// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/DosX-dev/DotNET_XorCryptor
meta("cryptor", "XorCryptor");

function detect() {
    if (/^[A-Za-z]{10,31}$/.test(PE.getNetAssemblyName()) &&
        PE.isNetObjectPresent("LateIndexGet") &&
        PE.isNetUStringPresent("System.Reflection.Assembly") &&
        PE.isNetUStringPresent("EntryPoint") &&
        PE.isNetUStringPresent("Load") &&
        PE.isNetUStringPresent("Invoke")) {
        bDetected = true;
    }

    return result();
}