// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "ORiEN");

function detect() {
    if (PE.compareEP("E95D010000CED1CE..'\r\n--------------------------------------------\r\n- ORiEN executable files protection system -\r\n------ Created by A. Fisun, 1994-2003 ------\r\n------- WWW: http://zalexf.narod.ru/ -------\r\n-------- e-mail: zalexf@hotmail.ru ---------\r\n--------------'")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 8)) {
            case 0xCE: sVersion = "2.11"; break;
            case 0xCD: sVersion = "2.12"; break;
        }
        bDetected = true;
    }

    return result();
}
