rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.emotet."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7c04 3c7a 7e0b 3c41 7c04 3c5a }
            // n = 6, score = 2900
            //   7c04                 | jl                  6
            //   3c7a                 | cmp                 al, 0x7a
            //   7e0b                 | jle                 0xd
            //   3c41                 | cmp                 al, 0x41
            //   7c04                 | jl                  6
            //   3c5a                 | cmp                 al, 0x5a

        $sequence_1 = { 3c39 7e13 3c61 7c04 3c7a 7e0b }
            // n = 6, score = 2900
            //   3c39                 | cmp                 al, 0x39
            //   7e13                 | jle                 0x15
            //   3c61                 | cmp                 al, 0x61
            //   7c04                 | jl                  6
            //   3c7a                 | cmp                 al, 0x7a
            //   7e0b                 | jle                 0xd

        $sequence_2 = { 3c41 7c04 3c5a 7e03 c60158 41 }
            // n = 6, score = 2900
            //   3c41                 | cmp                 al, 0x41
            //   7c04                 | jl                  6
            //   3c5a                 | cmp                 al, 0x5a
            //   7e03                 | jle                 5
            //   c60158               | mov                 byte ptr [ecx], 0x58
            //   41                   | inc                 ecx

        $sequence_3 = { 8a01 3c30 7c04 3c39 7e13 3c61 }
            // n = 6, score = 2900
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   3c30                 | cmp                 al, 0x30
            //   7c04                 | jl                  6
            //   3c39                 | cmp                 al, 0x39
            //   7e13                 | jle                 0x15
            //   3c61                 | cmp                 al, 0x61

        $sequence_4 = { 33c0 3903 5f 5e 0f95c0 5b 8be5 }
            // n = 7, score = 2400
            //   33c0                 | xor                 eax, eax
            //   3903                 | cmp                 dword ptr [ebx], eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   0f95c0               | setne               al
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_5 = { c60158 41 803900 75dd }
            // n = 4, score = 2400
            //   c60158               | mov                 byte ptr [ecx], 0x58
            //   41                   | inc                 ecx
            //   803900               | cmp                 byte ptr [ecx], 0
            //   75dd                 | jne                 0xffffffdf

        $sequence_6 = { 83c020 eb03 0fb7c0 69d23f000100 }
            // n = 4, score = 2300
            //   83c020               | add                 eax, 0x20
            //   eb03                 | jmp                 5
            //   0fb7c0               | movzx               eax, ax
            //   69d23f000100         | imul                edx, edx, 0x1003f

        $sequence_7 = { 8d5204 c1e910 8842fd 884afe }
            // n = 4, score = 2100
            //   8d5204               | test                eax, eax
            //   c1e910               | add                 ecx, 4
            //   8842fd               | mov                 dword ptr [esi + 4], ecx
            //   884afe               | mov                 eax, dword ptr [eax]

        $sequence_8 = { 880a 8bc1 c1e808 8d5204 c1e910 }
            // n = 5, score = 2100
            //   880a                 | cmp                 byte ptr [ecx], 0
            //   8bc1                 | jle                 5
            //   c1e808               | mov                 byte ptr [ecx], 0x58
            //   8d5204               | inc                 ecx
            //   c1e910               | cmp                 byte ptr [ecx], 0

        $sequence_9 = { 8d5801 f6c30f 7406 83e3f0 83c310 }
            // n = 5, score = 2000
            //   8d5801               | lea                 ebx, [eax + 1]
            //   f6c30f               | test                bl, 0xf
            //   7406                 | je                  8
            //   83e3f0               | and                 ebx, 0xfffffff0
            //   83c310               | add                 ebx, 0x10

        $sequence_10 = { 894dcc 8d4dc8 8945c8 8975d4 }
            // n = 4, score = 1900
            //   894dcc               | add                 eax, 0x20
            //   8d4dc8               | jmp                 8
            //   8945c8               | movzx               eax, ax
            //   8975d4               | imul                edx, edx, 0x1003f

        $sequence_11 = { 6a04 50 ff760c 8d45fc }
            // n = 4, score = 1900
            //   6a04                 | pop                 ebx
            //   50                   | mov                 esp, ebp
            //   ff760c               | add                 eax, 0x20
            //   8d45fc               | jmp                 8

