// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "Stone's PE Encryptor");

function detect() {
    if (PE.compareEP("555756525153E8........5D8BD581ED........2B95........83EA0B8995")) {
        switch (PE.getEntryPointSignature(35, 2)) {
            case "8DB5": sVersion = "1.0"; break;
            case "0195": sVersion = "1.13"; break;
        }
        bDetected = true;
    } else if (PE.compareEP("535152565755E8........5D81ED........FF95........B8........03C52B85")) {
        sVersion = "2.0";
        bDetected = true;
    }

    return result();
}