// Detect It Easy: detection rule file
// Author: Jason Hood <jadoxa@yahoo.com.au>

meta("installer", "Windows Installer");

function detect() {
    for (var i = 0; i < PE.resource.length; i++) {
        if (PE.compare("D0CF11E0A1B11AE1", PE.resource[i].Offset)) {
            var nOffset = PE.findString(PE.resource[i].Offset, PE.resource[i].Size, "Windows Installer");
            if (nOffset != -1) {
                var aVersion = PE.getString(nOffset).match(/ XML \((.*?)\)/);
                if (aVersion) {
                    sOptions = "XML";
                    sVersion = aVersion[1];
                }

                bDetected = true;
            }
        }
    }

    return result();
}