        $sequence_12 = { ff15???????? 017758 83c40c 29775c 8b477c }
            // n = 5, score = 1900
            //   ff15????????         |                     
            //   017758               | pop                 ebx
            //   83c40c               | mov                 esp, ebp
            //   29775c               | xor                 eax, eax
            //   8b477c               | cmp                 dword ptr [ebx], eax

        $sequence_13 = { 56 50 8b4774 03878c000000 50 ff15???????? }
            // n = 6, score = 1900
            //   56                   | sub                 esp, 0x48
            //   50                   | push                ebx
            //   8b4774               | push                esi
            //   03878c000000         | push                edi
            //   50                   | push                0x44
            //   ff15????????         |                     

        $sequence_14 = { 7448 8b00 2b878c000000 56 }
            // n = 4, score = 1900
            //   7448                 | mov                 dword ptr [ecx], eax
            //   8b00                 | mov                 eax, dword ptr [edi + 0x7c]
            //   2b878c000000         | test                eax, eax
            //   56                   | je                  0x4f

        $sequence_15 = { 8bf1 ff15???????? 8b17 83c40c }
            // n = 4, score = 1900
            //   8bf1                 | pop                 edi
            //   ff15????????         |                     
            //   8b17                 | pop                 esi
            //   83c40c               | setne               al

        $sequence_16 = { c745fc04000000 50 8d45f8 81ca00000020 50 52 }
            // n = 6, score = 1800
            //   c745fc04000000       | cmp                 al, 0x61
            //   50                   | jl                  8
            //   8d45f8               | cmp                 al, 0x7a
            //   81ca00000020         | cmp                 al, 0x30
            //   50                   | jl                  8
            //   52                   | cmp                 al, 0x39

        $sequence_17 = { 418808 0fb7c1 c1e910 66c1e808 4d8d4004 418840fd }
            // n = 6, score = 1700
            //   418808               | shr                 cx, 8
            //   0fb7c1               | inc                 ecx
            //   c1e910               | mov                 byte ptr [eax - 1], cl
            //   66c1e808             | dec                 ebp
            //   4d8d4004             | cmp                 ebx, ecx
            //   418840fd             | inc                 ecx

        $sequence_18 = { 48895010 4c894018 4c894820 c3 }
            // n = 4, score = 1700
            //   48895010             | shr                 ecx, 1
            //   4c894018             | add                 ecx, edx
            //   4c894820             | shr                 ecx, 6
            //   c3                   | mov                 dword ptr [ebp + 0x18], ecx

        $sequence_19 = { 4803c8 eb08 803900 7408 48ffc9 }
            // n = 5, score = 1700
            //   4803c8               | lea                 eax, [eax + 4]
            //   eb08                 | inc                 ecx
            //   803900               | mov                 byte ptr [eax - 3], al
            //   7408                 | inc                 ecx
            //   48ffc9               | mov                 byte ptr [eax - 2], cl

        $sequence_20 = { 488bd3 488bcf 488b5c2460 4883c450 }
            // n = 4, score = 1700
            //   488bd3               | je                  0xd
            //   488bcf               | dec                 eax
            //   488b5c2460           | dec                 ecx
            //   4883c450             | dec                 eax

        $sequence_21 = { 2bca d1e9 03ca c1e906 894d20 }
            // n = 5, score = 1700
            //   2bca                 | shr                 ax, 8
            //   d1e9                 | dec                 ebp
            //   03ca                 | lea                 eax, [eax + 4]
            //   c1e906               | inc                 ecx
            //   894d20               | mov                 byte ptr [eax - 3], al

        $sequence_22 = { 418bd0 d3e2 418bcb d3e0 03d0 }
            // n = 5, score = 1700
            //   418bd0               | inc                 ecx
            //   d3e2                 | mov                 edx, eax
            //   418bcb               | shl                 edx, cl
            //   d3e0                 | inc                 ecx
            //   03d0                 | mov                 ecx, ebx

        $sequence_23 = { d3e7 83f841 7208 83f85a 7703 }
            // n = 5, score = 1700
            //   d3e7                 | cmp                 al, 0x7a
            //   83f841               | jle                 0xf
            //   7208                 | cmp                 al, 0x41
            //   83f85a               | jl                  0xc
            //   7703                 | cmp                 al, 0x5a

