SYMBOLCOMMON_NAMEaka. SYNONYMS
win.isfb (Back to overview)

ISFB

aka: Gozi ISFB, IAP, Pandemyia

Actor(s): GOLD CABIN

VTCollection     URLhaus                      

2006 Gozi v1.0, Gozi CRM, CRM, Papras
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)

In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi Prinimalka, which was merge with Pony and became Vawtrak/Neverquest.

The other branch became known as Gozi ISFB, or ISFB in short. Webinject functionality was added to this version.

There is one panel which often was used in combination with ISFB: IAP. The panel's login page comes with the title 'Login - IAP'. The body contains 'AUTHORIZATION', 'Name:', 'Password:' and a single button 'Sign in' in a minimal design. Often, the panel is directly accessible by entering the C2 IP address in a browser. But there are ISFB versions which are not directly using IAP. The bot accesses a gate, which is called the 'Dreambot' gate. See win.dreambot for further information.

ISFB often was protected by Rovnix. This led to a further complication in the naming scheme - many companies started to call ISFB Rovnix. Because the signatures started to look for Rovnix, other trojans protected by Rovnix (in particular ReactorBot and Rerdom) sometimes got wrongly labelled.

In April 2016 a combination of Gozi ISFB and Nymaim was detected. This breed became known as GozNym. The merge uses a shellcode-like version of Gozi ISFB, that needs Nymaim to run. The C2 communication is performed by Nymaim.

See win.gozi for additional historical information.

References
2023-10-13Twitter (@JAMESWT_MHT)JamesWT
Tweets on Wikiloader delivering ISFB
ISFB WikiLoader
2023-10-12SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2023
FluBot AsyncRAT Ave Maria Cobalt Strike DCRat Havoc IcedID ISFB Nanocore RAT NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Stealc Tofsee Vidar
2023-07-31ProofpointKelsey Merriman, Pim Trouerbach
Out of the Sandbox: WikiLoader Digs Sophisticated Evasion
ISFB WikiLoader
2023-07-18Kostas TSKostas
Ursnif VS Italy: Il PDF del Destino
Gozi ISFB Snifula
2023-07-11SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2023
Hydra AsyncRAT Aurora Stealer Ave Maria BumbleBee Cobalt Strike DCRat Havoc IcedID ISFB NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee
2023-05-10BridewellBridewell
Hunting for Ursnif
ISFB Royal Ransom
2023-04-12SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-03-30eSentireeSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: BatLoader
BATLOADER Cobalt Strike ISFB SystemBC Vidar
2023-03-190xToxin Labs@0xToxin
Gozi - Italian ShellCode Dance
Gozi ISFB
2023-03-09eSentireeSentire Threat Response Unit (TRU)
BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif
BATLOADER ISFB Vidar
2023-02-27PRODAFT Threat IntelligencePRODAFT
RIG Exploit Kit: In-Depth Analysis
Dridex IcedID ISFB PureCrypter Raccoon RecordBreaker RedLine Stealer Royal Ransom Silence SmokeLoader Zloader
2023-02-08NTT SecurityRyu Hiyoshi
SteelClover Attacks Distributing Malware Via Google Ads Increased
BATLOADER ISFB RedLine Stealer
2023-01-09The DFIR ReportThe DFIR Report
Unwrapping Ursnifs Gifts
ISFB
2022-10-24Medium CSIS TechblogBenoît Ancel
Chapter 1 — From Gozi to ISFB: The history of a mythical malware family.
Gozi ISFB Snifula
2022-08-08Medium CSIS TechblogBenoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-06-24Group-IBAlbert Priego
We see you, Gozi Hunting the latest TTPs used for delivering the Trojan
ISFB
2022-06-07McAfeeJyothi Naveen, Kiran Raj
Phishing Campaigns featuring Ursnif Trojan on the Rise
ISFB
2022-05-19IBMCharlotte Hammond, Golo Mühr, Ole Villadsen
ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups
IcedID ISFB Mount Locker WIZARD SPIDER
2022-05-09MicrosoftMicrosoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-05-08QualysAmit Gadhave
Ursnif Malware Banks on News Events for Phishing Attacks
ISFB
2022-04-14Avast DecodedVladimir Martyanov
Zloader 2: The Silent Night
ISFB Raccoon Zloader
2022-01-11Medium walmartglobaltechJason Reaves, Joshua Platt
Signed DLL campaigns as a service
BATLOADER Cobalt Strike ISFB Zloader
2021-10-25CleafyCleafy
Digital banking fraud: how the Gozi malware works
ISFB
2021-09-29ProofpointProofpoint Staff, Selena Larson
TA544 Targets Italian Organizations with Ursnif Malware
ISFB
2021-09-03Trend MicroMohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-07-30HPPatrick Schläpfer
Detecting TA551 domains
Valak Dridex IcedID ISFB QakBot
2021-06-30The RecordCatalin Cimpanu
Gozi malware gang member arrested in Colombia
Gozi ISFB
2021-06-23IBMItzik Chimino
Ursnif Leverages Cerberus to Automate Fraudulent Bank Transfers in Italy
ISFB
2021-05-26DeepInstinctRon Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader
2021-05-10Mal-Eatsmal_eats
Overview of Campo, a new attack campaign targeting Japan
AnchorDNS BazarBackdoor Cobalt Strike ISFB Phobos TrickBot Zloader
2021-05-04NCC Groupfumik0, NCC RIFT
RM3 – Curiosities of the wildest banking malware
ISFB RM3
2021-05-04Fox-ITFox IT, fumik0, the RIFT Team
RM3 – Curiosities of the wildest banking malware
ISFB
2021-04-12PTSecurityPTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader
2021-04-06Intel 471Intel 471
EtterSilent: the underground’s new favorite maldoc builder
BazarBackdoor ISFB QakBot TrickBot
2021-02-03ZDNetCharlie Osborne
Ursnif Trojan has targeted over 100 Italian banks
ISFB Snifula
2021-01-12FortinetXiaopeng Zhang
New Variant of Ursnif Continuously Targeting Italy
ISFB
2021-01-09Marco Ramilli's BlogMarco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot
2021-01-080xC0DECAFEThomas Barabosch
The malware analyst’s guide to aPLib decompression
ISFB Rovnix
2020-11-27malware.loveRobert Giczewski
Having fun with a Ursnif VBS dropper
ISFB Snifula
2020-11-26CybereasonCybereason Nocturnus, Lior Rochberger
Cybereason vs. Egregor Ransomware
Cobalt Strike Egregor IcedID ISFB QakBot
2020-10-29CERT-FRCERT-FR
LE MALWARE-AS-A-SERVICE EMOTET
Dridex Emotet ISFB QakBot
2020-10-15Department of JusticeDepartment of Justice
Officials Announce International Operation Targeting Transnational Criminal Organization QQAAZZ that Provided Money Laundering Services to High-Level Cybercriminals
Dridex ISFB TrickBot
2020-09-02Cisco TalosEdmund Brumaghin, Holger Unterbrink
Salfram: Robbing the place without removing your name tag
Ave Maria ISFB SmokeLoader Zloader
2020-08-28CheckpointCheck Point Research
Gozi: The Malware with a Thousand Faces
DreamBot ISFB LOLSnif SaiGon
2020-08-01TG SoftTG Soft
TG Soft Cyber - Threat Report
DarkComet Darktrack RAT Emotet ISFB
2020-07-30SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader
2020-07-29ESET Researchwelivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-07-23DarktraceMax Heinemeyer
The resurgence of the Ursnif banking trojan
ISFB Snifula
2020-07-22SentinelOneJason Reaves, Joshua Platt
Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)
ISFB Maze TrickBot Zloader
2020-07-18HornetsecurityHornetsecurity Security Lab
Firefox Send sends Ursnif malware
ISFB
2020-07-17CERT-FRCERT-FR
The Malware Dridex: Origins and Uses
Andromeda CryptoLocker Cutwail DoppelPaymer Dridex Emotet FriedEx Gameover P2P Gandcrab ISFB Murofet Necurs Predator The Thief Zeus
2020-07-01Cisco TalosEdmund Brumaghin, Mariano Graziano, Nick Biasini
Threat Spotlight: Valak Slithers Its Way Into Manufacturing and Transportation Networks
Valak IcedID ISFB MyKings Spreader
2020-07-01TG SoftTG Soft
Cyber-Threat Report on the cyber attacks of June 2020 in Italy
Avaddon ISFB
2020-06-24MorphisecArnold Osipov
Obfuscated VBScript Drops Zloader, Ursnif, Qakbot, Dridex
Dridex ISFB QakBot Zloader
2020-06-23NCC GroupMichael Sandee, Nikolaos Pantazopoulos, Stefano Antenucci
WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
Cobalt Strike ISFB WastedLocker
2020-06-17Youtube (Red Canary)Adam Pennington, David Kaplan, Erika Noerenberg, Matt Graeber
ATT&CK® Deep Dive: Process Injection
ISFB Ramnit TrickBot
2020-06-02MorphisecArnold Osipov
Ursnif/Gozi Delivery - Excel Macro 4.0 Utilization Uptick & OCR Bypass
ISFB
2020-06-02Lastline LabsJames Haughom, Stefano Ortolani
Evolution of Excel 4.0 Macro Weaponization
Agent Tesla DanaBot ISFB TrickBot Zloader
2020-05-07Github (mlodic)Matteo Lodi
Ursnif beacon decryptor
Gozi ISFB
2020-03-30IntezerMichael Kajiloti
Fantastic payloads and where we find them
Dridex Emotet ISFB TrickBot
2020-03-18ProofpointAxel F, Sam Scholten
Coronavirus Threat Landscape Update
Agent Tesla Get2 ISFB Remcos
2020-03-04CrowdStrikeCrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03PWC UKPWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-01-23SANS ISC InfoSec ForumsBrad Duncan
German language malspam pushes Ursnif
ISFB
2020-01-22Thomas Barabosch
The malware analyst’s guide to PE timestamps
Azorult Gozi IcedID ISFB LOLSnif SUNBURST TEARDROP
2020-01-17Ken Sajo, Yasuhiro Takeda, Yusuke Niwa
Battle Against Ursnif Malspam Campaign targeting Japan
Cutwail ISFB TrickBot UrlZone
2019-12-24SophosSophosLabs Threat Research
Gozi V3: tracked by their own stealth
ISFB
2019-12-23Palo Alto Networks Unit 42Brad Duncan
Wireshark Tutorial: Examining Ursnif Infections
ISFB
2019-12-07SecureworksKeith Jarvis, Kevin O’Reilly
End-to-end Botnet Monitoring... Botconf 2019
Emotet ISFB QakBot
2019-08-07FortinetXiaopeng Zhang
New Ursnif Variant Spreading by Word Document
ISFB
2019-07-11ProofpointProofpoint Threat Insight Team
Threat Actor Profile: TA544 targets geographies from Italy to Japan with a range of malware
ISFB PandaBanker UrlZone NARWHAL SPIDER
2019-06-25VMRayTamas Boczan
Analyzing Ursnif’s Behavior Using a Malware Sandbox
ISFB
2019-06-19ProofpointProofpoint Threat Insight Team
URLZone top malware in Japan, while Emotet and LINE Phishing round out the landscape
ISFB UrlZone NARWHAL SPIDER
2019-05-250ffset Blog0verfl0w_
Analyzing ISFB – The Second Loader
ISFB
2019-04-06Youtube (hasherezade)hasherezade
Unpacking ISFB (including the custom 'PX' format)
ISFB
2019-04-05YoroiAntonio Pirozzi, Davide Testa
Ursnif: The Latest Evolution of the Most Popular Banking Malware
ISFB
2019-03-26YoroiDavide Testa, Luca Mella, Luigi Martire
The Ursnif Gangs keep Threatening Italy
ISFB
2019-03-130ffset Blog0verfl0w_
Analysing ISFB – The First Loader
ISFB
2019-03-12CybereasonAssaf Dahan, Cybereason Nocturnus
New Ursnif Variant targets Japan packed with new Features
ISFB UrlZone
2019-03-11MinervaMinerva Labs
Attackers Insert Themselves into the Email Conversation to Spread Malware
ISFB
2019-02-07YoroiAntonio Farina, Antonio Pirozzi, Davide Testa
Ursnif: Long Live the Steganography!
ISFB
2019-01-30CyberbitHod Gavriel
New Ursnif Malware Variant – a Stunning Matryoshka (Матрёшка)
ISFB
2019-01-24Cisco TalosJohn Arneson
Cisco AMP tracks new campaign that delivers Ursnif
ISFB
2019-01-150ffset Blog0verfl0w_
Analyzing COMmunication in Malware
ISFB
2019-01-01CSISBenoît Ancel, Peter Kruse
Dreambot Business overview 2019
ISFB
2018-12-18Trend MicroTrendmicro
URSNIF, EMOTET, DRIDEX and BitPaymer Gangs Linked by a Similar Loader
Dridex Emotet FriedEx ISFB
2018-05-17FidelisThreat Research Team
Gozi V3 Technical Update
ISFB
2018-03-19hasherezade
Unpacking Ursnif
ISFB
2018-03-06Cisco TalosAdam Weller, Edmund Brumaghin, Holger Unterbrink
Gozi ISFB Remains Active in 2018, Leverages "Dark Cloud" Botnet For Distribution
ISFB
2018-02-07CylanceThreat Research Team
Threat Spotlight: URSNIF Infostealer Malware
ISFB
2018-01-17SANS ISCbrad
Reviewing the spam filters: Malspam pushing Gozi-ISFB
ISFB
2018-01-12ProofpointProofpoint Staff
Holiday lull? Not so much
Dridex Emotet GlobeImposter ISFB Necurs PandaBanker UrlZone NARWHAL SPIDER
2017-11-28FireEyeAbhay Vaish, Sandor Nemes
Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection
ISFB
2017-07-02CERT.PLMaciej Kotowicz
ISFB: Still Live and Kicking
ISFB
2017-05-29Lokalhost.plMaciej Kotowicz
Gozi Tree
DreamBot Gozi ISFB Powersniff
2017-04-20MalwarebytesJérôme Segura
Binary Options malvertising campaign drops ISFB banking Trojan
ISFB
2016-11-01Ariel Koren's BlogAriel Koren
Ursnif Malware: Deep Technical Dive
ISFB
2016-04-14SecurityIntelligenceLimor Kessem, Lior Keshet
Meet GozNym: The Banking Malware Offspring of Gozi ISFB and Nymaim
ISFB Nymaim GozNym
2016-03-23Github (gbrindisi)gbrindisi
Gozi ISFB Sourceccode
ISFB
Yara Rules
[TLP:WHITE] win_isfb_auto (20230808 | Detects win.isfb.)
rule win_isfb_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.isfb."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? eb02 33c0 3bc7 741b 50 }
            // n = 6, score = 2500
            //   e8????????           |                     
            //   eb02                 | push                dword ptr [ebp + 8]
            //   33c0                 | cmp                 dword ptr [ebp + 8], 0
            //   3bc7                 | je                  0xa
            //   741b                 | push                dword ptr [ebp + 8]
            //   50                   | mov                 eax, edi

