// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ac3ss0r/obfusheader.h
meta("protection", "obfusheader.h");

function detect() {
    if (PE.section[".rdata"] && PE.isFunctionPresent("LoadLibraryA") && PE.isFunctionPresent("GetProcAddress") && PE.isSignaturePresent(
        PE.section[0].FileOffset, PE.getSize() - PE.getOverlaySize(),
        "00 'Stop reversing the ' ** ** ** **")) {
        bDetected = true;
    }

    const dataSection = PE.section[".data"];
    if (dataSection && PE.compare("6162636465666768696A6B6C6D6E6F707172737475767778797A534C41494450", dataSection.FileOffset)) {
        sOptions = "data consts";
        bDetected = true;
    }

    if (bDetected && PE.section[".vmp0"]) {
        sOptions = sOptions.append("fake signs");
        _removeResult("protector", ["Enigma", "SecuROM", "Denuvo", "Themida/Winlicense"]);
    }

    sLang = "C++";

    return result();
}