// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("crypter", "Unknown cryptor");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (Binary.compare("fa8cde8ccf8edf8ec783c7..bb....8b1f83c3..b1..d3eb2bfbe8")) {
        sVersion = "#01";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....b3..be....bf....acfec332c3aae2")) {
        sVersion = "#02";
        sOptions = "exe 0-relocs crypt";
        bDetected = true;
    } else if (Binary.compare("'GENERATED'00'FILE'bc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")) {
        sVersion = "#03";
        sOptions = "GENERATED FILE";
        bDetected = true;
    } else if (Binary.compare("3ec606......90eb$$2e8a36....8ec08cd8be....bf....2e033e....26a3....26893e....26a3....26c706........0e07")) {
        sVersion = "#04";
        bDetected = true;
    } else if (Binary.compare("e8$$$$fc8bec8b4e..2bc08bf9f2aebb....03d9875e..fec58bf1ac8ad0ad8bc88bfeac32c2aae2")) {
        sVersion = "#05";
        bDetected = true;
    } else if (Binary.compare("fc525756ba....b9....be....bf....52f3a52ec606......c3")) {
        sVersion = "#06";
        bDetected = true;
    } else if (Binary.compare("b4..be....bf....b9....68....68....68....57f3a4c3")) {
        sVersion = "#07";
        bDetected = true;
    } else if (Binary.compare("b8....05....50c3")) {
        var nOffset = Binary.readWord(1) + Binary.readWord(4) - 256;
        if (Binary.compare("90902ea1....8bc85005....9083e9..bf....2e8035..47495083f9..74..c3", nOffset)) {
            sVersion = "#08";
            sOptions = "xorer";
            bDetected = true;
        }
    } else if (Binary.compare("e9$$$$fd1e2efe0e....81ce....39f63bf6b1..0e0e071f1e1fb9....bd....80c1..20c9bf....d1c7124e..80d1..124d..b1")) {
        sVersion = "#09";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fd1e2a0980e9..80dd..0e80c6..32f780d2..0e10c5071f28cd26fe06....be....d1c6323780e2..02ae....2288")) {
        sVersion = "#10";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$5e83ee..2e8984....06562e8c9c....0e070e1fb430cd213c..7d..bb....03dee8....b0..b44ccd21")) {
        sVersion = "#11";
        bDetected = true;
    } else if (Binary.compare("e9$$$$3bfd81e7....fc81ef....33fc1e842b0e23fb13fc85c733ff1f0e31c70723fe26fe0e....81ef....bf....31ff")) {
        sVersion = "#12";
        bDetected = true;
    } else if (Binary.compare("e9$$$$1efc0e1f81df....2bfb0e81df....19d781df....89e72af4b2..072efe06....0681f7....23ff2274..02b0")) {
        sVersion = "#13";
        bDetected = true;
    } else if (Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....2ec706........31c0ada3....3136....8bc18bdef7e33106....3116....a1....abe2")) {
        sVersion = "#14";
        bDetected = true;
    } else if (Binary.compare("e9$$$$b9....be....bf....bb....5357ad3d....74..c1c8..bb....03d933c3abe2")) {
        sVersion = "#15";
        sOptions = "xorer";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e8$$$$5d83ed..0e1f0e07be....03f5bf....b9....f3a460be....0204463b")) {
        sVersion = "#16";
        sOptions = "1995 by A.V.Lemenkov";
        bDetected = true;
    } else if (Binary.compare("e9$$$$be....56b9....c704....c644....8134....4646cce2")) {
        sVersion = "#17";
        sOptions = "xorer";
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}