// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Gentee Installer");

function detect() {
    if (PE.compareEP("558bec81ec........538d85........5633db578d8d........68........895d..518945..53ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x80, "'GEA'") != -1) {
            bDetected = true;
        } else if (PE.getNumberOfResources() > 0 && PE.compare("'GEA'", PE.getResourceNameOffset("SETUP_TEMP"))) {
            bDetected = true;
        }

    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..33db895d..6a..ff15")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x80, "'GEA'") != -1 ||
            PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".data")), 0x80, "'gentee'") != -1) {
            bDetected = true;
        }
    } else if (PE.compareEP("81ec........5356575568........6a..6a..ff15........8bf0ff15........3d........75..56") && PE.compareOverlay("'OWS9G1'", 0xb) != -1) {
        bDetected = true;
    } else if (PE.compareEP("558bec81ec........5356576a..ff15........68........ff15........85c074..6a..a1........50ff15........8bf06a..56ff15")) {
        bDetected = true;
    }

    return result();
}