// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

meta("installer", "BitRock Installer");

function detect() {
    if (PE.compareOverlay("........'.eh_frame'00")) {
        if (PE.compareEP("60be........8dbe........c787................5789e58d9c24........31c05039dc75..46465368")) {
            bDetected = true;
        } else if (PE.compareEP("83ec..c70424........ff15........e8........8d7426..8dbc27........a1........ffe0")) {
            bDetected = true;
        }
    }

    if (!bDetected) {
        if (/BitRock/.test(PE.getManifest())) {
            bDetected = true;
        }
    }

    return result();
}