// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// sign by A.S.L  - asl@onet.eu
// fixed by adoxa

meta("protector", "Vbs To Exe");

function detect() {
    if (PE.resource["D"]) {
        if (PE.compare("'2edecompile'", PE.resource["D"].Offset + 2)) {
            sVersion = "2.0.2.0";
            bDetected = true;
        } else if (PE.resource["D"].Size == 14 &&
            PE.isResourceNamePresent("B") &&
            PE.isResourceNamePresent("F") &&
            PE.isResourceNamePresent("I") &&
            PE.isResourceNamePresent("N") &&
            PE.isResourceNamePresent("O")) {
            sVersion = "2.0.2.0";
            bDetected = true;
        }
        if (bDetected) {
            if (PE.isResourceNamePresent("P")) {
                sOptions = "Protected";
            }
        }
    }

    sLang = "VBScript";

    return result();
}
