rule win_trickbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.trickbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 1bc0 83e070 83c010 eb25 a900000040 7411 2500000080 } // n = 7, score = 4500 // 1bc0 | sbb eax, eax // 83e070 | and eax, 0x70 // 83c010 | add eax, 0x10 // eb25 | jmp 0x27 // a900000040 | test eax, 0x40000000 // 7411 | je 0x13 // 2500000080 | and eax, 0x80000000 $sequence_1 = { 83e020 83c020 eb36 2500000080 f7d8 } // n = 5, score = 4500 // 83e020 | and eax, 0x20 // 83c020 | add eax, 0x20 // eb36 | jmp 0x38 // 2500000080 | and eax, 0x80000000 // f7d8 | neg eax $sequence_2 = { 2500000080 f7d8 1bc0 83e070 83c010 } // n = 5, score = 4500 // 2500000080 | and eax, 0x80000000 // f7d8 | neg eax // 1bc0 | sbb eax, eax // 83e070 | and eax, 0x70 // 83c010 | add eax, 0x10 $sequence_3 = { 83e002 83c002 eb0d 2500000080 f7d8 } // n = 5, score = 4500 // 83e002 | and eax, 2 // 83c002 | add eax, 2 // eb0d | jmp 0xf // 2500000080 | and eax, 0x80000000 // f7d8 | neg eax $sequence_4 = { a900000020 7429 a900000040 7411 2500000080 f7d8 } // n = 6, score = 4500 // a900000020 | test eax, 0x20000000 // 7429 | je 0x2b // a900000040 | test eax, 0x40000000 // 7411 | je 0x13 // 2500000080 | and eax, 0x80000000 // f7d8 | neg eax $sequence_5 = { 83c724 8b07 a900000020 7429 } // n = 4, score = 3700 // 83c724 | add edi, 0x24 // 8b07 | mov eax, dword ptr [edi] // a900000020 | test eax, 0x20000000 // 7429 | je 0x2b $sequence_6 = { c705????????fdffffff c705????????feffffff c705????????ffffffff e8???????? } // n = 4, score = 3700 // c705????????fdffffff | // c705????????feffffff | // c705????????ffffffff | // e8???????? | $sequence_7 = { 895df4 895dec 66c745f00005 895dfc } // n = 4, score = 3500 // 895df4 | test eax, 0x40000000 // 895dec | je 0x18 // 66c745f00005 | and eax, 0x80000000 // 895dfc | je 0x2b $sequence_8 = { 7ff3 b871800780 f7e1 c1ea0f 69d20f00ffff } // n = 5, score = 3400 // 7ff3 | and eax, 0x80000000 // b871800780 | neg eax // f7e1 | sbb eax, eax // c1ea0f | and eax, 7 // 69d20f00ffff | inc eax $sequence_9 = { 75fa 33d2 33f6 0f94c2 83e201 23c2 83f801 } // n = 7, score = 3400 // 75fa | and eax, 0x70 // 33d2 | add eax, 0x10 // 33f6 | jmp 0x27 // 0f94c2 | test eax, 0x40000000 // 83e201 | je 0x1a // 23c2 | add eax, 2 // 83f801 | jmp 0xf $sequence_10 = { 33ff 57 6880000000 6a02 57 6a01 68000000c0 } // n = 7, score = 3400 // 33ff | mov eax, dword ptr [ecx + 0x40] // 57 | dec eax // 6880000000 | mov edx, dword ptr [ecx + 0x18] // 6a02 | dec eax // 57 | mov dword ptr [esp + 0x40], eax // 6a01 | dec eax // 68000000c0 | mov eax, dword ptr [ecx + 0x48] $sequence_11 = { 41 83c028 3bce 7ce9 } // n = 4, score = 3000 // 41 | test eax, 0x40000000 // 83c028 | je 0x13 // 3bce | and eax, 0x80000000 // 7ce9 | neg eax $sequence_12 = { 1bc0 83e007 40 8b4fe8 } // n = 4, score = 3000 // 1bc0 | and eax, 0x80000000 // 83e007 | neg eax // 40 | sbb eax, eax // 8b4fe8 | and eax, 0x70 $sequence_13 = { 4c8b4120 488b5118 4889442438 488b4140 } // n = 4, score = 2800 // 4c8b4120 | mov ecx, dword ptr [ecx + 0x10] // 488b5118 | dec eax // 4889442438 | mov dword ptr [esp + 0x20], eax // 488b4140 | dec eax $sequence_14 = { 4889442440 488b4148 4889442438 488b4140 4889442430 488b4138 } // n = 6, score = 2800 // 4889442440 | dec eax // 488b4148 | mov edx, dword ptr [ecx + 0x18] // 4889442438 | dec eax // 488b4140 | mov dword ptr [esp + 0x40], eax // 4889442430 | dec eax // 488b4138 | mov eax, dword ptr [ecx + 0x50] $sequence_15 = { 33db 53 53 6a03 53 6a01 6800010000 } // n = 7, score = 2800 // 33db | dec eax // 53 | mov dword ptr [esp + 0x38], eax // 53 | dec eax // 6a03 | mov eax, dword ptr [ecx + 0x40] // 53 | dec eax // 6a01 | mov dword ptr [esp + 0x30], eax // 6800010000 | dec eax $sequence_16 = { 4c8b4120 488b5118 4889442440 488b4148 } // n = 4, score = 2800 // 4c8b4120 | dec eax // 488b5118 | mov ecx, dword ptr [ecx + 0x10] // 4889442440 | dec eax // 488b4148 | mov dword ptr [esp + 0x30], eax $sequence_17 = { 4889442428 488b4130 488b4910 4889442420 41ffd2 } // n = 5, score = 2800 // 4889442428 | mov eax, dword ptr [ecx + 0x48] // 488b4130 | dec eax // 488b4910 | mov dword ptr [esp + 0x40], eax // 4889442420 | dec eax // 41ffd2 | mov eax, dword ptr [ecx + 0x48] $sequence_18 = { 4889442430 488b4138 4889442428 488b4130 } // n = 4, score = 2800 // 4889442430 | dec eax // 488b4138 | mov dword ptr [esp + 0x38], eax // 4889442428 | dec eax // 488b4130 | mov eax, dword ptr [ecx + 0x40] $sequence_19 = { 488b01 4c8b4120 488b5118 488b4910 } // n = 4, score = 2800 // 488b01 | mov dword ptr [esp + 0x40], eax // 4c8b4120 | dec eax // 488b5118 | mov eax, dword ptr [ecx + 0x48] // 488b4910 | dec eax $sequence_20 = { 488b4150 4c8b11 4c8b4928 4c8b4120 488b5118 } // n = 5, score = 2800 // 488b4150 | dec eax // 4c8b11 | mov eax, dword ptr [ecx + 0x50] // 4c8b4928 | dec esp // 4c8b4120 | mov edx, dword ptr [ecx] // 488b5118 | dec esp $sequence_21 = { 488b01 488b5118 488b4910 ffd0 } // n = 4, score = 2800 // 488b01 | mov edx, dword ptr [ecx + 0x18] // 488b5118 | dec eax // 488b4910 | mov dword ptr [esp + 0x40], eax // ffd0 | dec eax $sequence_22 = { 83780400 7404 8b4008 c3 } // n = 4, score = 2000 // 83780400 | mov ecx, dword ptr [ecx + 0x28] // 7404 | dec esp // 8b4008 | mov eax, dword ptr [ecx + 0x20] // c3 | dec esp $sequence_23 = { 2bc2 d1e8 03c2 c1e806 6bc05f } // n = 5, score = 2000 // 2bc2 | dec eax // d1e8 | mov dword ptr [esp + 0x28], eax // 03c2 | dec eax // c1e806 | mov eax, dword ptr [ecx + 0x30] // 6bc05f | dec eax $sequence_24 = { 6820bf0200 68905f0100 68905f0100 50 } // n = 4, score = 2000 // 6820bf0200 | dec eax // 68905f0100 | mov dword ptr [esp + 0x38], eax // 68905f0100 | dec eax // 50 | mov eax, dword ptr [ecx] $sequence_25 = { 51 68e9fd0000 50 e8???????? } // n = 4, score = 1800 // 51 | mov eax, dword ptr [ecx + 0x40] // 68e9fd0000 | dec eax // 50 | mov dword ptr [esp + 0x30], eax // e8???????? | $sequence_26 = { 6a40 6800300000 6a70 6a00 } // n = 4, score = 1800 // 6a40 | dec eax // 6800300000 | mov eax, dword ptr [ecx + 0x38] // 6a70 | dec eax // 6a00 | mov dword ptr [esp + 0x30], eax $sequence_27 = { 8d440002 6a00 50 e8???????? } // n = 4, score = 1500 // 8d440002 | lea eax, [eax + eax + 2] // 6a00 | push 0 // 50 | push eax // e8???????? | $sequence_28 = { c3 6a01 ff15???????? 50 } // n = 4, score = 1500 // c3 | ret // 6a01 | push 1 // ff15???????? | // 50 | push eax $sequence_29 = { 85c0 7f0b e8???????? 8b05???????? } // n = 4, score = 1300 // 85c0 | mov eax, dword ptr [ecx + 0x20] // 7f0b | dec eax // e8???????? | // 8b05???????? | $sequence_30 = { e8???????? 83f801 7411 ba0a000000 } // n = 4, score = 1300 // e8???????? | // 83f801 | mov eax, dword ptr [ecx + 0x40] // 7411 | dec eax // ba0a000000 | mov dword ptr [esp + 0x30], eax $sequence_31 = { 59 03d0 52 ebdc 89450c } // n = 5, score = 1200 // 59 | mov eax, dword ptr [ecx + 0x20] // 03d0 | dec eax // 52 | mov edx, dword ptr [ecx + 0x18] // ebdc | dec eax // 89450c | mov dword ptr [esp + 0x38], eax $sequence_32 = { 8bc1 66ad 85c0 741c } // n = 4, score = 1200 // 8bc1 | dec eax // 66ad | mov edx, dword ptr [ecx + 0x18] // 85c0 | dec eax // 741c | mov dword ptr [esp + 0x40], eax $sequence_33 = { ff5514 50 8b450c ff4d0c ba28000000 f7e2 } // n = 6, score = 1200 // ff5514 | mov eax, dword ptr [ecx + 0x40] // 50 | dec eax // 8b450c | mov dword ptr [esp + 0x30], eax // ff4d0c | dec eax // ba28000000 | mov eax, dword ptr [ecx + 0x38] // f7e2 | dec esp $sequence_34 = { 7405 e8???????? ff15???????? 8bc3 } // n = 4, score = 1200 // 7405 | dec eax // e8???????? | // ff15???????? | // 8bc3 | mov eax, dword ptr [ecx + 0x38] $sequence_35 = { ff5508 58 894514 8b5510 } // n = 4, score = 1100 // ff5508 | mov eax, dword ptr [ecx + 0x20] // 58 | dec eax // 894514 | mov edx, dword ptr [ecx + 0x18] // 8b5510 | dec eax $sequence_36 = { c1e102 2bc1 8b00 894508 } // n = 4, score = 1100 // c1e102 | mov dword ptr [esp + 0x40], eax // 2bc1 | dec eax // 8b00 | mov eax, dword ptr [ecx + 0x48] // 894508 | dec esp $sequence_37 = { 85c0 741c 3bc1 7213 } // n = 4, score = 1100 // 85c0 | mov dword ptr [esp + 0x38], eax // 741c | dec esp // 3bc1 | mov ecx, dword ptr [ecx + 0x28] // 7213 | dec esp $sequence_38 = { 8b4a04 ff5508 50 51 50 } // n = 5, score = 1100 // 8b4a04 | dec esp // ff5508 | mov ecx, dword ptr [ecx + 0x28] // 50 | dec esp // 51 | mov eax, dword ptr [ecx + 0x20] // 50 | dec eax $sequence_39 = { 2bc1 8b00 3bc7 72f2 } // n = 4, score = 1100 // 2bc1 | mov dword ptr [esp + 