// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://www.boxedapp.com/
meta("packer", "BoxedApp");

function detect() {
    if (PE.isTLSPresent()) {
        const boxedAppSection = PE.section[".bxpck"];

        if (boxedAppSection && PE.getNumberOfSections() > 2) {

            const mainSection = PE.section[boxedAppSection.Number + 1];

            if (mainSection && mainSection.Name === ".main") {
                bDetected = true;
            }
        }

        if (!bDetected && PE.getNumberOfImports() === 2 && PE.compareEP("C200000000000000000000000000000000")) {
            sOptions = "modified";
            bDetected = true;
        }

        if (bDetected && boxedAppSection && PE.isSignatureInSectionPresent(boxedAppSection.Number, "2000640065006D006F0020")) {
            sVersion = "demo";
        }
    }

    return result();
}