// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Xoreax Installer");

function detect() {
    if (PE.compareEP("558becb9........6a..6a..4975..51535657b8........e8........33c055")) {
        for (var i = 0; i < PE.getNumberOfResources(); i++) {
            if (PE.resource[i].Type == "RT_RCDATA") {
                if (PE.compare("5d0000", PE.resource[i].Offset)) {
                    bDetected = true;
                    break;
                }
            }
        }
    }

    return result();
}