lpsLinkUpdatePreparationStep
    lpsNoneUnknown = 0
    lpsStart = 1
    lpsGetShapeAndAttributes = 2
    lpsValidateWbk = 3
    lpsGetWbk = 4
    lpsValidateWbkRange = 5
    lpsCheckForNewerFiles = 6
    lpsCheckForMatchingFiles = 7
    lpsDo = 8
    lpsFinish = 9
End Enum

Public Enum lrsLinkReadyState
    lrsConflicted = -1
    lrsNotAnalyzed = 0
    lrsReady
    lrsNewerFiles
    lrsOtherFiles
    lrsBrokenNewClosed
    lrsBrokenSavedPathNotFound
    lrsBrokenCannotOpenWbk
    lrsBrokenRangeNotFound
    lrsBrokenChartCannotResolveSource
    lrsCannotOpenWbkCorrupt
    lrsCannotOpenWbkFilenameCollision
End Enum

Public Enum swcShowWindowCmd
    swcHide = 0
    swcNormal = 1
    swcMinimized = 2 'but activated
    swcMaximized = 3
    swcNormalNoActivate = 4
    swcShow = 5
    swcMinimize = 6 'activates next
    swcMinimizeNoActivate = 7
    swcShowNoActive = 8
    swcRestore = 9
    swcShowDefault = 10
    swcForceMinimized = 11
End Enum

Public Enum tssTocDividerShowSetting
    tssToC
    tssSectionNumbers
    tssPageNumbers
    tssFooterForDividers
    tssHyperlinks
End Enum

Public Enum urfRootFolders
    urfWindowsDesktop = &H0      ' CSIDL_DESKTOP: Virtual folder
    urfProgramsUser = &H2        ' CSIDL_PROGRAMS: File-system folder
    urfProgramsCommon = &H17     ' CSIDL_COMMON_PROGRAMS: File-system folder
    urfPersonal = &H5            ' CSIDL_PERSONAL: File-system folder
    urfFavorites = &H6           ' CSIDL_FAVORITES: File-system folder
    urfStartupUser = &H7         ' CSIDL_STARTUP: File-system folder
    urfStartupCommon = &H18      ' CSIDL_COMMON_STARTUP: File-system folder
    urfRecent = &H8              ' CSIDL_RECENT: File-system folder
    urfSendTo = &H9              ' CSIDL_SENDTO: File-system folder
    urfStartMenuUser = &HB       ' CSIDL_STARTMENU: File-system folder
    urfStartMenuCommon = &H16    ' CSIDL_COMMON_STARTMENU: File-system folder
    urfDesktopFolderUser = &H10      ' CSIDL_DESKTOPDIRECTORY: File-system folder
    urfDesktopFolderCommon = &H19    ' CSIDL_COMMON_DESKTOPDIRECTORY: File-system folder
    urfMyComputer = &H11         ' CSIDL_DRIVES: Virtual folder
    urfNetwork = &H12            ' CSIDL_NETWORK: Virtual folder
    urfTemplates = &H15          ' CSIDL_TEMPLATES: File-system folder
    urfAppData = &H1A            ' CSIDL_APPDATA: File-system folder
End Enum
'global variables
Public g_processID                          As String
Public gRibbonAddinName                     As String
Public gConnection                          As ADODB.Connection
Public DividerTitle                         As String
Public DividerSubTitle                      As String
Public DividerCancelled                     As Boolean
Public SubDividerChecked                    As Boolean
Public SlideNumberingOff                    As Boolean


' Constants for use with GetLocaleInfo
Private Const LOCALE_USER_DEFAULT           As Long = 1024
Private Const LOCALE_SISO639LANGNAME        As Long = 89
Private Const ISONAME_RESPONSE_LENGTH       As Long = 16


#If VBA7 Then
Private m_rtdModule                         As LongPtr
#Else
Private m_rtdModule                         As Long
#End If
'


Public Function ToLocalizedResourceName(resourceName As String, extension As String) As String
    pushTrace "ToLocalizedResourceName", "Globals.bas", resourceName, extension
Dim lenResponse As Integer
Dim isoName As String * ISONAME_RESPONSE_LENGTH
Dim uiCulture As String

