// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://github.com/ac3ss0r/obfusheader.h
init("protection", "obfusheader.h");

function detect(bShowType, bShowVersion, bShowOptions) {
    if (PE.section[".rdata"] && PE.isFunctionPresent("LoadLibraryA") && PE.isFunctionPresent("GetProcAddress") && PE.isSignaturePresent(
            0x00,
            PE.getSize() - PE.getOverlaySize(),
            "00 'Stop reversing the ' ** ** ** **")) {
        bDetected = true;
    }

    const dataSection = PE.section[".data"];
    if (dataSection && PE.compare("6162636465666768696A6B6C6D6E6F707172737475767778797A534C41494450", dataSection.FileOffset)) {
        sOptions = "data consts";
        bDetected = true;
    }

    if (bDetected && PE.section[".vmp0"]) {
        sOptions += (sOptions ? " + " : "") + "fake signs";
        _removeResult("protector", "Enigma");
        _removeResult("protector", "SecuROM");
        _removeResult("protector", "Denuvo");
        _removeResult("protector", "Themida/Winlicense");
    }

    return result(bShowType, bShowVersion, bShowOptions);
}