0x40], eax // 8b00 | dec eax // 3bc7 | mov eax, dword ptr [ecx + 0x48] // 72f2 | dec eax $sequence_40 = { 03d0 895510 8b4a04 ff5508 8b5510 8b4a0c } // n = 6, score = 1100 // 03d0 | mov edx, dword ptr [ecx + 0x18] // 895510 | dec eax // 8b4a04 | mov dword ptr [esp + 0x38], eax // ff5508 | dec eax // 8b5510 | mov eax, dword ptr [ecx + 0x40] // 8b4a0c | dec eax $sequence_41 = { 813950450000 7578 f6411602 7472 } // n = 4, score = 1000 // 813950450000 | add eax, 0x10 // 7578 | jmp 0x27 // f6411602 | test eax, 0x40000000 // 7472 | je 0x1a $sequence_42 = { ba28000000 f7e2 8d9500040000 03d0 } // n = 4, score = 1000 // ba28000000 | mov dword ptr [esp + 0x38], eax // f7e2 | dec eax // 8d9500040000 | mov eax, dword ptr [ecx + 0x40] // 03d0 | dec eax $sequence_43 = { ff15???????? 8bf0 c1ee1f 83f601 } // n = 4, score = 900 // ff15???????? | // 8bf0 | dec eax // c1ee1f | mov dword ptr [esp + 0x28], eax // 83f601 | dec eax $sequence_44 = { c744242000300000 ff15???????? 85c0 7911 } // n = 4, score = 900 // c744242000300000 | mov dword ptr [esp + 0x38], eax // ff15???????? | // 85c0 | dec eax // 7911 | mov eax, dword ptr [ecx + 0x40] $sequence_45 = { 8bcf e8???????? 8bf0 85ed } // n = 4, score = 900 // 8bcf | mov eax, dword ptr [ecx + 0x50] // e8???????? | // 8bf0 | dec esp // 85ed | mov edx, dword ptr [ecx] $sequence_46 = { b9e0000000 663bc1 740b b80b010000 } // n = 4, score = 900 // b9e0000000 | mov dword ptr [esp + 0x30], eax // 663bc1 | dec eax // 740b | mov eax, dword ptr [ecx + 0x38] // b80b010000 | dec eax $sequence_47 = { 58 41 41 41 } // n = 4, score = 900 // 58 | mov eax, dword ptr [ecx + 0x38] // 41 | dec eax // 41 | mov dword ptr [esp + 0x28], eax // 41 | dec eax $sequence_48 = { 85c0 790f 8bc8 e8???????? 8d5e10 e9???????? } // n = 6, score = 900 // 85c0 | dec eax // 790f | mov dword ptr [esp + 0x28], eax // 8bc8 | dec eax // e8???????? | // 8d5e10 | mov eax, dword ptr [ecx + 0x30] // e9???????? | $sequence_49 = { 0f89d2000000 8bc8 e8???????? bb17000000 } // n = 4, score = 900 // 0f89d2000000 | dec eax // 8bc8 | mov dword ptr [esp + 0x30], eax // e8???????? | // bb17000000 | dec eax $sequence_50 = { 7cea 8bc1 c3 b905000000 } // n = 4, score = 900 // 7cea | dec eax // 8bc1 | mov ecx, dword ptr [ecx + 0x10] // c3 | dec eax // b905000000 | mov dword ptr [esp + 0x20], eax $sequence_51 = { 7536 b906000000 8bc1 c3 } // n = 4, score = 900 // 7536 | dec eax // b906000000 | mov edx, dword ptr [ecx + 0x18] // 8bc1 | dec eax // c3 | mov dword ptr [esp + 0x38], eax $sequence_52 = { 8b03 0fbae01d 732b 0fbae01e 7315 0fbae01f } // n = 6, score = 900 // 8b03 | dec eax // 0fbae01d | mov eax, dword ptr [ecx + 0x40] // 732b | dec eax // 0fbae01e | mov dword ptr [esp + 0x30], eax // 7315 | dec eax // 0fbae01f | mov eax, dword ptr [ecx + 0x38] $sequence_53 = { 3bd1 0f8293000000 038e8c000000 