// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "PESpin");

function detect() {
    if (!PE.is64()) {
        if (PE.compareEP("EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24")) {
            switch (PE.readByte(PE.getEntryPointOffset() + 27)) {
                case 0x5C: sVersion = "0.1"; break;
                case 0xB7: sVersion = "0.3"; break;
                case 0x73: sVersion = "0.4"; break;
                case 0x83: sVersion = "0.7"; break;
                case 0xC8: sVersion = "1.0"; break;
                case 0x7D: sVersion = "1.1"; break;
                case 0x71: sVersion = "1.3, beta"; break;
                case 0xAC: sVersion = "1.3"; break;
                case 0x88: sVersion = "1.3X"; break;
                case 0x17: sVersion = "1.32"; break;
                case 0x77: sVersion = "1.33"; break;
            }

            bDetected = true;
        }
    } else if (PE.compareEP("554881EC900000008D6C2428488975..48897D..48895D..4C8945..4C894D..4C8955..4C895D..4C8965..4C896D..4C8975..4C897D..48894D..488955")) {
        sVersion = "1.2X";
        bDetected = true;
    } else if (PE.compareEP("554881EC90000000488d6c24284889751848897d2048895d004c8945284c894d304c8955384c895d404c8965484c896d504c8975584c897d6048894d0848895510482bc94c8d05")) {
        sVersion = "1.23";
        bDetected = true;
    }

    return result();
}
