// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Skater");

function detect() {
    if (PE.isNet()) {
        if (PE.compareEP_NET("4228070000066f09000006283800000a2a1b3004006f0000000d0000110272b9")) {
            sVersion = "2.X";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "'RustemSoft.Skater'")) {
            bDetected = true;
        }
    }

    if (bDetected && PE.isSignatureInSectionPresent(0, "4F0062006600750073006300610074006F0072002000440065006D006F00")) {
        sOptions = "demo";
    }

    return result();
}
