rule win_isfb_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.isfb." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 33c0 e8???????? 3bc7 740f } // n = 4, score = 2500 // 33c0 | push esi // e8???????? | // 3bc7 | xor esi, esi // 740f | cmp dword ptr [ebp - 4], esi $sequence_1 = { 33c0 3bc7 741b 50 33c0 } // n = 5, score = 2500 // 33c0 | push ebx // 3bc7 | cmp edi, esi // 741b | je 0x13 // 50 | push edi // 33c0 | push esi $sequence_2 = { 33c0 3bc7 7413 50 6a10 58 } // n = 6, score = 2400 // 33c0 | push ebx // 3bc7 | cmp edi, esi // 7413 | je 0x17 // 50 | mov esi, dword ptr [ebp + 8] // 6a10 | xor esi, esi // 58 | cmp dword ptr [ebp - 4], esi $sequence_3 = { 58 e8???????? 3bc7 7406 50 } // n = 5, score = 2400 // 58 | je 0x17 // e8???????? | // 3bc7 | xor esi, esi // 7406 | cmp dword ptr [ebp - 4], esi // 50 | je 0x15 $sequence_4 = { ff75f0 ff75f4 6822010000 e9???????? ff7508 } // n = 5, score = 2400 // ff75f0 | cmp eax, edi // ff75f4 | je 0x17 // 6822010000 | push eax // e9???????? | // ff7508 | push 0x10 $sequence_5 = { 57 50 e8???????? 83c40c e8???????? 3bc7 } // n = 6, score = 2200 // 57 | je 0x1f // 50 | push eax // e8???????? | // 83c40c | xor eax, eax // e8???????? | // 3bc7 | cmp eax, edi $sequence_6 = { 6a64 ff15???????? a1???????? 85c0 7407 83ee64 } // n = 6, score = 2200 // 6a64 | je 0x1d // ff15???????? | // a1???????? | // 85c0 | push eax // 7407 | xor eax, eax // 83ee64 | cmp eax, edi $sequence_7 = { ff35???????? e8???????? 8bf0 3bf3 7443 6aff } // n = 6, score = 2200 // ff35???????? | // e8???????? | // 8bf0 | mov ebx, edi // 3bf3 | mov esi, edi // 7443 | dec eax // 6aff | cmp ebx, edi $sequence_8 = { 50 e8???????? 3bdf 7414 } // n = 4, score = 2100 // 50 | dec eax // e8???????? | // 3bdf | mov dword ptr [eax], eax // 7414 | dec eax $sequence_9 = { 5d 5b 59 c20400 8325????????00 6a00 } // n = 6, score = 2100 // 5d | mov eax, eax // 5b | mov ebx, eax // 59 | xor edx, edx // c20400 | dec ecx // 8325????????00 | // 6a00 | add eax, 1 $sequence_10 = { ff35???????? ff15???????? 85c0 a3???????? 7402 ffe0 } // n = 6, score = 2100 // ff35???????? | // ff15???????? | // 85c0 | je 0x19 // a3???????? | // 7402 | cmp eax, edi // ffe0 | je 8 $sequence_11 = { 8bd3 e8???????? eb02 33c0 3bc7 7413 } // n = 6, score = 2100 // 8bd3 | dec eax // e8???????? | // eb02 | lea eax, [edx + 0x4a20] // 33c0 | dec eax // 3bc7 | add esp, 0x28 // 7413 | ret $sequence_12 = { ff15???????? 3c05 7506 84e4 7704 3ac0 } // n = 6, score = 1800 // ff15???????? | // 3c05 | push esi // 7506 | pop ebx // 84e4 | pop edi // 7704 | pop esi // 3ac0 | push ebx $sequence_13 = { c20400 55 8bec 83ec0c a1???????? 8365f800 } // n = 6, score = 1800 // c20400 | push eax // 55 | cmp eax, edi // 8bec | je 0x15 // 83ec0c | push eax // a1???????? | // 8365f800 | push 0x10 $sequence_14 = { 7512 e8???????? 3bc3 a3???????? } // n = 4, score = 1700 // 7512 | push dword ptr [ebp - 0xc] // e8???????? | // 3bc3 | push 0x122 // a3???????? | $sequence_15 = { 7417 8b10 2b55fc 8b7d10 0155fc } // n = 5, score = 1700 // 7417 | push eax // 8b10 | mov edx, ebx // 2b55fc | jmp 6 // 8b7d10 | xor eax, eax // 0155fc | cmp eax, edi $sequence_16 = { ff7510 e8???????? 83c40c c745fc01000000 8b4610 } // n = 5, score = 1700 // ff7510 | push eax // e8???????? | // 83c40c | add esi, 4 // c745fc01000000 | cmp eax, edi // 8b4610 | je 0x11 $sequence_17 = { 8b7d10 0155fc 83451004 83c004 49 8917 75e9 } // n = 7, score = 1700 // 8b7d10 | add esp, 0xc // 0155fc | cmp eax, edi // 83451004 | push edi // 83c004 | push eax // 49 | add esp, 0xc // 8917 | cmp eax, edi // 75e9 | mov dword ptr [ebp - 0x10], eax $sequence_18 = { 83e103 740d 51 50 ff7510 } // n = 5, score = 1700 // 83e103 | add esp, 0xc // 740d | cmp eax, edi // 51 | add esp, 0xc // 50 | cmp eax, edi // ff7510 | mov dword ptr [ebp - 0x10], eax $sequence_19 = { b8???????? 53 bb60ea0000 53 } // n = 4, score = 1700 // b8???????? | // 53 | mov edx, 1 // bb60ea0000 | dec eax // 53 | mov ecx, edi $sequence_20 = { 57 33ff 3bdf 7414 a1???????? } // n = 5, score = 1600 // 57 | ret // 33ff | dec eax // 3bdf | mov dword ptr [esp + 8], ebx // 7414 | dec eax // a1???????? | $sequence_21 = { 83ec14 8364240400 53 8b5d0c 837b240c } // n = 5, score = 1600 // 83ec14 | je 0x1d // 8364240400 | push eax // 53 | xor eax, eax // 8b5d0c | cmp eax, edi // 837b240c | je 0x16 $sequence_22 = { 2b4b28 894c2410 8b4b34 f6c140 } // n = 4, score = 1600 // 2b4b28 | push dword ptr [ebp + 8] // 894c2410 | push 0 // 8b4b34 | push 0x122 // f6c140 | push dword ptr [ebp + 8] $sequence_23 = { e8???????? 