rule win_retro_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.retro."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 498bcc 03f0 e8???????? 03f0 8b85a0120000 0385ec120000 }
            // n = 6, score = 200
            //   498bcc               | lea                 ecx, [0x32ccc]
            //   03f0                 | inc                 ecx
            //   e8????????           |                     
            //   03f0                 | cmp                 esp, 0x20
            //   8b85a0120000         | jl                  0xcbf
            //   0385ec120000         | mov                 ecx, dword ptr [esp + 0x24]

        $sequence_1 = { e8???????? 4889842408050000 4883bc240805000000 7555 4883bc24b007000000 740f 488b8c24b0070000 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   4889842408050000     | add                 esi, 4
            //   4883bc240805000000     | dec    ecx
            //   7555                 | dec                 esp
            //   4883bc24b007000000     | inc    esp
            //   740f                 | mov                 ebp, ebx
            //   488b8c24b0070000     | subss               xmm0, xmm6

        $sequence_2 = { 4c894c2420 4489442418 89542410 48894c2408 4883ec38 c744242400000000 }
            // n = 6, score = 200
            //   4c894c2420           | dec                 esp
            //   4489442418           | arpl                word ptr [edi - 4], bx
            //   89542410             | dec                 esp
            //   48894c2408           | arpl                word ptr [edi], dx
            //   4883ec38             | inc                 ecx
            //   c744242400000000     | mov                 ebp, ebp

        $sequence_3 = { 8d7520 8bfb 8d041e 2bfe 99 2bc2 d1f8 }
            // n = 7, score = 200
            //   8d7520               | cmovl               eax, edx
            //   8bfb                 | inc                 ecx
            //   8d041e               | cmp                 eax, esp
            //   2bfe                 | cmovl               ecx, eax
            //   99                   | inc                 ebp
            //   2bc2                 | mov                 esi, edi
            //   d1f8                 | inc                 ebp

        $sequence_4 = { 488d2dd9240300 8bfe 440f2940a8 440f294898 f2440f100d???????? f2440f1005???????? 6666660f1f840000000000 }
            // n = 7, score = 200
            //   488d2dd9240300       | add                 esp, 0x20
            //   8bfe                 | pop                 edi
            //   440f2940a8           | inc                 eax
            //   440f294898           | mov                 dword ptr [esp + 0x20], eax
            //   f2440f100d????????     |     
            //   f2440f1005????????     |     
            //   6666660f1f840000000000     | cmp    dword ptr [esp + 0x20], eax

        $sequence_5 = { 4889b42488400000 418bd8 488bf9 48894c2438 4c89a42480400000 488bf2 }
            // n = 6, score = 200
            //   4889b42488400000     | cvtps2pd            xmm0, xmm2
            //   418bd8               | inc                 ecx
            //   488bf9               | mulps               xmm0, xmm1
            //   48894c2438           | cvtsd2ss            xmm0, xmm0
            //   4c89a42480400000     | jmp                 0x110
            //   488bf2               | movaps              xmm0, xmm6

        $sequence_6 = { f30f59c4 f30f59dc f30f114018 f30f119818100000 f30f105810 0f28c1 f30f58c2 }
            // n = 7, score = 200
            //   f30f59c4             | lea                 eax, [ebp + 0x1e0]
            //   f30f59dc             | dec                 eax
            //   f30f114018           | mov                 ebp, dword ptr [esp + 0x3f58]
            //   f30f119818100000     | cmp                 dword ptr [ebx + 0x15294], eax
            //   f30f105810           | jge                 0x8c0
            //   0f28c1               | dec                 eax
            //   f30f58c2             | lea                 ecx, [0x3bcb2]

        $sequence_7 = { 488bce e8???????? 488d2da35b0400 4c8d2d985b0400 85c0 488bd5 488d0d705b0400 }
            // n = 7, score = 200
            //   488bce               | mulps               xmm2, xmmword ptr [ecx + 0x10]
            //   e8????????           |                     
            //   488d2da35b0400       | inc                 ecx
            //   4c8d2d985b0400       | movaps              xmm0, xmm1
            //   85c0                 | mulss               xmm0, xmm4
            //   488bd5               | inc                 ecx
            //   488d0d705b0400       | addps               xmm2, xmmword ptr [edx + 0x800]

        $sequence_8 = { 0fbfd7 e8???????? 448bd8 0fbfc6 83f803 745a 83f805 }
            // n = 7, score = 200
            //   0fbfd7               | mov                 eax, 0x28b
            //   e8????????           |                     
            //   448bd8               | test                ecx, ecx
            //   0fbfc6               | jg                  0x16d3
            //   83f803               | dec                 esp
            //   745a                 | mov                 ecx, dword ptr [esp + 0x50]
            //   83f805               | dec                 ecx

        $sequence_9 = { 7d24 8b93fc120000 488d8c8300120000 412bd0 0f1f00 8b01 3bf8 }
            // n = 7, score = 200
            //   7d24                 | dec                 eax
            //   8b93fc120000         | inc                 edx
            //   488d8c8300120000     | dec                 ecx
            //   412bd0               | dec                 eax
            //   0f1f00               | inc                 ecx
            //   8b01                 | mov                 ecx, dword ptr [edx]
            //   3bf8                 | inc                 ecx

    condition:
        7 of them and filesize < 1409024
}