        $sequence_1 = { 741b 50 33c0 e8???????? 3bc7 }
            // n = 5, score = 2500
            //   741b                 | push                0
            //   50                   | test                edi, edi
            //   33c0                 | jne                 0x10
            //   e8????????           |                     
            //   3bc7                 | cmp                 dword ptr [ebp + 8], 0

        $sequence_2 = { ff75f0 ff75f4 6822010000 e9???????? ff7508 }
            // n = 5, score = 2400
            //   ff75f0               | mov                 eax, esi
            //   ff75f4               | dec                 eax
            //   6822010000           | add                 esp, 0x40
            //   e9????????           |                     
            //   ff7508               | inc                 ecx

        $sequence_3 = { 58 e8???????? 3bc7 7406 50 }
            // n = 5, score = 2400
            //   58                   | push                1
            //   e8????????           |                     
            //   3bc7                 | push                ebx
            //   7406                 | cmp                 edi, esi
            //   50                   | je                  0x12

        $sequence_4 = { 3bc7 7413 50 6a10 58 e8???????? }
            // n = 6, score = 2400
            //   3bc7                 | cmp                 edi, esi
            //   7413                 | cmp                 edi, esi
            //   50                   | je                  0x10
            //   6a10                 | push                edi
            //   58                   | jne                 0x30
            //   e8????????           |                     

        $sequence_5 = { ff35???????? e8???????? 8bf0 3bf3 7443 6aff 68806967ff }
            // n = 7, score = 2200
            //   ff35????????         |                     
            //   e8????????           |                     
            //   8bf0                 | or                  eax, edx
            //   3bf3                 | mov                 dword ptr [ebp - 0xc], ebx
            //   7443                 | mov                 dword ptr [ebp - 0x10], ebx
            //   6aff                 | mov                 dword ptr [ebp - 8], 0x57
            //   68806967ff           | mov                 edi, 0x119

        $sequence_6 = { 50 e8???????? 83c40c e8???????? 3bc7 }
            // n = 5, score = 2200
            //   50                   | je                  0xa
            //   e8????????           |                     
            //   83c40c               | push                eax
            //   e8????????           |                     
            //   3bc7                 | push                eax

        $sequence_7 = { 6a64 ff15???????? a1???????? 85c0 7407 83ee64 }
            // n = 6, score = 2200
            //   6a64                 | push                dword ptr [ebp - 0x10]
            //   ff15????????         |                     
            //   a1????????           |                     
            //   85c0                 | push                dword ptr [ebp - 0xc]
            //   7407                 | push                0x122
            //   83ee64               | push                dword ptr [ebp + 8]

        $sequence_8 = { ff35???????? ff15???????? 85c0 a3???????? 7402 ffe0 c20400 }
            // n = 7, score = 2100
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   85c0                 | je                  0x15
            //   a3????????           |                     
            //   7402                 | xor                 eax, eax
            //   ffe0                 | cmp                 eax, edi
            //   c20400               | je                  0x21

        $sequence_9 = { 5d 5b 59 c20400 8325????????00 6a00 68???????? }
            // n = 7, score = 2100
            //   5d                   | cmp                 dword ptr [ebp - 4], esi
            //   5b                   | je                  0x15
            //   59                   | push                dword ptr [ebp - 4]
            //   c20400               | push                esi
            //   8325????????00       |                     
            //   6a00                 | push                edi
            //   68????????           |                     

        $sequence_10 = { 7406 50 e8???????? 3bdf 7414 }
            // n = 5, score = 2100
            //   7406                 | push                esi
            //   50                   | jne                 7
            //   e8????????           |                     
            //   3bdf                 | push                ebx
            //   7414                 | mov                 ebx, 0xea60

        $sequence_11 = { a1???????? 85c0 751a 68???????? ff35???????? ff15???????? 85c0 }
            // n = 7, score = 1800
            //   a1????????           |                     
            //   85c0                 | je                  0x1f
            //   751a                 | push                eax
            //   68????????           |                     
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   85c0                 | xor                 eax, eax

        $sequence_12 = { 3c05 7506 84e4 7704 3ac0 }
            // n = 5, score = 1800
            //   3c05                 | mov                 ecx, edi
            //   7506                 | dec                 eax
            //   84e4                 | cmp                 ecx, edi
            //   7704                 | je                  0xa
            //   3ac0                 | mov                 edx, 1

        $sequence_13 = { c20400 55 8bec 83ec0c a1???????? 8365f800 }
            // n = 6, score = 1800
            //   c20400               | dec                 eax
            //   55                   | mov                 ebx, edi
            //   8bec                 | mov                 esi, edi
            //   83ec0c               | dec                 eax
            //   a1????????           |                     
            //   8365f800             | cmp                 ebx, edi

        $sequence_14 = { 2b55fc 8b7d10 0155fc 83451004 }
            // n = 4, score = 1700
            //   2b55fc               | cmp                 eax, edi
            //   8b7d10               | je                  0x19
            //   0155fc               | push                eax
            //   83451004             | push                0x10

