// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Unknown cryptor");

function detect() {
    if (Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")) {
        sVersion = "#01";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2")) {
        sVersion = "#02";
        sOptions = "exe 0-relocs crypt";
        bDetected = true;
    } else if (Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")) {
        sVersion = "#03";
        sOptions = "GENERATED FILE";
        bDetected = true;
    } else if (Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")) {
        sVersion = "#04";
        bDetected = true;
    } else if (Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2")) {
        sVersion = "#05";
        bDetected = true;
    } else if (Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3")) {
        sVersion = "#06";
        bDetected = true;
    } else if (Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3")) {
        sVersion = "#07";
        bDetected = true;
    } else if (Binary.compare("b8....05....50c3")) {
        var nOffset = Binary.readWord(1) + Binary.readWord(4) - 256;
        if (Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3", nOffset)) {
            sVersion = "#08";
            sOptions = "xorer";
            bDetected = true;
        }
    } else if (Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21")) {
        sVersion = "#11";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2")) {
        sVersion = "#15";
        sOptions = "xorer";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$5d83ed..0e1f0e07be....03f5bf....b9....f3a460be....0204463b")) {
        sVersion = "#16";
        sOptions = "1995 by A.V.Lemenkov";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646cce2")) {
        sVersion = "#17";
        sOptions = "xorer";
        bDetected = true;
    } else if (Binary.compare("60bb....be....bf....8bcf03fb5781e9....f3a4c3")) {
        sName = "Com-crypt";
        sVersion = "#18";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8b1e....81eb....b8....5053b430cd215beb")) {
        sVersion = "#19";
        sOptions = "by WICKED!";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....8bf43bf776..8be7e8$$$$5f53518bdf43b9....2bcb300f43e2")) {
        sVersion = "#20";
        sOptions = "(xorer) 1988 by Executive Systems, Inc.";
        bDetected = true;
    }

    return result();
}