// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "AHTeam EP Protector");

function detect() {
    if (PE.compareEP("90") && PE.compareEP("90FFE0", 47)) {
        sVersion = "0.3";
        bDetected = true;

        if (PE.compareEP("60E8........5EB9000000002BC0", 50)) {
            sOptions = "fake k.kryptor 9/kryptor a";
        } else if (PE.compareEP("6A0068........E8........BF", 50)) {
            sOptions = "fake Microsoft Visual C++ 7.0";
        } else switch (PE.getEntryPointSignature(50, 14)) {
            case "60E803000000E9EB045D4555C3E8": sOptions = "fake ASPack 2.12"; break;
            case "60E801000000905D81ED00000000": sOptions = "fake ASProtect 1.0"; break;
            case "538BD833C0A3000000006A00E800": sOptions = "fake Borland Delphi 6.0-7.0"; break;
            case "FC5550E8000000005DEB01E360E8": sOptions = "fake PCGuard 4.03-4.15"; break;
            case "EB03CD20C71EEB03CD20EA9CEB02": sOptions = "fake PE Lock NT 2.04"; break;
            case "E8000000005B83EB05EB04524E44": sOptions = "fake PE-Crypt 1.02"; break;
            case "60E800000000414E414B494E5D83": sOptions = "fake PESHiELD 2.X"; break;
            case "B800000000680000000064FF3500": sOptions = "fake PEtite 2.2"; break;
            case "9C608B442424E8000000005D81ED": sOptions = "fake Spalsher 1.X-3.X"; break;
            case "535152565755E8000000005D81ED": sOptions = "fake Stone's PE Encryptor 2.0"; break;
            case "60E8000000005D81ED06000000EB": sOptions = "fake SVKP 1.3X"; break;
            case "E90000000060E8000000005883C0": sOptions = "fake tElock 0.61"; break;
            case "EB16A85400004741424C4B434743": sOptions = "fake VIRUS/I-Worm Hybris"; break;
            case "5F81EF00000000BE000040008B87": sOptions = "fake VOB ProtectCD"; break;
            case "E8000000005D8100000000006A45": sOptions = "fake Xtreme-Protector 1.05"; break;
            case "E912000000000000000000000000": sOptions = "fake ZCode 1.01"; break;
        }
    } else if (PE.compareEP("55908bec906aff9090")) {
        sVersion = "0.3";
        sOptions = "alt";
        bDetected = true;
    }

    return result();
}