        $sequence_15 = { 83e103 740d 51 50 ff7510 e8???????? 83c40c }
            // n = 7, score = 1700
            //   83e103               | push                eax
            //   740d                 | push                0x10
            //   51                   | pop                 eax
            //   50                   | push                0x10
            //   ff7510               | pop                 eax
            //   e8????????           |                     
            //   83c40c               | cmp                 eax, edi

        $sequence_16 = { 0155fc 83451004 83c004 49 8917 75e9 }
            // n = 6, score = 1700
            //   0155fc               | je                  0x19
            //   83451004             | push                eax
            //   83c004               | jmp                 4
            //   49                   | xor                 eax, eax
            //   8917                 | cmp                 eax, edi
            //   75e9                 | je                  0x19

        $sequence_17 = { 7417 8b10 2b55fc 8b7d10 }
            // n = 4, score = 1700
            //   7417                 | je                  0x1d
            //   8b10                 | mov                 edx, ebx
            //   2b55fc               | jmp                 4
            //   8b7d10               | xor                 eax, eax

        $sequence_18 = { 3bc3 7512 e8???????? 3bc3 a3???????? }
            // n = 5, score = 1700
            //   3bc3                 | push                eax
            //   7512                 | xor                 eax, eax
            //   e8????????           |                     
            //   3bc3                 | cmp                 eax, edi
            //   a3????????           |                     

        $sequence_19 = { 895df4 0f84c7000000 56 53 }
            // n = 4, score = 1700
            //   895df4               | je                  0x13
            //   0f84c7000000         | push                eax
            //   56                   | push                eax
            //   53                   | xor                 eax, eax

        $sequence_20 = { b8???????? 7505 b8???????? 53 bb60ea0000 }
            // n = 5, score = 1700
            //   b8????????           |                     
            //   7505                 | sub                 esp, 0x9c
            //   b8????????           |                     
            //   53                   | push                ebx
            //   bb60ea0000           | mov                 eax, edi

        $sequence_21 = { 68000f0000 e8???????? 8bd8 85db 895df4 0f84c7000000 }
            // n = 6, score = 1700
            //   68000f0000           | push                ecx
            //   e8????????           |                     
            //   8bd8                 | push                edi
            //   85db                 | push                eax
            //   895df4               | add                 esp, 0xc
            //   0f84c7000000         | cmp                 eax, edi

        $sequence_22 = { 837b240c 56 57 8b3b 897c241c 760a 8b4b20 }
            // n = 7, score = 1600
            //   837b240c             | ret                 4
            //   56                   | pop                 ebp
            //   57                   | pop                 ebx
            //   8b3b                 | pop                 ecx
            //   897c241c             | ret                 4
            //   760a                 | push                0
            //   8b4b20               | pop                 ebp

        $sequence_23 = { 894b34 8b4b24 2b4b28 894c2410 8b4b34 f6c140 }
            // n = 6, score = 1600
            //   894b34               | push                dword ptr [ebp + 8]
            //   8b4b24               | push                0
            //   2b4b28               | push                0x122
            //   894c2410             | push                dword ptr [ebp + 8]
            //   8b4b34               | push                0
            //   f6c140               | push                0

        $sequence_24 = { 58 e8???????? 85c0 740d 8906 83c604 }
            // n = 6, score = 1600
            //   58                   | dec                 eax
            //   e8????????           |                     
            //   85c0                 | mov                 dword ptr [esi], ebp
            //   740d                 | jmp                 0x17
            //   8906                 | xor                 ebx, ebx
            //   83c604               | mov                 dx, 0x20

        $sequence_25 = { 8b442418 894110 836334f9 c7432c01000000 8b4334 }
            // n = 5, score = 1600
            //   8b442418             | mov                 esi, edi
            //   894110               | dec                 eax
            //   836334f9             | cmp                 ebx, edi
            //   c7432c01000000       | jne                 0x12
            //   8b4334               | dec                 eax

        $sequence_26 = { e8???????? 8b4320 897324 897328 83c40c 8974240c c6401a00 }
            // n = 7, score = 1600
            //   e8????????           |                     
            //   8b4320               | push                0
            //   897324               | pop                 esi
            //   897328               | mov                 eax, ebp
            //   83c40c               | pop                 ebp
            //   8974240c             | pop                 ebx
            //   c6401a00             | pop                 ecx

        $sequence_27 = { 57 33ff 3bdf 7414 }
            // n = 4, score = 1600
            //   57                   | push                eax
            //   33ff                 | xor                 eax, eax
            //   3bdf                 | je                  0x1d
            //   7414                 | push                eax

        $sequence_28 = { ff35???????? 0fc8 50 a1???????? }
            // n = 4, score = 1600
            //   ff35????????         |                     
            //   0fc8                 | cmp                 eax, edi
            //   50                   | je                  0x11
            //   a1????????           |                     

        $sequence_29 = { 8a4604 2404 f6d8 1bc0 }
            // n = 4, score = 1600
            //   8a4604               | mov                 dword ptr [ebp - 8], eax
            //   2404                 | mov                 ebx, eax
            //   f6d8                 | cmp                 ebx, esi
            //   1bc0                 | je                  0x12

        $sequence_30 = { c6400731 8b74241c 8b1e 6a00 ff37 ff15???????? 2b442414 }
            // n = 7, score = 1600
            //   c6400731             | mov                 esi, edi
            //   8b74241c             | dec                 eax
            //   8b1e                 | cmp                 ebx, edi
            //   6a00                 | xor                 edx, edx
            //   ff37                 | dec                 eax
            //   ff15????????         |                     
            //   2b442414             | mov                 ebx, edi

        $sequence_31 = { ff15???????? 8b442414 8b4c240c 8907 8b442418 }
            // n = 5, score = 1600
            //   ff15????????         |                     
            //   8b442414             | mov                 ebx, edi
            //   8b4c240c             | mov                 esi, edi
            //   8907                 | dec                 eax
            //   8b442418             | cmp                 ebx, edi

        $sequence_32 = { 83ec14 8364240400 53 8b5d0c 837b240c 56 }
            // n = 6, score = 1600
            //   83ec14               | cmp                 ebx, edi
            //   8364240400           | dec                 esp
            //   53                   | mov                 eax, ebx
            //   8b5d0c               | xor                 edx, edx
            //   837b240c             | dec                 eax
            //   56                   | mov                 ebx, edi

        $sequence_33 = { 2b442414 50 8b07 03442418 50 56 ff5310 }
            // n = 7, score = 1600
            //   2b442414             | cmp                 ebx, edi
            //   50                   | jne                 0x14
            //   8b07                 | dec                 esp
            //   03442418             | mov                 eax, ebx
            //   50                   | xor                 edx, edx
            //   56                   | dec                 eax
            //   ff5310               | mov                 ebx, edi

        $sequence_34 = { 837d0800 7408 ff7508 e8???????? 8bc7 5f 5e }
            // n = 7, score = 1500
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   7408                 | je                  0xa
            //   ff7508               | push                dword ptr [ebp + 8]
            //   e8????????           |                     
            //   8bc7                 | mov                 eax, edi
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_35 = { 752f 8b450c 8930 eb33 }
            // n = 4, score = 1500
            //   752f                 | jne                 0x31
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8930                 | mov                 dword ptr [eax], esi
            //   eb33                 | jmp                 0x35

        $sequence_36 = { 74a3 33ff eb0b 33ff eb03 }
            // n = 5, score = 1500
            //   74a3                 | je                  0xffffffa5
            //   33ff                 | xor                 edi, edi
            //   eb0b                 | jmp                 0xd
            //   33ff                 | xor                 edi, edi
            //   eb03                 | jmp                 5

        $sequence_37 = { 6a01 33db 53 ff35???????? e8???????? 8bf0 }
            // n = 6, score = 1500
            //   6a01                 | mov                 dword ptr [ebp - 0x1c], eax
            //   33db                 | mov                 dword ptr [ebp - 0x20], eax
            //   53                   | test                eax, eax
            //   ff35????????         |                     
            //   e8????????           |                     
            //   8bf0                 | je                  0xea

        $sequence_38 = { 50 8d4508 50 53 8bc6 }
            // n = 5, score = 1500
            //   50                   | push                eax
            //   8d4508               | lea                 eax, [ebp + 8]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   8bc6                 | mov                 eax, esi

        $sequence_39 = { 8bd1 83c128 4e 7404 3bd0 74e7 3bd0 }
            // n = 7, score = 1500
            //   8bd1                 | add                 esi, 4
            //   83c128               | xor                 eax, eax
            //   4e                   | cmp                 eax, edi
            //   7404                 | je                  0x13
            //   3bd0                 | push                eax
            //   74e7                 | add                 esi, 4
            //   3bd0                 | cmp                 eax, edi

        $sequence_40 = { 488bcf c744242860ea0000 4c0f45c8 48895c2420 }
            // n = 4, score = 1500
            //   488bcf               | jne                 7
            //   c744242860ea0000     | push                ebx
            //   4c0f45c8             | mov                 ebx, 0xea60
            //   48895c2420           | push                ebx

        $sequence_41 = { 3bc8 7415 8b5210 3bd0 }
            // n = 4, score = 1500
            //   3bc8                 | je                  0x11
            //   7415                 | push                eax
            //   8b5210               | add                 esi, 4
            //   3bd0                 | test                eax, eax

        $sequence_42 = { 53 8bc6 e8???????? 85c0 7516 }
            // n = 5, score = 1500
            //   53                   | push                ebx
            //   8bc6                 | mov                 eax, esi
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7516                 | jne                 0x18

        $sequence_43 = { 6a0b eb02 6a02 58 }
            // n = 4, score = 1500
            //   6a0b                 | je                  0x11
            //   eb02                 | push                eax
            //   6a02                 | add                 esi, 4
            //   58                   | cmp                 eax, edi

        $sequence_44 = { 85ff 750e 837d0800 7408 }
            // n = 4, score = 1500
            //   85ff                 | test                edi, edi
            //   750e                 | jne                 0x10
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   7408                 | je                  0xa

        $sequence_45 = { 488bcf ff15???????? 4c8964dd00 83c301 4885ff 4c8be7 }
            // n = 6, score = 1400
            //   488bcf               | inc                 ecx
            //   ff15????????         |                     
            //   4c8964dd00           | pop                 ebp
            //   83c301               | inc                 ecx
            //   4885ff               | pop                 esp
            //   4c8be7               | pop                 edi

