// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Zprotect");

function detect() {
    if (PE.section.length > 3) {
        if (PE.section[0].FileOffset == 0 && PE.section[0].FileSize == 0) {
            if (!PE.isDosStubPresent()) {
                if (PE.compare("6B65726E656C33322E646C6C000000005669727475616C416C6C6F6300000000", PE.section[1].FileOffset)) {
                    sVersion = "1.X";
                    bDetected = true;
                } else if ((PE.getEntryPointSection() == 1) && (PE.calculateEntropy(PE.section[2].FileOffset, PE.section[2].FileSize) > 7.6)) {
                    sVersion = "1.X";
                    bDetected = true;
                }
            }
        }
    }
    if (PE.compareEP("e8$$$$$$$$87..248d..........87..24e9$$$$$$$$60e9$$$$$$$$54e9")) {
        bDetected = true;
    }

    // TODO EP NFD

    return result();
}