// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "N-Joy");

function detect() {
    if (PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 33)) {
            case 0xf5ef: sVersion = "1.0"; break;
            case 0xf57f: sVersion = "1.1"; break;
            case 0xeac7: sVersion = "1.2"; break;
            case 0xe723: sVersion = "1.3"; break;
        }
        bDetected = true;
    }

    return result();
}