        $sequence_46 = { 498bcc ff15???????? 33db 66ba2000 }
            // n = 4, score = 1400
            //   498bcc               | push                ebx
            //   ff15????????         |                     
            //   33db                 | jne                 7
            //   66ba2000             | push                ebx

        $sequence_47 = { 415c 5f 5e 5d 5b c3 8b4754 }
            // n = 7, score = 1400
            //   415c                 | xor                 eax, eax
            //   5f                   | cmp                 eax, edi
            //   5e                   | je                  0x26
            //   5d                   | push                eax
            //   5b                   | xor                 eax, eax
            //   c3                   | je                  0x2b
            //   8b4754               | push                eax

        $sequence_48 = { 75c4 48892e eb02 33db 488b0d???????? 885e08 }
            // n = 6, score = 1400
            //   75c4                 | inc                 ecx
            //   48892e               | pop                 esi
            //   eb02                 | inc                 ecx
            //   33db                 | pop                 ebp
            //   488b0d????????       |                     
            //   885e08               | mov                 esi, 1

        $sequence_49 = { c21000 55 8bec 83ec14 a1???????? 53 }
            // n = 6, score = 1400
            //   c21000               | je                  0x23
            //   55                   | push                eax
            //   8bec                 | xor                 eax, eax
            //   83ec14               | xor                 eax, eax
            //   a1????????           |                     
            //   53                   | cmp                 eax, edi

        $sequence_50 = { 53 b800080000 50 56 ff35???????? }
            // n = 5, score = 1400
            //   53                   | xor                 eax, eax
            //   b800080000           | cmp                 eax, edi
            //   50                   | xor                 eax, eax
            //   56                   | cmp                 eax, edi
            //   ff35????????         |                     

        $sequence_51 = { e8???????? be01000000 8bc6 4883c440 415e }
            // n = 5, score = 1400
            //   e8????????           |                     
            //   be01000000           | xor                 eax, eax
            //   8bc6                 | cmp                 eax, edi
            //   4883c440             | je                  0x26
            //   415e                 | xor                 eax, eax

        $sequence_52 = { 33db 66ba2000 498bcc ff15???????? 4885c0 }
            // n = 5, score = 1400
            //   33db                 | pop                 edi
            //   66ba2000             | pop                 esi
            //   498bcc               | pop                 ebp
            //   ff15????????         |                     
            //   4885c0               | pop                 ebx

        $sequence_53 = { e8???????? 85c0 742d ff75fc 6a0d }
            // n = 5, score = 1400
            //   e8????????           |                     
            //   85c0                 | mov                 dx, 0x20
            //   742d                 | mov                 ebx, 1
            //   ff75fc               | dec                 ecx
            //   6a0d                 | mov                 ecx, esp

        $sequence_54 = { 742d ff75fc 6a0d 58 e8???????? 85c0 }
            // n = 6, score = 1400
            //   742d                 | dec                 eax
            //   ff75fc               | test                eax, eax
            //   6a0d                 | dec                 eax
            //   58                   | mov                 ebp, eax
            //   e8????????           |                     
            //   85c0                 | je                  0x64

        $sequence_55 = { ff15???????? 4885c0 488be8 7453 }
            // n = 4, score = 1400
            //   ff15????????         |                     
            //   4885c0               | test                eax, eax
            //   488be8               | inc                 ecx
            //   7453                 | pop                 esp

        $sequence_56 = { 4c0f45c8 48895c2420 e8???????? 85c0 8bd8 }
            // n = 5, score = 1400
            //   4c0f45c8             | push                dword ptr [ebp + 0xc]
            //   48895c2420           | jne                 7
            //   e8????????           |                     
            //   85c0                 | push                ebx
            //   8bd8                 | mov                 ebx, 0xea60

        $sequence_57 = { 51 50 57 6a01 ff75e0 68???????? e8???????? }
            // n = 7, score = 1400
            //   51                   | mov                 ebx, edi
            //   50                   | mov                 esi, edi
            //   57                   | dec                 eax
            //   6a01                 | cmp                 ebx, edi
            //   ff75e0               | dec                 eax
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_58 = { ff15???????? bb01000000 498bcc eb07 83c301 488d4801 66ba2000 }
            // n = 7, score = 1400
            //   ff15????????         |                     
            //   bb01000000           | add                 esp, 0x40
            //   498bcc               | inc                 ecx
            //   eb07                 | pop                 esi
            //   83c301               | mov                 esi, 1
            //   488d4801             | mov                 eax, esi
            //   66ba2000             | dec                 eax

        $sequence_59 = { 8bd5 488bcf bb57000000 e8???????? }
            // n = 4, score = 1300
            //   8bd5                 | pop                 ebp
            //   488bcf               | pop                 ebx
            //   bb57000000           | pop                 ecx
            //   e8????????           |                     

        $sequence_60 = { e8???????? 3bc3 740f 8b35???????? 50 83c604 }
            // n = 6, score = 1300
            //   e8????????           |                     
            //   3bc3                 | je                  0xd
            //   740f                 | push                eax
            //   8b35????????         |                     
            //   50                   | push                eax
            //   83c604               | push                0x10

        $sequence_61 = { a810 ff750c 7535 68???????? ff75f8 }
            // n = 5, score = 1300
            //   a810                 | jne                 0x31
            //   ff750c               | mov                 eax, dword ptr [ebp + 0xc]
            //   7535                 | mov                 dword ptr [eax], esi
            //   68????????           |                     
            //   ff75f8               | jmp                 0x3a

        $sequence_62 = { ff75f8 ffd6 8b4df4 66c7015c00 }
            // n = 4, score = 1300
            //   ff75f8               | lea                 eax, [ebp + 8]
            //   ffd6                 | push                eax
            //   8b4df4               | push                ebx
            //   66c7015c00           | mov                 eax, esi

        $sequence_63 = { 8945e0 e8???????? 85c0 0f84dc000000 8b45e0 8d4de0 3bc1 }
            // n = 7, score = 1300
            //   8945e0               | push                ebx
            //   e8????????           |                     
            //   85c0                 | mov                 eax, esi
            //   0f84dc000000         | test                eax, eax
            //   8b45e0               | jne                 0x1e
            //   8d4de0               | xor                 edi, edi
            //   3bc1                 | jmp                 0xd

        $sequence_64 = { 33db 53 ff35???????? c745f408000000 ff15???????? 3bc3 8945f8 }
            // n = 7, score = 1300
            //   33db                 | test                eax, eax
            //   53                   | je                  0xffffffa5
            //   ff35????????         |                     
            //   c745f408000000       | xor                 edi, edi
            //   ff15????????         |                     
            //   3bc3                 | jmp                 0xf
            //   8945f8               | xor                 edi, edi

        $sequence_65 = { 6641b85c00 33d2 488bcd ff15???????? }
            // n = 4, score = 1300
            //   6641b85c00           | jmp                 0x13
            //   33d2                 | mov                 ebx, dword ptr [ebp + 8]
            //   488bcd               | test                eax, eax
            //   ff15????????         |                     

        $sequence_66 = { 50 83c604 e8???????? 3bfb }
            // n = 4, score = 1300
            //   50                   | cmp                 esi, ebx
            //   83c604               | je                  0x47
            //   e8????????           |                     
            //   3bfb                 | push                -1

        $sequence_67 = { b90e010000 41b800000100 4889442420 e8???????? e9???????? }
            // n = 5, score = 1300
            //   b90e010000           | push                4
            //   41b800000100         | push                eax
            //   4889442420           | push                edi
            //   e8????????           |                     
            //   e9????????           |                     

        $sequence_68 = { 6a01 e8???????? 85db 7423 8b0d???????? }
            // n = 5, score = 1300
            //   6a01                 | dec                 eax
            //   e8????????           |                     
            //   85db                 | mov                 dword ptr [esi], ebp
            //   7423                 | dec                 eax
            //   8b0d????????         |                     

        $sequence_69 = { 50 e8???????? 3bfb 7414 }
            // n = 4, score = 1300
            //   50                   | pop                 eax
            //   e8????????           |                     
            //   3bfb                 | cmp                 eax, edi
            //   7414                 | je                  0xd

        $sequence_70 = { 72c1 eb0c bb7f000000 eb05 bb7e000000 }
            // n = 5, score = 1300
            //   72c1                 | inc                 ecx
            //   eb0c                 | pop                 esp
            //   bb7f000000           | pop                 edi
            //   eb05                 | pop                 esi
            //   bb7e000000           | pop                 ebp

        $sequence_71 = { 33d2 ff15???????? 488bdf 8bf7 483bdf }
            // n = 5, score = 1300
            //   33d2                 | jne                 0x30
            //   ff15????????         |                     
            //   488bdf               | push                ebx
            //   8bf7                 | push                1
            //   483bdf               | push                1

        $sequence_72 = { 4883c608 83fd05 72c1 eb0c }
            // n = 4, score = 1300
            //   4883c608             | mov                 eax, dword ptr [edi + 0x54]
            //   83fd05               | test                al, 4
            //   72c1                 | mov                 esi, 1
            //   eb0c                 | mov                 eax, esi

        $sequence_73 = { 3bc3 8945f4 741a ff750c 668918 68???????? }
            // n = 6, score = 1300
            //   3bc3                 | jne                 0x10
            //   8945f4               | cmp                 dword ptr [ebp + 8], 0
            //   741a                 | je                  0xe
            //   ff750c               | push                dword ptr [ebp + 8]
            //   668918               | je                  0xa
            //   68????????           |                     

        $sequence_74 = { 50 8bd7 e8???????? eb02 33c0 3bc3 7413 }
            // n = 7, score = 1300
            //   50                   | xor                 eax, eax
            //   8bd7                 | cmp                 eax, edi
            //   e8????????           |                     
            //   eb02                 | je                  0x19
            //   33c0                 | push                eax
            //   3bc3                 | jmp                 4
            //   7413                 | xor                 eax, eax