85c0 740d 8906 83c604 47 } // n = 6, score = 1600 // e8???????? | // 85c0 | cmp dword ptr [ebp - 4], esi // 740d | je 0x15 // 8906 | push dword ptr [ebp - 4] // 83c604 | push esi // 47 | push edi $sequence_24 = { 8a4604 2404 f6d8 1bc0 } // n = 4, score = 1600 // 8a4604 | je 0x15 // 2404 | push dword ptr [ebp - 4] // f6d8 | push esi // 1bc0 | mov esi, dword ptr [ebp + 8] $sequence_25 = { 50 8b07 03442418 50 56 ff5310 8b16 } // n = 7, score = 1600 // 50 | push dword ptr [ebp + 8] // 8b07 | push 0 // 03442418 | push 0 // 50 | push dword ptr [ebp - 0x10] // 56 | push dword ptr [ebp - 0xc] // ff5310 | push 0x122 // 8b16 | push dword ptr [ebp + 8] $sequence_26 = { 8b1e 6a00 ff37 ff15???????? 2b442414 50 8b07 } // n = 7, score = 1600 // 8b1e | xor eax, eax // 6a00 | cmp eax, edi // ff37 | je 0x13 // ff15???????? | // 2b442414 | push eax // 50 | push eax // 8b07 | xor eax, eax $sequence_27 = { 57 8b3b 897c241c 760a 8b4b20 e8???????? } // n = 6, score = 1600 // 57 | je 0x11 // 8b3b | cmp eax, edi // 897c241c | je 0x11 // 760a | push eax // 8b4b20 | push eax // e8???????? | $sequence_28 = { 83c40c 8974240c c6401a00 8b44240c 85c0 } // n = 5, score = 1600 // 83c40c | push dword ptr [ebp + 8] // 8974240c | push 0 // c6401a00 | ret 4 // 8b44240c | push ebp // 85c0 | mov ebp, esp $sequence_29 = { 7520 ff37 50 ff35???????? ff15???????? 8b442414 8b4c240c } // n = 7, score = 1600 // 7520 | cmp eax, edi // ff37 | je 0x13 // 50 | cmp eax, edi // ff35???????? | // ff15???????? | // 8b442414 | je 0x11 // 8b4c240c | push eax $sequence_30 = { e8???????? 8b07 c6400731 8b74241c 8b1e 6a00 ff37 } // n = 7, score = 1600 // e8???????? | // 8b07 | cmp eax, edi // c6400731 | je 0x15 // 8b74241c | push edi // 8b1e | push eax // 6a00 | add esp, 0xc // ff37 | cmp eax, edi $sequence_31 = { 85ff 750e 837d0800 7408 ff7508 e8???????? } // n = 6, score = 1500 // 85ff | test edi, edi // 750e | jne 0x10 // 837d0800 | cmp dword ptr [ebp + 8], 0 // 7408 | je 0xa // ff7508 | push dword ptr [ebp + 8] // e8???????? | $sequence_32 = { 8b5210 3bd0 740e 8b742408 890e } // n = 5, score = 1500 // 8b5210 | push eax // 3bd0 | xor eax, eax // 740e | xor eax, eax // 8b742408 | cmp eax, edi // 890e | je 0x1f $sequence_33 = { 488bcf c744242860ea0000 4c0f45c8 48895c2420 } // n = 4, score = 1500 // 488bcf | push 0xff676980 // c744242860ea0000 | lea eax, [ebp - 8] // 4c0f45c8 | push 4 // 48895c2420 | push eax $sequence_34 = { 7408 ff7508 e8???????? 8bc7 5f 5e } // n = 6, score = 1500 // 7408 | je 0xa // ff7508 | push dword ptr [ebp + 8] // e8???????? | // 8bc7 | mov eax, edi // 5f | pop edi // 5e | pop esi $sequence_35 = { 837d1800 b8???????? 7505 b8???????? } // n = 4, score = 1500 // 837d1800 | xor eax, eax // b8???????? | // 7505 | jmp 4 // b8???????? | $sequence_36 = { 6a0b eb02 6a02 58 5e } // n = 5, score = 1500 // 6a0b | push 0x10 // eb02 | pop eax // 6a02 | cmp eax, edi // 58 | je 0xe // 5e | cmp eax, edi $sequence_37 = { 752f 8b450c 8930 eb33 } // n = 4, score = 1500 // 752f | jne 0x31 // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8930 | mov dword ptr [eax], esi // eb33 | jmp 0x35 $sequence_38 = { 74a3 33ff eb0b 33ff eb03 } // n = 5, score = 1500 // 74a3 | je 0xffffffa5 // 33ff | xor edi, edi // eb0b | jmp 0xd // 33ff | xor edi, edi // eb03 | jmp 5 $sequence_39 = { 53 8bc6 e8???????? 85c0 7516 } // n = 5, score = 1500 // 53 | push ebx // 8bc6 | mov eax, esi // e8???????? | // 85c0 | test eax, eax // 7516 | jne 0x18 $sequence_40 = { 4e 7404 3bd0 74e7 } // n = 4, score = 1500 // 4e | push eax // 7404 | xor eax, eax // 3bd0 | je 0x15 // 74e7 | push eax $sequence_41 = { 50 8d4508 50 53 8bc6 } // n = 5, score = 1500 // 50 | push eax // 8d4508 | lea eax, [ebp + 8] // 50 | push eax // 53 | push ebx // 8bc6 | mov eax, esi $sequence_42 = { 57 6a01 ff75e0 68???????? } // n = 4, score = 1400 // 57 | xor eax, eax // 6a01 | cmp eax, edi // ff75e0 | je 0x16 // 68???????? | $sequence_43 = { 488b0d???????? 33d2 ff15???????? bb01000000 498bcc eb07 } // n = 6, score = 1400 // 488b0d???????? | // 33d2 | xor eax, eax // ff15???????? | // bb01000000 | cmp eax, edi // 498bcc | je 0x17 // eb07 | push eax $sequence_44 = { 448bc3 33d2 41c1e003 ff15???????? 4885c0 488be8 7453 } // n = 7, score = 1400 // 448bc3 | je 0x15 // 33d2 | push eax // 41c1e003 | push 0x10 // ff15???????? | // 4885c0 | jmp 4 // 488be8 | xor eax, eax // 7453 | cmp eax, edi $sequence_45 = { 742d ff75fc 6a0d 58 e8???????? } // n = 5, score = 1400 // 742d | cmp dword ptr [ebp - 4], esi // ff75fc | je 0x15 // 6a0d | push dword ptr [ebp - 4] // 58 | push esi // e8???????? | $sequence_46 = { c21000 55 8bec 83ec14 a1???????? 53 } // n = 6, score = 1400 // c21000 | xor ebx, ebx // 55 | mov dx, 0x20 // 8bec | dec ecx // 83ec14 | mov ecx, esp // a1???????? | // 53 | dec eax $sequence_47 = { 53 b800080000 50 56 ff35???????? } // n = 5, score = 1400 // 53 | je 0xa // b800080000 | push dword ptr [ebp + 8] // 50 | push eax // 56 | lea eax, [ebp + 8] // ff35???????? | $sequence_48 = { e8???????? be01000000 8bc6 4883c440 415e } // n = 5, score = 1400 // e8???????? | // be01000000 | lea ecx, [eax + 1] // 8bc6 | mov dx, 0x20 // 4883c440 | dec eax // 415e | mov ecx, edi $sequence_49 = { 4c0f45c8 48895c2420 e8???????? 