// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "ExeFog");

function detect() {
    if (PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3") ||
        PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5") ||
        PE.findSignature(PE.getEntryPointOffset(), 0x1000, "6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e") != -1) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result();
}