// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("protector", "Ste@lth PE");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.findSignature(PE.getSize() - 0x40, 0x40, "ba........b8........8902424242b8........89024a4a4affd2") != -1) {
        sVersion = "2.x";
        bDetected = true;
    } else if (PE.findSignature(PE.getSize() - 0x40, 0x40, "b8........ba........8910404040ba........891048484850c3") != -1) {
        sVersion = "2.x";
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}