85c0 8bd8 } // n = 5, score = 1400 // 4c0f45c8 | push edi // 48895c2420 | push dword ptr [ebp + 8] // e8???????? | // 85c0 | push ebx // 8bd8 | mov ebx, 0xea60 $sequence_50 = { 488bcf ff15???????? 4c8964dd00 83c301 4885ff 4c8be7 } // n = 6, score = 1400 // 488bcf | cmp eax, edi // ff15???????? | // 4c8964dd00 | je 0xb // 83c301 | push eax // 4885ff | push 0x10 // 4c8be7 | pop eax $sequence_51 = { 75c4 48892e eb02 33db 488b0d???????? } // n = 5, score = 1400 // 75c4 | push eax // 48892e | push 0x10 // eb02 | push 0x10 // 33db | pop eax // 488b0d???????? | $sequence_52 = { 33db 66ba2000 498bcc ff15???????? 4885c0 } // n = 5, score = 1400 // 33db | pop eax // 66ba2000 | push eax // 498bcc | push 0x10 // ff15???????? | // 4885c0 | pop eax $sequence_53 = { bb01000000 498bcc eb07 83c301 488d4801 66ba2000 ff15???????? } // n = 7, score = 1400 // bb01000000 | cmp eax, edi // 498bcc | je 0xb // eb07 | push eax // 83c301 | pop eax // 488d4801 | cmp eax, edi // 66ba2000 | je 0xa // ff15???????? | $sequence_54 = { 5e 5d 5b c3 8b4754 a804 } // n = 6, score = 1400 // 5e | mov ebx, 1 // 5d | dec ecx // 5b | mov ecx, esp // c3 | jmp 9 // 8b4754 | add ebx, 1 // a804 | dec eax $sequence_55 = { 33d2 ff15???????? 488bdf 8bf7 483bdf } // n = 5, score = 1300 // 33d2 | je 0x10 // ff15???????? | // 488bdf | push edi // 8bf7 | push esi // 483bdf | push dword ptr [ebp + 0x10] $sequence_56 = { e8???????? 3bc3 740f 8b35???????? 50 83c604 } // n = 6, score = 1300 // e8???????? | // 3bc3 | cmp eax, edi // 740f | je 0xb // 8b35???????? | // 50 | push 0x10 // 83c604 | pop eax $sequence_57 = { 6641b85c00 33d2 488bcd ff15???????? } // n = 4, score = 1300 // 6641b85c00 | test eax, eax // 33d2 | mov ebx, eax // 488bcd | mov dword ptr [esp + 0x28], 0xea60 // ff15???????? | $sequence_58 = { 50 83c604 e8???????? 3bfb } // n = 4, score = 1300 // 50 | xor eax, eax // 83c604 | cmp eax, edi // e8???????? | // 3bfb | je 0x1b $sequence_59 = { 741a ff750c 668918 68???????? ff75f8 } // n = 5, score = 1300 // 741a | mov al, byte ptr [esi + 4] // ff750c | and al, 4 // 668918 | neg al // 68???????? | // ff75f8 | sbb eax, eax $sequence_60 = { 33db 6a01 e8???????? 85db 7423 8b0d???????? 0fb701 } // n = 7, score = 1300 // 33db | push dword ptr [ebp - 4] // 6a01 | push esi // e8???????? | // 85db | push ebx // 7423 | xor esi, esi // 8b0d???????? | // 0fb701 | cmp dword ptr [ebp - 4], esi $sequence_61 = { a3???????? 7402 ffe0 c20400 55 8bec 83ec10 } // n = 7, score = 1300 // a3???????? | // 7402 | xor eax, eax // ffe0 | cmp eax, edi // c20400 | je 0x11 // 55 | xor eax, eax // 8bec | cmp eax, edi // 83ec10 | je 0x1d $sequence_62 = { e8???????? 3bfb 7414 a1???????? } // n = 4, score = 1300 // e8???????? | // 3bfb | je 0x15 // 7414 | push eax // a1???????? | $sequence_63 = { 83fd05 72c1 eb0c bb7f000000 eb05 bb7e000000 } // n = 6, score = 1300 // 83fd05 | inc ecx // 72c1 | shl eax, 3 // eb0c | dec eax // bb7f000000 | test eax, eax // eb05 | dec eax // bb7e000000 | mov ebp, eax $sequence_64 = { 56 ff15???????? 85c0 89442418 750d } // n = 5, score = 1300 // 56 | and eax, 6 // ff15???????? | // 85c0 | xor edx, edx // 89442418 | dec eax // 750d | mov ebx, edi $sequence_65 = { ba08000000 b90e010000 41b800000100 4889442420 e8???????? e9???????? } // n = 6, score = 1300 // ba08000000 | push dword ptr [ebp - 0x20] // b90e010000 | push ecx // 41b800000100 | push eax // 4889442420 | push edi // e8???????? | // e9???????? | $sequence_66 = { 8bd7 e8???????? eb02 33c0 3bc3 741b } // n = 6, score = 1300 // 8bd7 | je 8 // e8???????? | // eb02 | push eax // 33c0 | push eax // 3bc3 | push 0x10 // 741b | pop eax $sequence_67 = { 8bd5 488bcf bb57000000 e8???????? } // n = 4, score = 1300 // 8bd5 | dec eax // 488bcf | mov dword ptr [esi], ebp // bb57000000 | jmp 7 // e8???????? | $sequence_68 = { 6a5c 8d44481c 53 50 89450c ff15???????? 3bc3 } // n = 7, score = 1300 // 6a5c | push ebx // 8d44481c | push esi // 53 | mov al, byte ptr [esi + 4] // 50 | and al, 4 // 89450c | neg al // ff15???????? | // 3bc3 | sbb eax, eax $sequence_69 = { 3bc3 8945f4 741a ff750c } // n = 4, score = 1300 // 3bc3 | mov ebx, edi // 8945f4 | mov esi, edi // 741a | dec eax // ff750c | cmp ebx, edi $sequence_70 = { 56 ff5214 8bf7 8bfe e8???????? 5f } // n = 6, score = 1200 // 56 | xor eax, eax // ff5214 | cmp eax, ebx // 8bf7 | je 0x2b // 8bfe | push eax // e8???????? | // 5f | push eax $sequence_71 = { 83632800 e9???????? 8b4330 a840 0f84e2000000 8b7334 8d442418 } // n = 7, score = 1200 // 83632800 | je 0x47 // e9???????? | // 8b4330 | push -1 // a840 | push ebx // 0f84e2000000 | mov esi, eax // 8b7334 | cmp esi, ebx // 8d442418 | je 0x49 $sequence_72 = { 0f854affffff 894330 e9???????? 55 } // n = 4, score = 1200 // 0f854affffff | cmp dword ptr [esp + 0x210], 0 // 894330 | je 0x18 // e9???????? | // 55 | dec esp $sequence_73 = { 752e 53 e8???????? 