        $sequence_24 = { 483bd8 730b 488bcb e8???????? 488bd8 }
            // n = 5, score = 1700
            //   483bd8               | add                 ecx, edx
            //   730b                 | shr                 ecx, 6
            //   488bcb               | mov                 dword ptr [ebp + 0x20], ecx
            //   e8????????           |                     
            //   488bd8               | shr                 ax, 8

        $sequence_25 = { 4d8d4004 418840fd 418848fe 66c1e908 418848ff 4d3bd9 }
            // n = 6, score = 1700
            //   4d8d4004             | shl                 eax, cl
            //   418840fd             | add                 edx, eax
            //   418848fe             | dec                 ebp
            //   66c1e908             | lea                 eax, [eax + 4]
            //   418848ff             | inc                 ecx
            //   4d3bd9               | mov                 byte ptr [eax - 3], al

        $sequence_26 = { c1e807 41 83f87f 77f7 }
            // n = 4, score = 1600
            //   c1e807               | jmp                 0xa
            //   41                   | cmp                 byte ptr [ecx], 0
            //   83f87f               | je                  0xf
            //   77f7                 | inc                 ecx

        $sequence_27 = { 84c0 75f2 eb03 c60100 }
            // n = 4, score = 1500
            //   84c0                 | inc                 ecx
            //   75f2                 | mov                 byte ptr [eax - 1], cl
            //   eb03                 | dec                 eax
            //   c60100               | add                 ecx, eax

        $sequence_28 = { f7e1 b84fecc44e 2bca d1e9 }
            // n = 4, score = 1500
            //   f7e1                 | jl                  0xc
            //   b84fecc44e           | cmp                 al, 0x7a
            //   2bca                 | jle                 0xf
            //   d1e9                 | cmp                 al, 0x41

        $sequence_29 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 1200
            //   7907                 | dec                 ecx
            //   83c107               | dec                 eax
            //   3bf7                 | cmp                 ecx, eax
            //   72e8                 | movzx               eax, cx

        $sequence_30 = { 83c104 894e04 8b00 85c0 }
            // n = 4, score = 1200
            //   83c104               | mov                 byte ptr [ecx], 0x58
            //   894e04               | cmp                 al, 0x30
            //   8b00                 | jl                  8
            //   85c0                 | cmp                 al, 0x39

        $sequence_31 = { 52 52 52 68???????? 52 }
            // n = 5, score = 1100
            //   52                   | shr                 ecx, 0x10
            //   52                   | shr                 ax, 8
            //   52                   | dec                 ebp
            //   68????????           |                     
            //   52                   | lea                 eax, [eax + 4]

        $sequence_32 = { 83ec48 53 56 57 6a44 }
            // n = 5, score = 1100
            //   83ec48               | movzx               eax, ax
            //   53                   | add                 eax, 0x20
            //   56                   | jmp                 5
            //   57                   | movzx               eax, ax
            //   6a44                 | imul                edx, edx, 0x1003f

        $sequence_33 = { 56 57 6a1e 8d45e0 }
            // n = 4, score = 1100
            //   56                   | push                0x400
            //   57                   | push                0
            //   6a1e                 | push                0
            //   8d45e0               | push                dword ptr [ebp - 4]

        $sequence_34 = { 83f87f 760d 8d642400 c1e807 }
            // n = 4, score = 1000
            //   83f87f               | shr                 ecx, 6
            //   760d                 | mov                 dword ptr [ebp + 0x10], ecx
            //   8d642400             | sub                 ecx, edx
            //   c1e807               | shr                 ecx, 1

        $sequence_35 = { b901000000 83f87f 7609 c1e807 41 }
            // n = 5, score = 900
            //   b901000000           | mov                 dword ptr [eax + 0x18], eax
            //   83f87f               | dec                 esp
            //   7609                 | mov                 dword ptr [eax + 0x20], ecx
            //   c1e807               | ret                 
            //   41                   | movzx               eax, cx

        $sequence_36 = { 6a00 6aff 50 51 ff15???????? }
            // n = 5, score = 800
            //   6a00                 | je                  0xa
            //   6aff                 | dec                 eax
            //   50                   | dec                 ecx
            //   51                   | dec                 eax
            //   ff15????????         |                     

