// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "XComp");

function detect() {
    if (PE.getNumberOfImports() == 1 &&
        PE.isImportPositionHashPresent(0, 0x4bc52e77)) { // GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, VirtualProtect
        if (PE.compareEP("68........9C60E8$$$$$$$$E8$$$$$$$$5B5D833B00")) {
            bDetected = true;
        }
    }

    return result();
}