6a01 6a01 } // n = 5, score = 1200 // 752e | je 0xe // 53 | push dword ptr [ebp + 8] // e8???????? | // 6a01 | mov eax, edi // 6a01 | pop edi $sequence_74 = { e8???????? 33f6 3975fc 7410 ff75fc } // n = 5, score = 1200 // e8???????? | // 33f6 | jne 0x31 // 3975fc | mov eax, dword ptr [ebp + 0xc] // 7410 | mov dword ptr [eax], esi // ff75fc | jmp 0x3a $sequence_75 = { ff750c 53 e8???????? 3bfe 740e 57 } // n = 6, score = 1200 // ff750c | jne 0x10 // 53 | cmp dword ptr [ebp + 8], 0 // e8???????? | // 3bfe | je 0x10 // 740e | push dword ptr [ebp + 8] // 57 | je 0xa $sequence_76 = { a801 742d ff37 e8???????? 85c0 0f85d7000000 } // n = 6, score = 1200 // a801 | ret 4 // 742d | push 0 // ff37 | mov eax, ebp // e8???????? | // 85c0 | pop ebp // 0f85d7000000 | pop ebx $sequence_77 = { c744242000010000 ff15???????? 4883f8ff 488bf8 7442 } // n = 5, score = 1200 // c744242000010000 | push eax // ff15???????? | // 4883f8ff | push edi // 488bf8 | push 1 // 7442 | push dword ptr [ebp - 0x20] $sequence_78 = { 85c0 0f8544010000 8b472c a801 } // n = 4, score = 1200 // 85c0 | pop ecx // 0f8544010000 | ret 4 // 8b472c | mov eax, ebp // a801 | pop ebp $sequence_79 = { ff15???????? 53 56 ff35???????? ff15???????? 5b 5f } // n = 7, score = 1200 // ff15???????? | // 53 | and esp, 0xfffffff8 // 56 | sub esp, 0x9c // ff35???????? | // ff15???????? | // 5b | push ebx // 5f | pop edi $sequence_80 = { 8be5 5d c20800 8b4330 a804 0f8451ffffff } // n = 6, score = 1200 // 8be5 | dec eax // 5d | mov dword ptr [edi + 0x18], eax // c20800 | dec eax // 8b4330 | and dword ptr [esi + 0x10], 0 // a804 | and dword ptr [esp + 0x28], eax // 0f8451ffffff | dec eax $sequence_81 = { ff75fc 56 ff35???????? ff15???????? 53 56 } // n = 6, score = 1200 // ff75fc | push dword ptr [ebp + 8] // 56 | mov eax, edi // ff35???????? | // ff15???????? | // 53 | je 0xffffffa5 // 56 | xor edi, edi $sequence_82 = { eb0b 8b4f30 84c9 0f8992000000 8b4f30 } // n = 5, score = 1200 // eb0b | pop ebx // 8b4f30 | pop ecx // 84c9 | ret 4 // 0f8992000000 | push 0 // 8b4f30 | pop ebp $sequence_83 = { ff35???????? 8945f8 ff15???????? 8bd8 3bde } // n = 5, score = 1200 // ff35???????? | // 8945f8 | ret 4 // ff15???????? | // 8bd8 | push ebp // 3bde | mov ebp, esp $sequence_84 = { 83bc248800000000 4c8b442440 488b542448 894c2430 } // n = 4, score = 1200 // 83bc248800000000 | push eax // 4c8b442440 | push edi // 488b542448 | push 1 // 894c2430 | push dword ptr [ebp - 0x20] $sequence_85 = { 0f84e2000000 8b7334 8d442418 50 8d442410 50 } // n = 6, score = 1200 // 0f84e2000000 | push ebx // 8b7334 | mov esi, eax // 8d442418 | cmp esi, ebx // 50 | je 0x49 // 8d442410 | push -1 // 50 | push ebx $sequence_86 = { 8a4b1c 488b4558 4c8b4d30 4c8b4510 } // n = 4, score = 1100 // 8a4b1c | mov eax, ebp // 488b4558 | test al, 1 // 4c8b4d30 | je 0x30 // 4c8b4510 | dec eax $sequence_87 = { ff15???????? 488bcf 48870d???????? 483bcf 7405 e8???????? } // n = 6, score = 1100 // ff15???????? | // 488bcf | mov esi, ecx // 48870d???????? | // 483bcf | add eax, 0xfffffefe // 7405 | push ebx // e8???????? | $sequence_88 = { 4803df 410fb64101 33d2 488d0cc3 } // n = 4, score = 1100 // 4803df | jbe 0x12 // 410fb64101 | mov ecx, dword ptr [ebx + 0x20] // 33d2 | push eax // 488d0cc3 | mov eax, dword ptr [edi] $sequence_89 = { 50 8b4508 e8???????? 85c0 742d ff75fc } // n = 6, score = 1100 // 50 | cmp eax, edi // 8b4508 | je 0x13 // e8???????? | // 85c0 | cmp eax, edi // 742d | je 0x1f // ff75fc | push eax $sequence_90 = { 48890d???????? 410fb64102 488d0cc3 48890d???????? } // n = 4, score = 1100 // 48890d???????? | // 410fb64102 | call dword ptr [ebx + 0x10] // 488d0cc3 | mov esi, 1 // 48890d???????? | $sequence_91 = { 33d2 ff15???????? 483bc3 4c8be8 } // n = 4, score = 1100 // 33d2 | push ebp // ff15???????? | // 483bc3 | mov ebp, esp // 4c8be8 | sub esp, 0xc $sequence_92 = { 33d2 ff15???????? 8b05???????? 418bdd } // n = 4, score = 1100 // 33d2 | push 0 // ff15???????? | // 8b05???????? | // 418bdd | push 0 $sequence_93 = { ff15???????? 4885db 740c 4c8b0d???????? } // n = 4, score = 1100 // ff15???????? | // 4885db | mov eax, esi // 740c | dec eax // 4c8b0d???????? | $sequence_94 = { e8???????? 85c0 7507 33db 895d08 eb03 } // n = 6, score = 1100 // e8???????? | // 85c0 | test eax, eax // 7507 | jne 9 // 33db | xor ebx, ebx // 895d08 | mov dword ptr [ebp + 8], ebx // eb03 | jmp 5 $sequence_95 = { 33d2 498bcc 498bfd e8???????? } // n = 4, score = 1100 // 33d2 | pop esi // 498bcc | mov eax, ebp // 498bfd | pop ebp // e8???????? | $sequence_96 = { 85d2 4d8bf1 458bf8 8bc2 } // n = 4, score = 1100 // 85d2 | mov ecx, dword ptr [ebx] // 4d8bf1 | test eax, eax // 458bf8 | jne 0xf3 // 8bc2 | dec esp $sequence_97 = { 33d2 488d0cc3 48890d???????? 410fb64102 } // n = 4, score = 1100 // 33d2 | add eax, dword ptr [esp + 0x18] // 488d0cc3 | push eax // 48890d???????? | // 410fb64102 | push esi $sequence_98 = { 83ff03 72d6 eb13 ff75fc 6a00 ff35???????? } // n = 6, score = 1100 // 83ff03 | push eax // 72d6 | push 0x10 // eb13 | pop eax // ff75fc | jmp 4 // 6a00 | xor eax, eax // ff35???????? | $sequence_99 = { 50 57 e8???????? e9???????? 