        $sequence_37 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
            // n = 6, score = 800
            //   50                   | cmp                 ecx, eax
            //   6a00                 | ja                  0xfffffffd
            //   6a01                 | cmp                 byte ptr [ecx], 0
            //   6a00                 | je                  0xa
            //   ff15????????         |                     
            //   a3????????           |                     

        $sequence_38 = { 53 56 8bf1 bb00c34c84 }
            // n = 4, score = 600
            //   53                   | lea                 ebx, [eax + 1]
            //   56                   | test                bl, 0xf
            //   8bf1                 | je                  8
            //   bb00c34c84           | and                 ebx, 0xfffffff0

        $sequence_39 = { 50 6a00 ff75fc 6800040000 6a00 6a00 6a00 }
            // n = 7, score = 600
            //   50                   | mov                 edx, esp
            //   6a00                 | xor                 esi, esi
            //   ff75fc               | mov                 dword ptr [edx + 0xc], esi
            //   6800040000           | mov                 dword ptr [edx + 8], esi
            //   6a00                 | mov                 edx, esp
            //   6a00                 | xor                 esi, esi
            //   6a00                 | mov                 dword ptr [edx + 0xc], esi

        $sequence_40 = { 68400000f0 6a18 33f6 56 }
            // n = 4, score = 600
            //   68400000f0           | xor                 esi, esi
            //   6a18                 | mov                 dword ptr [edx + 0xc], esi
            //   33f6                 | mov                 dword ptr [edx + 8], esi
            //   56                   | mov                 dword ptr [edx + 4], esi

        $sequence_41 = { 83ec08 56 68400000f0 6a18 }
            // n = 4, score = 600
            //   83ec08               | xor                 esi, esi
            //   56                   | mov                 dword ptr [edx + 0xc], esi
            //   68400000f0           | mov                 dword ptr [edx + 8], esi
            //   6a18                 | mov                 dword ptr [esp + 8], 2

        $sequence_42 = { 50 56 6800800000 6a6a }
            // n = 4, score = 600
            //   50                   | movsd               qword ptr [esp + 0x10], xmm0
            //   56                   | xor                 ecx, ecx
            //   6800800000           | lea                 ecx, [0xd8306c]
            //   6a6a                 | xor                 edx, edx

        $sequence_43 = { 51 ff75f8 50 6a03 6a30 }
            // n = 5, score = 500
            //   51                   | je                  0xb
            //   ff75f8               | and                 ebx, 0xfffffff0
            //   50                   | add                 ebx, 0x10
            //   6a03                 | lea                 ebx, [eax + 1]
            //   6a30                 | test                bl, 0xf

        $sequence_44 = { 8b466c 5f 5e 5b 8be5 5d }
            // n = 6, score = 500
            //   8b466c               | add                 ebx, 0x10
            //   5f                   | lea                 ebx, [eax + 1]
            //   5e                   | test                bl, 0xf
            //   5b                   | je                  8
            //   8be5                 | and                 ebx, 0xfffffff0
            //   5d                   | shr                 eax, 7

        $sequence_45 = { 8bec 83ec08 56 57 8bf1 33ff }
            // n = 6, score = 500
            //   8bec                 | inc                 esi
            //   83ec08               | cmp                 eax, 0x7f
            //   56                   | ja                  0xfffffffc
            //   57                   | shr                 eax, 7
            //   8bf1                 | inc                 ecx
            //   33ff                 | cmp                 eax, 0x7f

        $sequence_46 = { 6a00 6a03 6a00 6a00 ff7508 53 }
            // n = 6, score = 500
            //   6a00                 | je                  0x32
            //   6a03                 | lea                 ebx, [ebx]
            //   6a00                 | cmp                 ax, 0x41
            //   6a00                 | jb                  0x14
            //   ff7508               | cmp                 dword ptr [ebx], eax
            //   53                   | pop                 edi

        $sequence_47 = { 8bf1 bb00c34c84 57 33ff }
            // n = 4, score = 500
            //   8bf1                 | inc                 ecx
            //   bb00c34c84           | cmp                 eax, 0x7f
            //   57                   | ja                  0xfffffffc
            //   33ff                 | xor                 edx, edx