        $sequence_75 = { a840 0f84e2000000 8b7334 8d442418 50 8d442410 50 }
            // n = 7, score = 1200
            //   a840                 | je                  8
            //   0f84e2000000         | push                eax
            //   8b7334               | cmp                 ebx, edi
            //   8d442418             | je                  0x19
            //   50                   | pop                 eax
            //   8d442410             | cmp                 eax, edi
            //   50                   | je                  0xa

        $sequence_76 = { 8b7508 e8???????? 33f6 3975fc }
            // n = 4, score = 1200
            //   8b7508               | xor                 eax, eax
            //   e8????????           |                     
            //   33f6                 | cmp                 eax, edi
            //   3975fc               | je                  0x1a

        $sequence_77 = { ff7510 57 ff750c 53 e8???????? 3bfe 740e }
            // n = 7, score = 1200
            //   ff7510               | je                  0x23
            //   57                   | push                eax
            //   ff750c               | xor                 eax, eax
            //   53                   | cmp                 eax, edi
            //   e8????????           |                     
            //   3bfe                 | je                  0x1f
            //   740e                 | push                eax

        $sequence_78 = { 0f8544010000 8b472c a801 742d ff37 e8???????? 85c0 }
            // n = 7, score = 1200
            //   0f8544010000         | mov                 eax, dword ptr [esi + 8]
            //   8b472c               | jne                 7
            //   a801                 | and                 dword ptr [ebx + 0x3c], edi
            //   742d                 | jmp                 0x10
            //   ff37                 | mov                 eax, dword ptr [ebx + 0x4c]
            //   e8????????           |                     
            //   85c0                 | test                al, al

        $sequence_79 = { e8???????? 3bfe 740e 57 56 ff35???????? ff15???????? }
            // n = 7, score = 1200
            //   e8????????           |                     
            //   3bfe                 | xor                 eax, eax
            //   740e                 | cmp                 eax, edi
            //   57                   | je                  0x1d
            //   56                   | push                eax
            //   ff35????????         |                     
            //   ff15????????         |                     

        $sequence_80 = { ff5214 8bf7 8bfe e8???????? 5f 5e }
            // n = 6, score = 1200
            //   ff5214               | je                  0x1b
            //   8bf7                 | cmp                 eax, edi
            //   8bfe                 | je                  8
            //   e8????????           |                     
            //   5f                   | push                eax
            //   5e                   | cmp                 ebx, edi

        $sequence_81 = { 5b 8be5 5d c20800 8b4330 a804 0f8451ffffff }
            // n = 7, score = 1200
            //   5b                   | xor                 eax, eax
            //   8be5                 | cmp                 eax, edi
            //   5d                   | je                  0x1b
            //   c20800               | cmp                 eax, edi
            //   8b4330               | je                  8
            //   a804                 | push                eax
            //   0f8451ffffff         | cmp                 ebx, edi

        $sequence_82 = { c744242000010000 ff15???????? 4883f8ff 488bf8 7442 }
            // n = 5, score = 1200
            //   c744242000010000     | push                0
            //   ff15????????         |                     
            //   4883f8ff             | push                eax
            //   488bf8               | push                edi
            //   7442                 | push                dword ptr [ebp + 8]

        $sequence_83 = { ff15???????? 53 56 ff35???????? ff15???????? 5b 5f }
            // n = 7, score = 1200
            //   ff15????????         |                     
            //   53                   | xor                 eax, eax
            //   56                   | cmp                 eax, edi
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   5b                   | je                  0x1d
            //   5f                   | push                eax

        $sequence_84 = { 3975fc 7410 ff75fc 56 ff35???????? ff15???????? 53 }
            // n = 7, score = 1200
            //   3975fc               | jmp                 4
            //   7410                 | xor                 eax, eax
            //   ff75fc               | cmp                 eax, edi
            //   56                   | je                  0x23
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   53                   | push                eax

        $sequence_85 = { 83bc248800000000 4c8b442440 488b542448 894c2430 }
            // n = 4, score = 1200
            //   83bc248800000000     | push                0
            //   4c8b442440           | push                eax
            //   488b542448           | push                edi
            //   894c2430             | push                dword ptr [ebp + 8]

        $sequence_86 = { 752e 53 e8???????? 6a01 6a01 }
            // n = 5, score = 1200
            //   752e                 | xor                 eax, eax
            //   53                   | cmp                 eax, edi
            //   e8????????           |                     
            //   6a01                 | je                  0x21
            //   6a01                 | push                eax

        $sequence_87 = { 56 ff35???????? 8945f8 ff15???????? 8bd8 3bde }
            // n = 6, score = 1200
            //   56                   | push                eax
            //   ff35????????         |                     
            //   8945f8               | xor                 eax, eax
            //   ff15????????         |                     
            //   8bd8                 | jmp                 4
            //   3bde                 | xor                 eax, eax

        $sequence_88 = { e8???????? 85c0 0f85d7000000 8b4604 }
            // n = 4, score = 1200
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   0f85d7000000         | jne                 0xee
            //   8b4604               | dec                 eax

        $sequence_89 = { 7505 894720 eb0b 8b4f30 84c9 0f8992000000 }
            // n = 6, score = 1200
            //   7505                 | je                  0x39
            //   894720               | jne                 7
            //   eb0b                 | and                 dword ptr [ebx + 0x3c], edi
            //   8b4f30               | jmp                 0xd
            //   84c9                 | mov                 eax, dword ptr [ebx + 0x4c]
            //   0f8992000000         | test                al, al

        $sequence_90 = { 83632800 e9???????? 8b4330 a840 0f84e2000000 8b7334 }
            // n = 6, score = 1200
            //   83632800             | mov                 ecx, eax
            //   e9????????           |                     
            //   8b4330               | and                 dword ptr [esp + 0x210], esi
            //   a840                 | inc                 ebp
            //   0f84e2000000         | mov                 eax, esp
            //   8b7334               | inc                 ecx

        $sequence_91 = { 0f854affffff 894330 e9???????? 55 }
            // n = 4, score = 1200
            //   0f854affffff         | dec                 eax
            //   894330               | lea                 eax, [edx + 0x4a20]
            //   e9????????           |                     
            //   55                   | dec                 eax

        $sequence_92 = { c9 c20400 51 56 ff74240c }
            // n = 5, score = 1100
            //   c9                   | mov                 eax, edi
            //   c20400               | jne                 0xc
            //   51                   | dec                 eax
            //   56                   | mov                 ecx, edi
            //   ff74240c             | mov                 ebx, eax

        $sequence_93 = { 4803df 410fb64101 33d2 488d0cc3 }
            // n = 4, score = 1100
            //   4803df               | xor                 ebx, ebx
            //   410fb64101           | push                ebx
            //   33d2                 | push                1
            //   488d0cc3             | xor                 ebx, ebx

        $sequence_94 = { 85d2 4d8bf1 458bf8 8bc2 }
            // n = 4, score = 1100
            //   85d2                 | push                0xf00
            //   4d8bf1               | mov                 ebx, eax
            //   458bf8               | test                ebx, ebx
            //   8bc2                 | mov                 dword ptr [ebp - 0xc], ebx

        $sequence_95 = { e8???????? 8d45fc 50 8b4508 e8???????? }
            // n = 5, score = 1100
            //   e8????????           |                     
            //   8d45fc               | mov                 ebp, eax
            //   50                   | dec                 ecx
            //   8b4508               | mov                 ecx, esp
            //   e8????????           |                     

        $sequence_96 = { 50 57 e8???????? e9???????? 68???????? }
            // n = 5, score = 1100
            //   50                   | push                dword ptr [ebp + 8]
            //   57                   | mov                 eax, edi
            //   e8????????           |                     
            //   e9????????           |                     
            //   68????????           |                     

        $sequence_97 = { ff15???????? 488bcf 48870d???????? 483bcf }
            // n = 4, score = 1100
            //   ff15????????         |                     
            //   488bcf               | je                  0x1c
            //   48870d????????       |                     
            //   483bcf               | mov                 eax, dword ptr [edx]

        $sequence_98 = { 33db 895d08 eb03 8b5d08 }
            // n = 4, score = 1100
            //   33db                 | xor                 ebx, ebx
            //   895d08               | mov                 dword ptr [ebp + 8], ebx
            //   eb03                 | jmp                 5
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]

        $sequence_99 = { 488d0cc3 48890d???????? 410fb64103 488d0cc3 }
            // n = 4, score = 1100
            //   488d0cc3             | xor                 ebx, ebx
            //   48890d????????       |                     
            //   410fb64103           | push                ebx
            //   488d0cc3             | mov                 esi, eax

        $sequence_100 = { ff15???????? 4885db 740c 4c8b0d???????? e9???????? }
            // n = 5, score = 1100
            //   ff15????????         |                     
            //   4885db               | xor                 ebx, ebx
            //   740c                 | push                ebx
            //   4c8b0d????????       |                     
            //   e9????????           |                     

        $sequence_101 = { c3 418bd8 4803df 410fb64101 }
            // n = 4, score = 1100
            //   c3                   | pop                 ebx
            //   418bd8               | pop                 ecx
            //   4803df               | ret                 4
            //   410fb64101           | pop                 ebp

        $sequence_102 = { e8???????? 85c0 7507 33db 895d08 }
            // n = 5, score = 1100
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7507                 | jne                 9
            //   33db                 | xor                 ebx, ebx
            //   895d08               | mov                 dword ptr [ebp + 8], ebx

        $sequence_103 = { 488bce ff15???????? 488b0d???????? 33d2 4c63c0 }
            // n = 5, score = 1100
            //   488bce               | mov                 ecx, esp
            //   ff15????????         |                     
            //   488b0d????????       |                     
            //   33d2                 | dec                 eax
            //   4c63c0               | test                eax, eax

        $sequence_104 = { 6a00 ff35???????? ff15???????? 33db 6a01 }
            // n = 5, score = 1100
            //   6a00                 | test                edi, edi
            //   ff35????????         |                     
            //   ff15????????         |                     
            //   33db                 | dec                 esp
            //   6a01                 | mov                 esp, edi

        $sequence_105 = { 8a4b1c 488b4558 4c8b4d30 4c8b4510 }
            // n = 4, score = 1100
            //   8a4b1c               | je                  0xd2
            //   488b4558             | push                esi
            //   4c8b4d30             | push                ebx
            //   4c8b4510             | push                ebx