68???????? } // n = 5, score = 1100 // 50 | dec eax // 57 | mov dword ptr [edi + ecx], eax // e8???????? | // e9???????? | // 68???????? | $sequence_100 = { c3 418bd8 4803df 410fb64101 } // n = 4, score = 1100 // c3 | cmp eax, edi // 418bd8 | je 0x13 // 4803df | push eax // 410fb64101 | xor eax, eax $sequence_101 = { 410fb64102 488d0cc3 48890d???????? 410fb64103 488d0cc3 48890d???????? } // n = 6, score = 1100 // 410fb64102 | xor eax, eax // 488d0cc3 | jmp 4 // 48890d???????? | // 410fb64103 | xor eax, eax // 488d0cc3 | cmp eax, edi // 48890d???????? | $sequence_102 = { 5b c9 c20400 51 56 ff74240c } // n = 6, score = 1100 // 5b | dec eax // c9 | add edi, 8 // c20400 | dec ecx // 51 | sub esi, esi // 56 | dec eax // ff74240c | mov dword ptr [edi + ecx], eax $sequence_103 = { 488bce ff15???????? 488b0d???????? 33d2 4c63c0 } // n = 5, score = 1100 // 488bce | push ebx // ff15???????? | // 488b0d???????? | // 33d2 | push esi // 4c63c0 | mov esi, eax $sequence_104 = { 4103ee 4883c608 83fd05 72c1 } // n = 4, score = 1100 // 4103ee | pop ebx // 4883c608 | pop ecx // 83fd05 | ret 4 // 72c1 | pop ebx $sequence_105 = { 753e ff7618 8b3d???????? ffd7 ff761c ffd7 } // n = 6, score = 1000 // 753e | jne 0x40 // ff7618 | push dword ptr [esi + 0x18] // 8b3d???????? | // ffd7 | call edi // ff761c | push dword ptr [esi + 0x1c] // ffd7 | call edi $sequence_106 = { 8bc3 5b c3 a1???????? 83c040 50 ff15???????? } // n = 7, score = 1000 // 8bc3 | jne 0xffffffcf // 5b | dec esp // c3 | mov dword ptr [ebp + ebx*8], esp // a1???????? | // 83c040 | add ebx, 1 // 50 | dec eax // ff15???????? | $sequence_107 = { 8b3d???????? 56 ffd7 53 56 } // n = 5, score = 1000 // 8b3d???????? | // 56 | dec ecx // ffd7 | mov ecx, esp // 53 | dec esp // 56 | mov dword ptr [ebp + ebx*8], esp $sequence_108 = { 8bf1 05fefeffff 33db 33c9 } // n = 4, score = 1000 // 8bf1 | dec dword ptr [esp + 0xc] // 05fefeffff | jne 0xffffffe8 // 33db | pop esi // 33c9 | pop ebx $sequence_109 = { ff4c240c 75e6 5e 5b } // n = 4, score = 1000 // ff4c240c | dec eax // 75e6 | add edi, 8 // 5e | dec ecx // 5b | sub esi, esi $sequence_110 = { 8bf0 8932 83c204 ff4c240c 75e6 } // n = 5, score = 1000 // 8bf0 | dec eax // 8932 | add edi, 8 // 83c204 | dec ecx // ff4c240c | sub esi, esi // 75e6 | jne 0xffffffe0 $sequence_111 = { ff15???????? 8ac3 5b c9 c20400 53 56 } // n = 7, score = 1000 // ff15???????? | // 8ac3 | dec eax // 5b | lea ecx, [eax + 1] // c9 | mov dx, 0x20 // c20400 | add ebx, 1 // 53 | dec eax // 56 | test edi, edi $sequence_112 = { 47 83c304 3b3e 72dc 8b45fc 5f 5b } // n = 7, score = 1000 // 47 | push ebx // 83c304 | mov esi, eax // 3b3e | cmp esi, ebx // 72dc | je 0x47 // 8b45fc | push -1 // 5f | push ebx // 5b | mov esi, eax $sequence_113 = { 8b02 43 8acb d3c0 33c6 33442410 8bf0 } // n = 7, score = 1000 // 8b02 | dec eax // 43 | mov ecx, dword ptr [edi + ecx] // 8acb | dec eax // d3c0 | mov dword ptr [edi + ecx], eax // 33c6 | dec eax // 33442410 | add edi, 8 // 8bf0 | dec ecx $sequence_114 = { 50 8d442430 50 8d442428 50 8d442428 } // n = 6, score = 900 // 50 | test edi, edi // 8d442430 | dec esp // 50 | mov esp, edi // 8d442428 | jne 0xffffffc6 // 50 | dec eax // 8d442428 | mov dword ptr [esi], ebp $sequence_115 = { 83c701 e9???????? 488b8424c8010000 498bcc bb01000000 4c8928 } // n = 6, score = 900 // 83c701 | mov ebx, 0xea60 // e9???????? | // 488b8424c8010000 | push ebx // 498bcc | jne 7 // bb01000000 | push ebx // 4c8928 | mov ebx, 0xea60 $sequence_116 = { 483bc3 488be8 0f8458010000 448b05???????? } // n = 4, score = 900 // 483bc3 | push ebx // 488be8 | push dword ptr [ebp + 0xc] // 0f8458010000 | push ebx // 448b05???????? | $sequence_117 = { e9???????? 33c9 bb26040000 48870d???????? } // n = 4, score = 900 // e9???????? | // 33c9 | push ebx // bb26040000 | mov eax, edi // 48870d???????? | $sequence_118 = { 0fb6f0 89b424d0010000 ff15???????? 488d542440 488bcd ff15???????? 4883f8ff } // n = 7, score = 900 // 0fb6f0 | dec esp // 89b424d0010000 | cmovne ecx, eax // ff15???????? | // 488d542440 | dec eax // 488bcd | mov dword ptr [esp + 0x20], ebx // ff15???????? | // 4883f8ff | test eax, eax $sequence_119 = { 41b905000000 488bd8 ff15???????? 488bcb ff15???????? 4533c9 488bd3 } // n = 7, score = 900 // 41b905000000 | mov eax, edi // 488bd8 | lea eax, [esi + 0x18] // ff15???????? | // 488bcb | mov ecx, dword ptr [eax] // ff15???????? | // 4533c9 | push eax // 488bd3 | push ecx $sequence_120 = { 4533c9 4889442428 215c2420 4533c0 } // n = 4, score = 900 // 4533c9 | mov eax, esi // 4889442428 | mov eax, dword ptr [esi] // 215c2420 | mov ecx, dword ptr [eax] // 4533c0 | push ebx $sequence_121 = { 7416 a1???????? 