// DIE's signature file

init("protector","EXECryptor");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("A4......00000000FFFFFFFF3C......94......D8......00000000FFFFFFFFB8"))
    {
        sVersion="2.0/2.1";
        sOptions="protected IAT";
        bDetected=1;
    }
    else if(PE.compareEP("558BEC83C4F4565753BE........B80000....8945FC89C28B460C09C00F84"))
    {
        sVersion="2.0/2.1";
        bDetected=1;
    }
    else if(PE.compareEP("BE........B80000....8945FC89C28B460C09C00F84..00000001D089C350FF15"))
    {
        sVersion="2.1.17";
        bDetected=1;
    }
    else if(PE.compareEP("E8$$$$$$$$E800000000............8B1C2481EB........B8........506A..68"))
    {
        sVersion="2.2.4";
        bDetected=1;
    }
    else if(PE.compareEP("5068........5881E0........E9......00870C2459E8......008945F8E9"))
    {
        sVersion="2.2.6";
        sOptions="minimum protection";
        bDetected=1;
    }
    else if(PE.compareEP("508BC687042468........5EE9........85C8E9........81C3........0F81"))
    {
        sVersion="2.2.6";
        sOptions="DLL/minimum protection";
        bDetected=1;
    }
    else if(PE.compareEP("E80000000058..........8B1C2481EB........B8........506A046800100000506A00B8"))
    {
        sVersion="2.2/2.3";
        sOptions="compressed code";
        bDetected=1;
    }
    else if(PE.compareEP("CC......00000000FFFFFFFF3C......B4......08......00000000FFFFFFFFE8"))
    {
        sVersion="2.2/2.3";
        sOptions="protected IAT";
        bDetected=1;
    }
    else if(PE.compareEP("5168........5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000"))
    {
        sVersion="2.3.9";
        sOptions="compressed resources";
        bDetected=1;
    }
    else if(PE.compareEP("68........E9......FF50C1C8188905........C3C1C01851E9......FF84C00F84"))
    {
        sVersion="2.3.9";
        sOptions="minimum protection";
        bDetected=1;
    }
    else if(PE.compareEP("5068........58C1C00FE9......00870424588945FCE9......FFFF05........E9"))
    {
        sVersion="2.3.9";
        sOptions="DLL/compressed resources";
        bDetected=1;
    }
    else if(PE.compareEP("5168........872C248BCD5D81E1........E9......008945F85168........5981F1"))
    {
        sVersion="2.3.9";
        sOptions="DLL/minimum protection";
        bDetected=1;
    }
    else if(PE.compareEP("56575331DB89C689D70FB60689C283E01FC1EA05742D4A74158D5C130246C1E00889"))
    {
        sVersion="2.xx";
        sOptions="compressed resources";
        bDetected=1;
    }
    else if(PE.compareEP("558BEC83C4ECFC5357568945FC8955F889C689D766813E4A430F852301000083C60A"))
    {
        sVersion="2.xx";
        sOptions="max. compressed resources";
        bDetected=1;
    }
    else if(PE.compareEP("E824......8B4C240CC70117..01..C781..............31C089411489411880A1"))
    {
        sVersion="1.3.0.45";
        bDetected=1;
    }
    else if(PE.compareEP("E8$$$$$$$$31c064ff30648920648f05........83c4..e9$$$$$$$$60e8$$$$$$$$83c4"))
    {
        sVersion="1.4X-1.5X";
        bDetected=1;
    }
    else if(PE.compareEP("E8$$$$$$$$31C064FF30648920CCC3"))
    {
        sVersion="1.5X";
        bDetected=1;
    }
    else if(PE.compareEP("83C6148B55FCE9..FFFFFF"))
    {
        sVersion="2.1X";
        bDetected=1;
    }
    else if(PE.compareEP("E9........669C60508D88........8D900416....8BDC8BE1"))
    {
        sVersion="2.1X";
        bDetected=1;
    }
    else if(PE.compareEP("FFE0E804000000FFFFFFFF5EC300"))
    {
        sVersion="2.2X";
        bDetected=1;
    }
    else if(PE.compareEP("E9$$$$$$$$E8$$$$$$$$0F"))
    {
        bDetected=1;
    }

    if(!bDetected)
    {
        var nNumberOfSections=PE.section.length;
        if(nNumberOfSections>3
         &&PE.getNumberOfImports()==2
         &&PE.getNumberOfImportThunks(1)==1
         &&PE.getImportFunctionName(1,0)=="MessageBoxA")
        {
            for(var nAdjust=1;nAdjust<3;nAdjust++)
            {
                if(PE.getImportSection()==nNumberOfSections-nAdjust
                 &&PE.section[nNumberOfSections-nAdjust-1].FileSize==0)
                {
                    sVersion=nNumberOfSections>4?"2.4X":"2.X";
                    bDetected=1;
                    break;
                }
            }
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
