rule win_compfun_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c7460465636f6d c7460870726573 c7460c73427566 c6461300 8bc6 }
            // n = 5, score = 200
            //   c7460465636f6d       | mov                 dword ptr [esi + 4], 0x6d6f6365
            //   c7460870726573       | mov                 dword ptr [esi + 8], 0x73657270
            //   c7460c73427566       | mov                 dword ptr [esi + 0xc], 0x66754273
            //   c6461300             | mov                 byte ptr [esi + 0x13], 0
            //   8bc6                 | mov                 eax, esi

        $sequence_1 = { 56 e8???????? 83c40c c7064d534141 c7460420416363 }
            // n = 5, score = 200
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   c7064d534141         | mov                 dword ptr [esi], 0x4141534d
            //   c7460420416363       | mov                 dword ptr [esi + 4], 0x63634120

        $sequence_2 = { c7460865427566 c7460c66657273 c6461000 8bc6 5e }
            // n = 5, score = 200
            //   c7460865427566       | mov                 dword ptr [esi + 8], 0x66754265
            //   c7460c66657273       | mov                 dword ptr [esi + 0xc], 0x73726566
            //   c6461000             | mov                 byte ptr [esi + 0x10], 0
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi

        $sequence_3 = { e8???????? 83c40c c746106e666f20 c7064765744e c7460461746976 }
            // n = 5, score = 200
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   c746106e666f20       | mov                 dword ptr [esi + 0x10], 0x206f666e
            //   c7064765744e         | mov                 dword ptr [esi], 0x4e746547
            //   c7460461746976       | mov                 dword ptr [esi + 4], 0x76697461

        $sequence_4 = { 59 50 57 ffd3 894634 }
            // n = 5, score = 200
            //   59                   | pop                 ecx
            //   50                   | push                eax
            //   57                   | push                edi
            //   ffd3                 | call                ebx
            //   894634               | mov                 dword ptr [esi + 0x34], eax

        $sequence_5 = { c7461072792020 c70657726974 c746046550726f c7460863657373 c7460c4d656d6f c6461200 }
            // n = 6, score = 200
            //   c7461072792020       | mov                 dword ptr [esi + 0x10], 0x20207972
            //   c70657726974         | mov                 dword ptr [esi], 0x74697257
            //   c746046550726f       | mov                 dword ptr [esi + 4], 0x6f725065
            //   c7460863657373       | mov                 dword ptr [esi + 8], 0x73736563
            //   c7460c4d656d6f       | mov                 dword ptr [esi + 0xc], 0x6f6d654d
            //   c6461200             | mov                 byte ptr [esi + 0x12], 0

        $sequence_6 = { c70643726561 c7460474654469 c7460872656374 c7460c6f727957 }
            // n = 4, score = 200
            //   c70643726561         | mov                 dword ptr [esi], 0x61657243
            //   c7460474654469       | mov                 dword ptr [esi + 4], 0x69446574
            //   c7460872656374       | mov                 dword ptr [esi + 8], 0x74636572
            //   c7460c6f727957       | mov                 dword ptr [esi + 0xc], 0x5779726f

        $sequence_7 = { c7066e69732e c6460700 8bc6 5e 5d c3 55 }
            // n = 7, score = 200
            //   c7066e69732e         | mov                 dword ptr [esi], 0x2e73696e
            //   c6460700             | mov                 byte ptr [esi + 7], 0
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   55                   | push                ebp

        $sequence_8 = { 0f8459010000 48c744243800000000 488b442470 488b4008 4889442440 488b442440 }
            // n = 6, score = 100
            //   0f8459010000         | mov                 ecx, dword ptr [ecx + 0x50]
            //   48c744243800000000     | mov    eax, dword ptr [esp + 0x34]
            //   488b442470           | dec                 eax
            //   488b4008             | mov                 ecx, dword ptr [ecx]
            //   4889442440           | dec                 esp
            //   488b442440           | mov                 ebx, dword ptr [esp + 0x40]

        $sequence_9 = { 83c101 488b442418 3908 740a }
            // n = 4, score = 100
            //   83c101               | mov                 eax, dword ptr [esp + 0x90]
            //   488b442418           | mov                 dword ptr [esp + 0x38], eax
            //   3908                 | mov                 dword ptr [esp + 0x50], 8
            //   740a                 | mov                 dword ptr [esp + 0x20], 4

        $sequence_10 = { 7428 8b542430 486bd218 488b4c2450 488b4950 8b442434 }
            // n = 6, score = 100
            //   7428                 | je                  0xe
            //   8b542430             | cmp                 dword ptr [esp + 0x54], 0
            //   486bd218             | je                  0xaa
            //   488b4c2450           | mov                 byte ptr [esp + 0x28], 1
            //   488b4950             | dec                 eax
            //   8b442434             | lea                 eax, [esp + 0x48]

        $sequence_11 = { 488b442428 4803c1 4889442428 488b842490000000 8b08 83c101 488b842490000000 }
            // n = 7, score = 100
            //   488b442428           | dec                 eax
            //   4803c1               | mov                 eax, dword ptr [esp + 0x28]
            //   4889442428           | dec                 eax
            //   488b842490000000     | add                 eax, ecx
            //   8b08                 | dec                 eax
            //   83c101               | mov                 dword ptr [esp + 0x28], eax
            //   488b842490000000     | dec                 eax

        $sequence_12 = { 837c245400 0f849f000000 c644242801 488d442448 4889442420 41b902000000 }
            // n = 6, score = 100
            //   837c245400           | dec                 esp
            //   0f849f000000         | lea                 ecx, [esp + 0x38]
            //   c644242801           | add                 ecx, 1
            //   488d442448           | dec                 eax
            //   4889442420           | mov                 eax, dword ptr [esp + 0x18]
            //   41b902000000         | cmp                 dword ptr [eax], ecx

        $sequence_13 = { 488b09 e8???????? 4c8b5c2440 8b442458 41894308 eb24 }
            // n = 6, score = 100
            //   488b09               | dec                 eax
            //   e8????????           |                     
            //   4c8b5c2440           | mov                 dword ptr [esp + 0x20], eax
            //   8b442458             | inc                 ecx
            //   41894308             | mov                 ecx, 2
            //   eb24                 | je                  0x2a

        $sequence_14 = { e8???????? 89442438 c744245008000000 c744242004000000 4c8d4c2438 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   89442438             | mov                 eax, dword ptr [esp + 0x90]
            //   c744245008000000     | mov                 ecx, dword ptr [eax]
            //   c744242004000000     | add                 ecx, 1
            //   4c8d4c2438           | dec                 eax

        $sequence_15 = { 4889442408 ebca 488b442440 48890424 c64424105c c644241148 }
            // n = 6, score = 100
            //   4889442408           | mov                 edx, dword ptr [esp + 0x30]
            //   ebca                 | dec                 eax
            //   488b442440           | imul                edx, edx, 0x18
            //   48890424             | dec                 eax
            //   c64424105c           | mov                 ecx, dword ptr [esp + 0x50]
            //   c644241148           | dec                 eax

    condition:
        7 of them and filesize < 402432
}