83c004 50 be???????? e8???????? } // n = 6, score = 900 // 7416 | mov dx, 0x20 // a1???????? | // 83c004 | dec ecx // 50 | mov ecx, esp // be???????? | // e8???????? | $sequence_122 = { 488bd6 ff15???????? eb14 488b0d???????? } // n = 4, score = 900 // 488bd6 | mov al, byte ptr [esi] // ff15???????? | // eb14 | leave // 488b0d???????? | $sequence_123 = { 4c8bc7 33d2 ff15???????? 33ff 4885ff } // n = 5, score = 900 // 4c8bc7 | ret 4 // 33d2 | push ebx // ff15???????? | // 33ff | push esi // 4885ff | mov esi, eax $sequence_124 = { 480f45f2 832700 458be0 bb08000000 e8???????? } // n = 5, score = 900 // 480f45f2 | lea eax, [esi + 0x18] // 832700 | mov ecx, dword ptr [eax] // 458be0 | push eax // bb08000000 | push ecx // e8???????? | $sequence_125 = { ff35???????? ffd3 8bd8 85db 7476 } // n = 5, score = 900 // ff35???????? | // ffd3 | dec eax // 8bd8 | mov ecx, edi // 85db | dec esp // 7476 | mov dword ptr [ebp + ebx*8], esp $sequence_126 = { 8d45fc 50 ff750c 33ff ff7508 217dfc e8???????? } // n = 7, score = 900 // 8d45fc | pop ebx // 50 | pop edi // ff750c | push ebx // 33ff | push esi // ff7508 | pop ebx // 217dfc | push ebx // e8???????? | $sequence_127 = { 488bce ff15???????? 4c8d4c2450 4c8d442458 8d5001 488bce e8???????? } // n = 7, score = 900 // 488bce | mov al, byte ptr [esi] // ff15???????? | // 4c8d4c2450 | mov al, bl // 4c8d442458 | pop ebx // 8d5001 | leave // 488bce | ret 4 // e8???????? | $sequence_128 = { 4c8be8 0f841c010000 448b05???????? 33d2 } // n = 4, score = 900 // 4c8be8 | dec eax // 0f841c010000 | mov dword ptr [esp + 0x20], ebx // 448b05???????? | // 33d2 | dec eax $sequence_129 = { 741d 3dd2100000 7416 a1???????? } // n = 4, score = 900 // 741d | jmp 0xc // 3dd2100000 | add ebx, 1 // 7416 | dec eax // a1???????? | $sequence_130 = { 754f 488d4c246c 66ba2e00 ff15???????? 488bf0 488d44246c 2bf0 } // n = 7, score = 900 // 754f | mov ecx, edi // 488d4c246c | mov dword ptr [esp + 0x28], 0xea60 // 66ba2e00 | dec esp // ff15???????? | // 488bf0 | cmovne ecx, eax // 488d44246c | dec eax // 2bf0 | mov dword ptr [esp + 0x20], ebx $sequence_131 = { 41be01000000 33c9 418bd6 ff15???????? } // n = 4, score = 800 // 41be01000000 | xor ecx, ecx // 33c9 | inc ebp // 418bd6 | xor eax, eax // ff15???????? | $sequence_132 = { 448bc0 8bd8 33d2 4983c001 } // n = 4, score = 800 // 448bc0 | push ebx // 8bd8 | push 1 // 33d2 | push 1 // 4983c001 | push dword ptr [ebp - 4] $sequence_133 = { 53 56 8bf1 05fefeffff } // n = 4, score = 800 // 53 | je 0x2b // 56 | mov eax, dword ptr [edx] // 8bf1 | inc ebx // 05fefeffff | mov cl, bl $sequence_134 = { 803f2a 750b 4883c701 83c3ff } // n = 4, score = 800 // 803f2a | mov ebx, eax // 750b | cmp ebx, esi // 4883c701 | mov esi, dword ptr [ebp + 8] // 83c3ff | xor esi, esi $sequence_135 = { e8???????? 85c0 740f 488d4f50 488bd6 ff15???????? } // n = 6, score = 800 // e8???????? | // 85c0 | ret 4 // 740f | push ebp // 488d4f50 | mov ebp, esp // 488bd6 | push ecx // ff15???????? | $sequence_136 = { a1???????? 25efff0000 0bc2 e9???????? } // n = 4, score = 800 // a1???????? | // 25efff0000 | pop esi // 0bc2 | pop ebx // e9???????? | $sequence_137 = { ff15???????? 488b8c2490000000 8bd8 ff15???????? 33d2 448bd8 418d041e } // n = 7, score = 800 // ff15???????? | // 488b8c2490000000 | add eax, 0x40 // 8bd8 | push edi // ff15???????? | // 33d2 | push esi // 448bd8 | push edi // 418d041e | dec esp $sequence_138 = { e9???????? 488bcb ff15???????? a810 } // n = 4, score = 800 // e9???????? | // 488bcb | dec esp // ff15???????? | // a810 | arpl ax, ax $sequence_139 = { 488b0d???????? 4c63c0 33d2 4983c00c ff15???????? } // n = 5, score = 800 // 488b0d???????? | // 4c63c0 | dec esp // 33d2 | arpl ax, ax // 4983c00c | xor edx, edx // ff15???????? | $sequence_140 = { 215c2420 4533c9 4533c0 33d2 ff15???????? 85c0 7511 } // n = 7, score = 800 // 215c2420 | xor edx, edx // 4533c9 | dec ecx // 4533c0 | add eax, 0xc // 33d2 | dec esp // ff15???????? | // 85c0 | arpl ax, ax // 7511 | xor edx, edx $sequence_141 = { 57 895df4 895df0 c745f857000000 bf19010000 } // n = 5, score = 800 // 57 | jne 0xffffffec // 895df4 | pop esi // 895df0 | pop ebx // c745f857000000 | ret 8 // bf19010000 | add edx, 4 $sequence_142 = { 6a03 8935???????? 8935???????? 8935???????? } // n = 4, score = 800 // 6a03 | jne 0xffffffe8 // 8935???????? | // 8935???????? | // 8935???????? | $sequence_143 = { 8bc7 5f c20400 55 8bec 83e4f8 81ec9c000000 } // n = 7, score = 700 // 8bc7 | test eax, eax // 5f | jne 0x1d // c20400 | push eax // 55 | lea eax, [ebp + 8] // 8bec | push eax // 83e4f8 | push ebx // 81ec9c000000 | mov eax, esi $sequence_144 = { 5e 33c0 c9 c20400 55 8bec 51 } // n = 7, score = 700 // 5e | cmp dword ptr [ebp + 8], 0 // 33c0 | je 0xe // c9 | push dword ptr [ebp + 8] // c20400 | mov eax, edi // 55 | push eax // 8bec | push ebx // 51 | mov eax, esi $sequence_145 = { ff15???????? 