// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("cryptor", "Cryptor");

function detect() {
    if (Binary.compare("e9$$$$60c704....c644....b9....bf....ac32018bd64a")) {
        sVersion = "0.04";
        sOptions = "by SkullC0DEr";
        bDetected = true;
    } else if (Binary.compare("e9$$$$60c704....c644....e8$$$$5f83c7..33dbb9....8a043201")) {
        sName = "crypt 95-97";
        sOptions = "type 2 by SkullC0DEr";
        bDetected = true;
    } else if (Binary.compare("e800005dbf....e8$$$$fa065733ff57078d76..b9....8004..46e2")) {
        sOptions = "by Synopsis";
        bDetected = true;
    } else if (Binary.compare("eb$$fdbf....ba....33c01e8ed8a3....1fb1..525e3bfa74..ac3205aae2..eb")) {
        sOptions = "by Min-Jei-Chen";
        bDetected = true;
    } else if (Binary.compare("e8$$$$eb$$8cca8eda8ec2be....bf....b9....eb$$ad2ea3....2e3136....8bc18bdef7e3eb$$2e3106....2e3116....2ea1....abe2")) {
        sOptions = "by PHOENiX";
        bDetected = true;
    } else if (Binary.compare("5053515756b8....508bf0b9....b0..8bfe0004f71404..46e2")) {
        sOptions = "by FalCoN'AleX";
        bDetected = true;
    } else if (Binary.compare("40429c58f6c4..74..eb....b4..be....bf....b9....68....68....68....57f3a4c3")) {
        sOptions = "by Terrible BloodSucker //FDs Group";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e80000fa9cfc505393584c4c3bc35b74..9de8....32e480c4..3065..47e2")) {
        sName += ' N1';
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (Binary.compare("be....b9....ac03d8e2..81fb....74..cd19be....8bfeb9....8a26....ac32c1aae2")) {
        sOptions = "by Kai";
        bDetected = true;
    } else if (Binary.compare("eb$$c606......f873..e9$$$$be....bf....0633c08ec0bb....fa268b07268917a3")) {
        sName += ' N2';
        sOptions = "by ZeroCoder //XG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800002e9c589e72..fa9cfc505393584c4c3bc35b74..9de8....32e480c4")) {
        sOptions = "by Digital Information Pirates Group (DiPG)";
        bDetected = true;
    } else if (Binary.compare("'PHROZEN'fa'CREW'0d....fbfdbe....ac300481fe....77..94")) {
        sOptions = "by Phrozen Crew";
        bDetected = true;
    } else if (Binary.compare("0e1fb9....be....80....301c46e2..eb")) {
        sOptions = "by Dwolf //ROK";
        bDetected = true;
    } else if (Binary.compare("2e8036....28eb00c3")) {
        sName += " #2";
        sOptions = "by Misha";
        bDetected = true;
    } else if (Binary.compare("be....e8$$$$5d8bce8d72..bf....fd5747acaa86c4ac32c4aae2..8d75..fcf98d7e..c3")) {
        sOptions = "by TGT";
        bDetected = true;
    } else if (Binary.compare("e9$$$$33dbb9....d1e941b8....8b97....33c28987....924343e2..68....c3")) {
        sOptions = "by hijaq";
        bDetected = true;
    } else if (Binary.compare("e9$$$$0e179c58f6c4..75..b9....b8....2bc8bf....be....8a0551b9....8ae0862432c44ee2..88054759e2..e9")) {
        sOptions = "1996 by WildRover";
        bDetected = true;
    } else if (Binary.compare("668d3e....66b9........678137....6683c7..e2..e9")) {
        sOptions = "by PCY group";
        bDetected = true;
    } else if (Binary.compare("e9$$$$66b8........66a3....be....8bfeb9....fcad35....f7d0abe2..68....c3")) {
        sOptions = "by Evil Genius //rPG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$9cfafc1e06bb....b44acd21b448bb....cd218ec0be....b9....51bf....57f3a5061fb9....5e8bfe")) {
        sOptions = "by AliS S0fT //VCrT";
        bDetected = true;
    } else if (Binary.compare("eb$$e8$$$$eb$$e4210c..e62133c08ed80e50558becc746......5dfa8f06....8f06....fb9c580d....509d")) {
        sVersion = "#2";
        sOptions = "by RAZOR 1911";
        bDetected = true;
