// DIE's signature file

init("protector","Yoda's Crypter");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("60E8000000005D81ED........E8A1000000E8D1000000E885010000F785"))
    {
        sVersion="1.0";
        bDetected=1;
    }
    else if(PE.compareEP("60E8000000005D81ED........B9....00008DBD........8BF7"))
    {
        switch(PE.readWord(PE.nEP+14))
        {
        case 0x009E: sVersion="1.1"; break;
        case 0x097B: sVersion="1.2"; break;
        default:     sVersion="1.x";
        }
        bDetected=1;
    }
    else if(PE.compareEP("558BEC53565760E8000000005D81ED"))
    {
        if(PE.compareEP("E803000000EB01",19))
        {
            sVersion="1.0b";
            bDetected=1;
        }
        else if(PE.compareEP("B9",19))
        {
            sVersion="1.3";
            bDetected=1;
        }
    }
    else if(PE.compareEP("558BEC535657E803000000EB01"))
    {
        sVersion="1.01";
        bDetected=1;
    }
    else if(PE.compareEP("558BEC81ECC00000005356578DBD40FFFFFFB930000000B8CCCCCCCCF3AB60"))
    {
        sVersion="1.3";
        bDetected=1;
    }
// need a sample
//    else if(PE.compareEP("E803000000EB01..BB55000000E803000000EB01..E8..000000E803000000EB01"))
//    {
//        sVersion="1.02-1.03";
//        bDetected=1;
//    }

    return result(bShowType,bShowVersion,bShowOptions);
}
