// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("cryptor", "Yoda's Crypter");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........E8A1000000E8D1000000E885010000F785")) {
        sVersion = "1.0";
        bDetected = true;
    } else if (PE.compareEP("60E8000000005D81ED........B9....00008DBD........8BF7")) {
        switch (PE.readWord(PE.getEntryPointOffset() + 14)) {
            case 0x009E: sVersion = "1.1"; break;
            case 0x097B: sVersion = "1.2"; break;
            default:
                sVersion = "1.X";
        }

        bDetected = true;
    } else if (PE.compareEP("558BEC53565760E8000000005D81ED")) {
        if (PE.compareEP("E803000000EB01", 19)) {
            sVersion = "1.0b";
            bDetected = true;
        } else if (PE.compareEP("B9", 19)) {
            sVersion = "1.3";
            bDetected = true;
        }
    } else if (PE.compareEP("558BEC81ECC00000005356578DBD40FFFFFFB930000000B8CCCCCCCCF3AB60")) {
        sVersion = "1.3";
        bDetected = true;
    }

    return result();
}