3bd1 0f8385000000 8bc2 } // n = 6, score = 900 // 3bd1 | mov dword ptr [esp + 0x28], eax // 0f8293000000 | dec eax // 038e8c000000 | mov eax, dword ptr [ecx + 0x30] // 3bd1 | dec eax // 0f8385000000 | mov ecx, dword ptr [ecx + 0x10] // 8bc2 | dec eax $sequence_54 = { 41 41 50 2bc1 8b00 } // n = 5, score = 800 // 41 | dec eax // 41 | mov eax, dword ptr [ecx + 0x40] // 50 | dec eax // 2bc1 | mov dword ptr [esp + 0x30], eax // 8b00 | dec eax $sequence_55 = { 8bc8 33c0 85c9 0f95c0 eb02 33c0 } // n = 6, score = 800 // 8bc8 | dec esp // 33c0 | mov ecx, dword ptr [ecx + 0x28] // 85c9 | dec esp // 0f95c0 | mov eax, dword ptr [ecx + 0x20] // eb02 | dec eax // 33c0 | mov edx, dword ptr [ecx + 0x18] $sequence_56 = { 8bc7 e8???????? 85c0 0f849f000000 } // n = 4, score = 700 // 8bc7 | mov eax, dword ptr [ecx + 0x20] // e8???????? | // 85c0 | dec eax // 0f849f000000 | mov edx, dword ptr [ecx + 0x18] $sequence_57 = { 2bc1 c1e002 51 8bcf } // n = 4, score = 600 // 2bc1 | dec eax // c1e002 | mov dword ptr [esp + 0x38], eax // 51 | dec eax // 8bcf | mov eax, dword ptr [ecx + 0x40] $sequence_58 = { ff15???????? 6a00 6a00 6a00 8d45dc 50 ff15???????? } // n = 7, score = 200 // ff15???????? | // 6a00 | dec eax // 6a00 | mov eax, dword ptr [ecx + 0x48] // 6a00 | dec eax // 8d45dc | mov dword ptr [esp + 0x38], eax // 50 | dec eax // ff15???????? | $sequence_59 = { 8dbf00500310 8bd6 897d08 3bc8 } // n = 4, score = 200 // 8dbf00500310 | mov dword ptr [esp + 0x28], eax // 8bd6 | dec eax // 897d08 | mov eax, dword ptr [ecx + 0x30] // 3bc8 | dec eax $sequence_60 = { 8b7d10 2bf9 53 50 } // n = 4, score = 200 // 8b7d10 | dec eax // 2bf9 | mov eax, dword ptr [ecx + 0x40] // 53 | dec eax // 50 | mov edx, dword ptr [ecx + 0x18] $sequence_61 = { 894dd8 837dd840 760b 8b55d8 83ea01 } // n = 5, score = 100 // 894dd8 | mov eax, dword ptr [ecx + 0x38] // 837dd840 | dec eax // 760b | mov dword ptr [esp + 0x28], eax // 8b55d8 | dec eax // 83ea01 | mov eax, dword ptr [ecx + 0x30] $sequence_62 = { 9c 000f 9c 000f 9c } // n = 5, score = 100 // 9c | add eax, 0x20 // 000f | jmp 0x38 // 9c | and eax, 0x80000000 // 000f | neg eax // 9c | sbb eax, eax $sequence_63 = { 51 dd1c24 e8???????? ddd8 83c408 } // n = 5, score = 100 // 51 | add eax, 0x20 // dd1c24 | jmp 0x3b // e8???????? | // ddd8 | and eax, 0x80000000 // 83c408 | neg eax $sequence_64 = { 50 e8???????? 83c40c 8bf3 8bc7 e8???????? } // n = 6, score = 100 // 50 | test eax, 0x40000000 // e8???????? | // 83c40c | and eax, 0x20 // 8bf3 | add eax, 0x20 // 8bc7 | jmp 0x3b // e8???????? | $sequence_65 = { 8945cc ebee 8b45d8 48 50 } // n = 5, score = 100 // 8945cc | dec eax // ebee | mov dword ptr [esp + 0x38], eax // 8b45d8 | dec eax // 48 | mov eax, dword ptr [ecx + 0x40] // 50 | dec eax $sequence_66 = { 40 8945d8 ebf1 8b45d4 } // n = 4, score = 100 // 40 | mov ecx, dword ptr [ecx + 0x10] // 8945d8 | dec eax // ebf1 | mov eax, dword ptr [ecx + 0x48] // 8b45d4 | dec esp $sequence_67 = { ff15???????? 