488b0d???????? 4889040f 4883c708 492bf6 } // n = 5, score = 700 // ff15???????? | // 488b0d???????? | // 4889040f | inc ecx // 4883c708 | push esi // 492bf6 | dec eax $sequence_146 = { 53 8bc7 e8???????? 8d4618 8b08 } // n = 5, score = 700 // 53 | rol eax, cl // 8bc7 | xor eax, esi // e8???????? | // 8d4618 | je 0x1c // 8b08 | mov eax, dword ptr [edx] $sequence_147 = { 56 57 4154 4155 4156 4883ec50 488bf1 } // n = 7, score = 700 // 56 | xor edx, edx // 57 | inc ebp // 4154 | xor ecx, ecx // 4155 | inc ebp // 4156 | xor eax, eax // 4883ec50 | xor edx, edx // 488bf1 | test eax, eax $sequence_148 = { 488d542438 488bcb e8???????? eb02 33c0 85c0 } // n = 6, score = 700 // 488d542438 | cmp eax, ebx // 488bcb | je 8 // e8???????? | // eb02 | push eax // 33c0 | cmp edi, ebx // 85c0 | je 0x1b $sequence_149 = { 750a 488bcf e8???????? 8bd8 488b0d???????? } // n = 5, score = 700 // 750a | mov edx, esi // 488bcf | inc ecx // e8???????? | // 8bd8 | mov esi, 1 // 488b0d???????? | $sequence_150 = { ff7508 8bc6 e8???????? 8b06 8b08 } // n = 5, score = 700 // ff7508 | add edx, 4 // 8bc6 | dec dword ptr [esp + 0xc] // e8???????? | // 8b06 | jne 0xfffffff1 // 8b08 | mov dword ptr [edx], esi $sequence_151 = { 6a20 40 50 ffd6 } // n = 4, score = 700 // 6a20 | mov eax, edi // 40 | pop edi // 50 | test edi, edi // ffd6 | jne 0x12 $sequence_152 = { 7412 ff7508 e8???????? eb03 33c0 40 83f8ff } // n = 7, score = 600 // 7412 | mov eax, edi // ff7508 | mov eax, dword ptr [ebp + 0xc] // e8???????? | // eb03 | mov dword ptr [eax], esi // 33c0 | jmp 0x35 // 40 | push 0 // 83f8ff | je 0xffffffa5 $sequence_153 = { 488b15???????? 4c8d842428020000 48c7c101000080 ff15???????? } // n = 4, score = 600 // 488b15???????? | // 4c8d842428020000 | push eax // 48c7c101000080 | add esi, 4 // ff15???????? | $sequence_154 = { 4155 4881ecf0010000 33f6 33c0 } // n = 4, score = 600 // 4155 | mov eax, dword ptr [edi + 0xc] // 4881ecf0010000 | pop ebx // 33f6 | pop ecx // 33c0 | ret 4 $sequence_155 = { 57 be04010000 56 8bde e8???????? 8bf8 85ff } // n = 7, score = 600 // 57 | push dword ptr [ebp + 8] // be04010000 | mov eax, edi // 56 | pop edi // 8bde | pop esi // e8???????? | // 8bf8 | pop ebx // 85ff | test edi, edi $sequence_156 = { 7417 4863461c 2b6e1c 4c03e8 488b4610 48894718 4883661000 } // n = 7, score = 600 // 7417 | je 0x16 // 4863461c | add esi, 4 // 2b6e1c | cmp edi, ebx // 4c03e8 | je 0x18 // 488b4610 | push eax // 48894718 | add esi, 4 // 4883661000 | cmp edi, ebx $sequence_157 = { 21b42410020000 eb0d ff15???????? 89842410020000 } // n = 4, score = 600 // 21b42410020000 | pop esi // eb0d | mov eax, ebp // ff15???????? | // 89842410020000 | pop ebp $sequence_158 = { 33d2 ff15???????? 83bc241002000000 7416 488d942410020000 } // n = 5, score = 600 // 33d2 | je 0x11 // ff15???????? | // 83bc241002000000 | push eax // 7416 | add esi, 4 // 488d942410020000 | push eax $sequence_159 = { 7405 e8???????? 4883c428 c3 488d82204a0000 488982284a0000 488900 } // n = 7, score = 600 // 7405 | push 1 // e8???????? | // 4883c428 | push dword ptr [ebp + 0x14] // c3 | cmp edi, esi // 488d82204a0000 | je 0x10 // 488982284a0000 | push edi // 488900 | push esi $sequence_160 = { 488bd3 ff15???????? 488b8c2428020000 8bf0 ff15???????? } // n = 5, score = 600 // 488bd3 | push eax // ff15???????? | // 488b8c2428020000 | cmp edi, ebx // 8bf0 | push eax // ff15???????? | $sequence_161 = { 21442428 488b8c2428020000 488364242000 448d4803 4533c0 } // n = 5, score = 600 // 21442428 | xor eax, eax // 488b8c2428020000 | cmp eax, ebx // 488364242000 | je 0x1d // 448d4803 | push eax // 4533c0 | add esi, 4 $sequence_162 = { 399c2498000000 75d2 38442430 7560 807c243101 7559 } // n = 6, score = 500 // 399c2498000000 | inc ecx // 75d2 | push ebp // 38442430 | inc ecx // 7560 | push esi // 807c243101 | dec eax // 7559 | sub esp, 0x50 $sequence_163 = { a801 742c 488b0b e8???????? 85c0 0f85e8000000 } // n = 6, score = 500 // a801 | xor eax, eax // 742c | cmp eax, ebx // 488b0b | je 0x19 // e8???????? | // 85c0 | push eax // 0f85e8000000 | add esi, 4 $sequence_164 = { e8???????? 85c0 0f85e8000000 488b4608 488b0e 4533c9 448bc5 } // n = 7, score = 500 // e8???????? | // 85c0 | jmp 4 // 0f85e8000000 | xor eax, eax // 488b4608 | cmp eax, ebx // 488b0e | je 0x1b // 4533c9 | mov edx, edi // 448bc5 | jmp 4 $sequence_165 = { 85c0 0f859b000000 4863533c 488b4608 } // n = 4, score = 500 // 85c0 | push eax // 0f859b000000 | cmp edi, ebx // 4863533c | cmp eax, ebx // 488b4608 | je 0x11 $sequence_166 = { e8???????? 483bc3 488905???????? 0f8431020000 817424302083b8ed 8d7b01 } // n = 6, score = 500 // e8???????? | // 483bc3 | push esi // 488905???????? | // 0f8431020000 | push ebx // 817424302083b8ed | mov eax, 0x800 // 8d7b01 | push eax $sequence_167 = { e8???????? 