// Detect It Easy: detection rule file

// Author: DosX
// E-Mail: collab@kay-software.ru
// GitHub: https://github.com/DosX-dev
// Telegram: @DosX_dev

// https://web.archive.org/web/20071012084924/http://secnull.org/
meta("cryptor", "AverCryptor");

function detect() {
    if (PE.compareEP("60E8000000005D81ED........8BBD........8B8D........B8")) {
        bDetected = true;

        switch (PE.readByte(PE.getEntryPointOffset() + 65)) {
            case 0xFA: sVersion = "1.0"; break;
            case 0xF7: sVersion = "1.02";
        }

        if (!PE.isSectionNamePresent(".avc")) {
            sOptions = "modified";
        }
    }

    return result();
}