        $sequence_48 = { 00b807000000 008b45fc33d2 00b871800780 00558b }
            // n = 4, score = 500
            //   00b807000000         | jmp                 0xd
            //   008b45fc33d2         | movzx               eax, ax
            //   00b871800780         | imul                edx, edx, 0x1003f
            //   00558b               | movzx               eax, ax

        $sequence_49 = { 8b55e0 01ca 89d6 83c604 8b7de0 }
            // n = 5, score = 500
            //   8b55e0               | test                ax, ax
            //   01ca                 | je                  0x32
            //   89d6                 | lea                 ebx, [ebx]
            //   83c604               | cmp                 ax, 0x41
            //   8b7de0               | jb                  0x1c

        $sequence_50 = { 8b8880000000 8b55f4 01ca 89d6 83c60c }
            // n = 5, score = 500
            //   8b8880000000         | add                 eax, 0x20
            //   8b55f4               | jmp                 8
            //   01ca                 | movzx               eax, ax
            //   89d6                 | imul                edx, edx, 0x1003f
            //   83c60c               | lea                 ebx, [eax + 1]

        $sequence_51 = { 08fb f6c301 89f0 8945a4 }
            // n = 4, score = 500
            //   08fb                 | cmp                 al, 0x7a
            //   f6c301               | jle                 0x1b
            //   89f0                 | cmp                 al, 0x41
            //   8945a4               | jle                 0xd

        $sequence_52 = { 8b4510 8b4d0c 8b5508 befbffffff c600e8 29d6 01ce }
            // n = 7, score = 500
            //   8b4510               | test                bl, 0xf
            //   8b4d0c               | je                  0xb
            //   8b5508               | and                 ebx, 0xfffffff0
            //   befbffffff           | lea                 ebx, [eax + 1]
            //   c600e8               | test                bl, 0xf
            //   29d6                 | je                  0xb
            //   01ce                 | and                 ebx, 0xfffffff0

        $sequence_53 = { 83ec10 53 6a00 8d45fc }
            // n = 4, score = 500
            //   83ec10               | add                 eax, 0x20
            //   53                   | jmp                 5
            //   6a00                 | movzx               eax, ax
            //   8d45fc               | imul                edx, edx, 0x1003f

        $sequence_54 = { 8b7020 8b7840 89c3 83c33c }
            // n = 4, score = 300
            //   8b7020               | push                edx
            //   8b7840               | cmp                 eax, 0x7f
            //   89c3                 | jbe                 0xf
            //   83c33c               | lea                 esp, [esp]

        $sequence_55 = { ff15???????? 83f803 7405 83f802 751e }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   83f803               | mov                 dword ptr [eax + 0x18], eax
            //   7405                 | dec                 esp
            //   83f802               | mov                 dword ptr [eax + 0x20], ecx
            //   751e                 | ret                 

        $sequence_56 = { 31f6 89720c 897208 897204 }
            // n = 4, score = 200
            //   31f6                 | shr                 eax, 7
            //   89720c               | shr                 eax, 7
            //   897208               | inc                 ebx
            //   897204               | cmp                 eax, 0x7f

        $sequence_57 = { e8???????? 84c0 7519 33c9 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   84c0                 | dec                 eax
            //   7519                 | mov                 dword ptr [eax + 8], ecx
            //   33c9                 | dec                 eax

        $sequence_58 = { 33d2 c605????????00 0fb6d8 e8???????? }
            // n = 4, score = 200
            //   33d2                 | dec                 eax
            //   c605????????00       |                     
            //   0fb6d8               | mov                 ecx, ebx
            //   e8????????           |                     

        $sequence_59 = { 743e 8b5c2430 85db 741d }
            // n = 4, score = 200
            //   743e                 | mov                 ebx, eax
            //   8b5c2430             | dec                 eax
            //   85db                 | cmp                 ebx, eax
            //   741d                 | jae                 0xd

        $sequence_60 = { 31c9 89e2 31f6 89720c }
            // n = 4, score = 200
            //   31c9                 | ja                  0xfffffffc
            //   89e2                 | shr                 eax, 7
            //   31f6                 | inc                 edi
            //   89720c               | cmp                 eax, 0x7f

        $sequence_61 = { 7519 33c9 0f1f4000 0fb6840c30010000 }
            // n = 4, score = 200
            //   7519                 | movzx               eax, cx
            //   33c9                 | shr                 ecx, 0x10
            //   0f1f4000             | shr                 ax, 8
            //   0fb6840c30010000     | dec                 ebp

