// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>
// Made by KDSS-Research <koffidev365supp@gmail.com>

// Rewritten by: DosX

meta("packer", "CX_Freeze");

function detect() {
    var rdataSection = PE.section[".rdata"];

    if (rdataSection) {

        bDetected = (PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Unable to change DLL search path!") !== -1 &&
            PE.isSignaturePresent(rdataSection.FileOffset, rdataSection.FileSize, "25006C0073005C006C00690062005C006C006900620072006100720079002E007A00690070003B0025006C0073005C006C0069006200") &&
            PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Out of memory creating sys.path!") !== -1 &&
            PE.findString(rdataSection.FileOffset, rdataSection.FileSize, "Unable to calculate directory of executable!") !== -1);

    }

    sLang = "Python";

    return result();
}
