// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/AdvDebug/NetShield_Protector
meta("protector", "NetShield");

function detect() {
    if (PE.isNet()) {
        if (PE.isSectionNamePresent("!Sugar") && PE.isNetGlobalCctorPresent()) {
            bDetected = true;

            if (PE.isNetObjectPresent("ConfusedByAttribute")) {
                sOptions = "Fake signs";
            }

            if (PE.isNetObjectPresent("SuppressIldasmAttribute")) {
                sOptions = sOptions.append("Anti-ILDASM");
            }

            if (PE.isNetObjectPresent("Form200")) {
                sOptions = sOptions.append("Anti-de4dot");
            }
        }

    }

    return result();
}