        $sequence_106 = { 448be8 418b4310 41394308 410f474308 }
            // n = 4, score = 1100
            //   448be8               | pop                 edi
            //   418b4310             | push                dword ptr [ebp - 0xc]
            //   41394308             | push                0x122
            //   410f474308           | push                dword ptr [ebp + 8]

        $sequence_107 = { 488d0cc3 48890d???????? 410fb64102 488d0cc3 }
            // n = 4, score = 1100
            //   488d0cc3             | mov                 ebp, esp
            //   48890d????????       |                     
            //   410fb64102           | sub                 esp, 0x14
            //   488d0cc3             | push                1

        $sequence_108 = { 33d2 ff15???????? 483bc3 4c8be8 }
            // n = 4, score = 1100
            //   33d2                 | add                 esi, 8
            //   ff15????????         |                     
            //   483bc3               | cmp                 ebp, 5
            //   4c8be8               | jb                  0xffffffc6

        $sequence_109 = { 33d2 498bcc 498bfd e8???????? 493bc5 7405 }
            // n = 6, score = 1100
            //   33d2                 | pop                 ebp
            //   498bcc               | pop                 ebx
            //   498bfd               | pop                 ecx
            //   e8????????           |                     
            //   493bc5               | ret                 4
            //   7405                 | mov                 eax, ebp

        $sequence_110 = { 5b c3 a1???????? 83c040 50 ff15???????? eb08 }
            // n = 7, score = 1000
            //   5b                   | je                  0x19
            //   c3                   | jmp                 4
            //   a1????????           |                     
            //   83c040               | xor                 eax, eax
            //   50                   | cmp                 eax, edi
            //   ff15????????         |                     
            //   eb08                 | je                  0x19

        $sequence_111 = { 8b3d???????? 56 ffd7 53 56 }
            // n = 5, score = 1000
            //   8b3d????????         |                     
            //   56                   | push                eax
            //   ffd7                 | xor                 eax, eax
            //   53                   | cmp                 eax, edi
            //   56                   | je                  0x1f

        $sequence_112 = { e8???????? 0945fc 47 83c304 3b3e 72dc 8b45fc }
            // n = 7, score = 1000
            //   e8????????           |                     
            //   0945fc               | push                eax
            //   47                   | push                edi
            //   83c304               | push                dword ptr [ebp + 8]
            //   3b3e                 | push                eax
            //   72dc                 | push                edi
            //   8b45fc               | push                dword ptr [ebp + 8]

        $sequence_113 = { c9 c20400 53 56 8bf0 8a06 }
            // n = 6, score = 1000
            //   c9                   | push                eax
            //   c20400               | push                0x10
            //   53                   | cmp                 eax, edi
            //   56                   | je                  0x15
            //   8bf0                 | push                eax
            //   8a06                 | push                0x10

        $sequence_114 = { 8bf1 05fefeffff 33db 33c9 }
            // n = 4, score = 1000
            //   8bf1                 | mov                 ebx, eax
            //   05fefeffff           | dec                 eax
            //   33db                 | mov                 dword ptr [edi + ecx], eax
            //   33c9                 | dec                 eax

        $sequence_115 = { 8b02 43 8acb d3c0 33c6 33442410 8bf0 }
            // n = 7, score = 1000
            //   8b02                 | test                eax, eax
            //   43                   | jne                 9
            //   8acb                 | xor                 ebx, ebx
            //   d3c0                 | mov                 dword ptr [ebp + 8], ebx
            //   33c6                 | jmp                 0xc
            //   33442410             | mov                 ebx, dword ptr [ebp + 8]
            //   8bf0                 | xor                 ebx, ebx

        $sequence_116 = { ff15???????? 8ac3 5b c9 c20400 53 }
            // n = 6, score = 1000
            //   ff15????????         |                     
            //   8ac3                 | je                  0x19
            //   5b                   | push                eax
            //   c9                   | push                0x10
            //   c20400               | push                eax
            //   53                   | push                0x10

        $sequence_117 = { 8bf0 8932 83c204 ff4c240c 75e6 5e 5b }
            // n = 7, score = 1000
            //   8bf0                 | pop                 edi
            //   8932                 | push                eax
            //   83c204               | lea                 eax, [ebp + 8]
            //   ff4c240c             | push                eax
            //   75e6                 | push                ebx
            //   5e                   | mov                 eax, esi
            //   5b                   | jne                 0x10

        $sequence_118 = { 4533c9 4889442428 215c2420 4533c0 }
            // n = 4, score = 900
            //   4533c9               | push                ebx
            //   4889442428           | mov                 eax, edi
            //   215c2420             | lea                 eax, [esi + 0x18]
            //   4533c0               | mov                 ecx, dword ptr [eax]

        $sequence_119 = { 50 8d442430 50 8d442428 50 8d442428 }
            // n = 6, score = 900
            //   50                   | pop                 eax
            //   8d442430             | cmp                 eax, edi
            //   50                   | je                  0xa
            //   8d442428             | cmp                 eax, edi
            //   50                   | je                  8
            //   8d442428             | push                eax

        $sequence_120 = { 480f45f2 832700 458be0 bb08000000 }
            // n = 4, score = 900
            //   480f45f2             | lea                 eax, [esi + 0x18]
            //   832700               | mov                 ecx, dword ptr [eax]
            //   458be0               | push                ebx
            //   bb08000000           | mov                 eax, edi

        $sequence_121 = { ff15???????? 4c8d4c2450 4c8d442458 8d5001 488bce e8???????? 85c0 }
            // n = 7, score = 900
            //   ff15????????         |                     
            //   4c8d4c2450           | dec                 eax
            //   4c8d442458           | mov                 edi, eax
            //   8d5001               | je                  0x26
            //   488bce               | inc                 esp
            //   e8????????           |                     
            //   85c0                 | mov                 eax, ebx

        $sequence_122 = { ff15???????? 4883f8ff 4c8be0 0f8583000000 488b0d???????? 4d8bc5 }
            // n = 6, score = 900
            //   ff15????????         |                     
            //   4883f8ff             | push                -1
            //   4c8be0               | push                ebx
            //   0f8583000000         | mov                 esi, eax
            //   488b0d????????       |                     
            //   4d8bc5               | cmp                 esi, ebx

        $sequence_123 = { e9???????? 33c9 bb26040000 48870d???????? }
            // n = 4, score = 900
            //   e9????????           |                     
            //   33c9                 | push                edi
            //   bb26040000           | push                dword ptr [ebp + 0x10]
            //   48870d????????       |                     

        $sequence_124 = { ff15???????? 49bb00c0692ac9000000 488bcf 4c019c24d8010000 ff15???????? 6641b85c00 33d2 }
            // n = 7, score = 900
            //   ff15????????         |                     
            //   49bb00c0692ac9000000     | cmp    esi, ebx
            //   488bcf               | push                ebx
            //   4c019c24d8010000     | mov                 esi, eax
            //   ff15????????         |                     
            //   6641b85c00           | cmp                 esi, ebx
            //   33d2                 | je                  0x49

        $sequence_125 = { 83c701 e9???????? 488b8424c8010000 498bcc bb01000000 4c8928 }
            // n = 6, score = 900
            //   83c701               | ret                 4
            //   e9????????           |                     
            //   488b8424c8010000     | push                0
            //   498bcc               | pop                 ebx
            //   bb01000000           | pop                 ecx
            //   4c8928               | ret                 4

        $sequence_126 = { ff15???????? 488d542440 488bcd ff15???????? 4883f8ff }
            // n = 5, score = 900
            //   ff15????????         |                     
            //   488d542440           | je                  0x47
            //   488bcd               | pop                 ebx
            //   ff15????????         |                     
            //   4883f8ff             | pop                 ecx

        $sequence_127 = { 4c8bc7 33d2 ff15???????? 33ff 4885ff }
            // n = 5, score = 900
            //   4c8bc7               | inc                 ecx
            //   33d2                 | shl                 eax, 3
            //   ff15????????         |                     
            //   33ff                 | dec                 eax
            //   4885ff               | test                eax, eax

        $sequence_128 = { 488bd6 ff15???????? eb14 488b0d???????? 4c8bc7 33d2 }
            // n = 6, score = 900
            //   488bd6               | xor                 edx, edx
            //   ff15????????         |                     
            //   eb14                 | inc                 ecx
            //   488b0d????????       |                     
            //   4c8bc7               | shl                 eax, 3
            //   33d2                 | dec                 eax

        $sequence_129 = { 6a00 ff35???????? ffd3 8bd8 85db 7476 }
            // n = 6, score = 900
            //   6a00                 | push                eax
            //   ff35????????         |                     
            //   ffd3                 | cmp                 eax, edi
            //   8bd8                 | je                  0x15
            //   85db                 | push                eax
            //   7476                 | push                0x10

        $sequence_130 = { 41b905000000 488bd8 ff15???????? 488bcb }
            // n = 4, score = 900
            //   41b905000000         | push                eax
            //   488bd8               | push                ecx
            //   ff15????????         |                     
            //   488bcb               | mov                 eax, edi

        $sequence_131 = { 4c8be8 0f841c010000 448b05???????? 33d2 488bc8 4c33c7 e8???????? }
            // n = 7, score = 900
            //   4c8be8               | je                  0x49
            //   0f841c010000         | mov                 esi, eax
            //   448b05????????       |                     
            //   33d2                 | cmp                 esi, ebx
            //   488bc8               | je                  0x47
            //   4c33c7               | push                -1
            //   e8????????           |                     

        $sequence_132 = { 7416 a1???????? 83c004 50 be???????? }
            // n = 5, score = 900
            //   7416                 | push                eax
            //   a1????????           |                     
            //   83c004               | push                0x10
            //   50                   | pop                 eax
            //   be????????           |                     

        $sequence_133 = { 498bcf ff15???????? 448bf0 488bce ff15???????? }
            // n = 5, score = 800
            //   498bcf               | dec                 eax
            //   ff15????????         |                     
            //   448bf0               | test                eax, eax
            //   488bce               | dec                 eax
            //   ff15????????         |                     

