// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://blog.rosseaux.net/page/875fbe6549aa072b5ee0ac9cefff4827/BeRoEXEPacker
meta("packer", "BeRoEXEPacker");

function detect() {
    var nEP = PE.compareEP("837C2408010F85") ? 11 : 0;
    if (PE.compareEP("60BE........BF........FCB28033DBA4B302E8", nEP)) {
        sVersion = "1.00";
        sOptions = "LZBRR";
    } else if (PE.compareEP("60BE........BF........FCAD8D1C07B0803BFB733BE8", nEP)) {
        sVersion = "1.00";
        sOptions = "LZBRS";
    } else if (PE.compareEP("6068........68........68........E8........BE........B9")) {
        sVersion = "1.00";
        sOptions = "LZMA";
    } else if (PE.compareEP("BA........8DB2........8B46..85C0745103C28B7E..8B1E85DB75028BDF03DA03FA525750FF15")) {
        sVersion = "1.00";
    } else if (PE.compareEP("6068........68......0068........e8..040000..................00")) {
        sVersion = "1.00";
        sOptions = "LZMA";
    } else if (PE.compareEP("60e8000000005e81c6....0000bf........6081ec0804000089e357fc31c0b4")) {
        sVersion = "1.00";
        sOptions = "CTX1";
    } else if (PE.compareEP("60c8940c0060fcbe........ad8945fc33c0f7d08945f8f7d0b408b923030000")) {
        sVersion = "1.00";
        sOptions = "LZBRA";
    } else if (PE.compare("52c3'(C)BeRo!PE'0000", 2)) {
        bDetected = true;
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}
