// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Maxtocode");

function detect() {
    if (PE.isNet()) {
        if (PE.isNetObjectPresent("Attick.dll") && PE.isNetObjectPresent("CheckRuntime")) {
            sVersion = "1.X";
            sOptions = "Runtime";
            bDetected = true;
        } else if (PE.isSignatureInSectionPresent(0, "00'InfaceMax 'ffffff005f175920ffff00'toCode_interface'00")) {
            sVersion = "1.X";
            bDetected = true;
        } else if (PE.isNetObjectPresent("MRuntime3.dll")) {
            sVersion = "3.X";
            bDetected = true;
        }
    }

    return result();
}