// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "Adobe");

function detect() {
    if (PE.compareEP("e8$$$$$$$$8bff558bec83ec..a1........8365....8365....5357bf........bb........3bc774..85c374..f7d0")) {
        for (var i = 0; i < PE.resource.length; i++) {
            if (PE.resource[i].Type == 3284) { // ARCHIVE_7Z
                if (PE.findSignature(PE.resource[i].Offset, 6, "'7z'BCAF271C") != -1) {
                    sName += " Reader Installer";
                    sOptions = "7zip sfx";
                    bDetected = true;
                    break;
                }
            }
        }
    } else if (PE.compareEP("558bec6a..68........68........64a1........50648925........83ec..5356578965..ff15")) {
        if (PE.compareOverlay("'^OPT'")) {
            var ArcOffset = PE.findString(PE.getOverlayOffset(), 0x50, "^ARC");
            if (ArcOffset != -1) {
                if (PE.compare("1f8b08", ArcOffset + 4)) {
                    sName += " SVG Installer";
                    sOptions = "gzip";
                    bDetected = true;
                }
            }
        }
    } else if (PE.compareEP("e8$$$$$$$$8b0d........5657bf........be........3bcf74..85ce75..e8........8bc8")) {
        if (PE.resource[0] && PE.findSignature(PE.resource[0].Offset, 6, "'7z'BCAF271C") != -1) {
            sName += " WebInstaller";
            sOptions = "7zip sfx";
            bDetected = true;
        }
    }

    return result();
}