// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("packer", "(Win)Upack");

function detect() {
    if (PE.compareEP("BE........AD8BF895A533C033")) {
        sVersion = "0.1X/0.20/0.21/0.24 beta";
    } else if (PE.compareEP("BE........AD8BF86A0495A533C0AB")) {
        sVersion = "0.21 beta";
    } else if (PE.compareEP("BE........AD8BF895AD91F3A5ADB5")) {
        sVersion = "0.24-0.27 beta/0.28 alpha";
    } else if (PE.compareEP("BE........AD50FF7634EB7C4801")) {
        switch (PE.readByte(PE.getEntryPointOffset() + 62)) {
            case 0x37: sVersion = "0.37 beta"; break;
            case 0x38: sVersion = "0.38 beta"; break;
            case 0x39: sVersion = "0.39 final"; break;
            case 0x3A: sVersion = "0.399"; break;
        }
    } else if (PE.compareEP("6A07BE........AD8BF85995F3A5")) {
        sVersion = "0.22/0.23 beta";
    } else if (PE.compareEP("BE........AD50..AD91F3A5")) {
        sVersion = "0.32 beta";
        sOptions = "Patch";
    } else if (PE.compareEP("BE........AD50..AD91..F3A5")) {
        sVersion = "0.32 beta";
    } else if (PE.compareEP("BE........AD50....AD91F3A5")) {
        sVersion = "0.32 beta";
    } else if (PE.compareEP("BE........AD50AD5066BE....6A..BF")) {
        sVersion = "0.34";
    } else if (PE.compareEP("BE........FF36E9C3000000")) {
        sVersion = "0.36 beta";
    } else if (PE.compareEP("60E809000000..................33C95E870E")) {
        sOptions = "Alt stub";
    } else if (PE.compare("4D5A4C6F61644C696272617279410000504500004C0102004B45524E454C3332")) {
        sVersion = "0.33";
    } else if (PE.compare("4D5A4B45524E454C33322E444C4C00004C6F61644C696272617279410000000047657450726F63416464726573730000")) {
        sVersion = "0.32";
    } else if (PE.compare("4D5A4B45524E454C33322E444C4C00005045")) {
        bDetected = true;
    }

    bDetected = bDetected || Boolean(sVersion) || Boolean(sOptions);

    return result();
}