// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://hacking-software-free-download.blogspot.com/2013/02/nt-packer-v21.html
meta("packer", "NTPacker");

function detect() {
    if (PE.compareEP("558BEC83C4E05333C08945E08945E48945E88945ECB8........E8....FFFF33C05568")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}
