// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("installer", "Wise Installer");

function detect() {
    if (PE.getOverlaySize() > 80) {
        var nOffset = PE.getOverlayOffset() + 77;
        if (PE.readDword(nOffset) == PE.getSize()) {
            bDetected = true;
        } else if (PE.isSectionNamePresent(".WISE")) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46")) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47")) {
            bDetected = true;
        }
    } else if (PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424")) {
        if (PE.isSectionNamePresent(".WISE")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........53565733f6466a..8975..ff15........ff15........8bf88a07")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.isSectionNamePresent(".WISE")) {
        if (PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "504b0304") != -1) {
            sOptions = "ZIP";
            bDetected = true;
        } else if (PE.compareOverlay("'MSCF'0000")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........538d85........5633db57be........565053ff15........568d85........5050ff15........538d8d........536a..536a..68........51ff15")) {
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........538d85........565733f6")) {
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........5356be........578d85........5633db5053")) {
        if (PE.compare("'GLB'00", PE.getSectionFileOffset(PE.getSectionNumber(".data")) + 0x10)) {
            bDetected = true;
        }
    }

    return result();
}
