// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "EXECryptor");

function detect() {
    if (PE.isNet()) return; // Doesn't support .NET

    if (PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8")) {
        sVersion = "2.0/2.1";
        sOptions = "protected IAT";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84")) {
        sVersion = "2.0/2.1";
        bDetected = true;
    } else if (PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15")) {
        sVersion = "2.1.17";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68")) {
        sVersion = "2.2.4";
        bDetected = true;
    } else if (PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9")) {
        sVersion = "2.2.6";
        sOptions = "minimum protection";
        bDetected = true;
    } else if (PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81")) {
        sVersion = "2.2.6";
        sOptions = "DLL/minimum protection";
        bDetected = true;
    } else if (PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8")) {
        sVersion = "2.2/2.3";
        sOptions = "compressed code";
        bDetected = true;
    } else if (PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8")) {
        sVersion = "2.2/2.3";
        sOptions = "protected IAT";
        bDetected = true;
    } else if (PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000")) {
        sVersion = "2.3.9";
        sOptions = "compressed resources";
        bDetected = true;
    } else if (PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84")) {
        sVersion = "2.3.9";
        sOptions = "minimum protection";
        bDetected = true;
    } else if (PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9")) {
        sVersion = "2.3.9";
        sOptions = "DLL/compressed resources";
        bDetected = true;
    } else if (PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1")) {
        sVersion = "2.3.9";
        sOptions = "DLL/minimum protection";
        bDetected = true;
    } else if (PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889")) {
        sVersion = "2.XX";
        sOptions = "compressed resources";
        bDetected = true;
    } else if (PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A")) {
        sVersion = "2.XX";
        sOptions = "max. compressed resources";
        bDetected = true;
    } else if (PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1")) {
        sVersion = "1.3.0.45";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4")) {
        sVersion = "1.4X-1.5X";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3")) {
        sVersion = "1.5X";
        bDetected = true;
    } else if (PE.compareEP("83C6148B55FCE9..FFFFFF")) {
        sVersion = "2.1X";
        bDetected = true;
    } else if (PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1")) {
        sVersion = "2.1X";
        bDetected = true;
    } else if (PE.compareEP("FFE0E804000000FFFFFFFF5EC300")) {
        sVersion = "2.2X";
        bDetected = true;
    } else if (PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F")) {
        bDetected = true;
    }

    if (!bDetected) {
        var nNumberOfSections = PE.section.length;
        if (nNumberOfSections > 3 &&
            PE.getNumberOfImports() == 2 &&
            PE.getNumberOfImportThunks(1) == 1 &&
            PE.getImportFunctionName(1, 0) == "MessageBoxA") {
            for (var nAdjust = 1; nAdjust < 3; nAdjust++) {
                if (PE.getImportSection() == nNumberOfSections - nAdjust &&
                    PE.section[nNumberOfSections - nAdjust - 1].FileSize == 0) {
                    sVersion = nNumberOfSections > 4 ? "2.4X" : "2.X";
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}
