// Detect It Easy: detection rule file format
// Author: hypn0 <hypn0@mail.ru>

init("installer", "Microsoft dotNET installer");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374")) {
        var ArcOffset = PE.findSignature(PE.getOverlayOffset(), Math.min(0x110, PE.getOverlaySize()), "'7z'bcaf");
        if (ArcOffset != -1) {
            sOptions = "7zip";
            bDetected = true;
        }
    }
    return result(bShowType, bShowVersion, bShowOptions);
}