    } else if (Binary.compare("'SNOWPANTHER'e9$$$$................8db7....bf....b9....f3a58db7....538ccf83c7..ad09c074..91ad")) {
        sName += " #1";
        sOptions = "by Snow Panther //DTG";
        bDetected = true;
    } else if (Binary.compare("fcbe....bf....b9....90ba....c606......90ac0fb61e....03da8a2732c4aafe06....803e......75..c606")) {
        sOptions = "by pASkuda";
        bDetected = true;
    } else if (Binary.compare("e9$$$$50538bdc8cd0bc....8ed49090909090909090909090909090909033e48ed4bc....909090909090909090909090909090908ed08be35b58c606")) {
        sOptions = "by Crack Soft";
        bDetected = true;
    } else if (Binary.compare("e9$$$$16179c58f6c4..74..faeb..e8$$$$58")) {
        sVersion = "1.0";
        sOptions = "1999 by Alex";
        bDetected = true;
    } else if (Binary.compare("e8$$$$33ed83ed..2ed0....5e0e8bfe81e7....f7df03fe2e893526a1....8ec0263b06....74..f92eff35")) {
        sOptions = "by DREAMMASTER";
        bDetected = true;
    } else if (Binary.compare("b8....ffe0")) {
        var nOffset = Binary.readWord(1) - 256;
        if (Binary.compare("be....8be88bd88bf883c5..908bd04a5287d687fe5981e9....52", nOffset)) {
            sOptions = "by BlackLight, MANtiCORE";
            bDetected = true;
        }
    } else if (Binary.compare("'FALCON//TULACREW'0d....e9$$$$be....b9....33c0f7d03004eb..04..32e046e2")) {
        sOptions = "by FALCON //UCL";
        bDetected = true;
    } else if (Binary.compare("bb....b9....be....301c02df86df46e2")) {
        sName += " #1";
        sOptions = "by dR.No";
        bDetected = true;
    } else if (Binary.compare("be....b9....b8....bb....33c34086c44b86fb93300446e2")) {
        sName += " #2";
        sOptions = "by dR.No";
        bDetected = true;
    } else if (Binary.compare("a3....eb$$5351525756b9....fa8bdc8cd2bc....03e1d1e94c4c5886e9d3c033c186e9f7d050e2")) {
        sOptions = "by venus soft.";
        bDetected = true;
    } else if (Binary.compare("e9$$$$3aac....3a29fc1aa8....80cd..1e0e0e1f0726fe06....ba....be....81f6....80f9")) {
        sName += " #1";
        sOptions = "by LiGHt DRUiD //SOS";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fd1e0e81de....89f63bf23aaf....03f423f61bf40a2d80f9..18dd0e071f03f433f081e6")) {
        sName += " #2";
        sOptions = "by LiGHt DRUiD //SOS";
        bDetected = true;
    } else if (Binary.compare("fcbe....8bfeac3206....8006......84c0aa75..be....e8")) {
        sOptions = "by Sludge Vohaul //DAT";
        bDetected = true;
    } else if (Binary.compare("'[HPA]'b5..8bf98be9be....57f3a4c3")) {
        sOptions = "by Hungarian Pirates Alliance [HPA]";
        bDetected = true;
    } else if (Binary.compare("bc....bb....b4..cd21bb....b9....8037..43e2..b409ba....cd21b8....cd21891e")) {
        sOptions = "by .EXEcutor //SOS";
        bDetected = true;
    } else if (Binary.compare("e9$$$$e800005b8bcc8cd2fa33c08ec08ed0bc....588947..90588947..900e8bc305....508ed28be1fb")) {
        sOptions = "1998 by Demon Magister Protection";
        bDetected = true;
    } else if (Binary.compare("eb$$2ea3....8cc82e0306....502eff36....cb")) {
        sOptions = "1991 by YMI";
        bDetected = true;
    } else if (Binary.compare("53515256570633c08ec0fa26a1....268b16....fb075052b8....06508cca33c08ec058fa26a3....268916....fb07")) {
        sOptions = "1991 by Elisoft";
        bDetected = true;
    } else if (Binary.compare("b8....5650c3")) {
        var nOffset = Binary.readWord(1) - 256;
        if (Binary.compare("bf....8bdeb9....8b0533c689074747434346e2..c3", nOffset)) {
            sOptions = "by PC0R$AiR //UCL";
            bDetected = true;
        }
    } else if (Binary.compare("908cc8515a54e9$$$$36c0e0..eb$$eb$$6a..e8$$$$58eb$$e8$$$$58eb$$e8$$$$eb$$2eeb$$eb$$665eeb$$eb$$7c")) {
