// Detect It Easy: detection rule file format

init("protector", "N-Joy");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("558BEC83C4F0B8........E8....FFFF6A0068........6A0A6A00E8....FFFFE8....FFFF8D4000")) {
        switch (PE.readWord(PE.nEP + 33)) {
            case 0xf5ef:
                sVersion = "1.0";
                break;
            case 0xf57f:
                sVersion = "1.1";
                break;
            case 0xeac7:
                sVersion = "1.2";
                break;
            case 0xe723:
                sVersion = "1.3";
                break;
        }
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}