// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Exe Shield");

function detect() {
    if (PE.compareEP("EB0668....0600C39C60E8020000")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 3)) {
            case 0x1f90: sVersion = "1.7"; break;
            case 0x86f4: sVersion = "2.7"; break;
            case 0x8540: sVersion = "2.7b"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED........B9EB0800008DBD........8BF7AC......F8")) {
        sVersion = "2.9";
        bDetected = true;
    } else if (PE.compareEP("558BEC53565760E8000000005D81ED........B9........81E9........8BD581C2")) {
        sVersion = "1.3RC";
        bDetected = true;
    }

    return result();
}