// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("protector", "MaskPE");

function detect() {
    if (PE.isSectionNamePresent(".MaskPE") && PE.compareEP("60")) {
        if (PE.isSignaturePresent(PE.getEntryPointOffset(), 0x100, "6160e8........8bc33e8b..40e8")) {
            sVersion = "2.0";
            bDetected = true;
        }
    }

    return result();
}