        sName = "Rowdy's Strong Protection {MtE}";
        bDetected = true;
    } else if (Binary.compare("0f011e....fbe9$$$$e90000c0c3..f8eb$$6a..c0e9..e800000f23dae8000059665e36e8")) {
        sName = "Rowdy's Strong Protection {MtE}";
        bDetected = true;
    } else if (Binary.compare("fa499033c0fbe9$$$$e800005eeb")) {
        sName = "Rowdy's Strong Protection";
        bDetected = true;
    } else if (Binary.compare("e9$$$$5060bf....c706........c605..e8....5e5681c6....b9....5756ffe7")) {
        sOptions = "1998 by StrangeLion";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5f87f757b9....ac34..aae2..c3")) {
        sName = "Wumpus soft lab cryptor";
        bDetected = true;
    } else if (Binary.compare("e8$$$$5eb9....ac32c12e8844..e2..e9")) {
        sOptions = "by MXL //RIP";
        bDetected = true;
    } else if (Binary.compare("e9$$$$8d36....fd8d0e....81e9....d1e9add1c835....8944..e2..ff26")) {
        sOptions = "1989 by Sydex";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....b4..b0..8b0e....8a1728c230e28857..43fec0e2")) {
        sOptions = "1999 by SLine";
        bDetected = true;
    } else if (Binary.compare("'(C)1997'00'by'00'PSH'0d0a..005b..3139287a..2850..81c6....33db8bfeb9....ad35")) {
        sOptions = "1997 by PSH";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bf....be....b9....b0..2e8a1c32c132d82e881d4647e2..e9")) {
        sName = "SAGE-crypt";
        bDetected = true;
    } else if (Binary.compare("e9$$$$fcb0..bf....b9....263005fec047e2..b9....be....e8")) {
        sName = "PU-Disk encryption";
        sOptions = "1992";
        bDetected = true;
    } else if (Binary.compare("e9$$$$bb....8a073c..74..e8$$$$50515234..3c..74..b4..8ad0cd21e9")) {
        sOptions = "1999 by Leon";
        bDetected = true;
    } else if (Binary.compare("fa'SNOW'fa'PANTHER'fabc....bf....8bf7b9....b3..ac34..d2c02ac3d2c832c3fec3aae2")) {
        sName += " #2";
        sOptions = "by Snow Panther //DTG";
        bDetected = true;
    } else if (Binary.compare("e9$$$$c704....c644....b9....5683c6..8bfeb2..b6..ac32c202d6aae2..c3")) {
        sOptions = "1997 by Ment0R //UCL";
        bDetected = true;
    } else if (Binary.compare("eb$$bb....8b0f03d981c3....8be38cc88ed88ec08ed0b8....ba....cd21b3..ccb3..cc")) {
        sOptions = "1993 by The Shadow Lord";
        bDetected = true;
    } else if (Binary.compare("eb$$ccbe....bb....b2..bf....cc8b0d8bc103c7cc05....83c7..8be0cc")) {
        sOptions = "by The Shadow Lord";
        bDetected = true;
    } else if (Binary.compare("eb$$bb....001f4beb$$001f4beb")) {
        sName = "Crypt.Trivial.173";
        sOptions = "1998 by SMT";
        bDetected = true;
    } else if (Binary.compare("'SFINKS_SOFT___'fafcb430cd21fb33c0502ec606......0783e9..3be175..26c706........b9")) {
        sOptions = "by SFINKS SOFT";
        bDetected = true;
    } else if (Binary.compare("e8$$$$1e33c08ed8f716....eb$$f716....1f5ebf....57b9....ac34..aae2")) {
        sOptions = "by R!SC";
        bDetected = true;
    } else if (Binary.compare("e9$$$$6033edbe....b4..bd....bf....ac32c4aa80c4..fec43bf575..33c0b9....f3ab61bf....ffe7")) {
        sOptions = "by DarkGrey //DSA";
        bDetected = true;
    } else if (Binary.compare("'(C)1997'00'by'00'PSH'............................bc....6081c6....33db8bfeb9....ad35....c1c0..03d8abe2")) {
        sOptions = "1997 by PSH";
        bDetected = true;
    } else if (Binary.compare("eb$$bf....33dbba....fcbe....8bcfccad")) {
        sName += " #3";
        sOptions = "by Misha /ACE";
        bDetected = true;
    } else if (Binary.compare("e9$$$$061e33c08ed8be....8904be....89041e071fb8....bf....268905be....b9....8a04263205")) {
        sOptions = "by SafeSoft";
        bDetected = true;
    }

    return result();
}