rule win_gameover_p2p_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.gameover_p2p."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b44241c 33c9 66394c043c 0f84ef010000 fec3 66894c043c 885c2417 }
            // n = 7, score = 100
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   33c9                 | xor                 ecx, ecx
            //   66394c043c           | cmp                 word ptr [esp + eax + 0x3c], cx
            //   0f84ef010000         | je                  0x1f5
            //   fec3                 | inc                 bl
            //   66894c043c           | mov                 word ptr [esp + eax + 0x3c], cx
            //   885c2417             | mov                 byte ptr [esp + 0x17], bl

        $sequence_1 = { 84db 0f95c2 51 8b4dec 81c292000000 e8???????? }
            // n = 6, score = 100
            //   84db                 | test                bl, bl
            //   0f95c2               | setne               dl
            //   51                   | push                ecx
            //   8b4dec               | mov                 ecx, dword ptr [ebp - 0x14]
            //   81c292000000         | add                 edx, 0x92
            //   e8????????           |                     

        $sequence_2 = { 8d3c9548373d02 8b0f 334f04 23cb 330f 8bc1 83e001 }
            // n = 7, score = 100
            //   8d3c9548373d02       | lea                 edi, [edx*4 + 0x23d3748]
            //   8b0f                 | mov                 ecx, dword ptr [edi]
            //   334f04               | xor                 ecx, dword ptr [edi + 4]
            //   23cb                 | and                 ecx, ebx
            //   330f                 | xor                 ecx, dword ptr [edi]
            //   8bc1                 | mov                 eax, ecx
            //   83e001               | and                 eax, 1

        $sequence_3 = { 8d4c2448 c7442448307f3902 895c2450 e8???????? 8b6c2450 b8???????? }
            // n = 6, score = 100
            //   8d4c2448             | lea                 ecx, [esp + 0x48]
            //   c7442448307f3902     | mov                 dword ptr [esp + 0x48], 0x2397f30
            //   895c2450             | mov                 dword ptr [esp + 0x50], ebx
            //   e8????????           |                     
            //   8b6c2450             | mov                 ebp, dword ptr [esp + 0x50]
            //   b8????????           |                     

        $sequence_4 = { 8a5603 80fa0e 0f87eef7ffff 0fb6c2 3a884c903902 0f85dff7ffff 8a4c2413 }
            // n = 7, score = 100
            //   8a5603               | mov                 dl, byte ptr [esi + 3]
            //   80fa0e               | cmp                 dl, 0xe
            //   0f87eef7ffff         | ja                  0xfffff7f4
            //   0fb6c2               | movzx               eax, dl
            //   3a884c903902         | cmp                 cl, byte ptr [eax + 0x239904c]
            //   0f85dff7ffff         | jne                 0xfffff7e5
            //   8a4c2413             | mov                 cl, byte ptr [esp + 0x13]

        $sequence_5 = { 8a1428 8a2438 3ad4 7505 80c308 eb3d }
            // n = 6, score = 100
            //   8a1428               | mov                 dl, byte ptr [eax + ebp]
            //   8a2438               | mov                 ah, byte ptr [eax + edi]
            //   3ad4                 | cmp                 dl, ah
            //   7505                 | jne                 7
            //   80c308               | add                 bl, 8
            //   eb3d                 | jmp                 0x3f

        $sequence_6 = { 8d4c2468 c744241494913902 e8???????? 6800100000 8d4c2478 e8???????? ff7510 }
            // n = 7, score = 100
            //   8d4c2468             | lea                 ecx, [esp + 0x68]
            //   c744241494913902     | mov                 dword ptr [esp + 0x14], 0x2399194
            //   e8????????           |                     
            //   6800100000           | push                0x1000
            //   8d4c2478             | lea                 ecx, [esp + 0x78]
            //   e8????????           |                     
            //   ff7510               | push                dword ptr [ebp + 0x10]

        $sequence_7 = { 5e c20400 56 51 8bf2 ff15???????? ba04010000 }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   c20400               | ret                 4
            //   56                   | push                esi
            //   51                   | push                ecx
            //   8bf2                 | mov                 esi, edx
            //   ff15????????         |                     
            //   ba04010000           | mov                 edx, 0x104

        $sequence_8 = { 56 ff15???????? 33d2 8bf2 85f6 0f8453020000 }
            // n = 6, score = 100
            //   56                   | push                esi
            //   ff15????????         |                     
            //   33d2                 | xor                 edx, edx
            //   8bf2                 | mov                 esi, edx
            //   85f6                 | test                esi, esi
            //   0f8453020000         | je                  0x259

        $sequence_9 = { 0f95c0 84c0 7404 b001 eb2d 833d????????ff 740d }
            // n = 7, score = 100
            //   0f95c0               | setne               al
            //   84c0                 | test                al, al
            //   7404                 | je                  6
            //   b001                 | mov                 al, 1
            //   eb2d                 | jmp                 0x2f
            //   833d????????ff       |                     
            //   740d                 | je                  0xf

    condition:
        7 of them and filesize < 598016
}