// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://github.com/DosX-dev/ASM-Guard
meta("protector", "ASM Guard");

function detect() {
    if (PE.isOverlayPresent()) {
        if (PE.isSectionNamePresent("ASMGUARD")) {
            sVersion = "2.XX";
            sOptions = "shell mutation";
            bDetected = true;
        } else if (PE.isResourceNamePresent("NT.DLL")) {
            bDetected = true;
        }
    }

    return result();
}