// DIE's signature file

init("protector","Zprotect");

function detect(bShowType,bShowVersion,bShowOptions)
{
    if(PE.section.length>3)
    {
        if((PE.section[0].FileOffset==0)&&(PE.section[0].FileSize==0))
        {
            if(!PE.isDosStubPresent())
            {
                if(PE.compare("6B65726E656C33322E646C6C000000005669727475616C416C6C6F6300000000",PE.section[1].FileOffset))
                {
                    sVersion="1.X";
                    bDetected=1;
                }
                else if((PE.getEntryPointSection()==1)&&(PE.calculateEntropy(PE.section[2].FileOffset,PE.section[2].FileSize)>7.6))
                {
                    sVersion="1.X";
                    bDetected=1;
                }
            }
        }
    }
// TODO EP NFD

    return result(bShowType,bShowVersion,bShowOptions);
}
