// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

includeScript("cab");

function cab_resource(bShowOptions) {
    for (var i = 0; i < PE.resource.length; i++) {
        if (detect_Cab(PE.resource[i].Offset, PE.resource[i].Size, bShowOptions)) {
            return true;
        }
    }

    return false;
}

function detect(bShowOptions) {
    if (!detect_Cab(PE.getOverlayOffset(), PE.getOverlaySize(), bShowOptions) &&
        !cab_resource(bShowOptions)) {
        var rsrcSection = PE.section[".rsrc"];

        if (rsrcSection) {
            if (rsrcSection.FileOffset > rsrcSection.VirtualSize) {
                var nOffset = rsrcSection.FileOffset + rsrcSection.VirtualSize;
                nOffset = (nOffset + 0x1ff) & -0x200;
                while (!detect_Cab(nOffset, rsrcSection.FileSize, bShowOptions) && nOffset > rsrcSection.FileOffset && !_isStop()) {
                    nOffset -= 0x200;
                }
            }
        }
    }

    return result();
}