        $sequence_62 = { 8bf8 e8???????? eb04 8b7c2430 }
            // n = 4, score = 200
            //   8bf8                 | lea                 eax, [eax + 4]
            //   e8????????           |                     
            //   eb04                 | inc                 ecx
            //   8b7c2430             | mov                 byte ptr [eax - 3], al

        $sequence_63 = { 89842488000000 89e8 83c03c 89842484000000 8b453c 89842480000000 89e8 }
            // n = 7, score = 100
            //   89842488000000       | mov                 ecx, 1
            //   89e8                 | cmp                 eax, 0x7f
            //   83c03c               | jbe                 0xb
            //   89842484000000       | shr                 eax, 7
            //   8b453c               | inc                 ecx
            //   89842480000000       | cmp                 eax, 0x7f
            //   89e8                 | jbe                 0x14

        $sequence_64 = { 8d15e70f0000 e8???????? 84c0 0f84f1000000 48 899c2480030000 }
            // n = 6, score = 100
            //   8d15e70f0000         | mov                 byte ptr [eax - 1], cl
            //   e8????????           |                     
            //   84c0                 | shr                 ax, 8
            //   0f84f1000000         | dec                 ebp
            //   48                   | lea                 eax, [eax + 4]
            //   899c2480030000       | inc                 ecx

        $sequence_65 = { 89542404 894c2418 e8???????? 8b4c2420 890c24 8b542430 }
            // n = 6, score = 100
            //   89542404             | shr                 eax, 7
            //   894c2418             | inc                 ecx
            //   e8????????           |                     
            //   8b4c2420             | mov                 ecx, 1
            //   890c24               | cmp                 eax, 0x7f
            //   8b542430             | jbe                 0xe

        $sequence_66 = { c744240802000000 8954240c 8b54246c 894c2434 ffd2 83ec10 31c9 }
            // n = 7, score = 100
            //   c744240802000000     | inc                 ecx
            //   8954240c             | cmp                 eax, 0x7f
            //   8b54246c             | ja                  0x10
            //   894c2434             | mov                 ecx, 1
            //   ffd2                 | cmp                 eax, 0x7f
            //   83ec10               | jbe                 0xb
            //   31c9                 | shr                 eax, 7

        $sequence_67 = { 89723c c7424004000000 c7424402920000 c7424800d00000 8b7c2418 }
            // n = 5, score = 100
            //   89723c               | cmp                 eax, 0x7f
            //   c7424004000000       | jbe                 0x13
            //   c7424402920000       | shr                 eax, 7
            //   c7424800d00000       | inc                 ecx
            //   8b7c2418             | cmp                 eax, 0x7f

        $sequence_68 = { 488bf9 7505 e8???????? 488bd3 488bcf }
            // n = 5, score = 100
            //   488bf9               | mov                 byte ptr [eax - 3], al
            //   7505                 | inc                 ecx
            //   e8????????           |                     
            //   488bd3               | mov                 byte ptr [eax - 2], cl
            //   488bcf               | shr                 cx, 8

        $sequence_69 = { 488bf2 488bd9 488d152c1b0000 488bce }
            // n = 4, score = 100
            //   488bf2               | inc                 ecx
            //   488bd9               | mov                 byte ptr [eax - 1], cl
            //   488d152c1b0000       | sub                 ecx, edx
            //   488bce               | shr                 ecx, 1

        $sequence_70 = { 8b442444 890424 f20f11442410 e8???????? 31c9 }
            // n = 5, score = 100
            //   8b442444             | push                -1
            //   890424               | push                eax
            //   f20f11442410         | push                ecx
            //   e8????????           |                     
            //   31c9                 | push                eax

        $sequence_71 = { b8000011c0 885dff e8???????? 8bf0 83feff 0f8492000000 }
            // n = 6, score = 100
            //   b8000011c0           | mov                 byte ptr [eax - 3], al
            //   885dff               | inc                 ecx
            //   e8????????           |                     
            //   8bf0                 | mov                 byte ptr [eax - 2], cl
            //   83feff               | shr                 cx, 8
            //   0f8492000000         | inc                 ecx

    condition:
        7 of them and filesize < 733184
}