// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "VMWare");

function detect() {
    if (PE.compareOverlay("'RWMV'")) {
        if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("4883ec..e8$$$$$$$$48895c24..574883ec..488b05........48836424....48bf................483bc774..48f7d0")) {
            sName += " Installation Launcher";
            bDetected = true;
        } else if (PE.compareEP("e8$$$$$$$$558bec83ec..8365....8365....a1........5657bf........be........3bc7")) {
            sName += " Installation Launcher";
            bDetected = true;
        }
    }

    if (PE.isOverlayPresent() && PE.compareEP("e8$$$$$$$$558bec83ec..a1........8365....8365....5357bf........3bc7bb........74..85c374..f7d0")) {
        var nSize = Math.min(PE.getOverlaySize(), 0x100);
        if (PE.findString(PE.getOverlayOffset(), nSize, "BZh91AY&") != -1) {
            sName += " Software Installer";
            sOptions = "bzip2";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), nSize, "d0cf11e0a1b11ae1") != -1) {
            sName += " Software Installer";
            sOptions = "MS Compound";
            bDetected = true;
        }
    }

    if (bDetected) {
        sVersion = PE.getFileVersion();
    }

    return result();
}