488b0d???????? 4c8bc3 33d2 ff15???????? 488b0d???????? 4c8bc7 } // n = 7, score = 500 // e8???????? | // 488b0d???????? | // 4c8bc3 | cmp dword ptr [ebp - 4], esi // 33d2 | je 0x15 // ff15???????? | // 488b0d???????? | // 4c8bc7 | push dword ptr [ebp - 4] $sequence_168 = { e8???????? 85c0 0f8561010000 8b4348 a801 742c 488b0b } // n = 7, score = 500 // e8???????? | // 85c0 | add esi, 4 // 0f8561010000 | cmp edi, ebx // 8b4348 | je 8 // a801 | push eax // 742c | cmp edi, ebx // 488b0b | je 0x19 $sequence_169 = { 4c8d40cc 33d2 33c9 e8???????? 85c0 0f8561010000 } // n = 6, score = 500 // 4c8d40cc | cmp edi, ebx // 33d2 | je 0x18 // 33c9 | pop eax // e8???????? | // 85c0 | cmp eax, ebx // 0f8561010000 | je 8 $sequence_170 = { eb0b 8b434c 84c0 0f89a3000000 } // n = 4, score = 500 // eb0b | cmp edi, ebx // 8b434c | je 0x1b // 84c0 | mov edx, edi // 0f89a3000000 | jmp 4 $sequence_171 = { 7415 397b44 7510 488b0b e8???????? 85c0 0f859b000000 } // n = 7, score = 500 // 7415 | cmp edi, ebx // 397b44 | je 0x16 // 7510 | push eax // 488b0b | cmp edi, ebx // e8???????? | // 85c0 | je 0x18 // 0f859b000000 | push eax $sequence_172 = { 4c8d442470 488d542440 e8???????? 8bd8 85c0 7541 488b7c2440 } // n = 7, score = 400 // 4c8d442470 | dec eax // 488d542440 | test eax, eax // e8???????? | // 8bd8 | dec ecx // 85c0 | mov ecx, esp // 7541 | xor ebx, ebx // 488b7c2440 | mov dx, 0x20 $sequence_173 = { 4885c0 7427 488d542420 b901020000 ff15???????? 85c0 } // n = 6, score = 400 // 4885c0 | jne 0xffffffcf // 7427 | dec eax // 488d542420 | mov dword ptr [esi], ebp // b901020000 | add ebx, 1 // ff15???????? | // 85c0 | dec eax $sequence_174 = { 488bcd 89442428 488b842410020000 4889442420 e8???????? 8bd8 85c0 } // n = 7, score = 400 // 488bcd | xor ebx, ebx // 89442428 | mov dx, 0x20 // 488b842410020000 | dec ecx // 4889442420 | mov ecx, esp // e8???????? | // 8bd8 | dec ecx // 85c0 | mov ecx, esp $sequence_175 = { 4c89642448 ff15???????? 8bd8 83f8ff } // n = 4, score = 400 // 4c89642448 | mov dword ptr [ebp + ebx*8], esp // ff15???????? | // 8bd8 | add ebx, 1 // 83f8ff | dec eax $sequence_176 = { 33d2 448d4256 ff15???????? 4c8be0 4885c0 0f8405010000 ff15???????? } // n = 7, score = 400 // 33d2 | dec ecx // 448d4256 | mov ecx, esp // ff15???????? | // 4c8be0 | dec eax // 4885c0 | test edi, edi // 0f8405010000 | dec esp // ff15???????? | $sequence_177 = { 488b0d???????? 03c6 33d2 468d44385f ff15???????? 4c8bf0 4885c0 } // n = 7, score = 400 // 488b0d???????? | // 03c6 | mov dword ptr [ebp + ebx*8], esp // 33d2 | add ebx, 1 // 468d44385f | dec esp // ff15???????? | // 4c8bf0 | mov esp, edi // 4885c0 | jne 0xffffffc6 $sequence_178 = { 33ff e8???????? 4c8be8 4885c0 7508 } // n = 5, score = 400 // 33ff | dec eax // e8???????? | // 4c8be8 | mov dword ptr [esi], ebp // 4885c0 | jmp 9 // 7508 | xor ebx, ebx $sequence_179 = { ba10000000 488bc8 e8???????? 48898424e0010000 } // n = 4, score = 400 // ba10000000 | test edi, edi // 488bc8 | dec esp // e8???????? | // 48898424e0010000 | mov esp, edi $sequence_180 = { 59 89ec 5d c20c00 60 8b742424 } // n = 6, score = 300 // 59 | mov ecx, esi // 89ec | test eax, eax // 5d | dec esp // c20c00 | lea ecx, [esp + 0x50] // 60 | dec esp // 8b742424 | lea eax, [esp + 0x58] $sequence_181 = { 59 5f 5e 01e8 8d342a eba2 5f } // n = 7, score = 300 // 59 | dec esp // 5f | lea ecx, [esp + 0x50] // 5e | dec esp // 01e8 | lea eax, [esp + 0x58] // 8d342a | lea edx, [eax + 1] // eba2 | dec eax // 5f | mov ecx, esi $sequence_182 = { 8b4c241c 01d1 894c2414 8b4c2424 01c1 83c304 } // n = 6, score = 300 // 8b4c241c | dec eax // 01d1 | mov edx, esi // 894c2414 | jmp 0x16 // 8b4c2424 | dec esp // 01c1 | mov eax, edi // 83c304 | dec esp $sequence_183 = { 894c2410 56 90 57 51 8b742420 } // n = 6, score = 300 // 894c2410 | dec eax // 56 | mov ecx, esi // 90 | dec esp // 57 | lea ecx, [esp + 0x50] // 51 | dec esp // 8b742420 | lea eax, [esp + 0x58] $sequence_184 = { 40 c1ca08 e2e4 c9 } // n = 4, score = 300 // 40 | lea edx, [eax + 1] // c1ca08 | dec esp // e2e4 | mov eax, edi // c9 | xor edx, edx $sequence_185 = { 034510 39d0 75c3 5e 5f 5b } // n = 6, score = 300 // 034510 | dec esp // 39d0 | lea ecx, [esp + 0x50] // 75c3 | dec esp // 5e | lea eax, [esp + 0x58] // 5f | lea edx, [eax + 1] // 5b | dec eax $sequence_186 = { 31db 30c0 85f6 57 884c2413 0f869c000000 eb04 } // n = 7, score = 300 // 31db | lea eax, [esp + 0x58] // 30c0 | lea edx, [eax + 1] // 85f6 | dec eax // 57 | mov ecx, esi // 884c2413 | test eax, eax // 0f869c000000 | je 0x12 // eb04 | dec eax $sequence_187 = { 8044241301 0fb6ca 01cb 30c9 eb59 } // n = 5, score = 300 // 8044241301 | dec esp // 0fb6ca | lea eax, [esp + 0x58] // 01cb | jmp 0x16 // 30c9 | dec esp // eb59 | mov eax, edi condition: 7 of them and filesize < 2940928 }