// Detect It Easy: detection rule file
// Author: horsicq <horsicq@gmail.com>

meta("protector", "Yoda's Protector");

function detect() {
    if (PE.compareEP("558BEC535657E8$$$$$$$$E8$$$$$$$$33C064FF30648920CCC3")) {
        sVersion = "1.01";
        bDetected = true;
    } else if (PE.compareEP("E8$$$$$$$$BB........E8$$$$$$$$E8$$$$$$$$33c064ff306489204bccc3") && PE.section[PE.nLastSection].Name !== ".inq") {
        sVersion = "1.02-1.03";
        bDetected = true;
    }

    return result();
}