// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("sfx");

function detect() {
    if (PE.compareEP("558bec6aff68........68........64a1........50648925........83ec..535657")) {
        if (PE.compareOverlay("....'-lh5-'")) {
            sName = "Toxsoft SFX";
            bDetected = true;
        } else if (PE.findSignature(PE.getOverlayOffset(), 0x100, "'MSCF'") !== -1) {
            sName = "Webest SFX";
            sVersion = "1.0";
            bDetected = true;
        } else if (PE.compareOverlay("a6d6b210")) {
            sType = "installer";
            sName = "Sax Software installer";
            bDetected = true;
        } else if (PE.compareOverlay("'Win_Sfx_For_Windows_'")) {
            sName = "XZIP-SFX";
            sOptions = "by Netzip";
            bDetected = true;
        } else if (PE.getNumberOfResources() > 0) {
            for (var i = 0; i < PE.resource.length && !bDetected; i++) {
                if (PE.compare("'SZDD'88", PE.resource[i].Offset)) {
                    sType = "installer";
                    sName = "custom installer with SZDD-archives";
                    bDetected = true;
                }
            }
        }
    } else if (PE.compareEP("558bec81ec........5333db53ff15........a3........891d........891d........e8........391d")) {
        if (PE.compareOverlay("'PK'0304")) {
            sType = "sfx";
            sName = "ZIP-SFX";
            sOptions = "by Ashampoo";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.getNumberOfResources() > 0 && PE.compare("5d00008000........000000000000", PE.resource[0].Offset)) {
            sType = "installer";
            sName = "Microsoft Windows update";
            bDetected = true;
        }
    } else if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc7")) {
        if (PE.compareOverlay("........00020200")) {
            var a = PE.getOverlayOffset();
            var b = PE.readWord(a);
            if (PE.compare("'SDLSOPKG'", a + b)) {
                sType = "installer";
                sName = "SysDev Laboratories";
                bDetected = true;
            }
        }
    } else if (PE.compareEP("64a1........558bec6a..68........68........50a1........648925........8b0d")) {
        if (PE.compareOverlay("'PK'0304")) {
            sType = "sfx";
            sName = "ZIP-SFX";
            sOptions = "by Aeco Systems";
            bDetected = true;
        }
    }

    return result();
}