85c0 7420 8b4de0 83c101 894de0 } // n = 6, score = 100 // ff15???????? | // 85c0 | dec eax // 7420 | mov ecx, dword ptr [ecx + 0x10] // 8b4de0 | dec eax // 83c101 | mov dword ptr [esp + 0x40], eax // 894de0 | dec eax $sequence_68 = { 8b4508 8b10 8b4804 56 57 be2037efc6 e8???????? } // n = 7, score = 100 // 8b4508 | jmp 0x2a // 8b10 | test eax, 0x40000000 // 8b4804 | je 0x1d // 56 | and eax, 0x80000000 // 57 | neg eax // be2037efc6 | and eax, 0x20 // e8???????? | $sequence_69 = { 750b 68f4010000 ff15???????? 837dfc00 74cf } // n = 5, score = 100 // 750b | mov dword ptr [esp + 0x30], eax // 68f4010000 | dec eax // ff15???????? | // 837dfc00 | mov eax, dword ptr [ecx + 0x38] // 74cf | dec eax $sequence_70 = { ff15???????? ebd5 8365f800 8365d000 c745d400000400 8b45d0 8945d8 } // n = 7, score = 100 // ff15???????? | // ebd5 | mov dword ptr [esp + 0x30], eax // 8365f800 | dec eax // 8365d000 | mov eax, dword ptr [ecx + 0x38] // c745d400000400 | dec eax // 8b45d0 | mov dword ptr [esp + 0x28], eax // 8945d8 | dec eax $sequence_71 = { 8b3d???????? 40 83e0fc 03c1 be???????? 8dbf00500310 } // n = 6, score = 100 // 8b3d???????? | // 40 | mov dword ptr [esp + 0x38], eax // 83e0fc | dec eax // 03c1 | mov eax, dword ptr [ecx + 0x40] // be???????? | // 8dbf00500310 | dec eax $sequence_72 = { 0305???????? 8bf9 c1e704 033d???????? 33c7 8d3c0e } // n = 6, score = 100 // 0305???????? | // 8bf9 | neg eax // c1e704 | sbb eax, eax // 033d???????? | // 33c7 | and eax, 2 // 8d3c0e | add eax, 2 $sequence_73 = { 140c 46 83f615 55 0db9e64e93 b1bb } // n = 6, score = 100 // 140c | and eax, 0x80000000 // 46 | neg eax // 83f615 | sbb eax, eax // 55 | and eax, 0x70 // 0db9e64e93 | and eax, 0x70 // b1bb | add eax, 0x10 $sequence_74 = { 51 58 8910 59 5a 42 42 } // n = 7, score = 100 // 51 | mov edx, dword ptr [ecx] // 58 | dec esp // 8910 | mov ecx, dword ptr [ecx + 0x28] // 59 | dec esp // 5a | mov eax, dword ptr [ecx + 0x20] // 42 | dec eax // 42 | mov edx, dword ptr [ecx + 0x18] $sequence_75 = { 3bc6 7712 8bc7 e8???????? 034710 } // n = 5, score = 100 // 3bc6 | and eax, 0x70 // 7712 | and eax, 0x70 // 8bc7 | add eax, 0x10 // e8???????? | // 034710 | jmp 0x2a $sequence_76 = { 894de0 817de014010000 7502 eb0c 8d55dc 52 } // n = 6, score = 100 // 894de0 | mov eax, dword ptr [ecx + 0x48] // 817de014010000 | dec eax // 7502 | mov dword ptr [esp + 0x38], eax // eb0c | dec eax // 8d55dc | mov eax, dword ptr [ecx + 0x40] // 52 | dec eax $sequence_77 = { 3bc6 7305 e8???????? 8b4508 e8???????? } // n = 5, score = 100 // 3bc6 | sbb eax, eax // 7305 | je 0x13 // e8???????? | // 8b4508 | and eax, 0x80000000 // e8???????? | condition: 7 of them and filesize < 712704 }