If Not GetUserStringValue(OFFICE_TOOLS_SETTINGS_REGKEY, "Language", uiCulture) Then
    lenResponse = GetLocaleInfo(LOCALE_USER_DEFAULT, LOCALE_SISO639LANGNAME, isoName, Len(isoName))
    uiCulture = Left$(LCase(isoName), lenResponse - 1)
End If

If Left$(uiCulture, 2) = "en" Then
    uiCulture = ""
Else
    uiCulture = "_" & uiCulture
End If

ToLocalizedResourceName = resourceName & uiCulture & extension
    popTrace "ToLocalizedResourceName"
End Function






Attribute VB_Name = "Loader_modBloombergUILoader"
Sub AutoExec()
    Dim sOfficeToolsPath As String
    Dim sBloombergUIWordPath As String
    Dim i As Long
    Dim ws As WORD.AddIn
                
    If Not IsAddinKillSwitchEnabled Then  'TREQ 3117337 - global add-in kill switch
        If (IsPowerToolsAvailable = True Or IsBlpofcRibbonAvailable = True) And Not isDisabledForOfficeToolsWord Then
            GetOfficeToolsPath sOfficeToolsPath
            'DRQS EN 43507865 - LinkV2/Legacy dual support
            If IsLinkManagerV2Available() Then
                sBloombergUIWordPath = sOfficeToolsPath & "\" & ADDIN_BLOOMBERG_UI_WORD
            Else
                sBloombergUIWordPath = sOfficeToolsPath & "\" & ADDIN_BLOOMBERG_UI_WORD_LEGACY
            End If
            If dir$(sBloombergUIWordPath) <> "" Then
                    Set ws = Application.AddIns.Add(sBloombergUIWordPath, False)
                    ws.Installed = True
            Else
                    MsgBox "Bloomberg Office tools folder not accessible"
            End If
        End If
    End If
    For i = Application.AddIns.count To 1 Step -1
        If Application.AddIns(i).name = ADDIN_BLOOMBERG_UI_WORD_STARTUP Then
                Application.AddIns(i).Installed = msoFalse
        End If
    Next i
    ThisDocument.Close
End Sub

Function IsWord64Bit() As Boolean
If val(Application.Version) >= 12 Then
    If Mid$(Application.ProductCode, 20, 2) = "-1" Then
            IsWord64Bit = True
    End If
End If

End Function

Attribute VB_Name = "Loader_modConstants"
Option Explicit
Public Const ADDIN_BLOOMBERG_UI_WORD = "BloombergUI.dot"
Public Const ADDIN_BLOOMBERG_UI_WORD_STARTUP = "BloombergUILoader.dot"
Public Const ADDIN_BLOOMBERG_UI_WORD_RIBBON = "BloombergRibbonUI.dotm"
'DRQS EN 43507865 - LinkV2/Legacy dual support
Public Const ADDIN_BLOOMBERG_UI_WORD_LEGACY = "BloombergUILegacy.dot"

Attribute VB_Name = "Loader_modUtility_Word"
Option Explicit

Private mxmlDom                             As DOMDocument
Private mxmlRoot                            As IXMLDOMElement
Private mUIDom                              As New DOMDocument
Private mCustomUIXml                        As String

Private Const Setting_XMLContainerTagName   As String = "Content"
Public ShuttingDown As Boolean



'DRQS EN 43507865 - LinkV2/Legacy dual support
#If VBA7 Then
Public Function GetApplicationHandle() As LongPtr
    Dim Hwnd As LongPtr
#Else
Public Function GetApplicationHandle() As Long
    Dim Hwnd As Long
#End If

    Dim VersionNo As String
    
    Hwnd = FindWindow("OpusApp", vbNullString)
    'VersionNo = Left(Application.Version, InStr(1, Application.Version, ".") - 1)
    GetApplicationHandle = Hwnd
End Function
Public Function uPathExists(pstrPath As String) As Boolean
   uPathExists = (PathFileExists(pstrPath) = 1)
End Function

Private Function GetXMLSettingFile() As Boolean
…

Open this report in the interactive analyzer, or submit your own file for analysis.