// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://web.archive.org/web/20071012084924/http://secnull.org/
meta("cryptor", "AverCryptor");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")) {
        bDetected = true;

        switch (PE.readByte(PE.getEntryPointOffset() + 65)) {
            case 0xFA: sVersion = "1.0"; break;
            case 0xF7: sVersion = "1.02";
        }

        if (!PE.isSectionNamePresent(".avc")) {
            sOptions = "modified";
        }
    }

    return result();
}