        $sequence_134 = { 895df4 895df0 c745f857000000 bf19010000 }
            // n = 4, score = 800
            //   895df4               | jne                 0xffffffe4
            //   895df0               | dec                 eax
            //   c745f857000000       | mov                 ecx, dword ptr [edi + ecx]
            //   bf19010000           | dec                 eax

        $sequence_135 = { 7520 41390424 741a 498d4c2401 }
            // n = 4, score = 800
            //   7520                 | dec                 ecx
            //   41390424             | mov                 ecx, esp
            //   741a                 | xor                 ebx, ebx
            //   498d4c2401           | mov                 dx, 0x20

        $sequence_136 = { 488b0d???????? 448bc0 8bd8 33d2 4983c001 }
            // n = 5, score = 800
            //   488b0d????????       |                     
            //   448bc0               | test                eax, eax
            //   8bd8                 | mov                 ebx, eax
            //   33d2                 | dec                 eax
            //   4983c001             | mov                 ecx, edi

        $sequence_137 = { a1???????? 25efff0000 0bc2 e9???????? }
            // n = 4, score = 800
            //   a1????????           |                     
            //   25efff0000           | dec                 ecx
            //   0bc2                 | sub                 esi, esi
            //   e9????????           |                     

        $sequence_138 = { 4c63c0 33d2 4983c00c ff15???????? }
            // n = 4, score = 800
            //   4c63c0               | add                 esp, 0x40
            //   33d2                 | inc                 ecx
            //   4983c00c             | pop                 esi
            //   ff15????????         |                     

        $sequence_139 = { 215c2420 4533c9 4533c0 33d2 ff15???????? 85c0 7511 }
            // n = 7, score = 800
            //   215c2420             | add                 eax, 0xc
            //   4533c9               | dec                 esp
            //   4533c0               | arpl                ax, ax
            //   33d2                 | xor                 edx, edx
            //   ff15????????         |                     
            //   85c0                 | dec                 ecx
            //   7511                 | add                 eax, 0xc

        $sequence_140 = { 6a03 8935???????? 8935???????? 8935???????? }
            // n = 4, score = 800
            //   6a03                 | add                 edi, 8
            //   8935????????         |                     
            //   8935????????         |                     
            //   8935????????         |                     

        $sequence_141 = { e9???????? 488bcb ff15???????? a810 }
            // n = 4, score = 800
            //   e9????????           |                     
            //   488bcb               | arpl                ax, ax
            //   ff15????????         |                     
            //   a810                 | xor                 edx, edx

        $sequence_142 = { 803f2a 750b 4883c701 83c3ff }
            // n = 4, score = 800
            //   803f2a               | dec                 esp
            //   750b                 | cmovne              ecx, eax
            //   4883c701             | dec                 eax
            //   83c3ff               | mov                 dword ptr [esp + 0x20], ebx

        $sequence_143 = { 41be01000000 33c9 418bd6 ff15???????? }
            // n = 4, score = 800
            //   41be01000000         | inc                 ebp
            //   33c9                 | xor                 ecx, ecx
            //   418bd6               | inc                 ebp
            //   ff15????????         |                     

        $sequence_144 = { 53 56 8bf1 05fefeffff }
            // n = 4, score = 800
            //   53                   | dec                 eax
            //   56                   | mov                 dword ptr [edi + ecx], eax
            //   8bf1                 | dec                 eax
            //   05fefeffff           | add                 edi, 8

        $sequence_145 = { 57 4154 4155 4156 4883ec50 488bf1 }
            // n = 6, score = 700
            //   57                   | inc                 ebp
            //   4154                 | xor                 eax, eax
            //   4155                 | xor                 edx, edx
            //   4156                 | inc                 ebp
            //   4883ec50             | xor                 ecx, ecx
            //   488bf1               | inc                 ebp

        $sequence_146 = { 5e 33c0 c9 c20400 55 8bec 51 }
            // n = 7, score = 700
            //   5e                   | push                ebx
            //   33c0                 | cmp                 edi, esi
            //   c9                   | jne                 0x30
            //   c20400               | push                ebx
            //   55                   | push                1
            //   8bec                 | push                1
            //   51                   | push                dword ptr [ebp + 0x14]

        $sequence_147 = { 4889040f 4883c708 492bf6 75db }
            // n = 4, score = 700
            //   4889040f             | inc                 ecx
            //   4883c708             | mov                 edx, esi
            //   492bf6               | push                edi
            //   75db                 | inc                 ecx

        $sequence_148 = { 8bc6 e8???????? 8b06 8b08 57 ff7510 }
            // n = 6, score = 700
            //   8bc6                 | inc                 ecx
            //   e8????????           |                     
            //   8b06                 | cmp                 byte ptr [esp + eax + 0x30], 0
            //   8b08                 | jne                 0x38
            //   57                   | mov                 edx, ebx
            //   ff7510               | sub                 edx, ecx

        $sequence_149 = { 750a 488bcf e8???????? 8bd8 488b0d???????? 4c8bc7 }
            // n = 6, score = 700
            //   750a                 | mov                 esi, 1
            //   488bcf               | xor                 ecx, ecx
            //   e8????????           |                     
            //   8bd8                 | inc                 ecx
            //   488b0d????????       |                     
            //   4c8bc7               | mov                 edx, esi

        $sequence_150 = { 5f c20400 55 8bec 83e4f8 81ec9c000000 }
            // n = 6, score = 700
            //   5f                   | mov                 edi, eax
            //   c20400               | xor                 esi, esi
            //   55                   | cmp                 dword ptr [ebp - 4], esi
            //   8bec                 | je                  0x15
            //   83e4f8               | mov                 esi, dword ptr [ebp + 8]
            //   81ec9c000000         | xor                 esi, esi

        $sequence_151 = { 488d542438 488bcb e8???????? eb02 }
            // n = 4, score = 700
            //   488d542438           | pop                 ecx
            //   488bcb               | ret                 4
            //   e8????????           |                     
            //   eb02                 | push                0

        $sequence_152 = { 8bc7 e8???????? 8d4618 8b08 50 51 }
            // n = 6, score = 700
            //   8bc7                 | dec                 eax
            //   e8????????           |                     
            //   8d4618               | mov                 dword ptr [edi + ecx], eax
            //   8b08                 | dec                 eax
            //   50                   | add                 edi, 8
            //   51                   | dec                 ecx

        $sequence_153 = { 6a20 40 50 ffd6 }
            // n = 4, score = 700
            //   6a20                 | mov                 edi, eax
            //   40                   | push                dword ptr [ebp + 0x10]
            //   50                   | push                edi
            //   ffd6                 | push                dword ptr [ebp + 0xc]

        $sequence_154 = { 488bd3 ff15???????? 488b8c2428020000 8bf0 ff15???????? }
            // n = 5, score = 600
            //   488bd3               | je                  0x11
            //   ff15????????         |                     
            //   488b8c2428020000     | push                eax
            //   8bf0                 | add                 esi, 4
            //   ff15????????         |                     

        $sequence_155 = { 7417 4863461c 2b6e1c 4c03e8 488b4610 48894718 }
            // n = 6, score = 600
            //   7417                 | ret                 4
            //   4863461c             | mov                 eax, ebp
            //   2b6e1c               | pop                 ebp
            //   4c03e8               | pop                 ebx
            //   488b4610             | pop                 ecx
            //   48894718             | ret                 4

        $sequence_156 = { 21442428 488b8c2428020000 488364242000 448d4803 }
            // n = 4, score = 600
            //   21442428             | add                 esi, 4
            //   488b8c2428020000     | cmp                 edi, ebx
            //   488364242000         | cmp                 eax, ebx
            //   448d4803             | je                  8

        $sequence_157 = { 21b42410020000 eb0d ff15???????? 89842410020000 }
            // n = 4, score = 600
            //   21b42410020000       | xor                 eax, eax
            //   eb0d                 | cmp                 eax, ebx
            //   ff15????????         |                     
            //   89842410020000       | je                  0x23

        $sequence_158 = { 488bcb ff15???????? 8bc8 ff15???????? 21b42410020000 }
            // n = 5, score = 600
            //   488bcb               | cmp                 edi, ebx
            //   ff15????????         |                     
            //   8bc8                 | add                 esi, 4
            //   ff15????????         |                     
            //   21b42410020000       | cmp                 edi, ebx

        $sequence_159 = { 4885c9 7405 e8???????? 4883c428 c3 488d82204a0000 488982284a0000 }
            // n = 7, score = 600
            //   4885c9               | test                eax, eax
            //   7405                 | mov                 ebx, eax
            //   e8????????           |                     
            //   4883c428             | dec                 eax
            //   c3                   | mov                 ecx, edi
            //   488d82204a0000       | mov                 dword ptr [esp + 0x28], 0xea60
            //   488982284a0000       | dec                 esp

        $sequence_160 = { 418bcd e8???????? 8b842410020000 4c8d9c24f0010000 }
            // n = 4, score = 600
            //   418bcd               | xor                 eax, eax
            //   e8????????           |                     
            //   8b842410020000       | cmp                 eax, ebx
            //   4c8d9c24f0010000     | je                  0x1b

        $sequence_161 = { 488b15???????? 4c8d842428020000 48c7c101000080 ff15???????? }
            // n = 4, score = 600
            //   488b15????????       |                     
            //   4c8d842428020000     | add                 esi, 4
            //   48c7c101000080       | cmp                 eax, ebx
            //   ff15????????         |                     

        $sequence_162 = { e8???????? 5e 5f c9 c3 51 53 }
            // n = 7, score = 600
            //   e8????????           |                     
            //   5e                   | push                ebx
            //   5f                   | test                byte ptr [eax + 4], 8
            //   c9                   | jne                 0x30
            //   c3                   | push                ebx
            //   51                   | push                ebx
            //   53                   | mov                 eax, 0x800

        $sequence_163 = { 50 57 6a01 ff7508 ffd6 85c0 742b }
            // n = 7, score = 600
            //   50                   | push                ebx
            //   57                   | cmp                 edi, esi
            //   6a01                 | cmp                 edi, esi
            //   ff7508               | je                  0x10
            //   ffd6                 | push                edi
            //   85c0                 | push                dword ptr [ebp - 4]
            //   742b                 | push                esi

