// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

// https://forum.hellroom.ru/index.php?topic=17435.0
meta("protector", "AZProtect 0001");

function detect() {
    if (PE.compareEP("EB70FC608C804D110070258100400D91BB608C804D11007021811D610D810040CE608C804D11007025812581258125812961418131611D610040B730")) {
        bDetected = true;

        if (!PE.isSectionNamePresent("AZPR0001")) {
            sOptions = "modified";
        }
    }

    return result();
}