// DIE's signature file

init("protector","AHTeam EP Protector");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.compareEP("90")&&PE.compareEP("90FFE0",47))
    {
        sVersion="0.3";
        bDetected=1;

        if(PE.compareEP("60E8........5EB9000000002BC0",50))
        {
            sOptions="fake k.kryptor 9/kryptor a";
        }
        else if(PE.compareEP("6A0068........E8........BF",50))
        {
            sOptions="fake Microsoft Visual C++ 7.0";
        }
        else switch(PE.getEPSignature(50,14))
        {
        case "60E803000000E9EB045D4555C3E8": sOptions="fake ASPack 2.12";              break;
        case "60E801000000905D81ED00000000": sOptions="fake ASProtect 1.0";            break;
        case "538BD833C0A3000000006A00E800": sOptions="fake Borland Delphi 6.0-7.0";   break;
        case "FC5550E8000000005DEB01E360E8": sOptions="fake PCGuard 4.03-4.15";        break;
        case "EB03CD20C71EEB03CD20EA9CEB02": sOptions="fake PE Lock NT 2.04";          break;
        case "E8000000005B83EB05EB04524E44": sOptions="fake PE-Crypt 1.02";            break;
        case "60E800000000414E414B494E5D83": sOptions="fake PESHiELD 2.x";             break;
        case "B800000000680000000064FF3500": sOptions="fake PEtite 2.2";               break;
        case "9C608B442424E8000000005D81ED": sOptions="fake Spalsher 1.x-3.x";         break;
        case "535152565755E8000000005D81ED": sOptions="fake Stone's PE Encryptor 2.0"; break;
        case "60E8000000005D81ED06000000EB": sOptions="fake SVKP 1.3x";                break;
        case "E90000000060E8000000005883C0": sOptions="fake tElock 0.61";              break;
        case "EB16A85400004741424C4B434743": sOptions="fake VIRUS/I-Worm Hybris";      break;
        case "5F81EF00000000BE000040008B87": sOptions="fake VOB ProtectCD";            break;
        case "E8000000005D8100000000006A45": sOptions="fake Xtreme-Protector 1.05";    break;
        case "E912000000000000000000000000": sOptions="fake ZCode 1.01";               break;
        }
    }
    else if(PE.compareEP("55908bec906aff9090"))
    {
        sVersion="0.3";
        bDetected=1;
    }

    return result(bShowType,bShowVersion,bShowOptions);
}
