// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("library", "Reprise License Manager (RLM)");

function detect(bShowType, bShowVersion, bShowOptions) {
    // I'm (adoxa) guessing these don't occur in the overlay, so don't search it (avoid wasting time on big installers).
    var nSize = PE.isOverlayPresent() ? PE.getOverlayOffset() : PE.getSize();

    if (nSize > 50000000)
        nSize = 50000000;

    var nOffset = PE.findString(0, nSize, "Reprise License Manager (RLM)");
    if (nOffset != -1) {
        sVersion = PE.getString(nOffset, 200).match(/\d\S*\w/i);
        bDetected = true;
        nOffset = PE.findSignature(0, nSize, "44894c24..4c894424..48895424..48894c24..b8........e8........482be0488b05........4833c448898424........48c78424................48c78424................48c78424................c74424..........c74424..........488b8424........4805........48894424..c74424..........c74424..........c74424..........c78424................4883bc24..........74..488b8424........c7");
        //v8.0-9.1 x64
        if (nOffset != -1) {
            sOptions = "rlm_pubkey at " + nOffset;
        }
    }

    return result(bShowType, bShowVersion, bShowOptions);
}