// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("protector", "ExeFog");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("56e8$$$$$$$$5e5ee9$$$$$$$$e8$$$$$$$$5d83c5..55c3")) {
        sVersion = "1.1";
        bDetected = true;
    } else if (PE.compareEP("52e8$$$$$$$$83c4..5a8be4510fb6c981e5")) {
        sVersion = "1.1";
        bDetected = true;
    }

    var ep_off = PE.getEntryPointOffset();
    if (PE.findSignature(ep_off, 0x1000, "6545c2fb195bbd004040ebef9155f0401897db0024e8e80000008387202e87d17820fb1cb800b0ef0b000000848e") != -1) {
        sVersion = "1.1";
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}