// DIE's signature file
// Author: KDSS-Research

init("cryptor", "LimeCrypter");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        bDetected = true;
        if (validateReferences(
                isPositive = true,
                references = [
                    "System.Security.Cryptography",
                    "System.Collections.Generic",
                    "System.Resources",
                    "System.Reflection"

                ]
            )) {
            bDetected = false;
            return null; // end
        }

        var n3 = PE.isSignatureInSectionPresent(0, "24........................................................................");
        var n2 = PE.isSignatureInSectionPresent(0, "3c50726976617465496d706c656d656e746174696f6e44657461696c733e7b........................................................................7d");

        if (!n2 || !n3 || !PE.isNetObjectPresent("<Initialize>o__SiteContainer0") ||
            !PE.isNetObjectPresent("$$method0x6000005-1") ||
            !PE.isNetObjectPresent("Assembly") ||
            !PE.isNetObjectPresent("Rfc2898DeriveBytes") ||
            !PE.isNetObjectPresent("AES_Decrypt") ||
            !PE.isNetObjectPresent("<>p__Site1") || PE.isNetObjectPresent("Chainski")) {
            bDetected = false;
        }


    }


    return result(bShowType, bShowVersion, bShowOptions);
}


// validateReferences by DosX
function validateReferences(isPositive, references) {
    for (var i = 0; i < references.length; i++) {
        var sign = "00'" + references[i] + "'00";
        if (isPositive == true) {
            if (!PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        } else { // negative
            if (PE.isSignatureInSectionPresent(0, sign)) {
                return true;
            }
        }
    }
    return false;
}