// Detect It Easy: detection rule file format

init("protector", "PC Guard");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.isNET()) {
        if (PE.isSignatureInSectionPresent(0, "00000000000000000000000000000000fc5550e8000000005d60e80300000083")) {
            sVersion = "5.X";
            bDetected = true;
        }
    } else if (PE.compareEP("fc5550e8000000005d60e8$$$$$$$$eb$$58eb$$40eb$$ffe0")) {
        sVersion = "5.04-5.05";
        bDetected = true;
    } else if (PE.compareEP("fc5550e8$$$$$$$$5deb$$60e8")) {
        sVersion = "4.06";
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}