// DIE's signature file

init("protector","MoleBox");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("e80000000060e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
    {
        sVersion="2.3.3-2.6.4";
        bDetected=1;
    }
    else if(PE.compareEP("60e8$$$$$$$$e8$$$$$$$$e8$$$$$$$$558bec83ec..56576a..ff15........8945..68........6a..ff15"))
    {
        sVersion="2.0.0-2.3.0";
        bDetected=1;
    }
    else if(PE.compareEP("eb$$b8........8338..74..50ff70..ff3050830424..e8$$$$$$$$558beca1........53568b75..85c0578bde75..6a..68........68........ff15"))
    {
        sVersion="2.36";
        bDetected=1;
    }
    else if(PE.compareEP("5589E583EC08C7042401000000FF15........E8B8FEFFFF908DB426000000005589E583EC08C7042402000000FF15"))
    {
        if(PE.isOverlayPresent()&&(PE.section.length>=6))
        {
            var nNumbersOfImports=PE.getNumberOfImports();
            if((nNumbersOfImports==4)||(nNumbersOfImports==3))
            {
                if(PE.isLibraryPresent("KERNEL32.dll")&&PE.isLibraryPresent("msvcrt.dll")&&PE.isLibraryPresent("USER32.dll"))
                {
                    sVersion="4.X";
                    bDetected=1;
                }
            }
        }
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
