// Detect It Easy: detection rule file format

init("installer", "Wise Installer");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.getOverlaySize() > 80) {
        var nOffset = PE.getOverlayOffset() + 77;
        if (PE.readDword(nOffset) == PE.getSize()) {
            bDetected = true;
        } else if (PE.section[".WISE"]) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..ff15........ff15........8bf08975..8a063c..0f85........8a46..46")) {
            bDetected = true;
        } else if (PE.compareEP("558bec81ec........5356576a..5e6a..8975..ff15........ff15........8bf8897d..8a073c..0f85........8a47..47")) {
            bDetected = true;
        }
    } else if (PE.compareEP("81ec........535556576a..ff15........33db895c24..895c24..895c24..895c24..895c24..ff15........8a08894424")) {
        if (PE.isSectionNamePresent(".WISE")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........53565733f6466a..8975..ff15........ff15........8bf88a07")) {
        if (PE.findSignature(PE.getOverlayOffset(), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.isSectionNamePresent(".WISE")) {
        if (PE.findSignature(PE.getSectionFileOffset(PE.getSectionNumber(".WISE")), 0x1000, "'Wise Installation Wizard...'") != -1) {
            bDetected = true;
        }
    }
    if (PE.compareEP("64a1........558bec6a..68........68........50648925........83ec..5356578965..ff15")) {
        var nOffset = PE.getOverlayOffset();
        var nZipsig = PE.findSignature(nOffset, 0x1000, "504b0304");
        if (nZipsig != -1) {
            sOptions = "ZIP";
            bDetected = true;
        } else if (PE.compareOverlay("'MSCF'0000")) {
            sOptions = "CAB";
            bDetected = true;
        }
    }
    if (PE.compareEP("558bec81ec........538d85........5633db57be........565053ff15........568d85........5050ff15........538d8d........536a..536a..68........51ff15")) {
        bDetected = true;
    }
    if (PE.compareEP("558bec81ec........538d85........565733f668........5056ff15........68........8d8d........5151ff15........568d8d........568b3d........6a..566a..68")) {
        bDetected = true;
    }

    return result(bShowType, bShowVersion, bShowOptions);
}