        $sequence_164 = { 448bcf 4533c0 e8???????? 483bc3 488905???????? 0f84dc000000 }
            // n = 6, score = 500
            //   448bcf               | dec                 eax
            //   4533c0               | mov                 edx, dword ptr [esp + 0x48]
            //   e8????????           |                     
            //   483bc3               | mov                 ecx, dword ptr [esp + 0x90]
            //   488905????????       |                     
            //   0f84dc000000         | cmp                 dword ptr [esp + 0x88], 0

        $sequence_165 = { e8???????? 488b0d???????? 4c8bc3 33d2 ff15???????? 488b0d???????? 4c8bc7 }
            // n = 7, score = 500
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   4c8bc3               | cmp                 dword ptr [esp + 0x88], 0
            //   33d2                 | dec                 esp
            //   ff15????????         |                     
            //   488b0d????????       |                     
            //   4c8bc7               | mov                 eax, dword ptr [esp + 0x40]

        $sequence_166 = { 4c8d40cc 33d2 33c9 e8???????? 85c0 0f8561010000 }
            // n = 6, score = 500
            //   4c8d40cc             | jmp                 7
            //   33d2                 | dec                 eax
            //   33c9                 | lea                 edx, [esp + 0x38]
            //   e8????????           |                     
            //   85c0                 | dec                 eax
            //   0f8561010000         | mov                 ecx, ebx

        $sequence_167 = { 7415 397b44 7510 488b0b e8???????? 85c0 0f859b000000 }
            // n = 7, score = 500
            //   7415                 | add                 ebp, eax
            //   397b44               | dec                 eax
            //   7510                 | mov                 eax, dword ptr [esi + 0x10]
            //   488b0b               | dec                 eax
            //   e8????????           |                     
            //   85c0                 | mov                 dword ptr [edi + 0x18], eax
            //   0f859b000000         | sub                 ebp, dword ptr [esi + 0x1c]

        $sequence_168 = { ffc1 807c043000 7531 8bd3 2bd1 8917 }
            // n = 6, score = 500
            //   ffc1                 | inc                 ecx
            //   807c043000           | push                ebp
            //   7531                 | inc                 ecx
            //   8bd3                 | push                esi
            //   2bd1                 | dec                 eax
            //   8917                 | sub                 esp, 0x50

        $sequence_169 = { 84c0 0f89a3000000 8b434c a804 7415 397b44 7510 }
            // n = 7, score = 500
            //   84c0                 | je                  0x18
            //   0f89a3000000         | push                eax
            //   8b434c               | add                 esi, 4
            //   a804                 | cmp                 edi, ebx
            //   7415                 | push                eax
            //   397b44               | add                 esi, 4
            //   7510                 | cmp                 edi, ebx

        $sequence_170 = { 7505 217b3c eb0b 8b434c 84c0 0f89a3000000 8b434c }
            // n = 7, score = 500
            //   7505                 | je                  0xa
            //   217b3c               | push                eax
            //   eb0b                 | cmp                 edi, ebx
            //   8b434c               | push                eax
            //   84c0                 | mov                 edx, edi
            //   0f89a3000000         | jmp                 6
            //   8b434c               | xor                 eax, eax

        $sequence_171 = { 85c0 0f8561010000 8b4348 a801 742c }
            // n = 5, score = 500
            //   85c0                 | cmp                 eax, ebx
            //   0f8561010000         | je                  0x25
            //   8b4348               | je                  8
            //   a801                 | push                eax
            //   742c                 | cmp                 edi, ebx

        $sequence_172 = { 742c 488b0b e8???????? 85c0 0f85e8000000 488b4608 488b0e }
            // n = 7, score = 500
            //   742c                 | push                eax
            //   488b0b               | cmp                 edi, ebx
            //   e8????????           |                     
            //   85c0                 | je                  0x1d
            //   0f85e8000000         | cmp                 eax, ebx
            //   488b4608             | je                  0x11
            //   488b0e               | push                eax

        $sequence_173 = { 85c0 0f859b000000 4863533c 488b4608 }
            // n = 4, score = 500
            //   85c0                 | add                 esi, 4
            //   0f859b000000         | mov                 edx, edi
            //   4863533c             | jmp                 4
            //   488b4608             | xor                 eax, eax

        $sequence_174 = { ba10000000 488bc8 e8???????? 48898424e0010000 4885c0 }
            // n = 5, score = 400
            //   ba10000000           | dec                 eax
            //   488bc8               | lea                 edx, [esp + 0x20]
            //   e8????????           |                     
            //   48898424e0010000     | mov                 ecx, 0x201
            //   4885c0               | test                eax, eax

        $sequence_175 = { 4c8d442470 488d542440 e8???????? 8bd8 85c0 }
            // n = 5, score = 400
            //   4c8d442470           | je                  0x29
            //   488d542440           | dec                 eax
            //   e8????????           |                     
            //   8bd8                 | lea                 edx, [esp + 0x20]
            //   85c0                 | mov                 ecx, 0x201

        $sequence_176 = { 33d2 468d44385f ff15???????? 4c8bf0 }
            // n = 4, score = 400
            //   33d2                 | je                  0x29
            //   468d44385f           | dec                 eax
            //   ff15????????         |                     
            //   4c8bf0               | lea                 edx, [esp + 0x20]

        $sequence_177 = { 488bf8 4885c0 7427 488d542420 b901020000 ff15???????? 85c0 }
            // n = 7, score = 400
            //   488bf8               | cmp                 eax, -1
            //   4885c0               | dec                 eax
            //   7427                 | mov                 edi, eax
            //   488d542420           | dec                 eax
            //   b901020000           | test                eax, eax
            //   ff15????????         |                     
            //   85c0                 | je                  0x2c

        $sequence_178 = { 4c89642448 ff15???????? 8bd8 83f8ff }
            // n = 4, score = 400
            //   4c89642448           | dec                 esp
            //   ff15????????         |                     
            //   8bd8                 | mov                 dword ptr [esp + 0x48], esp
            //   83f8ff               | mov                 ebx, eax

        $sequence_179 = { 488bc8 458bf9 33ff e8???????? 4c8be8 4885c0 7508 }
            // n = 7, score = 400
            //   488bc8               | jne                 0x21
            //   458bf9               | inc                 esp
            //   33ff                 | lea                 eax, [eax + 1]
            //   e8????????           |                     
            //   4c8be8               | dec                 eax
            //   4885c0               | mov                 ecx, eax
            //   7508                 | dec                 eax

        $sequence_180 = { 8bd8 85c0 0f85f3010000 4c8b842418020000 8d5808 488d8c24b0000000 4d85c0 }
            // n = 7, score = 400
            //   8bd8                 | mov                 dword ptr [esp + 0x1e0], eax
            //   85c0                 | dec                 eax
            //   0f85f3010000         | test                eax, eax
            //   4c8b842418020000     | mov                 ebx, eax
            //   8d5808               | cmp                 eax, -1
            //   488d8c24b0000000     | je                  0xa9
            //   4d85c0               | inc                 esp

        $sequence_181 = { 448d4256 ff15???????? 4c8be0 4885c0 0f8405010000 ff15???????? }
            // n = 6, score = 400
            //   448d4256             | je                  0x2c
            //   ff15????????         |                     
            //   4c8be0               | dec                 eax
            //   4885c0               | lea                 edx, [esp + 0x20]
            //   0f8405010000         | mov                 ecx, 0x201
            //   ff15????????         |                     

        $sequence_182 = { 90 57 51 8b742420 8b7c241c 8b4c2434 }
            // n = 6, score = 300
            //   90                   | jmp                 9
            //   57                   | add                 ebx, 1
            //   51                   | dec                 eax
            //   8b742420             | lea                 ecx, [eax + 1]
            //   8b7c241c             | mov                 dx, 0x20
            //   8b4c2434             | jne                 0xffffffc6

        $sequence_183 = { 56 57 51 90 8b742428 }
            // n = 5, score = 300
            //   56                   | dec                 eax
            //   57                   | mov                 dword ptr [esi], ebp
            //   51                   | mov                 ebx, 1
            //   90                   | dec                 ecx
            //   8b742428             | mov                 ecx, esp

        $sequence_184 = { 8b5508 035510 8b3a 83c204 }
            // n = 4, score = 300
            //   8b5508               | dec                 ecx
            //   035510               | mov                 ecx, esp
            //   8b3a                 | jmp                 0xc
            //   83c204               | add                 ebx, 1

        $sequence_185 = { 01f2 6683f9ff 896c2428 7508 }
            // n = 4, score = 300
            //   01f2                 | dec                 eax
            //   6683f9ff             | test                eax, eax
            //   896c2428             | dec                 eax
            //   7508                 | mov                 ebp, eax

        $sequence_186 = { eb67 8044241301 0fb6ca 01cb 30c9 eb59 }
            // n = 6, score = 300
            //   eb67                 | add                 ebx, 1
            //   8044241301           | dec                 eax
            //   0fb6ca               | test                edi, edi
            //   01cb                 | dec                 esp
            //   30c9                 | mov                 esp, edi
            //   eb59                 | jne                 0xffffffcf

        $sequence_187 = { 83c304 894c2410 56 90 }
            // n = 4, score = 300
            //   83c304               | inc                 ecx
            //   894c2410             | shl                 eax, 3
            //   56                   | dec                 eax
            //   90                   | test                eax, eax

        $sequence_188 = { 5e 01d5 01d3 b101 3b5c2428 0f8266ffffff }
            // n = 6, score = 300
            //   5e                   | dec                 ecx
            //   01d5                 | mov                 ecx, esp
            //   01d3                 | jmp                 9
            //   b101                 | add                 ebx, 1
            //   3b5c2428             | dec                 eax
            //   0f8266ffffff         | lea                 ecx, [eax + 1]

        $sequence_189 = { 8b5d10 6601da c1ca03 895510 3010 }
            // n = 5, score = 300
            //   8b5d10               | dec                 esp
            //   6601da               | mov                 dword ptr [ebp + ebx*8], esp
            //   c1ca03               | add                 ebx, 1
            //   895510               | dec                 eax
            //   3010                 | test                edi, edi

    condition:
        7 of them and filesize < 2940928
}
Download all Yara Rules