// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>
// updated A.S.L <asl@onet.eu>  2022.08.06

meta("installer", "Spoon Installer");

function detect() {
    if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'BZh91AY&SY'")) {
            sOptions = "BZIP2";
            bDetected = true;
        } else if (PE.compareOverlay("']'00008000")) {
            sOptions = "Lzma";
            bDetected = true;
        }

        if (PE.getAddressOfEntryPoint() == 0x0040C36E) {
            sVersion = "11 2005";
        }
    }

    return result();
}